3e39b760289d18662e9abc58045ed5f813ca76f4083bc36116fb29233aed4287

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3e39b760289d18662e9abc58045ed5f813ca76f4083bc36116fb29233aed4287.exe
Size 184KB
Sample260910-r2pygsdm81
SHA256 3e39b760289d18662e9abc58045ed5f813ca76f4083bc36116fb29233aed4287
MD5 e500fd07465450dcfda3f7fdd96ebf50
SHA1 2dbc771cebfa94d397479d8013bbdcc40d9671f4
SHA512 2e827ee0b042431f6b14b5084bb8a4bfef79007093db0443ad137946f202cd806af389b4b481a2484a844f15368539ad5c54dfc9f9ef6747c56c7ed503af17d2
SSDEEP 3072:9EdjVAo5LRUskx6eFXhoHy7HL3vMqzviuq:9EkoAJ6eAHMHL3Eqzviu
TLSH
T115048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 61 IoCs

pid	Process
3356	Unicorn-53675.exe
3388	Unicorn-11246.exe
2348	Unicorn-48750.exe
4688	Unicorn-55699.exe
2100	Unicorn-47339.exe
2508	Unicorn-15221.exe
3512	Unicorn-24872.exe
4412	Unicorn-37967.exe
4176	Unicorn-33883.exe
1104	Unicorn-59326.exe
756	Unicorn-9570.exe
3192	Unicorn-56725.exe
556	Unicorn-62590.exe
1264	Unicorn-20849.exe
1244	Unicorn-40715.exe
1332	Unicorn-14164.exe
4828	Unicorn-11364.exe
732	Unicorn-20029.exe
3700	Unicorn-429.exe
2728	Unicorn-48255.exe
4596	Unicorn-39703.exe
1476	Unicorn-19283.exe
5100	Unicorn-32089.exe
1080	Unicorn-51955.exe
4416	Unicorn-31462.exe
3152	Unicorn-6261.exe
1864	Unicorn-13344.exe
3544	Unicorn-19475.exe
3028	Unicorn-59553.exe
4944	Unicorn-18619.exe
920	Unicorn-15281.exe
1708	Unicorn-52059.exe
848	Unicorn-31831.exe
4276	Unicorn-11410.exe
4196	Unicorn-28301.exe
4212	Unicorn-24217.exe
1428	Unicorn-31255.exe
432	Unicorn-31255.exe
3828	Unicorn-14918.exe
4904	Unicorn-14918.exe
2052	Unicorn-53713.exe
1368	Unicorn-42745.exe
864	Unicorn-51410.exe
4448	Unicorn-22125.exe
588	Unicorn-39191.exe
2720	Unicorn-4586.exe
2584	Unicorn-38005.exe
800	Unicorn-24623.exe
2704	Unicorn-10324.exe
2832	Unicorn-886.exe
2116	Unicorn-46003.exe
412	Unicorn-18375.exe
3056	Unicorn-30819.exe
4208	Unicorn-59407.exe
4580	Unicorn-35457.exe
1436	Unicorn-35457.exe
748	Unicorn-31373.exe
3876	Unicorn-44533.exe
1868	Unicorn-25264.exe
4320	Unicorn-64067.exe
1236	Unicorn-64067.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
1760	2348	WerFault.exe	89
212	2508	WerFault.exe	92
4396	2508	WerFault.exe	92
4916	2348	WerFault.exe	89
1908	3192	WerFault.exe	99
3492	4412	WerFault.exe	94
4864	1104	WerFault.exe	96
2652	556	WerFault.exe	100
1808	1104	WerFault.exe	96
5092	3192	WerFault.exe	99
4436	556	WerFault.exe	100
4268	4412	WerFault.exe	94
412	1264	WerFault.exe	109
3980	3512	WerFault.exe	93
5076	1264	WerFault.exe	109
4580	3512	WerFault.exe	93
1540	1080	WerFault.exe	139
3208	1332	WerFault.exe	116
3172	3700	WerFault.exe	119
4544	1864	WerFault.exe	143
1676	1080	WerFault.exe	139
4932	3700	WerFault.exe	119
4684	1332	WerFault.exe	116
5096	2704	WerFault.exe	182
2856	800	WerFault.exe	181
1784	920	WerFault.exe	154
3096	920	WerFault.exe	154
2004	2704	WerFault.exe	182
5056	1868	WerFault.exe	198
3540	800	WerFault.exe	181
6036	1708	WerFault.exe	155
6012	4448	WerFault.exe	173
5704	5100	WerFault.exe	138
5816	1908	WerFault.exe	205
6432	5260	WerFault.exe
6208	4396	WerFault.exe	260
6224	4204	WerFault.exe	244
5032	5500	WerFault.exe	274
8244	6008	WerFault.exe	338
8200	5260	WerFault.exe	266
1116	4992	WerFault.exe	316
8748	3152	WerFault.exe	142
9164	1780	WerFault.exe	208
8116	2168	WerFault.exe	219
2708	1936	WerFault.exe	226
3580	2388	WerFault.exe	212
9200	432	WerFault.exe	165
9024	620	WerFault.exe	209
8692	736	WerFault.exe	259
2652	5588	WerFault.exe	277
1512	6488	WerFault.exe	390
4768	4560	WerFault.exe	327
4704	6708	WerFault.exe	393
5308	6216	WerFault.exe	346
4748	6192	WerFault.exe	345
3228	2584	WerFault.exe	179
9772	4548	WerFault.exe	234
9924	3032	WerFault.exe	321
10024	5180	WerFault.exe	301
9904	2112	WerFault.exe	229
2732	6748	WerFault.exe	363
10328	7296	WerFault.exe	421
10260	1428	WerFault.exe	164
10252	3732	WerFault.exe	215

System Location Discovery: System Language Discovery 1 TTPs 61 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e39b760289d18662e9abc58045ed5f813ca76f4083bc36116fb29233aed4287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62590.exe

Suspicious use of SetWindowsHookEx 59 IoCs

pid	Process
3840	3e39b760289d18662e9abc58045ed5f813ca76f4083bc36116fb29233aed4287.exe
3356	Unicorn-53675.exe
3388	Unicorn-11246.exe
2348	Unicorn-48750.exe
4688	Unicorn-55699.exe
2100	Unicorn-47339.exe
2508	Unicorn-15221.exe
3512	Unicorn-24872.exe
4412	Unicorn-37967.exe
4176	Unicorn-33883.exe
756	Unicorn-9570.exe
3192	Unicorn-56725.exe
556	Unicorn-62590.exe
1104	Unicorn-59326.exe
1244	Unicorn-40715.exe
1264	Unicorn-20849.exe
1332	Unicorn-14164.exe
4828	Unicorn-11364.exe
3700	Unicorn-429.exe
732	Unicorn-20029.exe
2728	Unicorn-48255.exe
4596	Unicorn-39703.exe
1476	Unicorn-19283.exe
3544	Unicorn-19475.exe
1080	Unicorn-51955.exe
3028	Unicorn-59553.exe
4416	Unicorn-31462.exe
1864	Unicorn-13344.exe
3152	Unicorn-6261.exe
4944	Unicorn-18619.exe
920	Unicorn-15281.exe
1708	Unicorn-52059.exe
848	Unicorn-31831.exe
4276	Unicorn-11410.exe
4196	Unicorn-28301.exe
4212	Unicorn-24217.exe
1428	Unicorn-31255.exe
432	Unicorn-31255.exe
3828	Unicorn-14918.exe
4904	Unicorn-14918.exe
2052	Unicorn-53713.exe
1368	Unicorn-42745.exe
588	Unicorn-39191.exe
864	Unicorn-51410.exe
4448	Unicorn-22125.exe
2584	Unicorn-38005.exe
2720	Unicorn-4586.exe
800	Unicorn-24623.exe
2704	Unicorn-10324.exe
2832	Unicorn-886.exe
2116	Unicorn-46003.exe
412	Unicorn-18375.exe
3056	Unicorn-30819.exe
4208	Unicorn-59407.exe
748	Unicorn-31373.exe
4580	Unicorn-35457.exe
1436	Unicorn-35457.exe
3876	Unicorn-44533.exe
1868	Unicorn-25264.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 3356	3840	3e39b760289d18662e9abc58045ed5f813ca76f4083bc36116fb29233aed4287.exe	87
PID 3356 wrote to memory of 3388	3356	Unicorn-53675.exe	88
PID 3840 wrote to memory of 2348	3840	3e39b760289d18662e9abc58045ed5f813ca76f4083bc36116fb29233aed4287.exe	89
PID 3388 wrote to memory of 4688	3388	Unicorn-11246.exe	90
PID 2348 wrote to memory of 2100	2348	Unicorn-48750.exe	91
PID 3356 wrote to memory of 2508	3356	Unicorn-53675.exe	92
PID 3840 wrote to memory of 3512	3840	3e39b760289d18662e9abc58045ed5f813ca76f4083bc36116fb29233aed4287.exe	93
PID 2100 wrote to memory of 4412	2100	Unicorn-47339.exe	94
PID 4688 wrote to memory of 4176	4688	Unicorn-55699.exe	95
PID 3388 wrote to memory of 1104	3388	Unicorn-11246.exe	96
PID 3512 wrote to memory of 756	3512	Unicorn-24872.exe	97
PID 3356 wrote to memory of 3192	3356	Unicorn-53675.exe	99
PID 3840 wrote to memory of 556	3840	3e39b760289d18662e9abc58045ed5f813ca76f4083bc36116fb29233aed4287.exe	100
PID 4688 wrote to memory of 1264	4688	Unicorn-55699.exe	109
PID 4176 wrote to memory of 1244	4176	Unicorn-33883.exe	110
PID 3388 wrote to memory of 1332	3388	Unicorn-11246.exe	116
PID 3840 wrote to memory of 4828	3840	3e39b760289d18662e9abc58045ed5f813ca76f4083bc36116fb29233aed4287.exe	117
PID 3356 wrote to memory of 732	3356	Unicorn-53675.exe	118
PID 3512 wrote to memory of 3700	3512	Unicorn-24872.exe	119
PID 1244 wrote to memory of 2728	1244	Unicorn-40715.exe	135
PID 4828 wrote to memory of 4596	4828	Unicorn-11364.exe	136
PID 1332 wrote to memory of 1476	1332	Unicorn-14164.exe	137
PID 4176 wrote to memory of 5100	4176	Unicorn-33883.exe	138
PID 3700 wrote to memory of 1080	3700	Unicorn-429.exe	139
PID 3388 wrote to memory of 4416	3388	Unicorn-11246.exe	141
PID 3840 wrote to memory of 3152	3840	3e39b760289d18662e9abc58045ed5f813ca76f4083bc36116fb29233aed4287.exe	142
PID 4688 wrote to memory of 1864	4688	Unicorn-55699.exe	143
PID 732 wrote to memory of 3544	732	Unicorn-20029.exe	144
PID 3356 wrote to memory of 3028	3356	Unicorn-53675.exe	146
PID 2728 wrote to memory of 4944	2728	Unicorn-48255.exe	153
PID 1244 wrote to memory of 920	1244	Unicorn-40715.exe	154
PID 3544 wrote to memory of 1708	3544	Unicorn-19475.exe	155
PID 4596 wrote to memory of 848	4596	Unicorn-39703.exe	156
PID 1476 wrote to memory of 4276	1476	Unicorn-19283.exe	157
PID 4828 wrote to memory of 4196	4828	Unicorn-11364.exe	160
PID 732 wrote to memory of 4212	732	Unicorn-20029.exe	161
PID 4416 wrote to memory of 1428	4416	Unicorn-31462.exe	164
PID 3152 wrote to memory of 3828	3152	Unicorn-6261.exe	166
PID 3028 wrote to memory of 4904	3028	Unicorn-59553.exe	167
PID 4176 wrote to memory of 2052	4176	Unicorn-33883.exe	169
PID 3388 wrote to memory of 1368	3388	Unicorn-11246.exe	171
PID 4688 wrote to memory of 864	4688	Unicorn-55699.exe	170
PID 3356 wrote to memory of 4448	3356	Unicorn-53675.exe	173
PID 3840 wrote to memory of 588	3840	3e39b760289d18662e9abc58045ed5f813ca76f4083bc36116fb29233aed4287.exe	172
PID 4944 wrote to memory of 2720	4944	Unicorn-18619.exe	178
PID 2728 wrote to memory of 2584	2728	Unicorn-48255.exe	179
PID 920 wrote to memory of 800	920	Unicorn-15281.exe	181
PID 1244 wrote to memory of 2704	1244	Unicorn-40715.exe	182
PID 1708 wrote to memory of 2832	1708	Unicorn-52059.exe	188
PID 848 wrote to memory of 2116	848	Unicorn-31831.exe	190
PID 4276 wrote to memory of 412	4276	Unicorn-11410.exe	191
PID 4196 wrote to memory of 3056	4196	Unicorn-28301.exe	192
PID 4212 wrote to memory of 4208	4212	Unicorn-24217.exe	193
PID 1476 wrote to memory of 4580	1476	Unicorn-19283.exe	194
PID 4596 wrote to memory of 1436	4596	Unicorn-39703.exe	195
PID 3544 wrote to memory of 748	3544	Unicorn-19475.exe	196
PID 4828 wrote to memory of 3876	4828	Unicorn-11364.exe	197
PID 732 wrote to memory of 1868	732	Unicorn-20029.exe	198
PID 3828 wrote to memory of 4320	3828	Unicorn-14918.exe	302
PID 2052 wrote to memory of 1236	2052	Unicorn-53713.exe	199

C:\Users\Admin\AppData\Local\Temp\3e39b760289d18662e9abc58045ed5f813ca76f4083bc36116fb29233aed4287.exe
"C:\Users\Admin\AppData\Local\Temp\3e39b760289d18662e9abc58045ed5f813ca76f4083bc36116fb29233aed4287.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53675.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53675.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11246.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55699.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33883.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18619.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4586.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56823.exe
        10⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe
        11⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 720
        12⤵
        Program crash
        
        PID:6432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 720
        12⤵
        Program crash
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14721.exe
        11⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6192 -s 636
        12⤵
        Program crash
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65369.exe
        11⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37616.exe
        12⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 756
        11⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
        10⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
        11⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46936.exe
        12⤵
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        9⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12614.exe
        10⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe
        11⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13915.exe
        12⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6724 -s 636
        12⤵
        
        PID:13624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53782.exe
        10⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31531.exe
        11⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        12⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        11⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28657.exe
        11⤵
        
        PID:12692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 660
        10⤵
        Program crash
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-584.exe
        9⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        10⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        10⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        11⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe
        10⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
        10⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38894.exe
        9⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21472.exe
        10⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8762.exe
        10⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64070.exe
        10⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53005.exe
        9⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4158.exe
        9⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
        9⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36185.exe
        9⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3730.exe
        9⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29335.exe
        10⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe
        10⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        11⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16584.exe
        12⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55851.exe
        11⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 636
        10⤵
        Program crash
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        9⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24935.exe
        10⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7496 -s 636
        11⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 632
        9⤵
        Program crash
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21528.exe
        8⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
        8⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45547.exe
        9⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        10⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        11⤵
        
        PID:13992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7684 -s 640
        10⤵
        
        PID:13640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5180 -s 644
        9⤵
        Program crash
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
        8⤵
        
        PID:728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47932.exe
        9⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 636
        9⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36469.exe
        8⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28488.exe
        9⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        8⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26517.exe
        8⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63715.exe
        8⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 636
        9⤵
        Program crash
        
        PID:2856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 624
        9⤵
        Program crash
        
        PID:3540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 640
        8⤵
        Program crash
        
        PID:1784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 640
        8⤵
        Program crash
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10324.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 636
        8⤵
        Program crash
        
        PID:5096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 636
        8⤵
        Program crash
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44306.exe
        7⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62199.exe
        8⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe
        9⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19943.exe
        10⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
        11⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 628
        10⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        9⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6391.exe
        10⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23353.exe
        9⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53879.exe
        9⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44410.exe
        9⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        8⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59621.exe
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15807.exe
        8⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe
        9⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11665.exe
        8⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45452.exe
        9⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17593.exe
        8⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13562.exe
        8⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33537.exe
        7⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 636
        8⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56659.exe
        7⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8076 -s 636
        8⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1857.exe
        7⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9412 -s 636
        8⤵
        
        PID:15016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        7⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe
        7⤵
        
        PID:14368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32089.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31255.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52007.exe
        8⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        9⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28967.exe
        10⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 632
        11⤵
        Program crash
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49330.exe
        10⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
        10⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45519.exe
        10⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52578.exe
        10⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19573.exe
        9⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56100.exe
        10⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6624 -s 548
        10⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10585.exe
        8⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34971.exe
        9⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18768.exe
        10⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7044 -s 636
        10⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2364.exe
        8⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 636
        9⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 644
        8⤵
        Program crash
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32873.exe
        7⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 656
        7⤵
        Program crash
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53713.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64067.exe
        7⤵
        Executes dropped EXE
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52495.exe
        8⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56330.exe
        8⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41633.exe
        8⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9079.exe
        9⤵
        
        PID:12680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 668
        8⤵
        
        PID:10392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26729.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55967.exe
        8⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 632
        8⤵
        Program crash
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26662.exe
        6⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 616
        7⤵
        Program crash
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        6⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61202.exe
        6⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61359.exe
        7⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        8⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6588 -s 668
        7⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6690.exe
        6⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 636
        7⤵
        
        PID:14288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55141.exe
        6⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59816.exe
        7⤵
        
        PID:14316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21374.exe
        6⤵
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35626.exe
        6⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20849.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1264
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 632
        6⤵
        Program crash
        
        PID:412
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 632
        6⤵
        Program crash
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13344.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1864
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 636
        6⤵
        Program crash
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51410.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52007.exe
        6⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33419.exe
        7⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48738.exe
        7⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33539.exe
        8⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12690.exe
        8⤵
        
        PID:9316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21729.exe
        8⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-314.exe
        8⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49993.exe
        7⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11486.exe
        7⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50834.exe
        7⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36810.exe
        7⤵
        
        PID:14468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
        6⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        6⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6708 -s 640
        7⤵
        Program crash
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        6⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36708.exe
        7⤵
        
        PID:12312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31174.exe
        6⤵
        
        PID:10028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
        6⤵
        
        PID:14620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60337.exe
        5⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
        6⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14742.exe
        7⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe
        8⤵
        
        PID:11700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
        8⤵
        
        PID:9056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47169.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        6⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6876 -s 644
        7⤵
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
        6⤵
        
        PID:332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 332 -s 636
        7⤵
        
        PID:13836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        6⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27595.exe
        6⤵
        
        PID:12636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53102.exe
        6⤵
        
        PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50603.exe
        5⤵
        
        PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe
        5⤵
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11575.exe
        6⤵
        
        PID:13756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62059.exe
        5⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        6⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24614.exe
        5⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3474.exe
        5⤵
        
        PID:14452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1104
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 636
        5⤵
        Program crash
        
        PID:4864
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 636
        5⤵
        Program crash
        
        PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11410.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18375.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54851.exe
        8⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22807.exe
        9⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        10⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48280.exe
        11⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        11⤵
        
        PID:13524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29521.exe
        8⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1878.exe
        9⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 632
        9⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54165.exe
        8⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7244 -s 636
        9⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        8⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57658.exe
        8⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1929.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2386.exe
        8⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36995.exe
        9⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2307.exe
        10⤵
        
        PID:13080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 636
        9⤵
        Program crash
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55422.exe
        8⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54284.exe
        9⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6132.exe
        8⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52416.exe
        9⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28119.exe
        8⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48198.exe
        8⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
        7⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55562.exe
        7⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33532.exe
        8⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33381.exe
        7⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        8⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28486.exe
        7⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53108.exe
        7⤵
        
        PID:14048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35457.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18479.exe
        7⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39225.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42888.exe
        8⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
        8⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5120.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17542.exe
        7⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9440 -s 632
        8⤵
        
        PID:15240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
        6⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 628
        7⤵
        Program crash
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe
        6⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6368 -s 628
        7⤵
        
        PID:12256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5776.exe
        6⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47040.exe
        7⤵
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32566.exe
        7⤵
        
        PID:7764
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 624
        6⤵
        
        PID:10432
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 644
        5⤵
        Program crash
        
        PID:3208
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 644
        5⤵
        Program crash
        
        PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31462.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31255.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26927.exe
        6⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37503.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49387.exe
        8⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3798.exe
        9⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23880.exe
        10⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 628
        9⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 628
        9⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31633.exe
        7⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15821.exe
        6⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39439.exe
        7⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
        8⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48103.exe
        8⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48908.exe
        9⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53634.exe
        8⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe
        8⤵
        
        PID:14380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55649.exe
        6⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2047.exe
        7⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19670.exe
        7⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31833.exe
        7⤵
        
        PID:13352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51774.exe
        6⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7412 -s 636
        7⤵
        
        PID:9204
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 632
        6⤵
        Program crash
        
        PID:10260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36957.exe
        5⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45863.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57083.exe
        8⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49728.exe
        9⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 548
        8⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35961.exe
        7⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
        7⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe
        8⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58923.exe
        7⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48494.exe
        7⤵
        
        PID:13760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        6⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62127.exe
        7⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6984 -s 648
        7⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53309.exe
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        7⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        7⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2166.exe
        6⤵
        
        PID:9980
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 704
        6⤵
        
        PID:13684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        5⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49262.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        5⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-719.exe
        6⤵
        
        PID:12948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exe
        5⤵
        
        PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44156.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52957.exe
        5⤵
        
        PID:14572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42745.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18759.exe
        5⤵
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-554.exe
        6⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 636
        7⤵
        Program crash
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15873.exe
        6⤵
        
        PID:6312
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 664
        6⤵
        Program crash
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52770.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        6⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49904.exe
        7⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9912 -s 616
        8⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe
        7⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55378.exe
        7⤵
        
        PID:14140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43801.exe
      4⤵
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23202.exe
      4⤵
      PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53907.exe
        5⤵
        
        PID:7692
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7692 -s 644
        6⤵
        
        PID:11668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20601.exe
        5⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42520.exe
        6⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59202.exe
        5⤵
        
        PID:9992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1850.exe
        5⤵
        
        PID:12724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51670.exe
        5⤵
        
        PID:7812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
      4⤵
      PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53812.exe
        5⤵
        
        PID:12992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29793.exe
      4⤵
      PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13931.exe
        5⤵
        
        PID:13136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-722.exe
      4⤵
      PID:9948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62415.exe
      4⤵
      PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe
      4⤵
      PID:14444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15221.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 636
      4⤵
      Program crash
      PID:212
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 652
      4⤵
      Program crash
      PID:4396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56725.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 636
      4⤵
      Program crash
      PID:1908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 636
      4⤵
      Program crash
      PID:5092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20029.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-886.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41255.exe
        7⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41779.exe
        8⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
        7⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47223.exe
        8⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46780.exe
        9⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39898.exe
        9⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35489.exe
        8⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
        8⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27196.exe
        9⤵
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26391.exe
        8⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        8⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35134.exe
        8⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64009.exe
        7⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36064.exe
        8⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36774.exe
        8⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
        8⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2203.exe
        8⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17138.exe
        8⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22857.exe
        7⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30214.exe
        7⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53876.exe
        7⤵
        
        PID:14484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53678.exe
        6⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe
        7⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        8⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19279.exe
        9⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16776.exe
        10⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
        9⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        9⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        8⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        9⤵
        
        PID:13812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 672
        8⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24617.exe
        7⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
        8⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6650.exe
        8⤵
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47210.exe
        8⤵
        
        PID:14332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 660
        7⤵
        Program crash
        
        PID:2708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 632
        6⤵
        Program crash
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31373.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38323.exe
        6⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe
        7⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 632
        8⤵
        Program crash
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35001.exe
        7⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5083.exe
        8⤵
        
        PID:13284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 628
        7⤵
        Program crash
        
        PID:9772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38457.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        7⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46537.exe
        6⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
        7⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58503.exe
        7⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25135.exe
        6⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45022.exe
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36042.exe
        6⤵
        
        PID:13980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12924.exe
        5⤵
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
        6⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45230.exe
        5⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49107.exe
        6⤵
        
        PID:3352
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 640
        6⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2896.exe
        5⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-807.exe
        6⤵
        
        PID:7544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65471.exe
        5⤵
        
        PID:9608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe
        5⤵
        
        PID:11796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        5⤵
        
        PID:14180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59407.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23523.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
        6⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33272.exe
        6⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45836.exe
        7⤵
        
        PID:12468
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 504
        6⤵
        
        PID:10416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5733.exe
        5⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48183.exe
        6⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        7⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        7⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51294.exe
        7⤵
        
        PID:9416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22016.exe
        5⤵
        
        PID:6488
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6488 -s 644
        6⤵
        Program crash
        
        PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51774.exe
        5⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe
        6⤵
        
        PID:13296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe
        5⤵
        
        PID:8396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6094.exe
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29564.exe
        5⤵
        
        PID:8752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1868
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 632
        5⤵
        Program crash
        
        PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46330.exe
      4⤵
      PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe
        5⤵
        
        PID:6748
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6748 -s 636
        6⤵
        Program crash
        
        PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19216.exe
      4⤵
      PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15067.exe
        5⤵
        
        PID:9636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4663.exe
        6⤵
        
        PID:14120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        5⤵
        
        PID:8736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56146.exe
        5⤵
        
        PID:14536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
      4⤵
      PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30076.exe
        5⤵
        
        PID:10796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11711.exe
      4⤵
      PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1629.exe
      4⤵
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2698.exe
      4⤵
      PID:12652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59553.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14918.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
        5⤵
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45095.exe
        6⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe
        7⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61167.exe
        8⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        9⤵
        
        PID:12200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
        8⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44440.exe
        9⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6560 -s 668
        8⤵
        
        PID:14248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39573.exe
        7⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57948.exe
        8⤵
        
        PID:14112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 684
        7⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47778.exe
        6⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38265.exe
        6⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
        7⤵
        
        PID:11504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60046.exe
        6⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26184.exe
        7⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59526.exe
        6⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        6⤵
        
        PID:12224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2801.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6766.exe
        6⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33760.exe
        7⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        8⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6664 -s 644
        7⤵
        
        PID:11296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49402.exe
      4⤵
      PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21359.exe
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe
        6⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 644
        7⤵
        Program crash
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6553.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exe
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9618.exe
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
        6⤵
        
        PID:11752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57159.exe
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42261.exe
        5⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48472.exe
        6⤵
        
        PID:12300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13386.exe
        6⤵
        
        PID:8748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        5⤵
        
        PID:9696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24793.exe
        5⤵
        
        PID:11740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31958.exe
        5⤵
        
        PID:14216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
      4⤵
      PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
        5⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53952.exe
        6⤵
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11857.exe
        5⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27004.exe
        6⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57071.exe
        6⤵
        
        PID:5316
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6072 -s 648
        5⤵
        
        PID:12972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
      4⤵
      PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62924.exe
        5⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
        6⤵
        
        PID:14224
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 660
        5⤵
        
        PID:14232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52045.exe
      4⤵
      PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62260.exe
        5⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42166.exe
        5⤵
        
        PID:9256
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 652
      4⤵
      PID:5220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22125.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
      4⤵
      PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21167.exe
        5⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21951.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        7⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8747.exe
        8⤵
        
        PID:13848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6732 -s 636
        7⤵
        
        PID:12236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19957.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        6⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
        7⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40734.exe
        7⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
        6⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49550.exe
        6⤵
        
        PID:12120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62011.exe
        6⤵
        
        PID:14508
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 632
        5⤵
        Program crash
        
        PID:9164
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 684
      4⤵
      Program crash
      PID:6012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48423.exe
    3⤵
    PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45863.exe
      4⤵
      PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12630.exe
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
        5⤵
        
        PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        5⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12846.exe
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10637.exe
      4⤵
      PID:6216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6216 -s 640
        5⤵
        Program crash
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61285.exe
      4⤵
      PID:3824
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 664
      4⤵
      Program crash
      PID:10252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5756.exe
    3⤵
    PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62075.exe
      4⤵
      PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe
        5⤵
        
        PID:12728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52325.exe
    3⤵
    PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
      4⤵
      PID:11680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1705.exe
    3⤵
    PID:5892
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5892 -s 636
      4⤵
      PID:15068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38523.exe
    3⤵
    PID:7232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44215.exe
    3⤵
    PID:11884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4758.exe
    3⤵
    PID:14388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48750.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48750.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37967.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4412
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 628
        5⤵
        Program crash
        
        PID:3492
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 656
        5⤵
        Program crash
        
        PID:4268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 624
    3⤵
    - Program crash
    PID:1760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 624
    3⤵
    - Program crash
    PID:4916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24872.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24872.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-429.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51955.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1080
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 636
        5⤵
        Program crash
        
        PID:1540
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 676
        5⤵
        Program crash
        
        PID:1676
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 636
      4⤵
      Program crash
      PID:3172
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 636
      4⤵
      Program crash
      PID:4932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 680
    3⤵
    - Program crash
    PID:3980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 680
    3⤵
    - Program crash
    PID:4580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62590.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62590.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 636
    3⤵
    - Program crash
    PID:2652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 636
    3⤵
    - Program crash
    PID:4436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39703.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31831.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
        6⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
        7⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4514.exe
        8⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7432 -s 628
        9⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21213.exe
        7⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38192.exe
        8⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41642.exe
        8⤵
        
        PID:14164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 632
        7⤵
        Program crash
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54026.exe
        6⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65443.exe
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62172.exe
        8⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5724 -s 664
        7⤵
        
        PID:8932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21581.exe
        5⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57259.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4706.exe
        7⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63500.exe
        8⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7580 -s 648
        8⤵
        
        PID:13608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        6⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34336.exe
        6⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65067.exe
        6⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58722.exe
        6⤵
        
        PID:12744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        6⤵
        
        PID:13732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        6⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        7⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38082.exe
        7⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
        6⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
        7⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50510.exe
        6⤵
        
        PID:12156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49759.exe
        6⤵
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9485.exe
        5⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31088.exe
        6⤵
        
        PID:12408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3332.exe
        5⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38680.exe
        6⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2918.exe
        5⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3035.exe
        5⤵
        
        PID:10756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63342.exe
        5⤵
        
        PID:14188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35457.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63787.exe
        5⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
        6⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25511.exe
        7⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62312.exe
        8⤵
        
        PID:11436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17093.exe
        7⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64350.exe
        7⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        7⤵
        
        PID:14148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50902.exe
        5⤵
        
        PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5696.exe
        5⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54772.exe
        6⤵
        
        PID:11532
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 660
        5⤵
        
        PID:12548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
      4⤵
      PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16715.exe
        5⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exe
        6⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
        7⤵
        
        PID:12884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4841.exe
        6⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21524.exe
        7⤵
        
        PID:12736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe
        6⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
        6⤵
        
        PID:12940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
        5⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4995.exe
        6⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52518.exe
        5⤵
        
        PID:9624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36516.exe
        6⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33459.exe
        5⤵
        
        PID:11720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13901.exe
      4⤵
      PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58485.exe
      4⤵
      PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15031.exe
        5⤵
        
        PID:11492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18098.exe
        5⤵
        
        PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe
      4⤵
      PID:6384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47280.exe
      4⤵
      PID:9576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32345.exe
      4⤵
      PID:14492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28301.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30819.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30155.exe
        5⤵
        
        PID:1032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36943.exe
        6⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
        7⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19116.exe
        8⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57934.exe
        7⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11170.exe
        7⤵
        
        PID:12908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54794.exe
        5⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe
        6⤵
        
        PID:9884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 644
        6⤵
        
        PID:13632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49697.exe
        5⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54528.exe
        6⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        6⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1590.exe
        5⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36656.exe
        6⤵
        
        PID:13368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        5⤵
        
        PID:12280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12498.exe
        5⤵
        
        PID:11368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35753.exe
      4⤵
      PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46455.exe
        5⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59992.exe
        6⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15453.exe
        5⤵
        
        PID:2956
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 640
        6⤵
        
        PID:13664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61838.exe
        5⤵
        
        PID:7988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59499.exe
        5⤵
        
        PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        5⤵
        
        PID:14556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64637.exe
      4⤵
      PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        5⤵
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe
        5⤵
        
        PID:8660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12321.exe
        5⤵
        
        PID:12216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11561.exe
      4⤵
      PID:7724
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7724 -s 636
        5⤵
        
        PID:2920
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 700
      4⤵
      PID:13196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44533.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48219.exe
      4⤵
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
      4⤵
      PID:836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        5⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
        5⤵
        
        PID:3496
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 668
        5⤵
        
        PID:14240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62666.exe
    3⤵
    PID:5500
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 636
      4⤵
      Program crash
      PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19792.exe
    3⤵
    PID:856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6131.exe
      4⤵
      PID:10160
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 648
      4⤵
      PID:13408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
    3⤵
    PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
      4⤵
      PID:13888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
    3⤵
    PID:2132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe
    3⤵
    PID:10924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27010.exe
    3⤵
    PID:14432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14918.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64067.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1841.exe
      4⤵
      PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2977.exe
    3⤵
    PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4830.exe
      4⤵
      PID:736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
        5⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35807.exe
        6⤵
        
        PID:8840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3858.exe
        6⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7697.exe
        6⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60335.exe
        6⤵
        
        PID:14592
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 656
        5⤵
        Program crash
        
        PID:8692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe
      4⤵
      PID:868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46012.exe
        5⤵
        
        PID:9964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60968.exe
        6⤵
        
        PID:13040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34086.exe
        5⤵
        
        PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45909.exe
      4⤵
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52032.exe
        5⤵
        
        PID:14008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19270.exe
      4⤵
      PID:9896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47710.exe
      4⤵
      PID:12096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24558.exe
      4⤵
      PID:14604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62421.exe
    3⤵
    PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36227.exe
      4⤵
      PID:7280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
        5⤵
        
        PID:9476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11694.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59986.exe
        5⤵
        
        PID:9348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44722.exe
      4⤵
      PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40164.exe
        5⤵
        
        PID:13856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5992 -s 664
      4⤵
      PID:13156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54654.exe
    3⤵
    PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64912.exe
      4⤵
      PID:10224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 616
    3⤵
    - Program crash
    PID:8748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39191.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39191.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
  2⤵
  PID:2436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
    3⤵
    PID:5224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
  2⤵
  PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
    3⤵
    PID:7296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7296 -s 636
      4⤵
      Program crash
      PID:10328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15941.exe
    3⤵
    PID:8804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37476.exe
      4⤵
      PID:12880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56526.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56526.exe
  2⤵
  PID:6704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6257.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6257.exe
  2⤵
  PID:6760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
  2⤵
  PID:9852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59615.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59615.exe
  2⤵
  PID:11768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
  2⤵
  PID:14460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2348 -ip 2348
1⤵
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2508 -ip 2508
1⤵
PID:460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2508 -ip 2508
1⤵
PID:360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2348 -ip 2348
1⤵
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3192 -ip 3192
1⤵
PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 756 -ip 756
1⤵
PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4412 -ip 4412
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 556 -ip 556
1⤵
PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1104 -ip 1104
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2100 -ip 2100
1⤵
PID:2436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 756 -ip 756
1⤵
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2100 -ip 2100
1⤵
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1104 -ip 1104
1⤵
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3192 -ip 3192
1⤵
PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 556 -ip 556
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4412 -ip 4412
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1264 -ip 1264
1⤵
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3512 -ip 3512
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1264 -ip 1264
1⤵
PID:2268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3512 -ip 3512
1⤵
PID:552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1080 -ip 1080
1⤵
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3700 -ip 3700
1⤵
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1332 -ip 1332
1⤵
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1864 -ip 1864
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1080 -ip 1080
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3700 -ip 3700
1⤵
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1332 -ip 1332
1⤵
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 2704 -ip 2704
1⤵
PID:3540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 800 -ip 800
1⤵
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 920 -ip 920
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 920 -ip 920
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2704 -ip 2704
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1868 -ip 1868
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4320 -ip 4320
1⤵
PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 800 -ip 800
1⤵
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1908 -ip 1908
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4320 -ip 4320
1⤵
PID:5136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1908 -ip 1908
1⤵
PID:5336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4696 -ip 4696
1⤵
PID:5472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4268 -ip 4268
1⤵
PID:5536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2948 -ip 2948
1⤵
PID:5672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4448 -ip 4448
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4696 -ip 4696
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1708 -ip 1708
1⤵
PID:5380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5100 -ip 5100
1⤵
PID:5336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2948 -ip 2948
1⤵
PID:5784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4268 -ip 4268
1⤵
PID:5584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4448 -ip 4448
1⤵
PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1708 -ip 1708
1⤵
PID:5536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5100 -ip 5100
1⤵
PID:5808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1868 -ip 1868
1⤵
PID:6104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5260 -ip 5260
1⤵
PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4204 -ip 4204
1⤵
PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4204 -ip 4204
1⤵
PID:6460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 5500 -ip 5500
1⤵
PID:6768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4396 -ip 4396
1⤵
PID:6864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5892 -ip 5892
1⤵
PID:6920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5660 -ip 5660
1⤵
PID:6964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4900 -ip 4900
1⤵
PID:7112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3172 -ip 3172
1⤵
PID:6168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4520 -ip 4520
1⤵
PID:6652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5224 -ip 5224
1⤵
PID:4640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 2872 -ip 2872
1⤵
PID:5544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4780 -ip 4780
1⤵
PID:7040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3632 -ip 3632
1⤵
PID:5628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5836 -ip 5836
1⤵
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5320 -ip 5320
1⤵
PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5308 -ip 5308
1⤵
PID:6980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 1792 -ip 1792
1⤵
PID:6340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2436 -ip 2436
1⤵
PID:7200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4504 -ip 4504
1⤵
PID:7228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3828 -ip 3828
1⤵
PID:7332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2052 -ip 2052
1⤵
PID:7376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4904 -ip 4904
1⤵
PID:7532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1368 -ip 1368
1⤵
PID:7616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5892 -ip 5892
1⤵
PID:7700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5660 -ip 5660
1⤵
PID:7876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2584 -ip 2584
1⤵
PID:7916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 4900 -ip 4900
1⤵
PID:7956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 2720 -ip 2720
1⤵
PID:7984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4520 -ip 4520
1⤵
PID:8020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3172 -ip 3172
1⤵
PID:8036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5224 -ip 5224
1⤵
PID:8052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 3632 -ip 3632
1⤵
PID:8076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4780 -ip 4780
1⤵
PID:8124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 2872 -ip 2872
1⤵
PID:6180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5320 -ip 5320
1⤵
PID:7456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5836 -ip 5836
1⤵
PID:7836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 4992 -ip 4992
1⤵
PID:5772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5308 -ip 5308
1⤵
PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1792 -ip 1792
1⤵
PID:8096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 4504 -ip 4504
1⤵
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2436 -ip 2436
1⤵
PID:7532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3828 -ip 3828
1⤵
PID:8052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4904 -ip 4904
1⤵
PID:5272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2052 -ip 2052
1⤵
PID:1036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 1368 -ip 1368
1⤵
PID:7240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 2584 -ip 2584
1⤵
PID:7288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 2720 -ip 2720
1⤵
PID:8128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1948 -ip 1948
1⤵
PID:7332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3288 -ip 3288
1⤵
PID:5356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5012 -ip 5012
1⤵
PID:8092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 2116 -ip 2116
1⤵
PID:7960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 1032 -ip 1032
1⤵
PID:8056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1260 -ip 1260
1⤵
PID:5324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5208 -ip 5208
1⤵
PID:6436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5188 -ip 5188
1⤵
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1900 -ip 1900
1⤵
PID:7708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 4992 -ip 4992
1⤵
PID:6996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 6008 -ip 6008
1⤵
PID:8092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 5260 -ip 5260
1⤵
PID:7212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3876 -ip 3876
1⤵
PID:6508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5904 -ip 5904
1⤵
PID:7508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5584 -ip 5584
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 6056 -ip 6056
1⤵
PID:668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1948 -ip 1948
1⤵
PID:7960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 1632 -ip 1632
1⤵
PID:5772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 5276 -ip 5276
1⤵
PID:8328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4132 -ip 4132
1⤵
PID:8480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3404 -ip 3404
1⤵
PID:8600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 5948 -ip 5948
1⤵
PID:8644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 5384 -ip 5384
1⤵
PID:8688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 5644 -ip 5644
1⤵
PID:8708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5852 -ip 5852
1⤵
PID:8736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5736 -ip 5736
1⤵
PID:8748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5884 -ip 5884
1⤵
PID:8764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5596 -ip 5596
1⤵
PID:8880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 736 -ip 736
1⤵
PID:9052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5588 -ip 5588
1⤵
PID:9148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 620 -ip 620
1⤵
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 432 -ip 432
1⤵
PID:5308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 2388 -ip 2388
1⤵
PID:8332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 3288 -ip 3288
1⤵
PID:8796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 5012 -ip 5012
1⤵
PID:9108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 1032 -ip 1032
1⤵
PID:8224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1936 -ip 1936
1⤵
PID:8392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2168 -ip 2168
1⤵
PID:8536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 1780 -ip 1780
1⤵
PID:9060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 2116 -ip 2116
1⤵
PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5188 -ip 5188
1⤵
PID:9268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 1260 -ip 1260
1⤵
PID:9276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5208 -ip 5208
1⤵
PID:9284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 1900 -ip 1900
1⤵
PID:9312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 5500 -ip 5500
1⤵
PID:9352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 3152 -ip 3152
1⤵
PID:9376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4396 -ip 4396
1⤵
PID:9396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 6708 -ip 6708
1⤵
PID:9420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4560 -ip 4560
1⤵
PID:9460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1036 -p 6488 -ip 6488
1⤵
PID:9492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1048 -p 6192 -ip 6192
1⤵
PID:9508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 6216 -ip 6216
1⤵
PID:9516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3876 -ip 3876
1⤵
PID:9528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 5904 -ip 5904
1⤵
PID:9568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6056 -ip 6056
1⤵
PID:9576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 5584 -ip 5584
1⤵
PID:9584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1632 -ip 1632
1⤵
PID:9728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1056 -p 5276 -ip 5276
1⤵
PID:9760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1068 -p 3404 -ip 3404
1⤵
PID:9768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 5384 -ip 5384
1⤵
PID:9776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1092 -p 4132 -ip 4132
1⤵
PID:9832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1112 -p 5948 -ip 5948
1⤵
PID:9848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 1784 -ip 1784
1⤵
PID:9892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4068 -ip 4068
1⤵
PID:10052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5900 -ip 5900
1⤵
PID:10180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5496 -ip 5496
1⤵
PID:9260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5944 -ip 5944
1⤵
PID:9448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5928 -ip 5928
1⤵
PID:9280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1100 -p 6044 -ip 6044
1⤵
PID:9404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5644 -ip 5644
1⤵
PID:9616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2112 -ip 2112
1⤵
PID:9680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1132 -p 5852 -ip 5852
1⤵
PID:9740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1152 -p 5884 -ip 5884
1⤵
PID:1124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 5736 -ip 5736
1⤵
PID:9856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5180 -ip 5180
1⤵
PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 3032 -ip 3032
1⤵
PID:9572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 4548 -ip 4548
1⤵
PID:8660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5596 -ip 5596
1⤵
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4196 -ip 4196
1⤵
PID:9740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 1436 -ip 1436
1⤵
PID:5748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 6368 -ip 6368
1⤵
PID:9036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 6312 -ip 6312
1⤵
PID:9352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 2224 -ip 2224
1⤵
PID:8728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1092 -p 6928 -ip 6928
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 6748 -ip 6748
1⤵
PID:6828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6512 -ip 6512
1⤵
PID:7976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 4068 -ip 4068
1⤵
PID:5468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 1784 -ip 1784
1⤵
PID:9280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 5900 -ip 5900
1⤵
PID:10216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5496 -ip 5496
1⤵
PID:10212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 7296 -ip 7296
1⤵
PID:9600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5944 -ip 5944
1⤵
PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1028 -p 6044 -ip 6044
1⤵
PID:10348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1188 -p 3732 -ip 3732
1⤵
PID:9568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 1236 -ip 1236
1⤵
PID:6024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5548 -ip 5548
1⤵
PID:9936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 4208 -ip 4208
1⤵
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 4864 -ip 4864
1⤵
PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4856 -ip 4856
1⤵
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1476 -ip 1476
1⤵
PID:8352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 2004 -ip 2004
1⤵
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5928 -ip 5928
1⤵
PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 1428 -ip 1428
1⤵
PID:5760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 5688 -ip 5688
1⤵
PID:6356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 5456 -ip 5456
1⤵
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 5724 -ip 5724
1⤵
PID:9804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1188 -p 6588 -ip 6588
1⤵
PID:9652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 3028 -ip 3028
1⤵
PID:10940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2776 -ip 2776
1⤵
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 3540 -ip 3540
1⤵
PID:8784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 6984 -ip 6984
1⤵
PID:11456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1148 -p 6368 -ip 6368
1⤵
PID:12096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1436 -ip 1436
1⤵
PID:12104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 6312 -ip 6312
1⤵
PID:12132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6732 -ip 6732
1⤵
PID:12160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 6928 -ip 6928
1⤵
PID:12184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 6512 -ip 6512
1⤵
PID:12224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1172 -p 4196 -ip 4196
1⤵
PID:9620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 6116 -ip 6116
1⤵
PID:8372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 6072 -ip 6072
1⤵
PID:12460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 5992 -ip 5992
1⤵
PID:12604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1164 -p 4580 -ip 4580
1⤵
PID:11444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 6704 -ip 6704
1⤵
PID:5508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 3824 -ip 3824
1⤵
PID:8996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 7344 -ip 7344
1⤵
PID:8248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 1128 -ip 1128
1⤵
PID:11288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1164 -p 6940 -ip 6940
1⤵
PID:11480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 6480 -ip 6480
1⤵
PID:11880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 7668 -ip 7668
1⤵
PID:13204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1060 -p 7008 -ip 7008
1⤵
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 7444 -ip 7444
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 6496 -ip 6496
1⤵
PID:11392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 7460 -ip 7460
1⤵
PID:4200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 7524 -ip 7524
1⤵
PID:9620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 4268 -ip 4268
1⤵
PID:13132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 7692 -ip 7692
1⤵
PID:12452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 6876 -ip 6876
1⤵
PID:12212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 6840 -ip 6840
1⤵
PID:12652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7724 -ip 7724
1⤵
PID:12936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 7496 -ip 7496
1⤵
PID:12228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1164 -p 7432 -ip 7432
1⤵
PID:12896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6664 -ip 6664
1⤵
PID:12240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 6008 -ip 6008
1⤵
PID:13600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 856 -ip 856
1⤵
PID:13732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1144 -p 7580 -ip 7580
1⤵
PID:13796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 6624 -ip 6624
1⤵
PID:13868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 6724 -ip 6724
1⤵
PID:13980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 2444 -ip 2444
1⤵
PID:14020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 7684 -ip 7684
1⤵
PID:14044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 728 -ip 728
1⤵
PID:14052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 7044 -ip 7044
1⤵
PID:14068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2956 -ip 2956
1⤵
PID:14076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2492 -ip 2492
1⤵
PID:14100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1144 -p 6448 -ip 6448
1⤵
PID:14132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6968 -ip 6968
1⤵
PID:14160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 836 -ip 836
1⤵
PID:14176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 6560 -ip 6560
1⤵
PID:14192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 5840 -ip 5840
1⤵
PID:14216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6116 -ip 6116
1⤵
PID:14280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5588 -ip 5588
1⤵
PID:13204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 8144 -ip 8144
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 736 -ip 736
1⤵
PID:13388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 4580 -ip 4580
1⤵
PID:15332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 9412 -ip 9412
1⤵
PID:14224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5892 -ip 5892
1⤵
PID:13824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 620 -ip 620
1⤵
PID:6540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1252 -p 7608 -ip 7608
1⤵
PID:14136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 7460 -ip 7460
1⤵
PID:14412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1256 -p 6704 -ip 6704
1⤵
PID:14420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 6760 -ip 6760
1⤵
PID:14428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1264 -p 7196 -ip 7196
1⤵
PID:14500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1296 -p 1128 -ip 1128
1⤵
PID:14580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1324 -p 3824 -ip 3824
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1352 -p 7344 -ip 7344
1⤵
PID:10264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1380 -p 6480 -ip 6480
1⤵
PID:10684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1408 -p 7668 -ip 7668
1⤵
PID:968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 6940 -ip 6940
1⤵
PID:9152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1144 -p 7008 -ip 7008
1⤵
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1328 -p 6496 -ip 6496
1⤵
PID:9264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1356 -p 7444 -ip 7444
1⤵
PID:6284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1384 -p 4268 -ip 4268
1⤵
PID:10260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 9912 -ip 9912
1⤵
PID:7140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1140 -p 9440 -ip 9440
1⤵
PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 7524 -ip 7524
1⤵
PID:12584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 332 -ip 332
1⤵
PID:7836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1336 -p 7412 -ip 7412
1⤵
PID:13896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1388 -p 6732 -ip 6732
1⤵
PID:10992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1332 -p 3540 -ip 3540
1⤵
PID:14344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 1476 -ip 1476
1⤵
PID:6152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1140 -p 8076 -ip 8076
1⤵
PID:8780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1348 -p 7244 -ip 7244
1⤵
PID:14552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6448 -ip 6448
1⤵
PID:8168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 8144 -ip 8144
1⤵
PID:15280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 3352 -ip 3352
1⤵
PID:14424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1172 -p 1780 -ip 1780
1⤵
PID:15040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1308 -p 2168 -ip 2168
1⤵
PID:9824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 3152 -ip 3152
1⤵
PID:8652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 432 -ip 432
1⤵
PID:10416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5964 -ip 5964
1⤵
PID:14636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1360 -p 6488 -ip 6488
1⤵
PID:14024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1040 -p 6192 -ip 6192
1⤵
PID:10260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1376 -p 2388 -ip 2388
1⤵
PID:7140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 5156 -ip 5156
1⤵
PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 412 -ip 412
1⤵
PID:10676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 868 -ip 868
1⤵
PID:6704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1292 -p 5300 -ip 5300
1⤵
PID:8012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 7404 -ip 7404
1⤵
PID:1192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-11246.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11246.exe
Size 184KB
SHA256 c817bedb30b2e48ed348636ea6e9cf97fcecec7e7121bbd9bbfffa6672ee99d8
MD5 43b7eefaa8b4265cf5fac3b67c18c55f
SHA1 7ae371efdbd88b835061177daa5ca250f6e48868
SHA512 ed3920f1d29eeeb57167d684c295da83355aebee180510552aec0842189f76b870ff5e40c30a3969a5f126b2908b6aec2590c133bf4e9887d915cec4a0b846d5
SSDEEP 3072:9EUjVAo5LRUskx6eFXhoHy7Hw3vMqzviuq:9EVoAJ6eAHMHw3Eqzviu
TLSH
T194048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-11364.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
Size 184KB
SHA256 28ef5b15018674f04d2efc5e07006d1a439b1a916141ad1f049c0ad130f3f510
MD5 b382298d4b9a38fb23d6a17e7150ea4d
SHA1 cc46e516f4be85441a85fd06a4031b821a2c4261
SHA512 33cea33df3011aa678cebf64f4a190bde50377ad9f793a3efa46a65a4371d2cdc7eb6da8946a0e7d8f95d6317047ce85806260e95afab250a7d1b3228db7821d
SSDEEP 3072:9EdjVAoVLRUskx6eFXhoHy7HL3vMqzviuq:9EkosJ6eAHMHL3Eqzviu
TLSH
T17D048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-13344.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13344.exe
Size 184KB
SHA256 77df64a93eb3cd1eceb2c5df70023836f3f4880661f66b7e128e17cefa3b6df0
MD5 128736ea1d479cc7712302e1ac604b76
SHA1 952fef48f95f2d8b04be98179460654213c0f954
SHA512 f9e92673a16bf5a99e0f6ad852d6a1fda4309f2d750f0de1c9354e87a9e51b672e49387bf5fbeffd2902fe0417c0aa3d84e345e573d1de4db60a3f9cbb12df13
SSDEEP 3072:SEUjVAo5LRUskx6eFXhoHy7HT3vMqzviuq:SEVoAJ6eAHMHT3Eqzviu
TLSH
T1E5048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-14164.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
Size 184KB
SHA256 d28f4088bd165a515ef8a090cb1428d92ec4956aba9a7a75c2fecfb8078f44aa
MD5 f2ec175f064786faca9773d2c8664d48
SHA1 27ff9255356e2e36363c9edb3b71152d656e2178
SHA512 304ac85b6427de261104f5d4fedc150110752d5125bcecd88924aa02326d7748f8d0d8bc59bf52f2f9068fac4398b2c0555cd1f0bf88e41e9fd1962ba85bf3a9
SSDEEP 3072:OEUjVAo5LRUskx6eFXhoHy7Hw3vMqzviuq:OEVoAJ6eAHMHw3Eqzviu
TLSH
T1EB048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-15221.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15221.exe
Size 184KB
SHA256 4eaacb82f408de97a4d146a88492ea4e7bcd348e933810814a3a1422de3b11ad
MD5 5e0e94b35f415ab77112e750cbcfdd67
SHA1 7dc1410d27846903f84e9f2d2768f1108afff391
SHA512 a4409d84e07c371f7027abe7fa5015bc5511e3fcf61e3faceee13b797c0b3c17659d43d30773cbee844bfea80125ce19bb22f52b76db5a75e67cb43c8a47362c
SSDEEP 3072:9EdjVAo5LRUskx6eFXhoHy7Hb3vMqzviuq:9EkoAJ6eAHMHb3Eqzviu
TLSH
T15D048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-15281.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
Size 184KB
SHA256 20ca55fbafda3f5ace66faed4e403826f8c60d6e3fe051350ccdc564c20f354f
MD5 9818097e43c9345d87ae6fe5a4dc36c0
SHA1 5a0b6976b50a81a7028c98dffe1ae73ff7166926
SHA512 641fa5af43de0fa42dbb835bc865f00f49dace6dd783a9dd3676a15d3da02361fd818b4fa8c6033ea08f2b3e91a3a253f4abc1ec6853626685a6c66496525508
SSDEEP 3072:9EUjVAo5LRUskx6eFXhoHy7YP3vMqzviuq:9EVoAJ6eAHMYP3Eqzviu
TLSH
T111048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18084.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18084.exe
Size 184KB
SHA256 b66ada9f05bd39159b122d3cc79c2af26fe685716e23d12e0409412e3b7304bb
MD5 ab15387c5e3e8024f22067e0b26cabb2
SHA1 5c91d2ef51a9fbf54b29b856619e4915fd595eac
SHA512 56d1aaaf8b3ac2426f8c3383a388586b65fc19eae7d707c399c943550e0a3fc9e161442e20fd1ac0ce883da7bddc2549e0ba9bd0745477288d73da3a11922ddf
SSDEEP 3072:7vdjVAo5LUUskx6eFXhoHy7HU3vMqzviuq:7vkoNJ6eAHMHU3Eqzviu
TLSH
T122048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18619.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18619.exe
Size 184KB
SHA256 1ede2fbf0bef286c1767b4f6a8965276a74a120c1cafb194c47ed2d0d1f39aa3
MD5 4ec0d49e872986a7ed2a76237c42d83a
SHA1 039e1c7d4167103ad0ea76682bfc2930cd5daf55
SHA512 493ade3b7b74644017d47b9ab6ced9101920bd255af2959c8260cc3d612479aa2521bb98b31f1260ffb246b0561d41c5dcac9237a375f368c579d36c11e42fb5
SSDEEP 3072:9EUjVAo5LXUskx6eFXhoHy7Yl3vMqzviuq:9EVoiJ6eAHMYl3Eqzviu
TLSH
T137048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-19283.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
Size 184KB
SHA256 31a7953b52675df51403da5c5c1e89362bc7657f545f23fab4b8681a165c5c0c
MD5 846cb02aad52df963265f44fb8c5c0d0
SHA1 5a8855f626d39f8bee105fc90b83b0d34d62e2ef
SHA512 f30be305d61d25513ad3916c651792793613b6d0f8fa8b8ed6d3005274f8da03e49a336638dc168c8e7b80e2b7d978f4cdfbe4f0afec5f8c9cca5edeaf5cd16e
SSDEEP 3072:OEUjVAo5LOUskx6eFXhoHy7Hw3vMqzviuq:OEVorJ6eAHMHw3Eqzviu
TLSH
T1A1048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-19475.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
Size 184KB
SHA256 fc08945928431202fd0ae0a73c901cb034afd058cf7b3ca403584f42ef824db7
MD5 5c7b7aac868e6eb967b831b6808b2cf5
SHA1 ce12e3f7727e5b277596d99aaaf573593314190a
SHA512 e5ec1c25d5ebcbfe68c94f5aa9a8300e78fd32bcd9a9bb43e0a38809e2f66f0bc59c8180e33f7acd82a449162706a8a02f8c51e91d6062cdfa3b56fee3de6682
SSDEEP 3072:9EdjVAo5LdUskx6eFXhoHy7HJ3vMqzviuq:9EkoEJ6eAHMHJ3Eqzviu
TLSH
T168048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-20029.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20029.exe
Size 184KB
SHA256 4492fdc7f44749669a831346a7420c9a94f936ee4ddf613113d09eff1d67805b
MD5 01604f1cbb32ccfdec4bfb1c8aadeba9
SHA1 ae22bd15bf89799f351ad4624895ddad7ac26bcd
SHA512 ce45b275a33f14f3f66a11a56122c5d6cb9a20a4b3da426a563af56997be001d2a7b10b5236ed647ce18f6d3f71ed57e422de828250369135069f84e6f1f38d3
SSDEEP 3072:9EdjVAo5LRUskx6eFXhoHy7HJ3vMqzviuq:9EkoAJ6eAHMHJ3Eqzviu
TLSH
T16F048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-20849.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20849.exe
Size 184KB
SHA256 65ce4219f6d0b98483e7a9d95fb653d1aeb56ad190d098a8828d73d5e0eacfc9
MD5 a3dfb3805c1fe269698a264a5e6f81b4
SHA1 b28abad12e88ab4753a34135cd01b3c67559b418
SHA512 7f146d578d870c5fc24cc033a21a1f4f369e604aa76e6d57a5558576e920c225f7b95a3986cc16ea5ccb888d05bf0786fe050e430438fcdef2afb2a93d99e6d9
SSDEEP 3072:9EUjVAo5LRUskx6eFXhoHy7HD3vMqzviuq:9EVoAJ6eAHMHD3Eqzviu
TLSH
T18E048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-24872.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-24872.exe
Size 184KB
SHA256 091cfde487446dafad0611b03eed404364856aa673c42fb47f8f417dc49d163a
MD5 dea094d7706b769b597211d555c38e5b
SHA1 7e77045d3463e9fb8a81a431832716b0c41fc2f5
SHA512 e64d4e3fec65b70ec4255c23649ba9a9b250d8aaada6643b94092cab13305798a1bfca8a69309bd15fec691f2aeccc8eb6268f26fc74845a996266ab828f3460
SSDEEP 3072:9EdjVAo5LTUskx6eFXhoHy7HL3vMqzviuq:9EkouJ6eAHMHL3Eqzviu
TLSH
T11F048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-31462.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31462.exe
Size 184KB
SHA256 b27afb370fe91201cad0e8c2847b2506d8fd60657ff4a363edbaa3a406f7e21a
MD5 8f66d5ad0c0f8bf5af58d113cfc2517f
SHA1 f0bbb53710494edbed9b327278dda80e4a6a18b9
SHA512 4e4c60ea768dfc5d74db3c53455b3e717fad6c4b23336af3417a9883186cd2d6e1b6d15c3a6682004d271aa49c520d010244748e23abb46616cda28e8c158e3c
SSDEEP 3072:9EUjVAo5LRUskx6eFXhoHy7Hz3vMqzviuq:9EVoAJ6eAHMHz3Eqzviu
TLSH
T1E0048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-32089.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32089.exe
Size 184KB
SHA256 410c48c3329e378cb7f82206baf7623c66245a2169b51912fd58775b2029cf8f
MD5 b8f46aeecc77fbccb5d198917d088c9a
SHA1 2fecfaca681e7e90b642da3e6bb29c3916df1145
SHA512 21fb229b051e3f0309f0c0d9eeda9ea7098b393206aa64e4e8cc4c8f456653f2e5f3a55702a82ed54215fb3c185c80e0644695bab1a8c6fd2787d4853142c830
SSDEEP 3072:9EUjVAo5LRUskx6eFXhoHy7YD3vMqzviuq:9EVoAJ6eAHMYD3Eqzviu
TLSH
T12A048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-32678.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32678.exe
Size 184KB
SHA256 f39093b73583689035cf7424f2e7cdc0b4a3d26f94802315edd75dc0911af92c
MD5 faf3e9be6a72451bee196dfc6302535b
SHA1 99666b515dd347c54328430e0945394cd63dc759
SHA512 f3667065602b4d5a3972330c292243e0db4b65dd63e48ca05484078393aede093fcf110206a80706cc33f66d7bd20eb9396d4ad8f979d4b129a3f2ec320768c6
SSDEEP 3072:FEdjVAoVLRUskx6LFXhoHy7HJ3vMqzviuq:FEkosJ6LAHMHJ3Eqzviu
TLSH
T107048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-33883.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33883.exe
Size 184KB
SHA256 d5ddccbc7faed8ba9627c86967a96ba895110f56255a567102a11d9dde145aaa
MD5 9af11419a3e86f0745965671dfcacb29
SHA1 8366a2ceb7de72c9930a78fa112014b32771a0c1
SHA512 5715ee15c6fc8f17785e32a6b64eb173eb151aeea0f77e0d8cc6a1e7517a0cc1197dd7d0b0a77e931c30d008006eaf20e7a3186f11456f99da0c0b1a9739d6fc
SSDEEP 3072:9EUjVAo5LRUskx6eFXhoHy7YT3vMqzviuq:9EVoAJ6eAHMYT3Eqzviu
TLSH
T12C048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37967.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37967.exe
Size 184KB
SHA256 9f3b2ae7eed88421397ae9deedfa613a6632927fdb00cb844d4b74be76338efc
MD5 71790f1ef4d7499991d8105f1ac3c3a2
SHA1 b88f0ed8d3c662b5c83ebc5f610dcef3c88c0741
SHA512 9caa208220a03b09cb551f747958bb772a28fcdfdb66a4252de696b0fa1630373a59d43b05ecccaff621a5b6fe8af6c5b6bd58043625e66a2aec4aedeb237e62
SSDEEP 3072:9EdjZAo5LRUskx6eFXhoHy7H03vMqzviuq:9EooAJ6eAHMH03Eqzviu
TLSH
T107048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-39703.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39703.exe
Size 184KB
SHA256 bf0a07150f859d523d3976866bd69ab9e90d277ec0db7eec8675ece6dfefebab
MD5 64f0887cfac0ebfbdea130c8e25eb952
SHA1 d9f96d242901e2c4496cd31c6af9ee8cd4c39400
SHA512 d077da1d0f30163d35cda287f09a87eca3054690d1aa9f1f42230cb637437a83a8f1f055db2eef95852c88cc7b7659e51f95ee651bfe0ce5cf395de118c242bc
SSDEEP 3072:9EdjVAoVLRUskx6eFXhoHy7HJ3vMqzviuq:9EkosJ6eAHMHJ3Eqzviu
TLSH
T1E0048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-40350.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40350.exe
Size 184KB
SHA256 598a6de24cb7adb0e4ba832eeef7e775c60e003870eb3f5b93c144f120327e06
MD5 c87adeb896e9c21f53c76d591d48c47f
SHA1 75910cfdd1e59f3462fe894e4431ef50e4a0dc24
SHA512 5da262faf94fe676c4aba7fd2f38b192e02c016906c06c47ef010ac9dfd2d504e8708cb8f0781a174966715c91172ca7c32821d5507e1b0aaa7607fd7c6faf7d
SSDEEP 3072:fEUjVAo5LRUskx6eFXhoHy7YJ3vMqzviuq:fEVoAJ6eAHMYJ3Eqzviu
TLSH
T1D3048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-40715.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
Size 184KB
SHA256 a4649d894a1af0900573508132af92126b2e187303a32f5d6586f110530960c0
MD5 be658122f25558a4b11119a4bb866136
SHA1 a536cbcdbd66d0312085be5859d3e134cf86f95e
SHA512 4621498510472cec8740f425407d2e711cd43807f5a44e18e32013a9afcf2ce3c3b1c8858cd9ce60e0c18d8dac7403ae2a78b2e977643e2b49ae2a4930284918
SSDEEP 3072:9EUjVAo5LRUskx6eFXhoHy7Yi3vMqzviuq:9EVoAJ6eAHMYi3Eqzviu
TLSH
T118048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-429.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-429.exe
Size 184KB
SHA256 42efa9c62f435966daf6552c9a255c8c6aa552c45f2d954e39d70563d6c92a2f
MD5 6a8b29291afc6e8da3da4d90b6a2bbf9
SHA1 ee8d6b981b981d8ceb00555dd4c7e5366a6a99f0
SHA512 a0492557ade8d77a38086677ed496808f0c7bb70a5621916af0c15b3be89a9a2d83186cac58cb53a180da5e47635a579c8076eda3333925ef8b2fdc666921713
SSDEEP 3072:9EdjVAo5LTUskx6eFXhoH/7HL3vMqzviuq:9EkouJ6eAHTHL3Eqzviu
TLSH
T1C0048F628970BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-47339.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
Size 184KB
SHA256 bcad9b6e479f859ad9e05f98fe0f947775c6753472e88dffb3eedf1ffae0fb7f
MD5 c0277d5b415bf1323dddc8f9a6ee93ce
SHA1 90246a7232b547ba8b169aa058abe9f752760b10
SHA512 b3b1b37b5bed2973ac503225686f8c18b35f2dee6ab54dbb11143b902b045b246319fd45701ddf4d10cdabd885e6f98171f8addf44e8b607e0abb4fe9ccb29b8
SSDEEP 3072:9EdjZAo5LRUskx6eFXhoHy7Hp3vMqzviuq:9EooAJ6eAHMHp3Eqzviu
TLSH
T1F2048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-48255.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
Size 184KB
SHA256 018d956439d12d926acc31079e75eec116151cab4dd28482741b89b0f8234505
MD5 12b2553d1805f9071180cf7307df67f8
SHA1 ebe4f0946d66761074aee67021b0a84f16ea6b0c
SHA512 411986469d6f3e8ad79e32b1d64ae01c9f50811ce056e4e087e479ab3e95fa9fafd4513e4bff20001442b841857b76f05e0324f774e0142f53756db405ff22d5
SSDEEP 3072:9EUjVAo5LRUskx6eFXhoHy7Yl3vMqzviuq:9EVoAJ6eAHMYl3Eqzviu
TLSH
T1C0048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-48750.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-48750.exe
Size 184KB
SHA256 b58cedfbbbf584ecee1b674ab1923317c06b4f27d9476fb34062bf51584f837a
MD5 c6ed5f523aa2bcb0ff97381d9aedda0d
SHA1 b1a3a32527991c8bda8a2cde860fab56a75fa9bd
SHA512 acf18c9fc3e97edc3cc08f042be725aa9a39e45e578fb17ebcfd50fca68068b3923fb78b1b9e22b9377fb44b142b4a651851d46794c5b1210a22680374b981b1
SSDEEP 3072:9EdjZAo5LRUskx6eFXhoHy7HL3vMqzviuq:9EooAJ6eAHMHL3Eqzviu
TLSH
T1F2048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-51955.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51955.exe
Size 184KB
SHA256 2b739ac8a68911e1be33a05213ea5f64fb10fcb8bf8064d081afa0d59a46d692
MD5 6bb88000132fd50ea769c8fb01787554
SHA1 c8664b22198d041ab623de0c9ded42b3a31db01b
SHA512 663b1c0de148665a835addf22bfdcc81dac7fdda4dc7a44304b33d773e1c583c73cbb4748040576d1db87d4a1e9ac5f548b32307fab1cbb268c67e7bac5690a9
SSDEEP 3072:9EdjVAo5LTUskx6eFXhoH/7HH3vMqzviuq:9EkouJ6eAHTHH3Eqzviu
TLSH
T10C048F628970BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-52059.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
Size 184KB
SHA256 7965e19b604929e10b3df8c511d869598c7be1965fc725edb61b63a563f8c68b
MD5 2948b4a318a7227f86a3be447ec1c58a
SHA1 9b90731f19e39a3898a14bec6cc6eaf7e1f87ee1
SHA512 21fddc459c7810411d77d1033f30df25d87d073d5ac6080abaf44308146d8d7fd1f6fed3de70c41c5f00457c8165d2ebc3348754f530b86e6a8d0d70ff063763
SSDEEP 3072:9EdjVAo5LdUskx6eFXhoHy7HA3vMqzviuq:9EkoEJ6eAHMHA3Eqzviu
TLSH
T14A048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-53675.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53675.exe
Size 184KB
SHA256 cea1f1a10b7fc2be5c286275cfb900b376ce7f5c5ff88ee658941e9c72b3bf59
MD5 897e869713f3fc8aca06fe0e7e0bb60d
SHA1 2aa8e651e9116c9d1aff63792f554bd06ca1dee0
SHA512 572b47872fd3aadbcee91db9a266a0839f9568f3afe9aa50b5f4f63ddcc23adf9e53f4581264c82459366738fc2ec6dbe2f142611eeef39eeb8fc8b054078dfa
SSDEEP 3072:9EdjVAo5LRUskx6eFXhoHy7Hw3vMqzviuq:9EkoAJ6eAHMHw3Eqzviu
TLSH
T1A4048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-55699.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-55699.exe
Size 184KB
SHA256 3e1461f9332b9c092b0d92473013508e2dd723a7e01d7912f86993740e91d5c7
MD5 5126b263a7d8c5bf4ed2cd14f552a1fd
SHA1 4e417070b397a60aac0cb0d4f74bcc1d324ff630
SHA512 d70e7b417b3947d7e4d099fc84e1b11ad238bece150145a3c27a82ad7dd5f610eeea8056aa70c42c17c0c0ad6ee57d5c0b6897fd195619390b3b56473e6f7adc
SSDEEP 3072:9EUjVAo5LRUskx6eFXhoHy7HT3vMqzviuq:9EVoAJ6eAHMHT3Eqzviu
TLSH
T17E048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-56725.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56725.exe
Size 184KB
SHA256 3f5e01bb7eb6749b4451f33c212eb99ed902e8ccf2540a36e2931af9cff0c290
MD5 1dffc475d9ebeeeff91df7757ae2a886
SHA1 cb82bc288bf4e2c0edd40d96d4c6102e9ee9f7be
SHA512 aeb5f3e7fedd0fbdd58057e6dacc271b9103ee1939bb92b4192a2fccb5ff01777f54e5cc4a07d785ea83b5d91d592f275fe01036f55e22300aa9ad3d8957eb13
SSDEEP 3072:9EdjVAo5LRUskx6eFXhoHy7H/3vMqzviuq:9EkoAJ6eAHMH/3Eqzviu
TLSH
T107048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59326.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe
Size 184KB
SHA256 f85d28dc25ab0b42567e188f664cf411be12e33304f243695aa34c4f4043b7d6
MD5 b32e0860d88ee4a8d42e3735bd30179e
SHA1 711933bb55859609d6aa3b7bbf99bc3bd494adff
SHA512 bc74c580d683c1e1a1617d1587c17f97e982c797c44421404511653a9545a7f1fa6a1334fa24d3b91ef983ba943b67d7b1597d3af8022ea6eb9e5f9d0e36d316
SSDEEP 3072:9EUjVAo5LRUskx6oFXhoHy7Hw3vMqzviuq:9EVoAJ6oAHMHw3Eqzviu
TLSH
T1F2048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59553.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59553.exe
Size 184KB
SHA256 bc941251d2c1ae3b468a3ff4727ba144489b69adf85b8d973938092a2da60e24
MD5 bd4ff0eaf65f4f004c03a899b2c6cfbd
SHA1 d390e339d7a8553f8f08235c5a288dccf65c6c35
SHA512 39e1158a45952ee44a419f9cbd05aa49b4aecc7b96406a387dd541a110557f8143fabaf83b97d17f945b6bb4991908af6115d71a5fffcfaa2e567e9c0d96c417
SSDEEP 3072:9EdjVAo5LRUskx6eFXhoHy7Ho3vMqzviuq:9EkoAJ6eAHMHo3Eqzviu
TLSH
T18F048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-62590.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62590.exe
Size 184KB
SHA256 dc5aa7d665147624a7ac24b14149801d7cb83298217a7fd93e9ee675c75b5173
MD5 178d1ad03e4be87be71412aeb6c0ff81
SHA1 b59b56f72066d78298bc01f1945cd3b1329030a7
SHA512 3a6ed6eb7208ce7373750f5e154d16c155922b37b0d7888e241e05fd1cf44563765ef868415c2d6418746c4edac9be930e06dcc446c93a099ccdf94b17b99648
SSDEEP 3072:9EdjVho5LRUskx6eFXhoHy7HL3vMqzviuq:9EtoAJ6eAHMHL3Eqzviu
TLSH
T17F048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-6261.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exe
Size 184KB
SHA256 ef6e5044725ad884b5be5ac9c02c805ad0b6731c5788cd0bc3090c9be02991f6
MD5 0810590e36461e7209517bd714b82c04
SHA1 3fe8c5d52bba2840eec51403002099dab9bdf7bf
SHA512 27b0d9595b8ccb5ec3402ce107a0505615404785a6098280f378adf2112e65f010a5661de4e49a7f25d1d6848269e72cac35b55376932603e235bba9750e3f08
SSDEEP 3072:9EdjVAo5LRUskx6eFXhoHy7H93vMqzviuq:9EkoAJ6eAHMH93Eqzviu
TLSH
T12A048F6289B0BB13E951093417E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-9570.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
Size 184KB
SHA256 0ae07da19cacbf4ba727c9e47271a87a14172a7b3b3e8b20893b78ba577c33cb
MD5 a29f20876afafe480264337f9c0f4776
SHA1 116af5fbc194111929919fefd22c907e52ebe76f
SHA512 11c5d976769377a772145d1336fb0b4f0c772a3a9c63c89f07bf4b71c305abf69ce99a9750fdd845ef9fb85d7bbb2fd9646e9bc309709e426a7315c68af1eb0e
SSDEEP 3072:9SdjVAo5LTUskx6eFXhoHy7HL3vMqzviuq:9SkouJ6eAHMHL3Eqzviu
TLSH
T196048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-9591.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9591.exe
Size 184KB
SHA256 aef4d5527ec613c03df7aca168c7d08ce303417dd9521c29803269e8a4fa8314
MD5 e80afd2d602ff851c5d68a1c95e7aa72
SHA1 0911ebf3e222fc7ff41291b9dac7ac06a7b515c0
SHA512 1da511a99b1fd0ea333a6d0016282251fea67de6d03d48b1ac30a8fce582d3821c27a3e2fe3fedf81325b62b065541d18157215a6e76924973acc6ce57220e3a
SSDEEP 3072:TEdjVAo5LdUskx6eFXhoHy7Hd3vMqzviuq:TEkoEJ6eAHMHd3Eqzviu
TLSH
T1A2048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349FA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads