kawaiiunicorn | 0c46d6c93d7163a08e3d1aa5c70e18dac468ba6eace75c4bcd7d1bcc775b0e77

Analysis

max time kernel
26s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0c46d6c93d7163a08e3d1aa5c70e18dac468ba6eace75c4bcd7d1bcc775b0e77.exe
Size 468KB
Sample260903-sdk53azblh
SHA256 0c46d6c93d7163a08e3d1aa5c70e18dac468ba6eace75c4bcd7d1bcc775b0e77
MD5 39ccf1ad7fc55c2acfbb96afff60d7b6
SHA1 ede47d9c72e06c59308dc1edbe593fbc941b77c1
SHA512 c170185ae003b51d144782de72211d16a1c80a6a9e47962e228bb123959b516ee61ae040870b203ccdddfbdf4ff3fda64a281b6980297320dd2cea9f7b4c9100
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3EXgfGnt/lK:u4UoVzUnUPMZaf27kVG3qmGnt
TLSH
T1DAA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery kawaiiunicorn trojan

Malware Config

Signatures

Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
trojan kawaiiunicorn

Detects KawaiiUnicorn 64 IoCs

resource	yara_rule
behavioral1/memory/4896-0-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000600000001e4ea-5.dat	family_kawaiiunicorn
behavioral1/memory/4892-7-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000243a5-12.dat	family_kawaiiunicorn
behavioral1/memory/2952-14-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000243a6-15.dat	family_kawaiiunicorn
behavioral1/memory/1816-20-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000243ab-26.dat	family_kawaiiunicorn
behavioral1/files/0x00070000000243ac-37.dat	family_kawaiiunicorn
behavioral1/files/0x00070000000243ad-40.dat	family_kawaiiunicorn
behavioral1/memory/1624-45-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/3228-44-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/3196-43-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000243ae-42.dat	family_kawaiiunicorn
behavioral1/memory/436-28-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000f0000000243b8-54.dat	family_kawaiiunicorn
behavioral1/memory/3332-55-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000243b9-60.dat	family_kawaiiunicorn
behavioral1/memory/4304-63-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000243ba-68.dat	family_kawaiiunicorn
behavioral1/files/0x00070000000243bc-77.dat	family_kawaiiunicorn
behavioral1/memory/3012-76-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/1512-90-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000243bb-91.dat	family_kawaiiunicorn
behavioral1/memory/3804-89-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000243be-88.dat	family_kawaiiunicorn
behavioral1/memory/920-87-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/2020-84-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000243bd-83.dat	family_kawaiiunicorn
behavioral1/memory/1624-102-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000e0000000243c0-105.dat	family_kawaiiunicorn
behavioral1/memory/1016-107-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000f0000000243c1-115.dat	family_kawaiiunicorn
behavioral1/files/0x000b0000000243c2-114.dat	family_kawaiiunicorn
behavioral1/memory/1356-118-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/4720-117-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00090000000243c3-126.dat	family_kawaiiunicorn
behavioral1/memory/1104-128-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000b0000000243c4-133.dat	family_kawaiiunicorn
behavioral1/files/0x000b0000000243c5-138.dat	family_kawaiiunicorn
behavioral1/memory/2184-140-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/2448-137-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000b0000000243c6-144.dat	family_kawaiiunicorn
behavioral1/memory/2844-161-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000243ca-165.dat	family_kawaiiunicorn
behavioral1/memory/2564-162-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/4276-168-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00070000000243c9-160.dat	family_kawaiiunicorn
behavioral1/files/0x000b0000000243c7-156.dat	family_kawaiiunicorn
behavioral1/memory/1396-154-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000b0000000243c8-177.dat	family_kawaiiunicorn
behavioral1/memory/1760-180-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/920-182-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/3012-181-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/memory/2020-183-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00170000000243cb-186.dat	family_kawaiiunicorn
behavioral1/memory/2472-188-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00180000000243cc-194.dat	family_kawaiiunicorn
behavioral1/memory/2084-195-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000e0000000243cd-200.dat	family_kawaiiunicorn
behavioral1/memory/2596-202-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x00110000000243ce-207.dat	family_kawaiiunicorn
behavioral1/memory/5096-209-0x0000000000400000-0x0000000000475000-memory.dmp	family_kawaiiunicorn
behavioral1/files/0x000d0000000243cf-213.dat	family_kawaiiunicorn

Executes dropped EXE 42 IoCs

pid	Process
4892	Unicorn-54295.exe
2952	Unicorn-382.exe
1816	Unicorn-9105.exe
436	Unicorn-59671.exe
3196	Unicorn-2494.exe
3228	Unicorn-56334.exe
1624	Unicorn-8616.exe
3332	Unicorn-58815.exe
4304	Unicorn-6277.exe
3012	Unicorn-43439.exe
2020	Unicorn-52354.exe
920	Unicorn-6417.exe
1512	Unicorn-6682.exe
3804	Unicorn-552.exe
1016	Unicorn-8410.exe
4720	Unicorn-37191.exe
1356	Unicorn-17325.exe
1104	Unicorn-56681.exe
2448	Unicorn-9142.exe
2184	Unicorn-45826.exe
1396	Unicorn-42199.exe
2844	Unicorn-35545.exe
2564	Unicorn-54649.exe
4276	Unicorn-57449.exe
1760	Unicorn-43713.exe
2472	Unicorn-36911.exe
2084	Unicorn-21321.exe
2596	Unicorn-25811.exe
5096	Unicorn-17643.exe
2648	Unicorn-1669.exe
3720	Unicorn-21535.exe
3624	Unicorn-63335.exe
3548	Unicorn-55914.exe
752	Unicorn-4112.exe
3344	Unicorn-10242.exe
3520	Unicorn-21924.exe
5064	Unicorn-27325.exe
4592	Unicorn-48653.exe
4064	Unicorn-54518.exe
4888	Unicorn-24724.exe
628	Unicorn-29317.exe
4180	Unicorn-47575.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
3944	1624	WerFault.exe	99
4980	1624	WerFault.exe	99
4884	920	WerFault.exe	106
3160	3012	WerFault.exe	103
4748	2020	WerFault.exe	104
3992	2020	WerFault.exe	104
5108	3012	WerFault.exe	103
4956	920	WerFault.exe	106
4444	1396	WerFault.exe	119
1432	2184	WerFault.exe	118
3908	1760	WerFault.exe	125
4684	1104	WerFault.exe	116
388	1104	WerFault.exe	116
5108	2184	WerFault.exe	118
3992	1396	WerFault.exe	119
2988	1760	WerFault.exe	125
2764	752	WerFault.exe	144
1916	3196	WerFault.exe	97
2216	1016	WerFault.exe	113
3872	1640	WerFault.exe	165
5404	752	WerFault.exe	144
5432	1016	WerFault.exe	113
5452	3196	WerFault.exe	97
5464	1640	WerFault.exe	165
5884	816	WerFault.exe	199
5408	5108	WerFault.exe	203
5236	4272	WerFault.exe	190
6812	596	WerFault.exe	185
4016	5108	WerFault.exe	203
6880	4272	WerFault.exe	190
7092	5696	WerFault.exe	249
740	596	WerFault.exe	185
1084	5752	WerFault.exe	250
2132	5496	WerFault.exe	244
9252	5972	WerFault.exe	256
10048	1756	WerFault.exe	204
8464	6732	WerFault.exe	390
4952	4180	WerFault.exe	164
7768	4424	WerFault.exe	263
6940	4180	WerFault.exe	164
11088	5152	WerFault.exe	269
10960	6704	WerFault.exe	401
4928	5480	WerFault.exe	243
4308	5872	WerFault.exe	254
9700	3776	WerFault.exe	178
10468	2676	WerFault.exe	183
2456	3236	WerFault.exe	200
6216	5504	WerFault.exe	245
8940	6048	WerFault.exe	260
9032	5772	WerFault.exe	251
2440	5932	WerFault.exe	255
8368	4424	WerFault.exe	263
8092	5968	WerFault.exe	285
9704	4884	WerFault.exe	307
5276	7000	WerFault.exe	365
1200	2644	WerFault.exe	366
11968	3812	WerFault.exe	232
11868	4320	WerFault.exe	367
11860	6196	WerFault.exe	348
12164	7816	WerFault.exe	434
12248	5912	WerFault.exe	310
12220	7192	WerFault.exe	416
12156	4028	WerFault.exe	392
12148	8036	WerFault.exe	443

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21924.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c46d6c93d7163a08e3d1aa5c70e18dac468ba6eace75c4bcd7d1bcc775b0e77.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42199.exe

Suspicious use of SetWindowsHookEx 42 IoCs

pid	Process
4896	0c46d6c93d7163a08e3d1aa5c70e18dac468ba6eace75c4bcd7d1bcc775b0e77.exe
4892	Unicorn-54295.exe
2952	Unicorn-382.exe
1816	Unicorn-9105.exe
436	Unicorn-59671.exe
3196	Unicorn-2494.exe
3228	Unicorn-56334.exe
1624	Unicorn-8616.exe
3332	Unicorn-58815.exe
4304	Unicorn-6277.exe
3804	Unicorn-552.exe
2020	Unicorn-52354.exe
3012	Unicorn-43439.exe
1512	Unicorn-6682.exe
920	Unicorn-6417.exe
1016	Unicorn-8410.exe
1356	Unicorn-17325.exe
4720	Unicorn-37191.exe
1104	Unicorn-56681.exe
2448	Unicorn-9142.exe
2184	Unicorn-45826.exe
1396	Unicorn-42199.exe
4276	Unicorn-57449.exe
2564	Unicorn-54649.exe
2844	Unicorn-35545.exe
1760	Unicorn-43713.exe
2472	Unicorn-36911.exe
2084	Unicorn-21321.exe
2596	Unicorn-25811.exe
5096	Unicorn-17643.exe
3720	Unicorn-21535.exe
3624	Unicorn-63335.exe
2648	Unicorn-1669.exe
3548	Unicorn-55914.exe
5064	Unicorn-27325.exe
3520	Unicorn-21924.exe
752	Unicorn-4112.exe
3344	Unicorn-10242.exe
4592	Unicorn-48653.exe
4888	Unicorn-24724.exe
628	Unicorn-29317.exe
4064	Unicorn-54518.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4892	4896	0c46d6c93d7163a08e3d1aa5c70e18dac468ba6eace75c4bcd7d1bcc775b0e77.exe	88
PID 4892 wrote to memory of 2952	4892	Unicorn-54295.exe	91
PID 4896 wrote to memory of 1816	4896	0c46d6c93d7163a08e3d1aa5c70e18dac468ba6eace75c4bcd7d1bcc775b0e77.exe	92
PID 2952 wrote to memory of 436	2952	Unicorn-382.exe	96
PID 4892 wrote to memory of 3228	4892	Unicorn-54295.exe	98
PID 1816 wrote to memory of 3196	1816	Unicorn-9105.exe	97
PID 4896 wrote to memory of 1624	4896	0c46d6c93d7163a08e3d1aa5c70e18dac468ba6eace75c4bcd7d1bcc775b0e77.exe	99
PID 436 wrote to memory of 3332	436	Unicorn-59671.exe	101
PID 2952 wrote to memory of 4304	2952	Unicorn-382.exe	102
PID 3196 wrote to memory of 3012	3196	Unicorn-2494.exe	103
PID 1816 wrote to memory of 2020	1816	Unicorn-9105.exe	104
PID 4896 wrote to memory of 920	4896	0c46d6c93d7163a08e3d1aa5c70e18dac468ba6eace75c4bcd7d1bcc775b0e77.exe	106
PID 4892 wrote to memory of 3804	4892	Unicorn-54295.exe	105
PID 3228 wrote to memory of 1512	3228	Unicorn-56334.exe	107
PID 3332 wrote to memory of 1016	3332	Unicorn-58815.exe	113
PID 436 wrote to memory of 1356	436	Unicorn-59671.exe	115
PID 4304 wrote to memory of 4720	4304	Unicorn-6277.exe	114
PID 2952 wrote to memory of 1104	2952	Unicorn-382.exe	116
PID 3804 wrote to memory of 2448	3804	Unicorn-552.exe	117
PID 4892 wrote to memory of 2184	4892	Unicorn-54295.exe	118
PID 1512 wrote to memory of 1396	1512	Unicorn-6682.exe	119
PID 3196 wrote to memory of 2844	3196	Unicorn-2494.exe	120
PID 4896 wrote to memory of 2564	4896	0c46d6c93d7163a08e3d1aa5c70e18dac468ba6eace75c4bcd7d1bcc775b0e77.exe	121
PID 1816 wrote to memory of 4276	1816	Unicorn-9105.exe	124
PID 3228 wrote to memory of 1760	3228	Unicorn-56334.exe	125
PID 1016 wrote to memory of 2472	1016	Unicorn-8410.exe	136
PID 3332 wrote to memory of 2084	3332	Unicorn-58815.exe	137
PID 1356 wrote to memory of 2596	1356	Unicorn-17325.exe	138
PID 4720 wrote to memory of 5096	4720	Unicorn-37191.exe	139
PID 2844 wrote to memory of 3720	2844	Unicorn-35545.exe	141
PID 4304 wrote to memory of 2648	4304	Unicorn-6277.exe	140
PID 2448 wrote to memory of 3624	2448	Unicorn-9142.exe	143
PID 1512 wrote to memory of 3548	1512	Unicorn-6682.exe	145
PID 4276 wrote to memory of 3344	4276	Unicorn-57449.exe	146
PID 436 wrote to memory of 752	436	Unicorn-59671.exe	144
PID 4892 wrote to memory of 3520	4892	Unicorn-54295.exe	147
PID 3804 wrote to memory of 5064	3804	Unicorn-552.exe	151
PID 3196 wrote to memory of 4592	3196	Unicorn-2494.exe	152
PID 1816 wrote to memory of 4064	1816	Unicorn-9105.exe	154
PID 3228 wrote to memory of 4888	3228	Unicorn-56334.exe	148
PID 4896 wrote to memory of 628	4896	0c46d6c93d7163a08e3d1aa5c70e18dac468ba6eace75c4bcd7d1bcc775b0e77.exe	153
PID 2472 wrote to memory of 4180	2472	Unicorn-36911.exe	164

C:\Users\Admin\AppData\Local\Temp\0c46d6c93d7163a08e3d1aa5c70e18dac468ba6eace75c4bcd7d1bcc775b0e77.exe
"C:\Users\Admin\AppData\Local\Temp\0c46d6c93d7163a08e3d1aa5c70e18dac468ba6eace75c4bcd7d1bcc775b0e77.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54295.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54295.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59671.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58815.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8410.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36911.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47575.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
        9⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
        10⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41403.exe
        11⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3266.exe
        12⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57151.exe
        13⤵
        
        PID:12896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        13⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
        12⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        13⤵
        
        PID:14384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19936.exe
        12⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
        12⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        11⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6444 -s 628
        12⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6444 -s 628
        12⤵
        
        PID:14048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 752
        11⤵
        Program crash
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54594.exe
        10⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63094.exe
        9⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9882.exe
        10⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16531.exe
        11⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6696 -s 632
        11⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59794.exe
        10⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8676 -s 636
        11⤵
        
        PID:15124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27032.exe
        10⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34147.exe
        11⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60586.exe
        10⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
        9⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7192 -s 636
        10⤵
        Program crash
        
        PID:12220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 744
        9⤵
        Program crash
        
        PID:6940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 744
        9⤵
        Program crash
        
        PID:4952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 788
        9⤵
        
        PID:14812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6913.exe
        8⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
        9⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43375.exe
        10⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33095.exe
        11⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe
        12⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        12⤵
        
        PID:14728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 656
        10⤵
        Program crash
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49358.exe
        9⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25415.exe
        10⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
        11⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6796 -s 672
        10⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44801.exe
        9⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
        10⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26969.exe
        10⤵
        
        PID:15204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 660
        9⤵
        Program crash
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15848.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
        8⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36131.exe
        9⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51531.exe
        10⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exe
        10⤵
        
        PID:15152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 664
        9⤵
        Program crash
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51513.exe
        8⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5838.exe
        9⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe
        8⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48839.exe
        8⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        8⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36897.exe
        7⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 636
        8⤵
        Program crash
        
        PID:3872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 636
        8⤵
        Program crash
        
        PID:5464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 740
        7⤵
        Program crash
        
        PID:2216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 740
        7⤵
        Program crash
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12222.exe
        7⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7510.exe
        8⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
        9⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37703.exe
        10⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6732 -s 636
        11⤵
        Program crash
        
        PID:8464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5152 -s 652
        10⤵
        Program crash
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31433.exe
        9⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 644
        10⤵
        Program crash
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
        9⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8524 -s 636
        10⤵
        
        PID:14460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32898.exe
        9⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23524.exe
        9⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1065.exe
        8⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63743.exe
        9⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7816 -s 636
        10⤵
        Program crash
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53182.exe
        7⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        8⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58507.exe
        9⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44211.exe
        10⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        11⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 632
        10⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20349.exe
        9⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20883.exe
        10⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57209.exe
        9⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62366.exe
        9⤵
        
        PID:11648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32512.exe
        9⤵
        
        PID:14608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23196.exe
        6⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48927.exe
        7⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38589.exe
        7⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13006.exe
        8⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38797.exe
        8⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6844 -s 640
        9⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38133.exe
        8⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19169.exe
        8⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41413.exe
        8⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10680.exe
        7⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        8⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15277.exe
        8⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7629.exe
        6⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52643.exe
        7⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53655.exe
        8⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56743.exe
        9⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8860 -s 640
        10⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7000 -s 636
        9⤵
        Program crash
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
        8⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31111.exe
        9⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14141.exe
        9⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34557.exe
        7⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38051.exe
        8⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36347.exe
        9⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 668
        8⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
        7⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8776 -s 636
        8⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63074.exe
        7⤵
        
        PID:10384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
        8⤵
        
        PID:13448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49617.exe
        7⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exe
        7⤵
        
        PID:14532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4024.exe
        6⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12726.exe
        7⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49883.exe
        8⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        9⤵
        
        PID:15024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41089.exe
        8⤵
        
        PID:13732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 628
        7⤵
        Program crash
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17325.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12798.exe
        7⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52243.exe
        8⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
        9⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51107.exe
        10⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3230.exe
        11⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        11⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 640
        10⤵
        Program crash
        
        PID:8368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 640
        10⤵
        Program crash
        
        PID:7768
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 640
        10⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13753.exe
        9⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33583.exe
        10⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8608 -s 644
        11⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        10⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1244.exe
        10⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38594.exe
        10⤵
        
        PID:15292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30421.exe
        8⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9498.exe
        9⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48575.exe
        10⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53835.exe
        11⤵
        
        PID:13272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43473.exe
        10⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        10⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36902.exe
        10⤵
        
        PID:14508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58921.exe
        8⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30667.exe
        9⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        9⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        9⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54698.exe
        8⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23848.exe
        8⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59698.exe
        8⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60007.exe
        8⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40545.exe
        7⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
        8⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35309.exe
        6⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
        7⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26337.exe
        7⤵
        
        PID:616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47245.exe
        7⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8036 -s 640
        8⤵
        Program crash
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        7⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44811.exe
        8⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43509.exe
        7⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19153.exe
        7⤵
        
        PID:13712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44489.exe
        6⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44091.exe
        7⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
        6⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42555.exe
        7⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32343.exe
        8⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe
        9⤵
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6473.exe
        8⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8400.exe
        8⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55710.exe
        7⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12854.exe
        8⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6004 -s 640
        7⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23256.exe
        6⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7176 -s 644
        7⤵
        
        PID:12132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24378.exe
        6⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47256.exe
        6⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32757.exe
        6⤵
        
        PID:14352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4112.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:752
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 636
        6⤵
        Program crash
        
        PID:2764
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 636
        6⤵
        Program crash
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
        5⤵
        
        PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12000.exe
        5⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
        5⤵
        
        PID:8028
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8028 -s 636
        6⤵
        
        PID:12092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe
        5⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26887.exe
        6⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35720.exe
        5⤵
        
        PID:10724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25113.exe
        5⤵
        
        PID:13680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6277.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37191.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17643.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16307.exe
        7⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64879.exe
        8⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42207.exe
        9⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20023.exe
        10⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22151.exe
        11⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7952 -s 632
        12⤵
        
        PID:12044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19389.exe
        10⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2226.exe
        11⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55646.exe
        11⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65185.exe
        10⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16133.exe
        10⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47505.exe
        10⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20385.exe
        9⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54003.exe
        10⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19923.exe
        11⤵
        
        PID:13740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        11⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        10⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21280.exe
        10⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55122.exe
        10⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        9⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7728 -s 636
        10⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53946.exe
        9⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60177.exe
        9⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30969.exe
        9⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exe
        8⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        8⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45171.exe
        9⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6864 -s 660
        9⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58398.exe
        8⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        9⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35332.exe
        8⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59506.exe
        8⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41943.exe
        8⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3405.exe
        7⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        8⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        9⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16759.exe
        10⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6414.exe
        11⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        11⤵
        
        PID:14768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
        10⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        10⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12589.exe
        10⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        9⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 648
        10⤵
        
        PID:14228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 648
        10⤵
        
        PID:15328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 660
        9⤵
        Program crash
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29151.exe
        8⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61190.exe
        8⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7566.exe
        9⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12169.exe
        9⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 676
        8⤵
        Program crash
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28694.exe
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12970.exe
        8⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59507.exe
        9⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17301.exe
        9⤵
        
        PID:14540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 652
        8⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35368.exe
        7⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8824 -s 632
        8⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33789.exe
        7⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
        7⤵
        
        PID:11692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11512.exe
        7⤵
        
        PID:14616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50494.exe
        6⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
        7⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        8⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
        9⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63679.exe
        10⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 628
        10⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        9⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53377.exe
        9⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64786.exe
        8⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        9⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15329.exe
        9⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44213.exe
        9⤵
        
        PID:15016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe
        8⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3741.exe
        8⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48709.exe
        8⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        7⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10436.exe
        7⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        8⤵
        
        PID:13252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 672
        7⤵
        Program crash
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1669.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47007.exe
        6⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50619.exe
        7⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50723.exe
        9⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31959.exe
        10⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 660
        10⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11781.exe
        8⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        9⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6976 -s 648
        9⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21943.exe
        8⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 636
        9⤵
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59986.exe
        8⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32559.exe
        9⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2720.exe
        8⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2205.exe
        8⤵
        
        PID:11444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19269.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46845.exe
        6⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57599.exe
        7⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10882.exe
        8⤵
        
        PID:12712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
        6⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26915.exe
        7⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        7⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65296.exe
        6⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48161.exe
        6⤵
        
        PID:8
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
        6⤵
        
        PID:13996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45537.exe
        5⤵
        
        PID:452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31491.exe
        6⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29727.exe
        7⤵
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57038.exe
        5⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10266.exe
        6⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6494.exe
        7⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7076 -s 640
        7⤵
        
        PID:15068
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 636
        6⤵
        Program crash
        
        PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51845.exe
        5⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58627.exe
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16481.exe
        6⤵
        
        PID:12564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36041.exe
        5⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5418.exe
        6⤵
        
        PID:14832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51763.exe
        5⤵
        
        PID:10420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33800.exe
        5⤵
        
        PID:12700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1104
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 636
        5⤵
        Program crash
        
        PID:4684
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 676
        5⤵
        Program crash
        
        PID:388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56334.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1396
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 632
        6⤵
        Program crash
        
        PID:4444
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 632
        6⤵
        Program crash
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55914.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51667.exe
        6⤵
        
        PID:456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
        7⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe
        8⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 636
        8⤵
        Program crash
        
        PID:9252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20648.exe
        5⤵
        
        PID:5108
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 636
        6⤵
        Program crash
        
        PID:5408
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 636
        6⤵
        Program crash
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50022.exe
        5⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44445.exe
        5⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16827.exe
        6⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe
        7⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53046.exe
        6⤵
        
        PID:13104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62277.exe
        6⤵
        
        PID:13568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4137.exe
        5⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10982.exe
        5⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5404.exe
        5⤵
        
        PID:13784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43713.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1760
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 632
        5⤵
        Program crash
        
        PID:3908
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 632
        5⤵
        Program crash
        
        PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24724.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43499.exe
        5⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2902.exe
        6⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54807.exe
        7⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6712 -s 640
        8⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
        7⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59647.exe
        8⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64173.exe
        7⤵
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe
        7⤵
        
        PID:13164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29928.exe
        7⤵
        
        PID:15320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
        5⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9690.exe
        6⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6704 -s 636
        7⤵
        Program crash
        
        PID:10960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe
      4⤵
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exe
        5⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
        6⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6862.exe
        7⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59779.exe
        8⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7408 -s 656
        8⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
        6⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63399.exe
        7⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        7⤵
        
        PID:14776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28236.exe
        6⤵
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56974.exe
        6⤵
        
        PID:11620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34292.exe
        6⤵
        
        PID:13724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4049.exe
        5⤵
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13790.exe
        6⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 636
        7⤵
        
        PID:13540
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 648
        5⤵
        Program crash
        
        PID:10048
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 664
        5⤵
        
        PID:15120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13048.exe
      4⤵
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36549.exe
      4⤵
      PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29499.exe
        5⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40623.exe
        6⤵
        
        PID:13228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        6⤵
        
        PID:15284
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 632
        5⤵
        Program crash
        
        PID:11868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7118.exe
      4⤵
      PID:8228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8228 -s 636
        5⤵
        
        PID:10664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65313.exe
      4⤵
      PID:10232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33841.exe
      4⤵
      PID:11708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
      4⤵
      PID:13920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-552.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9142.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25819.exe
        6⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63063.exe
        7⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        8⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19795.exe
        9⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8720 -s 636
        10⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14885.exe
        9⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52647.exe
        10⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7044 -s 664
        9⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20053.exe
        8⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13814.exe
        9⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58526.exe
        9⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2559.exe
        8⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54286.exe
        8⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe
        8⤵
        
        PID:13604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39269.exe
        7⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15030.exe
        8⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62719.exe
        9⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30181.exe
        9⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6613.exe
        8⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        9⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
        8⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9709.exe
        8⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43493.exe
        7⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 640
        8⤵
        
        PID:13148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 672
        7⤵
        Program crash
        
        PID:10468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
        6⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48175.exe
        7⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54423.exe
        8⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63302.exe
        8⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9172 -s 640
        9⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1952.exe
        8⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60394.exe
        8⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22689.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36427.exe
        8⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
        9⤵
        
        PID:14292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 664
        8⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 664
        8⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe
        7⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40727.exe
        8⤵
        
        PID:14320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 668
        7⤵
        Program crash
        
        PID:11968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27909.exe
        5⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35383.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56011.exe
        7⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23775.exe
        8⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5542.exe
        9⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7400 -s 640
        9⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63546.exe
        7⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7600 -s 632
        8⤵
        
        PID:12724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7600 -s 632
        8⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5932 -s 668
        7⤵
        Program crash
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26389.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        7⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42765.exe
        7⤵
        
        PID:1084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63633.exe
        6⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
        7⤵
        
        PID:12904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        6⤵
        
        PID:10704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18480.exe
        6⤵
        
        PID:12752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21753.exe
        6⤵
        
        PID:15060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19268.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26795.exe
        6⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17595.exe
        7⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57322.exe
        7⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9737.exe
        6⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60519.exe
        7⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13252.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60114.exe
        6⤵
        
        PID:13652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        5⤵
        
        PID:7492
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7492 -s 636
        6⤵
        
        PID:12068
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7492 -s 636
        6⤵
        
        PID:12348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21319.exe
        6⤵
        
        PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37445.exe
        5⤵
        
        PID:11388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1574.exe
        5⤵
        
        PID:13608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27325.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        5⤵
        
        PID:596
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 636
        6⤵
        Program crash
        
        PID:740
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 636
        6⤵
        Program crash
        
        PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
        5⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54645.exe
        5⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        6⤵
        
        PID:11256
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7468 -s 628
        6⤵
        
        PID:9484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51479.exe
        6⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17408.exe
        5⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
        5⤵
        
        PID:12928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41069.exe
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
      4⤵
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24024.exe
      4⤵
      PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24699.exe
        5⤵
        
        PID:10188
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7508 -s 632
        5⤵
        
        PID:6168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45826.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2184
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 632
      4⤵
      Program crash
      PID:1432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 676
      4⤵
      Program crash
      PID:5108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21924.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35331.exe
      4⤵
      PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54267.exe
        5⤵
        
        PID:5696
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5696 -s 636
        6⤵
        Program crash
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21537.exe
        5⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-718.exe
        6⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe
        7⤵
        
        PID:13456
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 668
        6⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54313.exe
        5⤵
        
        PID:8388
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8388 -s 636
        6⤵
        
        PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51014.exe
        5⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28656.exe
        5⤵
        
        PID:11908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22801.exe
        5⤵
        
        PID:13512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
      4⤵
      PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44785.exe
      4⤵
      PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15763.exe
        5⤵
        
        PID:180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34095.exe
        6⤵
        
        PID:13976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55874.exe
        5⤵
        
        PID:11328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3844.exe
        5⤵
        
        PID:13632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9773.exe
      4⤵
      PID:6656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24232.exe
      4⤵
      PID:11108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15157.exe
      4⤵
      PID:12876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38435.exe
      4⤵
      PID:15184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1313.exe
    3⤵
    PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47827.exe
      4⤵
      PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18051.exe
        5⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28119.exe
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25801.exe
        6⤵
        
        PID:12808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63338.exe
      4⤵
      PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
      4⤵
      PID:9200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe
        5⤵
        
        PID:13388
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 672
      4⤵
      PID:11456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25359.exe
    3⤵
    PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2290.exe
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29655.exe
        5⤵
        
        PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8313.exe
        5⤵
        
        PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        5⤵
        
        PID:14344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59410.exe
      4⤵
      PID:8868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55237.exe
      4⤵
      PID:7412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5416 -s 668
      4⤵
      PID:13844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34928.exe
    3⤵
    PID:7328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39795.exe
      4⤵
      PID:10476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55594.exe
      4⤵
      PID:12532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
    3⤵
    PID:8384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60810.exe
    3⤵
    PID:9400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
    3⤵
    PID:13772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9105.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9105.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2494.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3012
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 636
        5⤵
        Program crash
        
        PID:3160
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 636
        5⤵
        Program crash
        
        PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21535.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42731.exe
        6⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20723.exe
        7⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26824.exe
        7⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25763.exe
        8⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        8⤵
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41613.exe
        8⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
        7⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56721.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34913.exe
        7⤵
        
        PID:13672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63618.exe
        6⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43109.exe
        7⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 636
        8⤵
        
        PID:12444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7992.exe
        7⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe
        7⤵
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16316.exe
        7⤵
        
        PID:12844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14800.exe
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19425.exe
        6⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33851.exe
        7⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62610.exe
        7⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17548.exe
        6⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39993.exe
        6⤵
        
        PID:8928
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 692
        6⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60582.exe
        5⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35575.exe
        6⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        5⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64594.exe
        5⤵
        
        PID:7836
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7836 -s 640
        6⤵
        
        PID:12140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48653.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        5⤵
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
        6⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35871.exe
        7⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27859.exe
        8⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33931.exe
        9⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 636
        9⤵
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10697.exe
        8⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63413.exe
        8⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57374.exe
        8⤵
        
        PID:14016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64350.exe
        6⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11330.exe
        7⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6780 -s 636
        8⤵
        
        PID:12080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60753.exe
        6⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 636
        7⤵
        
        PID:14236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 636
        7⤵
        
        PID:14820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34102.exe
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48309.exe
        6⤵
        
        PID:11596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17757.exe
        6⤵
        
        PID:13708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63042.exe
        5⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44091.exe
        6⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16811.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe
        8⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe
        8⤵
        
        PID:13800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18605.exe
        6⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3318.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38769.exe
        7⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44109.exe
        7⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40073.exe
        5⤵
        
        PID:1284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37615.exe
        6⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5342.exe
        7⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12397.exe
        7⤵
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        6⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17759.exe
        7⤵
        
        PID:10868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42225.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56030.exe
        6⤵
        
        PID:13664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53110.exe
        5⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21679.exe
        6⤵
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65298.exe
        6⤵
        
        PID:13172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32728.exe
        6⤵
        
        PID:15300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32732.exe
        5⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30063.exe
        6⤵
        
        PID:8416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-305.exe
        5⤵
        
        PID:11336
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 624
      4⤵
      Program crash
      PID:1916
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 624
      4⤵
      Program crash
      PID:5452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52354.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 636
      4⤵
      Program crash
      PID:4748
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 636
      4⤵
      Program crash
      PID:3992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10242.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6550.exe
        5⤵
        
        PID:4272
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 636
        6⤵
        Program crash
        
        PID:5236
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 636
        6⤵
        Program crash
        
        PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10997.exe
      4⤵
      PID:388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63971.exe
        5⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        6⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22831.exe
        7⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43866.exe
        7⤵
        
        PID:12824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
        6⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2138.exe
        7⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        7⤵
        
        PID:14752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35008.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36082.exe
        6⤵
        
        PID:12632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38449.exe
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36427.exe
        6⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
        7⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        7⤵
        
        PID:14744
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6336 -s 636
        6⤵
        
        PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52533.exe
        5⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15735.exe
        6⤵
        
        PID:10216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48082.exe
        5⤵
        
        PID:10804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10504.exe
        5⤵
        
        PID:12568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24877.exe
        5⤵
        
        PID:14968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54518.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47775.exe
      4⤵
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
        5⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22187.exe
        6⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-230.exe
        7⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9922.exe
        8⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        8⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50535.exe
        8⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21368.exe
        7⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
        7⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
        6⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 636
        7⤵
        
        PID:13968
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 604
        6⤵
        Program crash
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45274.exe
        5⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50111.exe
        6⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47779.exe
        7⤵
        
        PID:11024
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6196 -s 668
        6⤵
        Program crash
        
        PID:11860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe
        5⤵
        
        PID:7480
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7480 -s 636
        6⤵
        
        PID:13520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5513.exe
        5⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
        6⤵
        
        PID:14580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7468.exe
        5⤵
        
        PID:11672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63566.exe
      4⤵
      PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61055.exe
        5⤵
        
        PID:6644
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 648
        5⤵
        Program crash
        
        PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39549.exe
      4⤵
      PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13546.exe
        5⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37987.exe
        6⤵
        
        PID:11700
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 668
        5⤵
        
        PID:11772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60178.exe
      4⤵
      PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
        5⤵
        
        PID:12792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2849.exe
        5⤵
        
        PID:15112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4440.exe
      4⤵
      PID:7960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36015.exe
        5⤵
        
        PID:13988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
      4⤵
      PID:11716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
      4⤵
      PID:14012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17848.exe
    3⤵
    PID:1808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61002.exe
    3⤵
    PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47023.exe
      4⤵
      PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51611.exe
        5⤵
        
        PID:10564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56118.exe
        5⤵
        
        PID:13180
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 636
      4⤵
      Program crash
      PID:9704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24554.exe
    3⤵
    PID:7536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63731.exe
      4⤵
      PID:9440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11732.exe
    3⤵
    PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23763.exe
      4⤵
      PID:14172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56041.exe
    3⤵
    PID:6736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18981.exe
    3⤵
    PID:14228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55002.exe
    3⤵
    PID:12892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8616.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8616.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 640
    3⤵
    - Program crash
    PID:3944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 640
    3⤵
    - Program crash
    PID:4980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6417.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6417.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 640
    3⤵
    - Program crash
    PID:4884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 628
    3⤵
    - Program crash
    PID:4956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35331.exe
    3⤵
    PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4106.exe
      4⤵
      PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13338.exe
        5⤵
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5798.exe
        6⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9426.exe
        7⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        7⤵
        
        PID:12932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12321.exe
        5⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13510.exe
        6⤵
        
        PID:10824
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7200 -s 628
        6⤵
        
        PID:14428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        5⤵
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35275.exe
        6⤵
        
        PID:10260
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8884 -s 632
        6⤵
        
        PID:15044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40874.exe
        5⤵
        
        PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36736.exe
        5⤵
        
        PID:12728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50866.exe
        5⤵
        
        PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23021.exe
      4⤵
      PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        5⤵
        
        PID:7236
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7236 -s 608
        6⤵
        
        PID:12036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14677.exe
        5⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50955.exe
        6⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        6⤵
        
        PID:14736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42985.exe
        5⤵
        
        PID:11240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23638.exe
        5⤵
        
        PID:13196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23700.exe
      4⤵
      PID:7652
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7652 -s 544
        5⤵
        
        PID:12124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
    3⤵
    PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52119.exe
      4⤵
      PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45835.exe
        5⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55563.exe
        6⤵
        
        PID:11688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54522.exe
        5⤵
        
        PID:11176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        5⤵
        
        PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50718.exe
      4⤵
      PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12034.exe
        5⤵
        
        PID:12320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 672
      4⤵
      Program crash
      PID:9032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39549.exe
    3⤵
    PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44299.exe
      4⤵
      PID:8836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
      4⤵
      PID:10364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24980.exe
      4⤵
      PID:12296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38018.exe
      4⤵
      PID:14868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
    3⤵
    PID:8216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26451.exe
      4⤵
      PID:11572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
      4⤵
      PID:14720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62385.exe
    3⤵
    PID:10164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11318.exe
      4⤵
      PID:13592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56470.exe
    3⤵
    PID:11656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1850.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1850.exe
  2⤵
  PID:816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 636
    3⤵
    - Program crash
    PID:5884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24440.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24440.exe
  2⤵
  PID:5040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34829.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34829.exe
  2⤵
  PID:8008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58627.exe
    3⤵
    PID:10524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8008 -s 668
    3⤵
    PID:14160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
  2⤵
  PID:2740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6849.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6849.exe
  2⤵
  PID:10624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33153.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33153.exe
  2⤵
  PID:13636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1624 -ip 1624
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1624 -ip 1624
1⤵
PID:2468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 920 -ip 920
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3012 -ip 3012
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2020 -ip 2020
1⤵
PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 920 -ip 920
1⤵
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2020 -ip 2020
1⤵
PID:2936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3012 -ip 3012
1⤵
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1104 -ip 1104
1⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1396 -ip 1396
1⤵
PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1760 -ip 1760
1⤵
PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2564 -ip 2564
1⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2184 -ip 2184
1⤵
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2952 -ip 2952
1⤵
PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2564 -ip 2564
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2952 -ip 2952
1⤵
PID:596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1104 -ip 1104
1⤵
PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2184 -ip 2184
1⤵
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1396 -ip 1396
1⤵
PID:548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1760 -ip 1760
1⤵
PID:816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 752 -ip 752
1⤵
PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1640 -ip 1640
1⤵
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1016 -ip 1016
1⤵
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 3196 -ip 3196
1⤵
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4720 -ip 4720
1⤵
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4720 -ip 4720
1⤵
PID:5280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 752 -ip 752
1⤵
PID:5340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3196 -ip 3196
1⤵
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1016 -ip 1016
1⤵
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1640 -ip 1640
1⤵
PID:5376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 596 -ip 596
1⤵
PID:6008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 816 -ip 816
1⤵
PID:5192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2520 -ip 2520
1⤵
PID:5244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4272 -ip 4272
1⤵
PID:1156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5108 -ip 5108
1⤵
PID:5364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1124 -ip 1124
1⤵
PID:5684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4476 -ip 4476
1⤵
PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2644 -ip 2644
1⤵
PID:6024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1808 -ip 1808
1⤵
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5084 -ip 5084
1⤵
PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1216 -ip 1216
1⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3548 -ip 3548
1⤵
PID:6196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3344 -ip 3344
1⤵
PID:6240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4276 -ip 4276
1⤵
PID:6248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2520 -ip 2520
1⤵
PID:6356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 2596 -ip 2596
1⤵
PID:6384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 3624 -ip 3624
1⤵
PID:6440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 2084 -ip 2084
1⤵
PID:6600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1124 -ip 1124
1⤵
PID:6720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4476 -ip 4476
1⤵
PID:6780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 2644 -ip 2644
1⤵
PID:6808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 1808 -ip 1808
1⤵
PID:6876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3548 -ip 3548
1⤵
PID:6944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 1216 -ip 1216
1⤵
PID:6952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4276 -ip 4276
1⤵
PID:7028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5084 -ip 5084
1⤵
PID:7080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3344 -ip 3344
1⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2596 -ip 2596
1⤵
PID:5240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 3624 -ip 3624
1⤵
PID:6140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2084 -ip 2084
1⤵
PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 596 -ip 596
1⤵
PID:6528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5108 -ip 5108
1⤵
PID:6748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4272 -ip 4272
1⤵
PID:6252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5696 -ip 5696
1⤵
PID:6844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4584 -ip 4584
1⤵
PID:6604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5784 -ip 5784
1⤵
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 816 -ip 816
1⤵
PID:6840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5792 -ip 5792
1⤵
PID:5860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 4584 -ip 4584
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 5784 -ip 5784
1⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 452 -ip 452
1⤵
PID:5204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5792 -ip 5792
1⤵
PID:6620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 456 -ip 456
1⤵
PID:7036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 2504 -ip 2504
1⤵
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 1608 -ip 1608
1⤵
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 1444 -ip 1444
1⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2404 -ip 2404
1⤵
PID:7268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1628 -ip 1628
1⤵
PID:7380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1688 -ip 1688
1⤵
PID:7572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6080 -ip 6080
1⤵
PID:7756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6032 -ip 6032
1⤵
PID:7900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5492 -ip 5492
1⤵
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 452 -ip 452
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5676 -ip 5676
1⤵
PID:7088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5040 -ip 5040
1⤵
PID:6392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5144 -ip 5144
1⤵
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5384 -ip 5384
1⤵
PID:7700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5624 -ip 5624
1⤵
PID:7476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 616 -ip 616
1⤵
PID:7676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 5180 -ip 5180
1⤵
PID:7864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 5472 -ip 5472
1⤵
PID:7880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 5276 -ip 5276
1⤵
PID:7988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 5192 -ip 5192
1⤵
PID:8180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 456 -ip 456
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3332 -ip 3332
1⤵
PID:6272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 2504 -ip 2504
1⤵
PID:7900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 2936 -ip 2936
1⤵
PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 4724 -ip 4724
1⤵
PID:7216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4888 -ip 4888
1⤵
PID:7872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 5296 -ip 5296
1⤵
PID:8176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 6032 -ip 6032
1⤵
PID:8368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 2404 -ip 2404
1⤵
PID:8456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 4996 -ip 4996
1⤵
PID:8572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 5676 -ip 5676
1⤵
PID:8632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5040 -ip 5040
1⤵
PID:8692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 6080 -ip 6080
1⤵
PID:8880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 5492 -ip 5492
1⤵
PID:8996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 1628 -ip 1628
1⤵
PID:9088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 1444 -ip 1444
1⤵
PID:9116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 1608 -ip 1608
1⤵
PID:9124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5752 -ip 5752
1⤵
PID:7960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 1688 -ip 1688
1⤵
PID:8344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5472 -ip 5472
1⤵
PID:8548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6288 -ip 6288
1⤵
PID:8744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5384 -ip 5384
1⤵
PID:8664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 616 -ip 616
1⤵
PID:8092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5180 -ip 5180
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 5144 -ip 5144
1⤵
PID:9000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5496 -ip 5496
1⤵
PID:8624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5624 -ip 5624
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5276 -ip 5276
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5192 -ip 5192
1⤵
PID:9004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5972 -ip 5972
1⤵
PID:9196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1756 -ip 1756
1⤵
PID:7060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3332 -ip 3332
1⤵
PID:7960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 2936 -ip 2936
1⤵
PID:9952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4724 -ip 4724
1⤵
PID:10064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 4888 -ip 4888
1⤵
PID:10120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5892 -ip 5892
1⤵
PID:10176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5296 -ip 5296
1⤵
PID:10200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 4996 -ip 4996
1⤵
PID:10236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 6064 -ip 6064
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5152 -ip 5152
1⤵
PID:5788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3908 -ip 3908
1⤵
PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 2268 -ip 2268
1⤵
PID:844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 5200 -ip 5200
1⤵
PID:6812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 7024 -ip 7024
1⤵
PID:8560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6732 -ip 6732
1⤵
PID:5980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 4328 -ip 4328
1⤵
PID:9964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 6592 -ip 6592
1⤵
PID:8024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 4336 -ip 4336
1⤵
PID:6776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 6644 -ip 6644
1⤵
PID:9296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5884 -ip 5884
1⤵
PID:8832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5728 -ip 5728
1⤵
PID:5372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5984 -ip 5984
1⤵
PID:7412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5548 -ip 5548
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 2444 -ip 2444
1⤵
PID:6344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1468 -ip 1468
1⤵
PID:10120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4884 -ip 4884
1⤵
PID:6232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 1184 -ip 1184
1⤵
PID:10236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5968 -ip 5968
1⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 4424 -ip 4424
1⤵
PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4180 -ip 4180
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6288 -ip 6288
1⤵
PID:9112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 5476 -ip 5476
1⤵
PID:7904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3804 -ip 3804
1⤵
PID:7772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4600 -ip 4600
1⤵
PID:5900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2844 -ip 2844
1⤵
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5912 -ip 5912
1⤵
PID:7448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 5628 -ip 5628
1⤵
PID:6176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5512 -ip 5512
1⤵
PID:5192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4772 -ip 4772
1⤵
PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 6680 -ip 6680
1⤵
PID:7060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 5536 -ip 5536
1⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 6852 -ip 6852
1⤵
PID:10308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 6704 -ip 6704
1⤵
PID:10524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5892 -ip 5892
1⤵
PID:10620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 6064 -ip 6064
1⤵
PID:10648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5152 -ip 5152
1⤵
PID:10752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 3908 -ip 3908
1⤵
PID:10868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 7024 -ip 7024
1⤵
PID:10924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5200 -ip 5200
1⤵
PID:10984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2268 -ip 2268
1⤵
PID:11004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4328 -ip 4328
1⤵
PID:11012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 6592 -ip 6592
1⤵
PID:11020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1044 -p 4336 -ip 4336
1⤵
PID:11028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 6644 -ip 6644
1⤵
PID:10208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1112 -p 5884 -ip 5884
1⤵
PID:10496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5984 -ip 5984
1⤵
PID:8744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1140 -p 5728 -ip 5728
1⤵
PID:10560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5548 -ip 5548
1⤵
PID:10624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1136 -p 2444 -ip 2444
1⤵
PID:10996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1468 -ip 1468
1⤵
PID:10924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1104 -p 1184 -ip 1184
1⤵
PID:10984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1120 -p 6664 -ip 6664
1⤵
PID:10208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 760 -ip 760
1⤵
PID:11016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 5248 -ip 5248
1⤵
PID:10848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 1916 -ip 1916
1⤵
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1136 -p 7052 -ip 7052
1⤵
PID:7260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 5772 -ip 5772
1⤵
PID:6180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1104 -p 5932 -ip 5932
1⤵
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6048 -ip 6048
1⤵
PID:8708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 5480 -ip 5480
1⤵
PID:11232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 5504 -ip 5504
1⤵
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3236 -ip 3236
1⤵
PID:6908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 2676 -ip 2676
1⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3776 -ip 3776
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1116 -p 5872 -ip 5872
1⤵
PID:10076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1136 -p 5696 -ip 5696
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5476 -ip 5476
1⤵
PID:11128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 3804 -ip 3804
1⤵
PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1140 -p 4600 -ip 4600
1⤵
PID:8560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5912 -ip 5912
1⤵
PID:7260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1128 -p 2844 -ip 2844
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5628 -ip 5628
1⤵
PID:11400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5512 -ip 5512
1⤵
PID:11552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 7000 -ip 7000
1⤵
PID:11836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 2644 -ip 2644
1⤵
PID:11976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4772 -ip 4772
1⤵
PID:12212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1100 -p 3116 -ip 3116
1⤵
PID:11104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6680 -ip 6680
1⤵
PID:9412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5536 -ip 5536
1⤵
PID:9432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1048 -p 3972 -ip 3972
1⤵
PID:5700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4444 -ip 4444
1⤵
PID:9696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 6796 -ip 6796
1⤵
PID:11684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5800 -ip 5800
1⤵
PID:11400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5960 -ip 5960
1⤵
PID:12340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 6852 -ip 6852
1⤵
PID:12456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 6196 -ip 6196
1⤵
PID:12656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4320 -ip 4320
1⤵
PID:12664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 6004 -ip 6004
1⤵
PID:12940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1104 -p 3812 -ip 3812
1⤵
PID:13036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 7236 -ip 7236
1⤵
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 7952 -ip 7952
1⤵
PID:12304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 7492 -ip 7492
1⤵
PID:13188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 6780 -ip 6780
1⤵
PID:9412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1096 -p 8028 -ip 8028
1⤵
PID:6500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 6712 -ip 6712
1⤵
PID:12912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1104 -p 3348 -ip 3348
1⤵
PID:5488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 7652 -ip 7652
1⤵
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 7836 -ip 7836
1⤵
PID:6012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 7176 -ip 7176
1⤵
PID:12592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 8036 -ip 8036
1⤵
PID:10172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4028 -ip 4028
1⤵
PID:12768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 7816 -ip 7816
1⤵
PID:13384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1100 -p 7192 -ip 7192
1⤵
PID:13512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 6688 -ip 6688
1⤵
PID:13968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1124 -p 6864 -ip 6864
1⤵
PID:13984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5716 -ip 5716
1⤵
PID:14080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6336 -ip 6336
1⤵
PID:14184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1112 -p 5388 -ip 5388
1⤵
PID:6264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 3220 -ip 3220
1⤵
PID:5760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6664 -ip 6664
1⤵
PID:11056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 760 -ip 760
1⤵
PID:9280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 1916 -ip 1916
1⤵
PID:13692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1184 -p 5248 -ip 5248
1⤵
PID:13484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1212 -p 7052 -ip 7052
1⤵
PID:12768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1216 -p 7600 -ip 7600
1⤵
PID:11148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5084 -ip 5084
1⤵
PID:13440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1240 -p 6444 -ip 6444
1⤵
PID:13316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 6696 -ip 6696
1⤵
PID:14284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 7508 -ip 7508
1⤵
PID:13560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1244 -p 7480 -ip 7480
1⤵
PID:6376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1088 -p 7348 -ip 7348
1⤵
PID:10960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1200 -p 7044 -ip 7044
1⤵
PID:6280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1244 -p 3872 -ip 3872
1⤵
PID:14380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 7728 -ip 7728
1⤵
PID:14464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 4084 -ip 4084
1⤵
PID:14668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4404 -ip 4404
1⤵
PID:15096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 8388 -ip 8388
1⤵
PID:6512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1224 -p 7468 -ip 7468
1⤵
PID:15012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1236 -p 8720 -ip 8720
1⤵
PID:6428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 4592 -ip 4592
1⤵
PID:5192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-11806.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
Size 468KB
SHA256 2743f181a8dd1d331aed02fd82191f29ee42c5db58603bac7b24cd6b03bc8684
MD5 a0ff8f848adeb7bf68223c74d5d73c4a
SHA1 24e558a5820688ad43bf21d62506b02d71d42f0a
SHA512 19b87606526d6d74894d59bbe39323298c67e1a9a55cd266b730273a72a4d1e57de11cbddd6ffcd79902ffaaccd0cca2aaf03b683c779f11abea6712b24d4e65
SSDEEP 3072:+4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4oYaEXJVInt/l1:+4UoVzUnUPMZaf27kLYaq3Int
TLSH
T193A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-14501.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
Size 468KB
SHA256 d2d475016d22ebce5fe74d4c24bfdb2d3280cc53fe5f9d1efeefb82c4621c588
MD5 faffd2f7fc20fc1a968b28412df0e01e
SHA1 e74981ce6f541d7b80d98cfe37f14787fd8d772b
SHA512 c007609d4b90c4ec2a12b5d67927059cc7a51ca09f512c7688b0b36ae45076c9e2f653132bef488623c8c5fccca470a41e83adf5589628505476a7d5794a92df
SSDEEP 3072:94Q/oKZPTIK8Un7/YPb4ZaXiJkw0SxhvtNH4IU4WqnEXgCInt/l1:94UoVzUnUPMZaX27kVqnqzInt
TLSH
T14BA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-1669.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1669.exe
Size 468KB
SHA256 69a8a9d674b798ae2be311d33dd57d70d12088cc2a42ed8d1d4b9721b1ac7554
MD5 9f93dbf71e39968567c4d1dc7691c859
SHA1 4b5720decec5d29229fabad5836b691d76cd282e
SHA512 a42c0e11c580376c53986a3555861866f56c7233ac97e48e3933cf7f2640ef84bc9e0c226a77c1ac00a5f1b87979a19d47be471c598fa5f13910dc939246a734
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4oGaEXgfInt/l1:u4UoVzUnUPMZaf27kLGaqmInt
TLSH
T196A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-17325.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-17325.exe
Size 468KB
SHA256 ad8b4ed582c0926f456ee595e1dbe1683fa2ffc849abfbde47be14fe2a7a765a
MD5 c7f2cd109af66fa85e385139a0b1a57a
SHA1 b94f98287e10f52461f802be86533bcd34889993
SHA512 4d4e2f3f28f27c506ce611c00b26690b005d6e4e8a8094bc43613087f9b311e92f6097e401608cdc6e6ceee0907fe4518d8e27deac4290963154f200d581b230
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3EXgUIntDl1:u4UoVzUnUPMZaf27kVG3qhInt
TLSH
T160A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-17643.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-17643.exe
Size 468KB
SHA256 fdb372590e34bd5256cba9d89b1c9f5c7912f080904928596387f7e6a745feec
MD5 4fb813b8814a959e508d1283389fc367
SHA1 0483ee31cb22e3ca8a42d352660e5c59ddfa883f
SHA512 c6b7d1f1ef1262ece924a0fff5724f3eb3bfea47d70eb643376caa1d0a041c3f3150827c489aac3eee593353acab1298d526f07586609449552edd06dc051837
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZaXiJkw0SxhvtNH4IU4WGnEXgfInt/l1:u4UoVzUnUPMZaX27kVGnqmInt
TLSH
T1E5A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-21321.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
Size 468KB
SHA256 a349d3bbd6e15802d7a1754f2abb2f87c01b013e6c365e19188d4bc51710fa95
MD5 d16a9a9b86bdd3cb2e7a9983d154c852
SHA1 9e131c75b5a1ca2c5debb6ae4737041ead065b4a
SHA512 79c6a4fd6cc284673de8c3218c784a3609d2247bb16363647d85b8b83b1767e9d06d05c024115074458b70d1bd85450e3e206424b407524320f9a4d12c698d66
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3EXgfUn8Dl1:u4UoVzUnUPMZaf27kVG3qmUn8
TLSH
T14DA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-21535.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21535.exe
Size 468KB
SHA256 ae315af95a47ec1c7df1070b2f84b245d4f11816e643d79f30eb6087f64d4d81
MD5 d60fad6af850199aed2357c1c09c3d59
SHA1 27a3d69b7bc86e63436780ea93517b693e542e32
SHA512 f8719f450b3e275d312db90aac8e15c15e82802ae9df3f6e26691c19373c1aad640ff0ae1a21e502ec3f7f9599ddf266f0d51650e77fddd63736522d1b4d331e
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw05xhvtNH4IU4WG3uXgfGnt/lh:u4UoVzUnUPMZaft7kVG3AmGnt
TLSH
T18DA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-2494.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2494.exe
Size 468KB
SHA256 6bd651593d384fa2460144c901ad6a9ce37e0b933c9cfe95feb720800a6081c3
MD5 f818920ca6edbeef97c2882c30ad747a
SHA1 2c36ccbd02563acb9c404ce3c285f4f4eb4a000f
SHA512 d2208587dd104f373cf3161592907495aac2058c521d816bf79c50f8938c0a04d41244e424eae682788949876f956a94c3d6aa15c592d154a4d80d91dc1c4b8f
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3uXgfGnt/lx:u4UoVzUnUPMZaf27kVG3AmGnt
TLSH
T1C7A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-25811.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
Size 468KB
SHA256 8ed0f8901aac41ac15c0bd380946ba66bdcc35b3021b184d7d55121b68a16e78
MD5 6db603589c9edf7cc9cdcf85d8225a7d
SHA1 23660117e1ec9a8ca7f509453a3dcd186d582aeb
SHA512 0a2efa90e702c9c91a507078b917300893ae8b5ef62d604d794e7db82c2985646cf3a8efe96d2d552f7a897f58d7c32496c88507fc7b34c0e383b80510695817
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4qG3EXgUIntDl1:u4UoVzUnUPMZaf27k5G3qhInt
TLSH
T169A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-35545.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
Size 468KB
SHA256 f22b5f265031f6abb12638488a8036282ef591ce21c241311b8dbcbcac23ecf4
MD5 027a74ca80f74e8f68fef4eccbae698d
SHA1 516c0ee660fe2e552f8f8545a96042b6a08a01db
SHA512 4750ef9c156903c64a184c2dc02c25a2a652fe56ab3a9ee4a9cd3a28a25d66e3214c749891e0c42d61bcc61aeb2c2bb928ca38338b7540fb24c0303c591efffb
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3uXgfGnt/lh:u4UoVzUnUPMZaf27kVG3AmGnt
TLSH
T131A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-36911.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-36911.exe
Size 468KB
SHA256 e19543f7f6919c44767b70620ac6524983cca3e22680e7d343229482d700481a
MD5 944fb2b8f40e774f08fd72a88473b78f
SHA1 5352ee0b818688d4e75e5e2a0918375cbeb00380
SHA512 93bd12433d474df890f8dd17820fdf11527e817afa89ad96562280de170613d5782c0578de5faaa7364823d742eeef81acc45fb5604ee501475c78ff743be162
SSDEEP 3072:u4QWoKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG8EXgfIn8Dl1:u4doVzUnUPMZaf27kVG8qmIn8
TLSH
T14BA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37191.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37191.exe
Size 468KB
SHA256 e46e80bcfa6ecbc919fb59c42e8762412b7bbee95b42c7759716663163abf3bf
MD5 1f5c5396339fd5fbf03e9838292f0663
SHA1 905e1064a9b1f85a92e5f46c16873d1521cd5685
SHA512 4136b33bbf467c8248be361347aaac37997e6ed3356d9762cac0f226bd19df6f775c936947f5a413f5ea527e97bf61e9cf530bf7b05a3bd963b7c6f022a93e13
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WGnEXgfInt/l1:u4UoVzUnUPMZaf27kVGnqmInt
TLSH
T10CA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-382.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
Size 468KB
SHA256 239b8d45754adefc1e85c05e733e08c01a78b5fc18a3ebba94991fa760390e87
MD5 f6cc5c015f03ac37911f35138b96bff0
SHA1 e83cd6446210d3384b6e88e8dd43cdad04426981
SHA512 ae8755c6bfafc719fb8291f567c14b2872f5dd79b6bbeb997d17f0ca1f09b3fabb78c5fd3975e13045d4ed7b70aa501bcde737eeeeda0ad9b773d3d9386e84e6
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3EXgfInt/l1:u4UoVzUnUPMZaf27kVG3qmInt
TLSH
T137A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42199.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
Size 468KB
SHA256 e4be761cc01809a7110f63241fc5d85aa3201981ef48ac96444295cb2d923da2
MD5 eed04ada4f11f9c305d189fcfd222a43
SHA1 b0032a17075f0eaf67390aec94bc566a886108ac
SHA512 35cb75d3bbeb7f04b509056df36688c086ee6156673dd6f43355f06b9ad343f48f8dbb8599173c47a492842437af3b4076c2147537dcf4d9107522beb5484bcb
SSDEEP 3072:uNQ/oKZPTIK8Un7/YPb4ZafiJkw0wxhvtNH4IU4WG3hIXgfInt/lK:uNUoVzUnUPMZafM7kVG3h2mInt
TLSH
T18EA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-43439.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
Size 468KB
SHA256 fd4e34a789922fe4024ede1da5c40d9b68a4535f89af28e972d48896db6be640
MD5 cd62312ea944d6951b67b3aaa61f6cb8
SHA1 8148bcca65b66254178cd450b5ed5115c962c351
SHA512 e6e6c7d8936a142d354966184f398fa7b451e797e3854fab9662eb86db385414b4840f532dfaf3d77122f9cc8b779207bf4a68e94145934fa24776938d2b8f8f
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3uJgfGnt/lx:u4UoVzUnUPMZaf27kVG36mGnt
TLSH
T114A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-43713.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43713.exe
Size 468KB
SHA256 e8cd7c636069ce1c8d906b8005cf6dccabe0ce3ddbe1c84d6b1f380f02764b7c
MD5 3b2f20495d7d96621232fee73ea78826
SHA1 20b56627fdce03e3e6e7e018bda39e2c735e2388
SHA512 8b7a45c066822288625cbd444c29da6d3c8eecc4a54315b3f2f6b63c86a9fbd544f72bf524bc775f4cb94e0554995794939125817256d1e8af06ebdf07a93bf1
SSDEEP 3072:u4Q5oKZPTIK8Un7/YPb4ZafiJkw0wxhvtNH4IU4WG3EXgfInt/lK:u4eoVzUnUPMZafM7kVG3qmInt
TLSH
T10AA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45826.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45826.exe
Size 468KB
SHA256 8881eab5e3b29ff51839965866fd1f2ffc3477f7a0ae38899fe5227a35b13f15
MD5 e4dcc4e37136c58f4730c8e01571a848
SHA1 a4eb439bf11381bf89db4960be4ad073f27fa843
SHA512 53feae9d2c6159269a738383d7a1dc36d9a3c6aac25c474e189980a1394a75ebb9619d089519140a53fd046576281333860dc59e7b5bd558192d986a26870109
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3EXgfInt/lL:u4UoVzUnUPMZaf27kVG3qmInt
TLSH
T165A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-46394.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46394.exe
Size 320KB
SHA256 367d44a469483bfb7d954efa0a2204031f9c106bb98e735f83bae2bd016236b6
MD5 a265d2553e632df73af64a70b8f3bc11
SHA1 aa93cbbf6f511154f08bdfa2a9d82a48c5c74a14
SHA512 6ac899227ae5366ab047c07819efc8953c00b240fb9c0d189ab3b8bc2392ee0332d27ae65058bcafb7195dbe0625a5e5eea2c30e6deccd34869010811e61aebc
SSDEEP 3072:f4Q/oKZPTIK8Un7/YPbDZafiJkw0SxhvtNH4IU4WG3EXg:f4UoVzUnUPPZaf27kVG3q
TLSH
T16E64A4928C60AF86FE16493423A56EBA404E7D2F66E4021CB85DD94B3353D9B34AFD07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-47634.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
Size 468KB
SHA256 8fea956336a572f8499d42a9a2a95bff554a600e24297e2fdd3aa2d60b33eef4
MD5 c50270a5b5fef5c23a061c1b7fa68fb0
SHA1 a1bd55fcec6f29fe7251676e217200ed2872fabb
SHA512 0b3538adebdd0517b85f25ece624afcf94cfc8d4157005a70f5c68bf43ef1769e67eb2502133056ca96836745a9df725987950471957888a51439a2bfb669a2b
SSDEEP 3072:a4Q/oKZPTIK8Un7/YPb4ZOfiJkw0SxhvtNH4IU4Wh3EXgfGnt/lK:a4UoVzUnUPMZOf27kVh3qmGnt
TLSH
T17DA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-52354.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52354.exe
Size 468KB
SHA256 1ed6a35fae98b5968cd2e7f879755d944c39e31eeb0a31c68d8185d9e0ece447
MD5 68ff5aab3edffc517544c8f18bdd5f43
SHA1 54a22ae0cc709f842a43bc4c59271d4db351314e
SHA512 dc11ff596b701694c5e5e1bb2869e5d359db8bbf228d3f8ed60effb249dca80b03c106b6b7357fd85cb9669c48572c8e4ccb6c3c92dac372dc1a366800155a8f
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafPJkw0SxhvtNH4IU4WG3uXgfGnt/lK:u4UoVzUnUPMZafn7kVG3AmGnt
TLSH
T11CA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-54295.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54295.exe
Size 468KB
SHA256 57fb871fd0faaa175cb00e8daa8c94cea91c132ed47981f443e8d684377fab1f
MD5 961db796127ec849dbb8fcdf2eee7c12
SHA1 220ff8727a6ab90307b5958fdb094c78b3f739a7
SHA512 9573eeeff8555cc01327266b03e126e77a2d3a26d8cee64fe30557ba476c9846edebd75ad7037260a166bd7bfaaba0c21e91ef73ba649ca830b5cb7212fcd828
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3EXgfInt/lK:u4UoVzUnUPMZaf27kVG3qmInt
TLSH
T179A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-54649.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
Size 468KB
SHA256 81cd40fe6a648733642402eacbcbb420782d5529959e44d16090b55759091bc4
MD5 dbcd58d30bf84ee2a632f4b14f272de6
SHA1 c67e2d45fcfcd6911eb857533b4d4a79f6ab6d2c
SHA512 211af7029520eec3d9966e788d0d1480b8038424dba989f32284789729390edd73b40cfef9c43670dd09850beb90b64e6f78861bbf83410444f2a14a99691845
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3EXgfGntrlK:u4UoVzUnUPMZaf27kVG3qmGnt
TLSH
T151A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-552.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-552.exe
Size 468KB
SHA256 0c0045b771e23988d60f0e15095eea71bc8537f0e3820088f4469c0a18a83ba1
MD5 ced90f162f0b593d3bb424941a1dd3ac
SHA1 93d5fb54b46c693c0c63ea963606c3a5546618bd
SHA512 681fecc1bac0104629d7f86b8bd669e39e217354c306e90ddd54f059f9408c298f3494aba389cd9b501b7a541f045d5b92962eb594856e94e086adfd7810e796
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3EXgfInt9lK:u4UoVzUnUPMZaf27kVG3qmInt
TLSH
T1B4A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-56334.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56334.exe
Size 468KB
SHA256 be572bb63e4b45156b6b4cfb2675b5fb8d98c144e88f350f7837acdfca3d7012
MD5 f9b3d492aa641e58dcac435987d20594
SHA1 7c7a67bf4d49531cb3d929e9c357f1a3a377a471
SHA512 3206687bacd80f6e9612054e12aaeee974a18e7959f02a5e490a8ce5296c310d4d9f73d173db9caaf18765cc1a7b75e984f1af53e225492829db8168734a2a73
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0wxhvtNH4IU4WG3EXgfInt/lK:u4UoVzUnUPMZafM7kVG3qmInt
TLSH
T125A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-56681.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
Size 468KB
SHA256 b4ab47184622958b810714b2bd28722dce0e98fa3af012a82915a21ce5d00f47
MD5 a88e9766bf988fdc90ee10a3abd047ad
SHA1 39535fea3ad8ae6b4eda083016c8674d49082423
SHA512 109c252ed390626d5360ae68ec0af64771e8a1614b9c910645e080a4b71cc19e3b5ed606187bdddb27339df53a6406077f70cb7d09f0190e6dc7482ce0aad4ae
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3EXgxInt/l1:u4UoVzUnUPMZaf27kVG3q4Int
TLSH
T1BEA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-57449.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
Size 468KB
SHA256 dc1a4e60880f6c682290c6119ec99c3ce8f82f07cef0b8eb0a6726ec5932e043
MD5 95112f1d62c9b9c194ec4523c85c48a2
SHA1 6f4fc00bf0643339a7b3ecdcd08624df446eb9ba
SHA512 82e5007b507b5391110afc0a107f634aa12412e25a063dae1202af52e6b79b61daf33e793d6d2fc93d77873f429b23db4f4bc6fc1b2935060f766cd590d4a01f
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3uXgfXnt/lK:u4UoVzUnUPMZaf27kVG3AmXnt
TLSH
T1BFA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-58815.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-58815.exe
Size 468KB
SHA256 3c8bc185e19eb0d4717aeb2954036113c856805691f1c1c8bf854c05ef8e6462
MD5 5e9e2a78482e3a1bbeb73bcf581bfb6b
SHA1 fb27bc8542d8c6e19de6ef11ecfa1ce6ff93a841
SHA512 d052921a0d70f96ce4dae7734131b7ed02a39003595b9937039fe6f4b15308ab53e36cb8b939f798433582df3a17540ad5fb1ea4e243a9bb7943da6fe3fcadf0
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3EXgfIn8Dl1:u4UoVzUnUPMZaf27kVG3qmIn8
TLSH
T176A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59671.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59671.exe
Size 468KB
SHA256 226e192a2f8a7d9389f861e449796c9073abd4b8e283ba4d9e8946bcf2856c5e
MD5 13de362103b65740c96b247a00754a24
SHA1 36ed1ab6295b8e8353f39dd1a24c851300877010
SHA512 42b186befc8940b903c36d8ca480422bc27f11825217277b58316f0f6491effd806b9942b881a0a67b1653ecb6307c79596320512824bf325fbdbf43fec84491
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3EXgfIntDl1:u4UoVzUnUPMZaf27kVG3qmInt
TLSH
T193A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-6277.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6277.exe
Size 468KB
SHA256 029dfb75b4e7016ca1df14e34834a8a05cbd3e7437268a4e0de2acc6ef2e4d40
MD5 557c6411d3b0be3b812dc3018fe49572
SHA1 ea3be1835059b7b58b336fa2633a5f916a67db1d
SHA512 1ee392b9dd91c0b0cffd5264f4a4fceb5fa263b3594bb30aae8c943fce6dcbe7a1a2be12c210036ffca6088d9090a2f6d44d0fa205091925cee04a69e3037fcc
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WGaEXgfInt/l1:u4UoVzUnUPMZaf27kVGaqmInt
TLSH
T1E0A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-6417.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6417.exe
Size 468KB
SHA256 b1e24fe41a1fffe73ec4f839281026a35325174e6068b254b894a785e694026f
MD5 ef3fa01fd8992d105a03522823cd0a76
SHA1 864bacfa3056d4681c314fb4e51998ca4e934bd7
SHA512 b52f9632c4d20761905a998a2747d8aa84b1b28d5fda76fee13699d5b652620e21ee41fbfc16dd2dba2523aafce6aa9ff0483acbd462eab647be72a99909c3bd
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtWH4IU4WG3EXgfGnt/lK:u4UoVzUnUPMZaf27NVG3qmGnt
TLSH
T14FA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-6682.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
Size 468KB
SHA256 ba91500c4b54f3cc788c5170ab67a1798de71d666d31834001b2db213d11415a
MD5 b746fddae816864d6d3cf5d50ee090a3
SHA1 43e20c5619264b4c5c774a7bfc9ddf5091c95ebc
SHA512 f67b364c0b67105b441c8c3b7c3952ea3750c15e701eb325238cdce83e2062707738d9816eea326e7892f364510ce5798fb5df75abd883384e5d7d26cb2e07b4
SSDEEP 3072:uNQ/oKZPTIK8Un7/YPb4ZafiJkw0wxhvtNH4IU4WG3EXgfInt/lK:uNUoVzUnUPMZafM7kVG3qmInt
TLSH
T1F1A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-8410.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8410.exe
Size 468KB
SHA256 9896a0c018d45e107723c9ca5411b6c3bf153919dad30c0dd31c86515cdf6e20
MD5 f708fc1058517db295f1bfdeafb3eecb
SHA1 ceef884ebe44a672893947e115aa38b1d3db0fa9
SHA512 b50e68bb293943d35376058132f6f2de47f5c3a11dce575edb379dba7961021266cd817193e503c43ee3388df7d5b21ab0b81a5dcfd3dedc411a82eea425fb41
SSDEEP 3072:u4QWoKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3EXgfIn8Dl1:u4doVzUnUPMZaf27kVG3qmIn8
TLSH
T169A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-8616.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8616.exe
Size 468KB
SHA256 c7a3d7a76561bb97651f7cb722f16b1339ed7efab818b25d420c04616999f5d6
MD5 383c00fa0372422d5eb596c529498ee5
SHA1 6255d562cbf11f3071b955822e04fc642578e3c3
SHA512 6e3e2c3e4e75d7ed491808167b0c281e14754dc6d5a1b2cf7e8beadeebd230861d6b4436c48b567c049e8a7d64b5a0ba829f53a3070a5df41c226fb233bf0e04
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3EXgfGnt/lX:u4UoVzUnUPMZaf27kVG3qmGnt
TLSH
T16DA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-9105.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9105.exe
Size 468KB
SHA256 907ff9ac647e35927571b253f03ee871346f845ab1d6a4316f9cbccfd8297983
MD5 42dad1142842dbc65a6701fad92c6404
SHA1 b62e8eff4265fac9130b1e27edc2e7f982b397a1
SHA512 73c8e7447e06a40fb8cd07c7044d863ed30c60e8a75d8e6dc5f4a5caf2987f991e2bcf4ac469bbdbb8a4df21da51b170b2b54f730fe52f2b8bc8b1953f98d9ea
SSDEEP 3072:u4Q/oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3uXgfGnt/lK:u4UoVzUnUPMZaf27kVG3AmGnt
TLSH
T14FA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-9142.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9142.exe
Size 468KB
SHA256 4b59943cf79c59cdb63ad2923808e30fe20254a126496098b2e69f55bf6b1060
MD5 8be6fc33425d11a19219bb5cbc534cae
SHA1 7a225e5563053053c635afd88aa6d12f89a4398f
SHA512 443e514d5c79fd02884cb81cc18e841ceec893ba4902a069750974a8cc79a1ab0b9e20a4b5e7accef73c5ca9da944f1ceb8a2f4b995870575c0a93a6d000cc93
SSDEEP 3072:u4Q7oKZPTIK8Un7/YPb4ZafiJkw0SxhvtNH4IU4WG3EXgfInt9lK:u4goVzUnUPMZaf27kVG3qmInt
TLSH
T1B0A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/388-423-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/388-2844-0x0000000075D10000-0x0000000075DCF000-memory.dmp

Download

memory/436-28-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/452-373-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/456-364-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/596-360-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/628-272-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/752-253-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/816-420-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/892-327-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/920-87-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/920-182-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/928-521-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1016-107-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1104-311-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1104-128-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1124-424-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1216-522-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1356-118-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1396-154-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1396-321-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1444-446-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1512-90-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1608-398-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1624-102-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1624-45-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1628-524-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1640-290-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1652-511-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1756-426-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1760-180-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1760-314-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1808-442-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1816-3142-0x00007FF925AF0000-0x00007FF925CE5000-memory.dmp

Download

memory/1816-20-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1892-2843-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1892-298-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1952-375-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1968-405-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2020-84-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2020-183-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2084-195-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2184-140-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2184-309-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2268-455-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2404-457-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2436-305-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2448-137-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2472-188-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2504-384-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2520-510-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2564-279-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2564-162-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2596-202-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2644-520-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2648-222-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2676-338-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2844-161-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2936-297-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2952-14-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2952-278-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3012-76-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3012-181-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3116-441-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3196-43-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3228-44-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3236-440-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3332-55-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3344-254-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3520-256-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3548-252-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3624-227-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3720-225-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3776-318-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3804-89-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3908-435-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4064-261-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4180-287-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4272-374-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4276-168-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4304-63-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4392-336-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4476-403-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4512-443-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4584-453-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4592-260-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4600-406-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4712-428-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4720-117-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4724-328-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4732-382-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4772-312-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4888-267-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4892-7-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4896-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4996-523-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5064-266-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5096-209-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5108-425-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/10076-3000-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/16208-3126-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads