35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2

Analysis

max time kernel
27s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe
Size

468KB
MD5

21a3ac69014cffab91d9d5c162b51294
SHA1

62cd5a0cb31fb94c713a0e8f60f8bf3478d4fbfa
SHA256

35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2
SHA512

74ff2ff9bdfd099968dfaa9975a170c483b7f83d4b43d22b3df5d45e41ce47e8ea185cf0c6475d6f6e61e0b9e69d55a1efc5d35d73960666c6a217631bb47fbb
SSDEEP

3072:1G3HogLSIE5TtbY2HzcOcf8/vChaP0p2JVHeTVPCQzNLDLOgEElj:1G3okMTtxH4OcfSYHkQzpnOgE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4372	Unicorn-2749.exe
1028	Unicorn-16154.exe
4524	Unicorn-27014.exe
4428	Unicorn-15167.exe
4220	Unicorn-9713.exe
4628	Unicorn-3583.exe
608	Unicorn-20574.exe
2636	Unicorn-59838.exe
3380	Unicorn-25028.exe
4068	Unicorn-1078.exe
2308	Unicorn-16860.exe
4352	Unicorn-39318.exe
2584	Unicorn-45183.exe
808	Unicorn-39008.exe
868	Unicorn-28702.exe
1916	Unicorn-24618.exe
4988	Unicorn-14311.exe
812	Unicorn-25172.exe
3412	Unicorn-59983.exe
1648	Unicorn-14046.exe
3340	Unicorn-32023.exe
4356	Unicorn-51815.exe
1208	Unicorn-61466.exe
3004	Unicorn-28292.exe
1876	Unicorn-24208.exe
936	Unicorn-36460.exe
4824	Unicorn-13709.exe
2188	Unicorn-13709.exe
2236	Unicorn-24570.exe
2004	Unicorn-44436.exe
2996	Unicorn-40352.exe
4432	Unicorn-40352.exe
1520	Unicorn-44991.exe
2020	Unicorn-19831.exe
4376	Unicorn-25962.exe
2232	Unicorn-57356.exe
3244	Unicorn-54556.exe
2204	Unicorn-43620.exe
1312	Unicorn-38020.exe
3088	Unicorn-63221.exe
860	Unicorn-12915.exe
872	Unicorn-8831.exe
3628	Unicorn-19692.exe
2400	Unicorn-48281.exe
3156	Unicorn-64062.exe
4856	Unicorn-40112.exe
4872	Unicorn-45972.exe
4464	Unicorn-9023.exe
4324	Unicorn-30212.exe
4728	Unicorn-30212.exe
744	Unicorn-22044.exe
3896	Unicorn-19906.exe
3128	Unicorn-15822.exe
3024	Unicorn-15822.exe
2956	Unicorn-42464.exe
2696	Unicorn-35977.exe
1760	Unicorn-12292.exe
2796	Unicorn-64061.exe
2444	Unicorn-17859.exe
1584	Unicorn-15059.exe
740	Unicorn-23725.exe
2476	Unicorn-4124.exe
2736	Unicorn-4124.exe
3372	Unicorn-4124.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2860	4628	WerFault.exe	87
2956	1028	WerFault.exe	83
4028	1028	WerFault.exe	83
4576	4628	WerFault.exe	87
2472	4352	WerFault.exe	95
4712	4068	WerFault.exe	93
3156	4352	WerFault.exe	95
4768	4068	WerFault.exe	93
4072	1208	WerFault.exe	119
2736	3380	WerFault.exe	92
1696	608	WerFault.exe	88
2388	3380	WerFault.exe	92
4440	1208	WerFault.exe	119
3804	608	WerFault.exe	88
3864	2236	WerFault.exe	134
3928	4824	WerFault.exe	132
1200	4376	WerFault.exe	142
3892	3088	WerFault.exe	147
3852	872	WerFault.exe	159
2988	2236	WerFault.exe	134
2260	2400	WerFault.exe	161
5208	4376	WerFault.exe	142
5888	740	WerFault.exe	181
5556	1760	WerFault.exe	178
6864	808	WerFault.exe	109
2988	2476	WerFault.exe	185
6284	4160	WerFault.exe	210
6224	3628	WerFault.exe	160
5268	2204	WerFault.exe	145
6940	3960	WerFault.exe	290
4788	348	WerFault.exe	305
3956	5284	WerFault.exe	243
3368	4360	WerFault.exe	484
9268	7104	WerFault.exe	426
9252	7108	WerFault.exe	392
6064	4068	WerFault.exe	399
464	6052	WerFault.exe	272
9332	5976	WerFault.exe	267
6388	4068	WerFault.exe	399
804	5564	WerFault.exe	397
5916	6916	WerFault.exe	388
4624	4204	WerFault.exe	417
8208	6540	WerFault.exe	386
9564	6596	WerFault.exe	445
9524	4456	WerFault.exe	408
9516	1876	WerFault.exe	420
9480	4988	WerFault.exe	113
9848	2968	WerFault.exe	230
9892	860	WerFault.exe	158
9864	7848	WerFault.exe	468
9776	4356	WerFault.exe	118
9768	1228	WerFault.exe	428
9760	7240	WerFault.exe	457
9752	5852	WerFault.exe	432
9744	5912	WerFault.exe	431
9736	5940	WerFault.exe	415
9728	5948	WerFault.exe	437
9720	6176	WerFault.exe	416
9712	4180	WerFault.exe	436
9704	6728	WerFault.exe	442
9472	3004	WerFault.exe	129
9464	6044	WerFault.exe	271
9456	936	WerFault.exe	131
9980	5144	WerFault.exe	236

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14311.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2084	35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe
4372	Unicorn-2749.exe
4524	Unicorn-27014.exe
1028	Unicorn-16154.exe
4428	Unicorn-15167.exe
4220	Unicorn-9713.exe
608	Unicorn-20574.exe
4628	Unicorn-3583.exe
2636	Unicorn-59838.exe
3380	Unicorn-25028.exe
4068	Unicorn-1078.exe
4352	Unicorn-39318.exe
2308	Unicorn-16860.exe
2584	Unicorn-45183.exe
808	Unicorn-39008.exe
868	Unicorn-28702.exe
1916	Unicorn-24618.exe
4356	Unicorn-51815.exe
3412	Unicorn-59983.exe
3340	Unicorn-32023.exe
1208	Unicorn-61466.exe
4988	Unicorn-14311.exe
812	Unicorn-25172.exe
1648	Unicorn-14046.exe
3004	Unicorn-28292.exe
1876	Unicorn-24208.exe
936	Unicorn-36460.exe
2188	Unicorn-13709.exe
4824	Unicorn-13709.exe
2996	Unicorn-40352.exe
2236	Unicorn-24570.exe
2020	Unicorn-19831.exe
4432	Unicorn-40352.exe
1520	Unicorn-44991.exe
2004	Unicorn-44436.exe
3088	Unicorn-63221.exe
4376	Unicorn-25962.exe
3244	Unicorn-54556.exe
2232	Unicorn-57356.exe
2204	Unicorn-43620.exe
1312	Unicorn-38020.exe
860	Unicorn-12915.exe
872	Unicorn-8831.exe
3628	Unicorn-19692.exe
2400	Unicorn-48281.exe
3156	Unicorn-64062.exe
4856	Unicorn-40112.exe
4872	Unicorn-45972.exe
4464	Unicorn-9023.exe
4728	Unicorn-30212.exe
4324	Unicorn-30212.exe
2956	Unicorn-42464.exe
744	Unicorn-22044.exe
3128	Unicorn-15822.exe
2696	Unicorn-35977.exe
3024	Unicorn-15822.exe
1584	Unicorn-15059.exe
3896	Unicorn-19906.exe
2444	Unicorn-17859.exe
1000	Unicorn-40094.exe
740	Unicorn-23725.exe
1760	Unicorn-12292.exe
2476	Unicorn-4124.exe
3372	Unicorn-4124.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 4372	2084	35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe	82
PID 2084 wrote to memory of 4372	2084	35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe	82
PID 2084 wrote to memory of 4372	2084	35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe	82
PID 4372 wrote to memory of 1028	4372	Unicorn-2749.exe	83
PID 4372 wrote to memory of 1028	4372	Unicorn-2749.exe	83
PID 4372 wrote to memory of 1028	4372	Unicorn-2749.exe	83
PID 2084 wrote to memory of 4524	2084	35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe	84
PID 2084 wrote to memory of 4524	2084	35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe	84
PID 2084 wrote to memory of 4524	2084	35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe	84
PID 4524 wrote to memory of 4428	4524	Unicorn-27014.exe	85
PID 4524 wrote to memory of 4428	4524	Unicorn-27014.exe	85
PID 4524 wrote to memory of 4428	4524	Unicorn-27014.exe	85
PID 1028 wrote to memory of 4220	1028	Unicorn-16154.exe	86
PID 1028 wrote to memory of 4220	1028	Unicorn-16154.exe	86
PID 1028 wrote to memory of 4220	1028	Unicorn-16154.exe	86
PID 2084 wrote to memory of 4628	2084	35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe	87
PID 2084 wrote to memory of 4628	2084	35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe	87
PID 2084 wrote to memory of 4628	2084	35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe	87
PID 4372 wrote to memory of 608	4372	Unicorn-2749.exe	88
PID 4372 wrote to memory of 608	4372	Unicorn-2749.exe	88
PID 4372 wrote to memory of 608	4372	Unicorn-2749.exe	88
PID 4220 wrote to memory of 2636	4220	Unicorn-9713.exe	91
PID 4220 wrote to memory of 2636	4220	Unicorn-9713.exe	91
PID 4220 wrote to memory of 2636	4220	Unicorn-9713.exe	91
PID 4428 wrote to memory of 3380	4428	Unicorn-15167.exe	92
PID 4428 wrote to memory of 3380	4428	Unicorn-15167.exe	92
PID 4428 wrote to memory of 3380	4428	Unicorn-15167.exe	92
PID 4524 wrote to memory of 4068	4524	Unicorn-27014.exe	93
PID 4524 wrote to memory of 4068	4524	Unicorn-27014.exe	93
PID 4524 wrote to memory of 4068	4524	Unicorn-27014.exe	93
PID 608 wrote to memory of 2308	608	Unicorn-20574.exe	94
PID 608 wrote to memory of 2308	608	Unicorn-20574.exe	94
PID 608 wrote to memory of 2308	608	Unicorn-20574.exe	94
PID 4372 wrote to memory of 4352	4372	Unicorn-2749.exe	95
PID 4372 wrote to memory of 4352	4372	Unicorn-2749.exe	95
PID 4372 wrote to memory of 4352	4372	Unicorn-2749.exe	95
PID 2084 wrote to memory of 2584	2084	35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe	97
PID 2084 wrote to memory of 2584	2084	35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe	97
PID 2084 wrote to memory of 2584	2084	35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe	97
PID 2636 wrote to memory of 808	2636	Unicorn-59838.exe	109
PID 2636 wrote to memory of 808	2636	Unicorn-59838.exe	109
PID 2636 wrote to memory of 808	2636	Unicorn-59838.exe	109
PID 3380 wrote to memory of 868	3380	Unicorn-25028.exe	110
PID 3380 wrote to memory of 868	3380	Unicorn-25028.exe	110
PID 3380 wrote to memory of 868	3380	Unicorn-25028.exe	110
PID 2308 wrote to memory of 1916	2308	Unicorn-16860.exe	112
PID 2308 wrote to memory of 1916	2308	Unicorn-16860.exe	112
PID 2308 wrote to memory of 1916	2308	Unicorn-16860.exe	112
PID 2584 wrote to memory of 4988	2584	Unicorn-45183.exe	113
PID 2584 wrote to memory of 4988	2584	Unicorn-45183.exe	113
PID 2584 wrote to memory of 4988	2584	Unicorn-45183.exe	113
PID 4428 wrote to memory of 812	4428	Unicorn-15167.exe	114
PID 4428 wrote to memory of 812	4428	Unicorn-15167.exe	114
PID 4428 wrote to memory of 812	4428	Unicorn-15167.exe	114
PID 4220 wrote to memory of 3412	4220	Unicorn-9713.exe	115
PID 4220 wrote to memory of 3412	4220	Unicorn-9713.exe	115
PID 4220 wrote to memory of 3412	4220	Unicorn-9713.exe	115
PID 4372 wrote to memory of 1648	4372	Unicorn-2749.exe	116
PID 4372 wrote to memory of 1648	4372	Unicorn-2749.exe	116
PID 4372 wrote to memory of 1648	4372	Unicorn-2749.exe	116
PID 2084 wrote to memory of 3340	2084	35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe	117
PID 2084 wrote to memory of 3340	2084	35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe	117
PID 2084 wrote to memory of 3340	2084	35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe	117
PID 608 wrote to memory of 4356	608	Unicorn-20574.exe	118

C:\Users\Admin\AppData\Local\Temp\35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe
"C:\Users\Admin\AppData\Local\Temp\35ff0f49a6cfd8599e115c0d1399afa9a474021903e99d481b27f1ce75c39ee2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2749.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2749.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9713.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12915.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63076.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61068.exe
        10⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17488.exe
        11⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44405.exe
        11⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7240 -s 636
        12⤵
        Program crash
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31383.exe
        11⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12293.exe
        12⤵
        
        PID:11660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53621.exe
        10⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12639.exe
        10⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 548
        11⤵
        Program crash
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28313.exe
        10⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8722.exe
        9⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26014.exe
        10⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63450.exe
        11⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26108.exe
        12⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe
        11⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6444 -s 504
        11⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34046.exe
        10⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
        11⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29350.exe
        11⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
        10⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21732.exe
        10⤵
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39474.exe
        9⤵
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46512.exe
        10⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 636
        11⤵
        
        PID:15056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 660
        10⤵
        
        PID:12796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 660
        10⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 508
        9⤵
        Program crash
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32904.exe
        8⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51046.exe
        8⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27768.exe
        9⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9231.exe
        10⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54104.exe
        11⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4509.exe
        12⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43076.exe
        12⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34700.exe
        11⤵
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32177.exe
        11⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe
        10⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        11⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48820.exe
        10⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5178.exe
        10⤵
        
        PID:14476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        9⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25900.exe
        10⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38784.exe
        10⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28093.exe
        10⤵
        
        PID:14364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 652
        9⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16366.exe
        8⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22418.exe
        9⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27950.exe
        10⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61255.exe
        10⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39106.exe
        10⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 740
        8⤵
        Program crash
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19692.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-217.exe
        8⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58930.exe
        9⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53066.exe
        10⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34352.exe
        9⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35682.exe
        10⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 636
        11⤵
        Program crash
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe
        10⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50958.exe
        10⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe
        10⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
        9⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50596.exe
        10⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51354.exe
        11⤵
        
        PID:13832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7324 -s 640
        10⤵
        
        PID:12748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43663.exe
        9⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9995.exe
        9⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58151.exe
        9⤵
        
        PID:14840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 616
        8⤵
        Program crash
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18591.exe
        7⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63590.exe
        8⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21738.exe
        9⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe
        10⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12163.exe
        11⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17020.exe
        10⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42126.exe
        10⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
        10⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5976 -s 636
        9⤵
        Program crash
        
        PID:9332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 668
        7⤵
        Program crash
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44991.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15822.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17859.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
        7⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49392.exe
        8⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18230.exe
        9⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23932.exe
        9⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10051.exe
        10⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37518.exe
        10⤵
        
        PID:13880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 652
        9⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1234.exe
        8⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42136.exe
        8⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34852.exe
        9⤵
        
        PID:11472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 752
        8⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        7⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42734.exe
        8⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24556.exe
        9⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7432 -s 636
        10⤵
        
        PID:13368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 636
        9⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
        8⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29385.exe
        8⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35329.exe
        8⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48026.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64794.exe
        8⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7936 -s 724
        9⤵
        
        PID:14728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7172 -s 664
        8⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27327.exe
        7⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4867.exe
        8⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51028.exe
        7⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35940.exe
        7⤵
        
        PID:14972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11218.exe
        6⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26071.exe
        6⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13953.exe
        7⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
        8⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21104.exe
        8⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9453.exe
        8⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        7⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8380 -s 636
        8⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 668
        7⤵
        
        PID:11748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42888.exe
        6⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55723.exe
        7⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60984.exe
        7⤵
        
        PID:10376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
        6⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32419.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53228.exe
        6⤵
        
        PID:12980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59983.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40352.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30212.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18884.exe
        8⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        9⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27960.exe
        10⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23212.exe
        11⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38152.exe
        12⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7776 -s 648
        12⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        11⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        10⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        10⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15318.exe
        10⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe
        10⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10668.exe
        8⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62224.exe
        8⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12111.exe
        9⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48001.exe
        8⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8492 -s 636
        9⤵
        
        PID:14736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 776
        8⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11654.exe
        7⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-383.exe
        8⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5977.exe
        9⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe
        10⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1883.exe
        11⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17098.exe
        11⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65261.exe
        10⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
        10⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        10⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
        9⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 624
        9⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23600.exe
        8⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        9⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5488 -s 636
        10⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7092 -s 632
        9⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54580.exe
        8⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8212 -s 640
        9⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
        8⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14027.exe
        8⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39178.exe
        7⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16092.exe
        8⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 640
        9⤵
        Program crash
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50575.exe
        8⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36964.exe
        9⤵
        
        PID:13756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41446.exe
        8⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22885.exe
        8⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4690.exe
        7⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8603.exe
        8⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19886.exe
        9⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8660.exe
        8⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44648.exe
        8⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24945.exe
        7⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41048.exe
        8⤵
        
        PID:13744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10050.exe
        7⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27194.exe
        7⤵
        
        PID:14144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12292.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 616
        7⤵
        Program crash
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44824.exe
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27684.exe
        7⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 640
        8⤵
        Program crash
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65078.exe
        7⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4125.exe
        8⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46777.exe
        8⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe
        7⤵
        
        PID:11320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35505.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7731.exe
        7⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 636
        8⤵
        Program crash
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
        7⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16248.exe
        8⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14358.exe
        8⤵
        
        PID:14392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6420 -s 668
        7⤵
        
        PID:64
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14499.exe
        6⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27078.exe
        7⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59548.exe
        8⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11966.exe
        8⤵
        
        PID:14396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7016 -s 660
        7⤵
        
        PID:11652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2764.exe
        6⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7600 -s 632
        7⤵
        
        PID:12740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
        6⤵
        
        PID:13112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22044.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17322.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55614.exe
        8⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23304.exe
        7⤵
        
        PID:348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 636
        8⤵
        Program crash
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53864.exe
        7⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23378.exe
        8⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15650.exe
        8⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53968.exe
        8⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
        7⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22693.exe
        7⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43724.exe
        6⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37306.exe
        7⤵
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        8⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6168 -s 636
        9⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61753.exe
        8⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        7⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7668 -s 608
        8⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5984 -s 652
        7⤵
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63054.exe
        6⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 644
        7⤵
        Program crash
        
        PID:6388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 644
        7⤵
        Program crash
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        6⤵
        
        PID:8552
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 764
        6⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23725.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:740
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 720
        6⤵
        Program crash
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42216.exe
        5⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52464.exe
        6⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61867.exe
        6⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32418.exe
        7⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22395.exe
        6⤵
        
        PID:668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36699.exe
        6⤵
        
        PID:13900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
        5⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        6⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5775.exe
        7⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64161.exe
        7⤵
        
        PID:14056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
        6⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
        7⤵
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        5⤵
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5585.exe
        5⤵
        
        PID:10856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22118.exe
        5⤵
        
        PID:13868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 728
      4⤵
      Program crash
      PID:2956
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 752
      4⤵
      Program crash
      PID:4028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16860.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        8⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe
        9⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        10⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48489.exe
        10⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38344.exe
        11⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
        12⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31872.exe
        12⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44623.exe
        11⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51804.exe
        10⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56823.exe
        10⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25293.exe
        10⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28924.exe
        9⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45504.exe
        9⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34068.exe
        10⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34508.exe
        10⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 668
        9⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51701.exe
        8⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        7⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        8⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        9⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3180.exe
        9⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7104 -s 624
        10⤵
        Program crash
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4009.exe
        9⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        9⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
        8⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35464.exe
        9⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13201.exe
        10⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21234.exe
        10⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32561.exe
        10⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        9⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-783.exe
        10⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8301.exe
        9⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe
        9⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38654.exe
        8⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6344 -s 636
        9⤵
        
        PID:14284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        8⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
        8⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exe
        7⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6579.exe
        8⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44042.exe
        9⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13839.exe
        10⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 660
        10⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57913.exe
        9⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32728.exe
        8⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17924.exe
        9⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11717.exe
        10⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7332 -s 624
        9⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7332 -s 624
        9⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
        8⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19886.exe
        9⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe
        8⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe
        8⤵
        
        PID:15144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38193.exe
        7⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16388.exe
        8⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36886.exe
        9⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28390.exe
        9⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4295.exe
        9⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 504
        7⤵
        Program crash
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40112.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50954.exe
        8⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51312.exe
        9⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40944.exe
        10⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 636
        11⤵
        Program crash
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7980.exe
        10⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18490.exe
        11⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        10⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58920.exe
        11⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64441.exe
        9⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5948 -s 640
        10⤵
        Program crash
        
        PID:9728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 736
        9⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32598.exe
        8⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe
        9⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7940 -s 636
        10⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
        8⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63336.exe
        9⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42370.exe
        9⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe
        8⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28033.exe
        8⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37310.exe
        7⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30729.exe
        7⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32916.exe
        8⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3419.exe
        9⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe
        9⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18774.exe
        8⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
        8⤵
        
        PID:14220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37887.exe
        7⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe
        7⤵
        
        PID:13796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55540.exe
        6⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43938.exe
        8⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12007.exe
        9⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4737.exe
        10⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46320.exe
        11⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37222.exe
        11⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15649.exe
        11⤵
        
        PID:14512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6756 -s 628
        10⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        9⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27400.exe
        10⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11888.exe
        10⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27071.exe
        10⤵
        
        PID:15180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13459.exe
        9⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33217.exe
        9⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
        9⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38374.exe
        8⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29984.exe
        9⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16034.exe
        9⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16827.exe
        9⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37798.exe
        8⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
        9⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63497.exe
        9⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe
        8⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46446.exe
        8⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57897.exe
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        7⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        8⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9180 -s 636
        9⤵
        
        PID:13184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7228 -s 652
        8⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57669.exe
        7⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8420 -s 636
        8⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46020.exe
        7⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45514.exe
        7⤵
        
        PID:14468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24239.exe
        6⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29522.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2791.exe
        8⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27592.exe
        9⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        10⤵
        
        PID:14160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48261.exe
        9⤵
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31347.exe
        9⤵
        
        PID:15136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6052 -s 708
        7⤵
        Program crash
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9455.exe
        6⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56050.exe
        7⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4384.exe
        7⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54390.exe
        8⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43086.exe
        7⤵
        
        PID:14044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2572.exe
        6⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45974.exe
        6⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2236
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 720
        6⤵
        Program crash
        
        PID:3864
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 756
        6⤵
        Program crash
        
        PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44436.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59355.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18373.exe
        5⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3382.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59558.exe
        6⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
        7⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33434.exe
        7⤵
        
        PID:14204
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6244 -s 716
        6⤵
        
        PID:11836
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 640
        5⤵
        Program crash
        
        PID:9776
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 712
      4⤵
      Program crash
      PID:1696
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 712
      4⤵
      Program crash
      PID:3804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39318.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 632
      4⤵
      Program crash
      PID:2472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 632
      4⤵
      Program crash
      PID:3156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14046.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40352.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15822.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44711.exe
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
        6⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42660.exe
        5⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
        7⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe
        8⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18442.exe
        8⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 628
        7⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53097.exe
        6⤵
        
        PID:8288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57782.exe
        6⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51473.exe
        6⤵
        
        PID:13128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        5⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46922.exe
        6⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 636
        7⤵
        
        PID:11672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59999.exe
        6⤵
        
        PID:9992
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6364 -s 624
        6⤵
        
        PID:13852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39336.exe
        5⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18900.exe
        6⤵
        
        PID:11468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32224.exe
        5⤵
        
        PID:9656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51698.exe
        5⤵
        
        PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59355.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54556.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54556.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32096.exe
        5⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18666.exe
        6⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33906.exe
        6⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        7⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52428.exe
        8⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27710.exe
        7⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        7⤵
        
        PID:12640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 624
        6⤵
        Program crash
        
        PID:9980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3460.exe
        5⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57124.exe
        6⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 608
        7⤵
        Program crash
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28400.exe
        6⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57514.exe
        7⤵
        
        PID:15024
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5880 -s 672
        6⤵
        
        PID:12084
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5880 -s 672
        6⤵
        
        PID:13708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3101.exe
        5⤵
        
        PID:6728
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6728 -s 644
        6⤵
        Program crash
        
        PID:9704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28313.exe
        5⤵
        
        PID:5028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64061.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
    3⤵
    PID:6112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
    3⤵
    PID:6176
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6176 -s 640
      4⤵
      Program crash
      PID:9720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27584.exe
    3⤵
    PID:11728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40959.exe
    3⤵
    PID:14356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15167.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28702.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24208.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8831.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 728
        8⤵
        Program crash
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
        7⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20228.exe
        8⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
        9⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36704.exe
        10⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15043.exe
        11⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60710.exe
        12⤵
        
        PID:640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7320 -s 664
        12⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
        11⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12795.exe
        11⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19760.exe
        11⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49615.exe
        10⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32610.exe
        11⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11644.exe
        11⤵
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61290.exe
        10⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21732.exe
        10⤵
        
        PID:12908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4017.exe
        10⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31768.exe
        9⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 636
        10⤵
        Program crash
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        9⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31359.exe
        9⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59075.exe
        8⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25467.exe
        8⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61888.exe
        9⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6408 -s 640
        9⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27965.exe
        8⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 636
        9⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49720.exe
        8⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11281.exe
        9⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48281.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 720
        7⤵
        Program crash
        
        PID:2260
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 736
        5⤵
        Program crash
        
        PID:2736
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 736
        5⤵
        Program crash
        
        PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25962.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4376
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 636
        6⤵
        Program crash
        
        PID:1200
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 636
        6⤵
        Program crash
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4124.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44348.exe
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19796.exe
        6⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
        6⤵
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4903.exe
        7⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9028 -s 636
        8⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 652
        7⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 652
        7⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exe
        6⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 636
        7⤵
        
        PID:15080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48158.exe
        6⤵
        
        PID:12056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47652.exe
        6⤵
        
        PID:8544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57356.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45718.exe
        6⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38894.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-658.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
        8⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7704 -s 636
        9⤵
        
        PID:15040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6536 -s 656
        8⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32021.exe
        7⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63647.exe
        7⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42808.exe
        7⤵
        
        PID:12396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14752.exe
        6⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 640
        7⤵
        Program crash
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14393.exe
        6⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25926.exe
        7⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53606.exe
        8⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 656
        8⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26813.exe
        6⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60228.exe
        7⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11498.exe
        6⤵
        
        PID:13912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48219.exe
        5⤵
        
        PID:628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51146.exe
        6⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
        6⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18334.exe
        7⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        8⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47249.exe
        8⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
        6⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8568 -s 644
        7⤵
        
        PID:15072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35251.exe
        6⤵
        
        PID:10904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63298.exe
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14145.exe
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37938.exe
        6⤵
        
        PID:8444
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 668
        6⤵
        
        PID:9284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35977.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24919.exe
      4⤵
      PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57559.exe
      4⤵
      PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57124.exe
        5⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe
        6⤵
        
        PID:7516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63211.exe
        5⤵
        
        PID:8456
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6188 -s 676
        5⤵
        
        PID:11812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
      4⤵
      PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48650.exe
        5⤵
        
        PID:5896
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 636
        6⤵
        
        PID:13980
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 668
        5⤵
        
        PID:12772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
      4⤵
      PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49216.exe
        5⤵
        
        PID:10756
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 744
      4⤵
      PID:13360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1078.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 636
      4⤵
      Program crash
      PID:4712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 636
      4⤵
      Program crash
      PID:4768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61466.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1208
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 632
      4⤵
      Program crash
      PID:4072
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 676
      4⤵
      Program crash
      PID:4440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63221.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 636
      4⤵
      Program crash
      PID:3892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15059.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64575.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64575.exe
    3⤵
    PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24452.exe
      4⤵
      PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55282.exe
        5⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51852.exe
        6⤵
        
        PID:10988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43740.exe
        6⤵
        
        PID:14192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 736
      4⤵
      Program crash
      PID:9464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
    3⤵
    PID:1876
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 636
      4⤵
      Program crash
      PID:9516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16773.exe
    3⤵
    PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
      4⤵
      PID:5152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23384.exe
    3⤵
    PID:11712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
    3⤵
    PID:13168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 724
    3⤵
    - Program crash
    PID:2860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 724
    3⤵
    - Program crash
    PID:4576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45183.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45183.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14311.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4824
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 636
        5⤵
        Program crash
        
        PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4124.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2476
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 712
        5⤵
        Program crash
        
        PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57460.exe
      4⤵
      PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6963.exe
        5⤵
        
        PID:968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37602.exe
        6⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44374.exe
        7⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35594.exe
        8⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44047.exe
        7⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45608.exe
        7⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26008.exe
        6⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
        7⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41576.exe
        6⤵
        
        PID:10476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        6⤵
        
        PID:13628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18888.exe
        5⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
        6⤵
        
        PID:10632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe
        6⤵
        
        PID:13140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49038.exe
        5⤵
        
        PID:8140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
        5⤵
        
        PID:11420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47477.exe
      4⤵
      PID:4204
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 720
        5⤵
        Program crash
        
        PID:4624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 632
      4⤵
      Program crash
      PID:9480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43620.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30212.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2547.exe
        5⤵
        
        PID:508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49563.exe
        5⤵
        
        PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
        5⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49252.exe
        6⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3419.exe
        7⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41332.exe
        6⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42510.exe
        6⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        5⤵
        
        PID:6020
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 636
        6⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54982.exe
        5⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26272.exe
        5⤵
        
        PID:12996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30320.exe
      4⤵
      PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        5⤵
        
        PID:836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 684
      4⤵
      Program crash
      PID:5268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32023.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32023.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45972.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51172.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45479.exe
        5⤵
        
        PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57949.exe
      4⤵
      PID:4160
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 716
        5⤵
        Program crash
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59214.exe
      4⤵
      PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
      4⤵
      PID:4456
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 636
        5⤵
        Program crash
        
        PID:9524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16969.exe
      4⤵
      PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63056.exe
        5⤵
        
        PID:12220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54945.exe
        5⤵
        
        PID:400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38446.exe
      4⤵
      PID:9632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43338.exe
      4⤵
      PID:2220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4124.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1845.exe
    3⤵
    PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33990.exe
      4⤵
      PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65012.exe
        5⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3995.exe
        6⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4576.exe
        5⤵
        
        PID:3616
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6828 -s 720
        5⤵
        
        PID:14452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19656.exe
      4⤵
      PID:8068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
      4⤵
      PID:10196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31245.exe
      4⤵
      PID:14132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20258.exe
    3⤵
    PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47882.exe
      4⤵
      PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51058.exe
        5⤵
        
        PID:11972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5352 -s 732
      4⤵
      PID:12096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53918.exe
    3⤵
    PID:3024
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 636
      4⤵
      PID:9336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
    3⤵
    PID:9644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14557.exe
    3⤵
    PID:13132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38020.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38020.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42464.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19268.exe
      4⤵
      PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
      4⤵
      PID:5540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
    3⤵
    PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23326.exe
      4⤵
      PID:5300
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 776
      4⤵
      Program crash
      PID:3956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2805.exe
    3⤵
    PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12474.exe
    3⤵
    PID:5852
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 636
      4⤵
      Program crash
      PID:9752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
    3⤵
    PID:4528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 636
      4⤵
      PID:10424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63911.exe
    3⤵
    PID:11796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29908.exe
    3⤵
    PID:11784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40094.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40094.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31520.exe
    3⤵
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe
      4⤵
      PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46818.exe
        5⤵
        
        PID:6916
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6916 -s 636
        6⤵
        Program crash
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
        5⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65282.exe
        6⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6792.exe
        6⤵
        
        PID:13924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22779.exe
        5⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
        5⤵
        
        PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34290.exe
      4⤵
      PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe
        5⤵
        
        PID:5204
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5204 -s 628
        6⤵
        
        PID:13336
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7180 -s 752
        5⤵
        
        PID:11548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 744
      4⤵
      Program crash
      PID:9848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60253.exe
    3⤵
    PID:5304
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33659.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33659.exe
  2⤵
  PID:5960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
    3⤵
    PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16030.exe
      4⤵
      PID:7848
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7848 -s 636
        5⤵
        Program crash
        
        PID:9864
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5568 -s 628
      4⤵
      PID:10976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
    3⤵
    PID:4360
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 464
      4⤵
      Program crash
      PID:3368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11731.exe
    3⤵
    PID:1000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5998.exe
    3⤵
    PID:10044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57712.exe
    3⤵
    PID:14384
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16176.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16176.exe
  2⤵
  PID:3052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
    3⤵
    PID:5052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 636
      4⤵
      PID:13324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
    3⤵
    PID:10252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30833.exe
    3⤵
    PID:13888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31782.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31782.exe
  2⤵
  PID:2700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 636
    3⤵
    PID:15064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39921.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39921.exe
  2⤵
  PID:9304
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40273.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40273.exe
  2⤵
  PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4628 -ip 4628
1⤵
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1028 -ip 1028
1⤵
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1028 -ip 1028
1⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4628 -ip 4628
1⤵
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4352 -ip 4352
1⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4068 -ip 4068
1⤵
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4352 -ip 4352
1⤵
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4068 -ip 4068
1⤵
PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1208 -ip 1208
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3380 -ip 3380
1⤵
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 608 -ip 608
1⤵
PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3380 -ip 3380
1⤵
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1208 -ip 1208
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 608 -ip 608
1⤵
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2236 -ip 2236
1⤵
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4824 -ip 4824
1⤵
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2004 -ip 2004
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3088 -ip 3088
1⤵
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4376 -ip 4376
1⤵
PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2308 -ip 2308
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2584 -ip 2584
1⤵
PID:680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2004 -ip 2004
1⤵
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2308 -ip 2308
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2400 -ip 2400
1⤵
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 872 -ip 872
1⤵
PID:896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2584 -ip 2584
1⤵
PID:4072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 868 -ip 868
1⤵
PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2236 -ip 2236
1⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2400 -ip 2400
1⤵
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 868 -ip 868
1⤵
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4376 -ip 4376
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3024 -ip 3024
1⤵
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4824 -ip 4824
1⤵
PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3128 -ip 3128
1⤵
PID:3296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3088 -ip 3088
1⤵
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2696 -ip 2696
1⤵
PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2476 -ip 2476
1⤵
PID:5180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1760 -ip 1760
1⤵
PID:5224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1584 -ip 1584
1⤵
PID:5248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 4788 -ip 4788
1⤵
PID:5364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 4392 -ip 4392
1⤵
PID:5396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 740 -ip 740
1⤵
PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2796 -ip 2796
1⤵
PID:5556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3372 -ip 3372
1⤵
PID:5620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 3024 -ip 3024
1⤵
PID:5708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 2696 -ip 2696
1⤵
PID:5840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 2476 -ip 2476
1⤵
PID:5876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4788 -ip 4788
1⤵
PID:5916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2548 -ip 2548
1⤵
PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1760 -ip 1760
1⤵
PID:6024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 2796 -ip 2796
1⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 872 -ip 872
1⤵
PID:5268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 3372 -ip 3372
1⤵
PID:5328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 1648 -ip 1648
1⤵
PID:5568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 1876 -ip 1876
1⤵
PID:5372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 4092 -ip 4092
1⤵
PID:5860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 1520 -ip 1520
1⤵
PID:5940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 508 -ip 508
1⤵
PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4160 -ip 4160
1⤵
PID:5340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 808 -ip 808
1⤵
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 3244 -ip 3244
1⤵
PID:5576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 3128 -ip 3128
1⤵
PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 3628 -ip 3628
1⤵
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1584 -ip 1584
1⤵
PID:6404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 812 -ip 812
1⤵
PID:6476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 2204 -ip 2204
1⤵
PID:6528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2548 -ip 2548
1⤵
PID:6592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2308 -ip 2308
1⤵
PID:6688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 5200 -ip 5200
1⤵
PID:6752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5416 -ip 5416
1⤵
PID:6852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 4392 -ip 4392
1⤵
PID:6872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 1648 -ip 1648
1⤵
PID:6948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1876 -ip 1876
1⤵
PID:6968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 4092 -ip 4092
1⤵
PID:6984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1520 -ip 1520
1⤵
PID:6996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 508 -ip 508
1⤵
PID:7008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 3244 -ip 3244
1⤵
PID:7016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4160 -ip 4160
1⤵
PID:7024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 3628 -ip 3628
1⤵
PID:7060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5200 -ip 5200
1⤵
PID:7148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 2204 -ip 2204
1⤵
PID:7164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 812 -ip 812
1⤵
PID:6072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 2308 -ip 2308
1⤵
PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 6060 -ip 6060
1⤵
PID:6148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 740 -ip 740
1⤵
PID:6172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5416 -ip 5416
1⤵
PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 6112 -ip 6112
1⤵
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 836 -ip 836
1⤵
PID:6728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 1684 -ip 1684
1⤵
PID:6884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 6016 -ip 6016
1⤵
PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 3960 -ip 3960
1⤵
PID:6692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6128 -ip 6128
1⤵
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4444 -ip 4444
1⤵
PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 5304 -ip 5304
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5180 -ip 5180
1⤵
PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3732 -ip 3732
1⤵
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5524 -ip 5524
1⤵
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2472 -ip 2472
1⤵
PID:664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 6100 -ip 6100
1⤵
PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 5300 -ip 5300
1⤵
PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5924 -ip 5924
1⤵
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 348 -ip 348
1⤵
PID:5308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5916 -ip 5916
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5944 -ip 5944
1⤵
PID:5552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 6216 -ip 6216
1⤵
PID:6360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5540 -ip 5540
1⤵
PID:7304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 6060 -ip 6060
1⤵
PID:7512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5264 -ip 5264
1⤵
PID:7552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1048 -p 5152 -ip 5152
1⤵
PID:7668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1056 -p 5592 -ip 5592
1⤵
PID:7744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 6668 -ip 6668
1⤵
PID:7968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 6448 -ip 6448
1⤵
PID:8020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6180 -ip 6180
1⤵
PID:8068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 6680 -ip 6680
1⤵
PID:8088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1092 -p 6644 -ip 6644
1⤵
PID:8120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 6580 -ip 6580
1⤵
PID:8144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1056 -p 3536 -ip 3536
1⤵
PID:8156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1124 -p 6112 -ip 6112
1⤵
PID:8184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 2232 -ip 2232
1⤵
PID:5420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1144 -p 4132 -ip 4132
1⤵
PID:7208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1164 -p 4872 -ip 4872
1⤵
PID:3332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 3156 -ip 3156
1⤵
PID:6492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1168 -p 1000 -ip 1000
1⤵
PID:5712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4500 -ip 4500
1⤵
PID:7236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1204 -p 808 -ip 808
1⤵
PID:7524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1216 -p 5284 -ip 5284
1⤵
PID:7348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 5304 -ip 5304
1⤵
PID:7780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 4688 -ip 4688
1⤵
PID:7420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 836 -ip 836
1⤵
PID:5308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1060 -p 1684 -ip 1684
1⤵
PID:7956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6016 -ip 6016
1⤵
PID:8044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5680 -ip 5680
1⤵
PID:5616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1136 -p 6128 -ip 6128
1⤵
PID:8164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1236 -p 2956 -ip 2956
1⤵
PID:7288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 5444 -ip 5444
1⤵
PID:6988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1036 -p 5524 -ip 5524
1⤵
PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 5924 -ip 5924
1⤵
PID:8088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 348 -ip 348
1⤵
PID:6884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1228 -p 5944 -ip 5944
1⤵
PID:8156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5592 -ip 5592
1⤵
PID:5228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 6100 -ip 6100
1⤵
PID:7456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1248 -p 5180 -ip 5180
1⤵
PID:7192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3732 -ip 3732
1⤵
PID:7896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 5340 -ip 5340
1⤵
PID:7236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5152 -ip 5152
1⤵
PID:6524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1268 -p 6580 -ip 6580
1⤵
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1052 -p 6216 -ip 6216
1⤵
PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 6668 -ip 6668
1⤵
PID:8132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4444 -ip 4444
1⤵
PID:8120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1160 -p 5916 -ip 5916
1⤵
PID:5168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2472 -ip 2472
1⤵
PID:7580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1204 -p 5540 -ip 5540
1⤵
PID:7936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1028 -p 6680 -ip 6680
1⤵
PID:7996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5264 -ip 5264
1⤵
PID:7596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1240 -p 3536 -ip 3536
1⤵
PID:7008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 5300 -ip 5300
1⤵
PID:6860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 6644 -ip 6644
1⤵
PID:5788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 4132 -ip 4132
1⤵
PID:5364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1184 -p 3156 -ip 3156
1⤵
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1000 -ip 1000
1⤵
PID:8276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1056 -p 4500 -ip 4500
1⤵
PID:8332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 2232 -ip 2232
1⤵
PID:8676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 6488 -ip 6488
1⤵
PID:8744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 4872 -ip 4872
1⤵
PID:8756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5284 -ip 5284
1⤵
PID:8848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 6448 -ip 6448
1⤵
PID:8928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 6180 -ip 6180
1⤵
PID:9068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1128 -p 4360 -ip 4360
1⤵
PID:5168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4688 -ip 4688
1⤵
PID:5916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5444 -ip 5444
1⤵
PID:8744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 2956 -ip 2956
1⤵
PID:6672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1116 -p 5392 -ip 5392
1⤵
PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 5680 -ip 5680
1⤵
PID:8392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 4596 -ip 4596
1⤵
PID:8948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 6540 -ip 6540
1⤵
PID:9096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 4068 -ip 4068
1⤵
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4204 -ip 4204
1⤵
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5564 -ip 5564
1⤵
PID:7980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 6916 -ip 6916
1⤵
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1116 -p 6052 -ip 6052
1⤵
PID:8744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5340 -ip 5340
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1192 -p 7108 -ip 7108
1⤵
PID:668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 7104 -ip 7104
1⤵
PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 5976 -ip 5976
1⤵
PID:9212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1168 -p 6044 -ip 6044
1⤵
PID:9296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 936 -ip 936
1⤵
PID:9356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 3004 -ip 3004
1⤵
PID:9428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4988 -ip 4988
1⤵
PID:9492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1244 -p 1876 -ip 1876
1⤵
PID:9540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 4456 -ip 4456
1⤵
PID:9580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1144 -p 6596 -ip 6596
1⤵
PID:9608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 6728 -ip 6728
1⤵
PID:9684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1136 -p 7848 -ip 7848
1⤵
PID:9836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4180 -ip 4180
1⤵
PID:9900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1096 -p 6176 -ip 6176
1⤵
PID:9940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5948 -ip 5948
1⤵
PID:10044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5940 -ip 5940
1⤵
PID:10084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1280 -p 5852 -ip 5852
1⤵
PID:10092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 5912 -ip 5912
1⤵
PID:10156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 7240 -ip 7240
1⤵
PID:5528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 1228 -ip 1228
1⤵
PID:8852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 4356 -ip 4356
1⤵
PID:5240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 2968 -ip 2968
1⤵
PID:9276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 860 -ip 860
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1028 -p 5144 -ip 5144
1⤵
PID:10264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5392 -ip 5392
1⤵
PID:10464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1204 -p 2360 -ip 2360
1⤵
PID:10472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1288 -p 6756 -ip 6756
1⤵
PID:10480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 5568 -ip 5568
1⤵
PID:10488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1300 -p 6488 -ip 6488
1⤵
PID:10496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1088 -p 5504 -ip 5504
1⤵
PID:10696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 1948 -ip 1948
1⤵
PID:10816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 4596 -ip 4596
1⤵
PID:11032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1116 -p 6392 -ip 6392
1⤵
PID:11192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1400 -p 3960 -ip 3960
1⤵
PID:10404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1088 -p 5488 -ip 5488
1⤵
PID:11760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 6588 -ip 6588
1⤵
PID:11880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1200 -p 1996 -ip 1996
1⤵
PID:12276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 7120 -ip 7120
1⤵
PID:11544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1088 -p 4392 -ip 4392
1⤵
PID:11548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1408 -p 6736 -ip 6736
1⤵
PID:11556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 1104 -ip 1104
1⤵
PID:11420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1264 -p 6796 -ip 6796
1⤵
PID:10404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 7488 -ip 7488
1⤵
PID:11672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 5836 -ip 5836
1⤵
PID:11828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1244 -p 7092 -ip 7092
1⤵
PID:11832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1288 -p 6964 -ip 6964
1⤵
PID:12112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5212 -ip 5212
1⤵
PID:6036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5984 -ip 5984
1⤵
PID:12236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1088 -p 1696 -ip 1696
1⤵
PID:12084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1200 -p 6536 -ip 6536
1⤵
PID:7268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1424 -p 5352 -ip 5352
1⤵
PID:9276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1132 -p 7180 -ip 7180
1⤵
PID:9580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1400 -p 6244 -ip 6244
1⤵
PID:11344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 4308 -ip 4308
1⤵
PID:5460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 2504 -ip 2504
1⤵
PID:12188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1176 -p 3248 -ip 3248
1⤵
PID:7892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1276 -p 4324 -ip 4324
1⤵
PID:12340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1444 -p 2020 -ip 2020
1⤵
PID:12396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1428 -p 8 -ip 8
1⤵
PID:12668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1424 -p 5880 -ip 5880
1⤵
PID:12680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1344 -p 5292 -ip 5292
1⤵
PID:12980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 6188 -ip 6188
1⤵
PID:12992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1132 -p 6420 -ip 6420
1⤵
PID:12348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1348 -p 6408 -ip 6408
1⤵
PID:13476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1164 -p 7016 -ip 7016
1⤵
PID:13624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 6496 -ip 6496
1⤵
PID:13732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1140 -p 7600 -ip 7600
1⤵
PID:13812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 7324 -ip 7324
1⤵
PID:14020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1052 -p 7332 -ip 7332
1⤵
PID:14236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1164 -p 608 -ip 608
1⤵
PID:12612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1444 -p 7020 -ip 7020
1⤵
PID:13464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 7320 -ip 7320
1⤵
PID:13944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1132 -p 7776 -ip 7776
1⤵
PID:14104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1432 -p 740 -ip 740
1⤵
PID:14536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 7228 -ip 7228
1⤵
PID:14760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 7172 -ip 7172
1⤵
PID:14868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1176 -p 6168 -ip 6168
1⤵
PID:14296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5052 -ip 5052
1⤵
PID:13876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5204 -ip 5204
1⤵
PID:14496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1148 -p 6392 -ip 6392
1⤵
PID:14288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 7940 -ip 7940
1⤵
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1092 -p 4428 -ip 4428
1⤵
PID:10480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 7432 -ip 7432
1⤵
PID:9444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1348 -p 5180 -ip 5180
1⤵
PID:10792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1232 -p 6400 -ip 6400
1⤵
PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 7516 -ip 7516
1⤵
PID:9320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5332 -ip 5332
1⤵
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1172 -p 1876 -ip 1876
1⤵
PID:9280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6588 -ip 6588
1⤵
PID:9244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 3896 -ip 3896
1⤵
PID:9356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2856 -ip 2856
1⤵
PID:14244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2592 -ip 2592
1⤵
PID:9100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1404 -p 1996 -ip 1996
1⤵
PID:14024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1232 -p 5664 -ip 5664
1⤵
PID:15100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 7120 -ip 7120
1⤵
PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 6736 -ip 6736
1⤵
PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1476 -p 1104 -ip 1104
1⤵
PID:13948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6796 -ip 6796
1⤵
PID:5172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4392 -ip 4392
1⤵
PID:15192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1248 -p 5836 -ip 5836
1⤵
PID:11088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1456 -p 7488 -ip 7488
1⤵
PID:14664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 7936 -ip 7936
1⤵
PID:11608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 8492 -ip 8492
1⤵
PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1468 -p 1236 -ip 1236
1⤵
PID:11892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 8444 -ip 8444
1⤵
PID:14784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1272 -p 8420 -ip 8420
1⤵
PID:9276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1308 -p 7704 -ip 7704
1⤵
PID:10052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1168 -p 5044 -ip 5044
1⤵
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1112 -p 2700 -ip 2700
1⤵
PID:14872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1380 -p 8568 -ip 8568
1⤵
PID:9244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1316 -p 4072 -ip 4072
1⤵
PID:14236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 640 -ip 640
1⤵
PID:15104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1152 -p 8836 -ip 8836
1⤵
PID:804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1468 -p 8416 -ip 8416
1⤵
PID:14140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 8068 -ip 8068
1⤵
PID:9320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 8400 -ip 8400
1⤵
PID:14084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1060 -p 8128 -ip 8128
1⤵
PID:14540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 8624 -ip 8624
1⤵
PID:6240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6344 -ip 6344
1⤵
PID:5280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 8136 -ip 8136
1⤵
PID:14764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1192 -p 6364 -ip 6364
1⤵
PID:13464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1464 -p 6444 -ip 6444
1⤵
PID:6636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1078.exe

Filesize
468KB

MD5
7a21ad11a0a8782ae275e705e401196a

SHA1
c0989d2a4cfe97765dd5e165cccf851d7d085de7

SHA256
4d07d40a179859b6dba8e1458f852662ed683307444e7e0cbd0ed13149e16478

SHA512
fee4c87bcfb5148e96147666f60a3351ed19d29e14d99be75fb6fba8f819a28028813b0072002710eef23f06b61d7891787026f757b34ee9c47630838a5bb99a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe

Filesize
468KB

MD5
1a99b08db92d871e04e29bb3bc716c1b

SHA1
fef085012dfdd2f80f600d0d50e361dc81e9379b

SHA256
e99ec62ac009bb13780d46125cfc7d16941b554ba3556824d869d37208da0362

SHA512
0257f62b61ba9eef6b8becf753c8e33b062cc18ebb1d8abd7967e895822cbd0f2b148c15cdcb39d2484278e577e821e14b02637ffaf48317b5ee65c4aa30a7f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14046.exe

Filesize
468KB

MD5
a7842bb1dc423a1583f9decd170d690e

SHA1
c276414acfb5b1418403caac7553e7edb0535a12

SHA256
debe49d906dc4aa9213d549e00ffa32ebb996da6ef7bf492651d976d22c13283

SHA512
da80396cadc091b50804f7aab6de244c7c6128ab2516103d41c7e1eceeba0f59175b3a6e67c5d36a7bbe6468382f412f4e3804282c160d3211840d90a8bbd709

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14311.exe

Filesize
468KB

MD5
ae9845343867516841a97e664d047192

SHA1
d1cd00b20db5423f03ea88996b8eb66ba11ab424

SHA256
f4df119cc5cdf61fd0253440f60106616b21357f0a94cab42885894fb0bd6e08

SHA512
23353067df4685b20a612f9e9db5d8648597b11ec8c8f860ff31a19d59a28c183791ab14dc8916742e30d3a334c09f7a44078db963888c2dc4e18d4645d5f725

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15167.exe

Filesize
468KB

MD5
16beb5d19108007970ab6bc293ec85bb

SHA1
78425ba64d3e00736140e43183a7fa5a54a8f325

SHA256
d58326c24ef5cca75866d27b392ceadf3a57f972012121974c3cd9f39e6fb07e

SHA512
3c5a1488ec8a22482bac1906c8a95497567a41593ac8c7102a88293b94e4d6c7b6b8fbd4071f0bae3c8934a53d1b5eab0c1ebc4a3d66a16917e1f9ae48f05bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe

Filesize
468KB

MD5
153da40e7e803f9c2aec03785563b8d6

SHA1
f3c9ad46eaf3917c7539b7b0c6e4d173a1c407d6

SHA256
9024e6556bbb232269db6b8ddfe6968e38ccc8eab3d4f84bde50c1a9343579d6

SHA512
7f19af0afc20952699109ff762720bc09ea1d55e0e3893815ef7186408228a574ce517ef6631f8a6881b6085b235cdf8ad7147d0acfebea0793839f757993639

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16860.exe

Filesize
468KB

MD5
1f4b98d52766e0cd8a516027934eade7

SHA1
74305a23fefeaf27efadd4e3492609a652cf9d30

SHA256
ac9eb39ea0a0dd2286d468162ed5787d03f7ab11efe7781cf7f87e0f75c3ebbf

SHA512
32d22b23f16b037bd538f58d34a4de5e3e0e6ee914a2ff6f998cef42827eb53a7edb47041b05b2e3ab75b509eec65fdfa42513bd6d362ab7e34dc50927483dec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18230.exe

Filesize
468KB

MD5
48947c59f5bec1c741a5f16991365fba

SHA1
6008897e383379359071e1175f2800b145e371be

SHA256
61f794edf7180033876f09c698a3995df530f121e65d4a807349e5e15698d71f

SHA512
1061245da2f55837ac18f9890f4f37d17c992b694260db96fa5ed1d3a35e4933e0ef65e11d0ef310137ad8ed8fd4975cb4928f1076fd3fe69ce789bff1a34181

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe

Filesize
468KB

MD5
1578550a876f808bf83a2f00d237376c

SHA1
4d11cb5ba6e06fa8de80dbc67427b1ba3bf91f04

SHA256
5f660a27a443183543074e921e85a4eb6e54562ab840376a348c264015e82ff0

SHA512
2bc78df86b9374fa595528a150738daf939ee85b6afc83e35ee80e11e9075ce4da7411d5106c732256c108054048c4c26f1cce58b67bf6d1f7410467d7cbdf69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24208.exe

Filesize
468KB

MD5
ed34e5bab37bcc874e4bf63a77d12093

SHA1
099a3d24dd2479f6a4e10f8b6cfb085a6bba04a1

SHA256
3d848d12be37e132d4c9530e503c268cc5b37320af1d05416093b466fc04a110

SHA512
e17f14ec332e01d176a3b15efc3a4cbade19c35c3df633d5a11c30c001ef8fc0c81115fb0630f64aa4499f679d76c0122c68051936819ce4f23ab73c95aba013

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe

Filesize
468KB

MD5
f332af84481eca528d1f9210a478e0b5

SHA1
8352f8dec546a5e9b7af98f8fb63e726110288cd

SHA256
522a4721d9fb5794f3faf0cec8374acee853100651f6570d086a9aa7db2835c1

SHA512
205137def29740496e2eb41343ce80af66d48d967b3dcebdd6701b24bbc96afdd630c4ae4c5ce1430898474767ccb59cf0bcd406c824e41d8caeb21d90d5bfb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe

Filesize
468KB

MD5
f1a1d2d46f87aa30b7fe1931e85f612d

SHA1
158a895d6fa25a8b2a33816378bfd431e722742a

SHA256
745d34094fbae7ec0fd84daf720ddb9fd1b32195df7e6267fc5190a56207ba92

SHA512
24c597a5dcf5db234501f5f82208bbfb55ad28da699f8f5c2e2109246d6543cbb380cde8cc5c560944609baed1f7fc3670270e73b4613f4af5053465e8e014dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe

Filesize
468KB

MD5
f42d1dac30389ea69996720f8e584f71

SHA1
ff031c01f9fc0ebe5f05857656e2034d25babdba

SHA256
6876bcc0e744588b0dd9f11f311281eb7c8008b61148562f4f40216c71d76e42

SHA512
5fb26241d183a946fb46c29a3b612bc18baf85392352ba0ead68d6392ca9009cb08911c13b56a55624504cecf7afee4741e5855ba001cddc7205e9a257dc6c23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe

Filesize
468KB

MD5
ee52ad74d552960e43f453eba1a932e7

SHA1
257097677423936256c58270f0f89564924cbce6

SHA256
70793f9e23ddaaa434e92640c549928c6d0cb8d0428bc89ae2250dd7ea86b82a

SHA512
ed6b085846d833f3b685b62b70fe29b7d52c7721b2cf9e4d2f69c9c5463870e13d0d05d35df71387bf84c0f419b8fbf32354e9666678e9506882c48ec59b0052

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe

Filesize
468KB

MD5
238fa053b68aae4bbcf16fc31846af65

SHA1
56b632424933cedbd84ec6fade2dbc16e7b6199a

SHA256
355b883edc36a9ac72930b03bb8d010ed7056d27b56b31dc64877fdb5cf2063c

SHA512
65665bc779c34abf863d33bd6ec7dd2763bd6b400cd7e01bda8a9750a493fed51a44678c9ae8f9bf6fe511ee8b9983e9b0cff852c983845782fc7c5290b029a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2749.exe

Filesize
468KB

MD5
f3d614fa1edf16a2dc6b1124538b4e45

SHA1
fd8f7e73335461fc59a9626db22c7fc74d81a252

SHA256
126245f97210b08421516edb0c3b3e8cc27b852b4458c7d37d36fdfcc6c90bb9

SHA512
c490ee9cfbf00652576b0ab23ca37ea1ff9181a02badfde07af94b0f58f71259ddd10a08adc7c760e32eb9b9b9474a08ee535346b63847a56c6d2653567f3d27

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe

Filesize
468KB

MD5
081bc0259fc29d4ba724575f9701e459

SHA1
2137cc92b0ffc5a31297e674fb363e6511321d55

SHA256
efb0a768e616362f316d855165ba76c6f48f2372cdaccf38672d228ebd68b57d

SHA512
725da3ed3cf930b3ad4520bf730505cb2cbf2614efe84561c5207a5c464d61e656ece643ac8a806078130b67b28aa14dbf648cfb47ed3bcb0936a2d92c7cc60b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28702.exe

Filesize
468KB

MD5
94c14a6d7565ef8983dc329d18bf40ca

SHA1
f1441cdc9bfe0e44be74cbe593febd8ed77634db

SHA256
3fd806081fe8307b83277aa5a7b375574a86ee921d0e2159a562a6a80007468c

SHA512
81a483d5ea87241b1d79a0ed4ffb5e2bf8e02e39e622705ee4bcca2247916cdea4d7f240b44e8950a29fa7f08f5757dec5a80fea30b26117a340ddb92b9bfc58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30729.exe

Filesize
468KB

MD5
d012f027863a3092e505b761c47fa856

SHA1
144bede49f4f03620a52f361db9dff5ab69b4acf

SHA256
c9de047526dbdaec4aa81b5c97d55adcb24ac0cb5312d8aef6f0585f45fa6219

SHA512
79e73160112265bc793d20e4c27233e1fb724f7a7eb530f048ceddb3b1ea304f6dbfedc4e955a77901e44bad75e6a3fcbe4e131a19d1dbd65e137133187def65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32023.exe

Filesize
468KB

MD5
d87c02f7df8cb4e29649c93837e6dd13

SHA1
fc8d92809358a835014b8d13e100855cc05d2604

SHA256
13e53f8c386df495f092709c9172e5621b4bca1667879ef031688ab48325ad18

SHA512
4489f6d8e039debab05cd8cc3020e05fb3bc00e9609c367578adddb700a52310e29021ae2156ccf9c73cad4358fd74014bb6868d092742f4f12ee1aa25456f9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe

Filesize
468KB

MD5
39f02eef2a0e7afe7c0783f580fd40c6

SHA1
11d4032e803fd95538dcb2ea371e71c9436afe07

SHA256
2d5e4623c4bc07fe0f3b45a1a56785afd6f4e8963ec533ef22a82dbf80e82f02

SHA512
876b561487d45e8c1992c4d3bf4be814feffa507891f34c0665919b87d7108aa3c4666da9187b72d986968d842921131da08056155df6be057ac7653768e844e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe

Filesize
468KB

MD5
0a3a1d6446ad43419802caa167a78d6e

SHA1
4b3a3ab18d859cac28a23bfbf46f0436fe5d041d

SHA256
de17914d6569c22fbfb4fe72de7d31ce62b7e52b584c131bf7ba970137320a30

SHA512
a227dd0c184120f74c32b9f84d98c3867936979b692f73eac5e8239639892dd7ed5c07a4653160078c349206eb9391476fe1117b6a901f28410fa21fba9c3349

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe

Filesize
468KB

MD5
3248e3ae71ca4ab08cd001416d8629d8

SHA1
cbb3073ae9bae2c363b160079edde86ee0f163c4

SHA256
443568f1106f2e61af6e348c9215935f08454341d9d3d30e0d3fce95785e41c0

SHA512
cce7e4bfcf7cb1f0f91f08ea195f56429c1812ae4f2d512264df2f5ac1607a801a3df4f7233ac96b172881cebb230fc9f0ca5403b326ea2bf21409523ed7dd21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39318.exe

Filesize
468KB

MD5
ce61428a8f3a67f8993685ec05a2cb3b

SHA1
2a6e74aa1f01e5b8c34a46ba77585b51dce5be94

SHA256
bf01dcf5699339670b0988dd846088e46e8020c74675c02d7af3b9a211d61824

SHA512
73af6683746412d79485cb46d51e9a1dc18e1d4f9b96e8e49134bd06517b88b66b15319a60e38af2782a6ceba0d31510d59053721d8ba3b6b3ed4cec85dfbb93

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40352.exe

Filesize
468KB

MD5
8de747b6b8e877eb4a4ce86138ea91d9

SHA1
899271d8417af281d169c9eedf0d1f34d4c5a783

SHA256
1def1d9f677f74c60168b45bc02adaf21aba1bb56fc721769685dd0513b0b887

SHA512
e573ace2d42571df791ca37764e29f119ed57e9513758b94a6fa51dd69a970c9e7b4f4b539f5212096036f242616b508de98eee8a71ffc0e835e5eead96e01ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44047.exe

Filesize
468KB

MD5
d2f7347419172b8d4ff8373171a3cd77

SHA1
5880961e455e5700303196b002e2a482ec756cda

SHA256
56486385dedc7e7097bb061aab09a0c418dc787bd74713cf36ff6566108e7d92

SHA512
4e779c096b8b9ac88be7afbc044447d94592e9ab6b59c563ab9e33935307337b93423754ddc4bbf841b747983dde416f8662175e2b65955fa2481f524cd6a553

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44436.exe

Filesize
468KB

MD5
991349fd5719a54c2297b4ea8322b0d0

SHA1
adf9fe32583ddb9263f717e08e7594d64487eb51

SHA256
98e5d07fd4cd24cc7d0610c4c10f3c466066032b2323945a695dad6329b79233

SHA512
16a3489e2aaab4067c53ef5235e3522c5e2b7a76e7b33667871d1313d220f5d9d7ed2c6107b400a6a8d6d105715954da36a415bebef5d2a517e0f5a42c6eaafc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45183.exe

Filesize
468KB

MD5
07c0819a24c45249aea9d3a9a6ef5c86

SHA1
082279676ea67cd106b1eb282f44a325be19ad4f

SHA256
f470a7608f07e3fa703d83e1264e922154590fa65fd9f1d88c6440743dc7e6fc

SHA512
964ff061787b8717b9c3e2806adcf15e697ffd82f42bc803ccf1f4cf2997e7ce3e76c1fb41c034acaa03c29415abdb91934a1d74be702ff1a1ce1e85a8ca3bb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe

Filesize
468KB

MD5
04bbcaadd5b354d64ac87e541744d8a2

SHA1
2eee161c4bc92fcd361264944bf519ed39c1abcf

SHA256
6c86b3208281b63788181ca1a8341b7b9214191f4ad70b8bb15fa64c33a3e594

SHA512
e4304eac0ab772e6734d0520a034d814a4e1691cf67000038e9bbe6b1687ad3a2ab05694dcf2b9a3a6fe559bfd825cdfdcb73fbe48475ce0b09ea867714706d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe

Filesize
468KB

MD5
39a8c2ead2328a27ea5551fa55095eb0

SHA1
a053270161d0a6e85011208f3158b081b5a633a2

SHA256
5351318560167cc91f49c4f4905f1ae9ee22b9cb98c8748a9a5f3747dcfcb166

SHA512
7cde36cf645be78c338da7715e564b8c8836e66d8b0bde6bd488fbadb06818fe49232d402628ff3e4f4c2b753cdb7bc546b12949e63992293ccf133ade30162b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59983.exe

Filesize
468KB

MD5
ccc2d75de5d7f756239681bef5207d82

SHA1
d5ee56bf54deff1c3609cc642eb99e7b1929ca47

SHA256
3cf3cb55454d89e920c17f145d2ed28da3728de46cdaea94d35650012440b827

SHA512
9a4c2feba0430d00ae6b6af9ddb03934fdebd05224cd188f4f9d24b8432cdc6bcb46f34103b0174d991da782869179b134e715d6ae54c63569feb27d9be580a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61466.exe

Filesize
468KB

MD5
b51377eb15ac68b446ff51d1e04a410e

SHA1
069a9c78e03e91a8e4ee98e4f3c4baba4537e4ca

SHA256
77dd54a562a3985d395774f43ec47e95c7c137ba10e459381d5c866a98503fb2

SHA512
b75eef8ba2d04544e364914431e0f97ec39dafd659afddc3643bbc7bad4ac10619a3c2e80a994b9baa6221d87825e4bd215e4fa42803d094bfe376ba7c44f3a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65261.exe

Filesize
468KB

MD5
4d0e6bd9ff128d77de939b29e51e1b21

SHA1
c1f9b1677692f3cec898db108ae247e70da30826

SHA256
9afbd6ce2aca2286fea781d2705d0045ebb70e5782b97029605a88dbe89d67c6

SHA512
9314e6e82f9d99c55b4420799918e5cfba47a1e881afc62b4fa7668146d6ec48f91f19005fb525feb7f9d470333508eb7b1ad038e6db2076149d80341bec8c99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9713.exe

Filesize
468KB

MD5
84ec0689df1872acb2b07002cfbd9a84

SHA1
c00fb0598be4198a6560eabe348ef36be03c68a8

SHA256
9e4cce7088aee3f8a331989af6473df0fe3dc0d9c78268da6469cd9a649c57bf

SHA512
21589685cdbc3b24348383b2e719bbd60ae6ff7ca266a3baae85c96b23215c6cf78173dfb4dcdd5af0c2e385f60c8f68eae12541ac1ac19ddabecdca6cfec129

Download Submit
memory/1068-2515-0x0000000075CF0000-0x0000000075E90000-memory.dmp

Filesize
1.6MB

Download
memory/4464-2588-0x0000000076070000-0x00000000760E5000-memory.dmp

Filesize
468KB

Download
memory/4464-2587-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download