7a42857108f616884669b24b5bb238678e4d8846085978476d148118d029002f

Analysis

max time kernel
150s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 11:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7a42857108f616884669b24b5bb238678e4d8846085978476d148118d029002f.exe
Size 468KB
Sample260916-n4wx2aar21
SHA256 7a42857108f616884669b24b5bb238678e4d8846085978476d148118d029002f
MD5 b5769d931a4dfb5fc28dc827ad3c2e03
SHA1 ec8662ccf26609a35966d91d61ee6fe00132b93e
SHA512 732f68ec2525bf2f97add7f11186bc75332960407d01216d6b390cdd0f7fbce18967c63cb98fffd06780968c8ef1f95c7abb86539e30135695f8c8a7e1cab2b8
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqwaMmgRVW93AlF:a96oGli6Sfl5Mf4WQAwazeW93
TLSH
T165A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 53 IoCs

pid	Process
1856	Unicorn-58273.exe
4436	Unicorn-35845.exe
3392	Unicorn-25491.exe
632	Unicorn-51361.exe
2148	Unicorn-51361.exe
2016	Unicorn-51724.exe
4428	Unicorn-1496.exe
2704	Unicorn-18195.exe
4132	Unicorn-38061.exe
1440	Unicorn-38061.exe
1992	Unicorn-18195.exe
1156	Unicorn-53193.exe
1592	Unicorn-45025.exe
2188	Unicorn-45025.exe
4404	Unicorn-45025.exe
3756	Unicorn-12907.exe
3372	Unicorn-26503.exe
684	Unicorn-27463.exe
2180	Unicorn-16349.exe
620	Unicorn-12.exe
2008	Unicorn-45684.exe
2712	Unicorn-45492.exe
2700	Unicorn-61273.exe
3784	Unicorn-45492.exe
4496	Unicorn-45492.exe
2400	Unicorn-61273.exe
3132	Unicorn-61273.exe
3916	Unicorn-61273.exe
4972	Unicorn-6016.exe
4424	Unicorn-15913.exe
4500	Unicorn-49929.exe
2484	Unicorn-38231.exe
548	Unicorn-21341.exe
4056	Unicorn-17257.exe
1296	Unicorn-37847.exe
4908	Unicorn-57713.exe
1180	Unicorn-57713.exe
3528	Unicorn-16873.exe
1452	Unicorn-16873.exe
3332	Unicorn-4620.exe
2424	Unicorn-54376.exe
980	Unicorn-8704.exe
1112	Unicorn-25403.exe
1248	Unicorn-7443.exe
3052	Unicorn-43453.exe
4244	Unicorn-12487.exe
4268	Unicorn-29037.exe
4740	Unicorn-49265.exe
3012	Unicorn-57625.exe
4200	Unicorn-4340.exe
3748	Unicorn-4340.exe
2728	Unicorn-44989.exe
4864	Unicorn-61517.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
420	3336	WerFault.exe	84
2828	1856	WerFault.exe	87
3660	4436	WerFault.exe	88
2504	3392	WerFault.exe	89
4876	2016	WerFault.exe	95
5008	632	WerFault.exe	93
3584	2148	WerFault.exe	94
1984	1440	WerFault.exe	101
2876	4428	WerFault.exe	98
312	1992	WerFault.exe	102
2672	2704	WerFault.exe	100
1064	4132	WerFault.exe	99
2220	2188	WerFault.exe	109
688	3756	WerFault.exe	111
3488	4404	WerFault.exe	110
3636	3372	WerFault.exe	112
2068	1156	WerFault.exe	107
2060	684	WerFault.exe	119
3412	1592	WerFault.exe	108
2828	2180	WerFault.exe	120
2552	2008	WerFault.exe	121
544	2712	WerFault.exe	123
1972	3916	WerFault.exe	127
4920	3784	WerFault.exe	125
4996	4496	WerFault.exe	126
4460	3132	WerFault.exe	129
3492	1180	WerFault.exe	148
3712	4908	WerFault.exe	147
2176	4740	WerFault.exe	175
1028	4864	WerFault.exe	181
4048	2400	WerFault.exe	128
5472	4800	WerFault.exe	192
5532	2512	WerFault.exe	204
5988	3012	WerFault.exe	176
5604	4172	WerFault.exe	217
5388	4024	WerFault.exe	219
6020	4540	WerFault.exe	235
5188	544	WerFault.exe	236
6004	3276	WerFault.exe	257
4804	3704	WerFault.exe	272
4352	5644	WerFault.exe	315
3800	5684	WerFault.exe	317
3720	3312	WerFault.exe	298
5560	2516	WerFault.exe	338
2896	5716	WerFault.exe	322
3432	4780	WerFault.exe	372
5744	5588	WerFault.exe	399
5972	6064	WerFault.exe	373
2068	5904	WerFault.exe	458
6252	5752	WerFault.exe	535
2612	3144	WerFault.exe
976	3952	WerFault.exe	583
2748	4468	WerFault.exe	652
5784	6416	WerFault.exe	728
5820	6568	WerFault.exe	734
1912	6372	WerFault.exe
6880	7120	WerFault.exe	788
2032	7044	WerFault.exe	830
6632	4772	WerFault.exe	767
5724	1728	WerFault.exe	793
5612	6800	WerFault.exe
2528	5688	Process not Found	902
4620	2232	Process not Found	925
1400	5008	Process not Found	932

System Location Discovery: System Language Discovery 1 TTPs 53 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29037.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7a42857108f616884669b24b5bb238678e4d8846085978476d148118d029002f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17257.exe

Suspicious use of SetWindowsHookEx 50 IoCs

pid	Process
3336	7a42857108f616884669b24b5bb238678e4d8846085978476d148118d029002f.exe
1856	Unicorn-58273.exe
4436	Unicorn-35845.exe
3392	Unicorn-25491.exe
632	Unicorn-51361.exe
2148	Unicorn-51361.exe
2016	Unicorn-51724.exe
4428	Unicorn-1496.exe
4132	Unicorn-38061.exe
1440	Unicorn-38061.exe
2704	Unicorn-18195.exe
1992	Unicorn-18195.exe
1156	Unicorn-53193.exe
1592	Unicorn-45025.exe
2188	Unicorn-45025.exe
4404	Unicorn-45025.exe
3372	Unicorn-26503.exe
3756	Unicorn-12907.exe
684	Unicorn-27463.exe
2180	Unicorn-16349.exe
2008	Unicorn-45684.exe
620	Unicorn-12.exe
3916	Unicorn-61273.exe
2712	Unicorn-45492.exe
2400	Unicorn-61273.exe
3132	Unicorn-61273.exe
3784	Unicorn-45492.exe
2700	Unicorn-61273.exe
4496	Unicorn-45492.exe
4972	Unicorn-6016.exe
4424	Unicorn-15913.exe
4500	Unicorn-49929.exe
2484	Unicorn-38231.exe
548	Unicorn-21341.exe
4056	Unicorn-17257.exe
1296	Unicorn-37847.exe
1180	Unicorn-57713.exe
4908	Unicorn-57713.exe
1112	Unicorn-25403.exe
3332	Unicorn-4620.exe
980	Unicorn-8704.exe
3528	Unicorn-16873.exe
1452	Unicorn-16873.exe
2424	Unicorn-54376.exe
1248	Unicorn-7443.exe
3052	Unicorn-43453.exe
4244	Unicorn-12487.exe
4268	Unicorn-29037.exe
4740	Unicorn-49265.exe
3012	Unicorn-57625.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 1856	3336	7a42857108f616884669b24b5bb238678e4d8846085978476d148118d029002f.exe	87
PID 1856 wrote to memory of 4436	1856	Unicorn-58273.exe	88
PID 3336 wrote to memory of 3392	3336	7a42857108f616884669b24b5bb238678e4d8846085978476d148118d029002f.exe	89
PID 4436 wrote to memory of 2148	4436	Unicorn-35845.exe	94
PID 3392 wrote to memory of 632	3392	Unicorn-25491.exe	93
PID 1856 wrote to memory of 2016	1856	Unicorn-58273.exe	95
PID 632 wrote to memory of 4428	632	Unicorn-51361.exe	98
PID 2016 wrote to memory of 4132	2016	Unicorn-51724.exe	99
PID 3392 wrote to memory of 2704	3392	Unicorn-25491.exe	100
PID 2148 wrote to memory of 1440	2148	Unicorn-51361.exe	101
PID 4436 wrote to memory of 1992	4436	Unicorn-35845.exe	102
PID 4428 wrote to memory of 1156	4428	Unicorn-1496.exe	107
PID 4132 wrote to memory of 2188	4132	Unicorn-38061.exe	109
PID 2704 wrote to memory of 4404	2704	Unicorn-18195.exe	110
PID 1992 wrote to memory of 1592	1992	Unicorn-18195.exe	108
PID 632 wrote to memory of 3756	632	Unicorn-51361.exe	111
PID 2148 wrote to memory of 3372	2148	Unicorn-51361.exe	112
PID 1440 wrote to memory of 684	1440	Unicorn-38061.exe	119
PID 1156 wrote to memory of 2180	1156	Unicorn-53193.exe	120
PID 4428 wrote to memory of 2008	4428	Unicorn-1496.exe	121
PID 2188 wrote to memory of 620	2188	Unicorn-45025.exe	122
PID 1992 wrote to memory of 2712	1992	Unicorn-18195.exe	123
PID 4132 wrote to memory of 3784	4132	Unicorn-38061.exe	125
PID 2704 wrote to memory of 4496	2704	Unicorn-18195.exe	126
PID 1592 wrote to memory of 2700	1592	Unicorn-45025.exe	124
PID 3756 wrote to memory of 3132	3756	Unicorn-12907.exe	129
PID 4404 wrote to memory of 2400	4404	Unicorn-45025.exe	128
PID 3372 wrote to memory of 3916	3372	Unicorn-26503.exe	127
PID 684 wrote to memory of 4972	684	Unicorn-27463.exe	132
PID 2180 wrote to memory of 4424	2180	Unicorn-16349.exe	141
PID 2008 wrote to memory of 4500	2008	Unicorn-45684.exe	142
PID 1156 wrote to memory of 2484	1156	Unicorn-53193.exe	143
PID 3916 wrote to memory of 548	3916	Unicorn-61273.exe	144
PID 2712 wrote to memory of 4056	2712	Unicorn-45492.exe	145
PID 3372 wrote to memory of 1296	3372	Unicorn-26503.exe	146
PID 2700 wrote to memory of 1180	2700	Unicorn-61273.exe	148
PID 4496 wrote to memory of 4908	4496	Unicorn-45492.exe	147
PID 2400 wrote to memory of 3528	2400	Unicorn-61273.exe	149
PID 3784 wrote to memory of 1452	3784	Unicorn-45492.exe	150
PID 3132 wrote to memory of 3332	3132	Unicorn-61273.exe	151
PID 1592 wrote to memory of 2424	1592	Unicorn-45025.exe	152
PID 4972 wrote to memory of 980	4972	Unicorn-6016.exe	153
PID 684 wrote to memory of 1112	684	Unicorn-27463.exe	154
PID 620 wrote to memory of 1248	620	Unicorn-12.exe	171
PID 4424 wrote to memory of 3052	4424	Unicorn-15913.exe	172
PID 2180 wrote to memory of 4244	2180	Unicorn-16349.exe	173
PID 4500 wrote to memory of 4268	4500	Unicorn-49929.exe	174
PID 2484 wrote to memory of 4740	2484	Unicorn-38231.exe	175
PID 1180 wrote to memory of 3012	1180	Unicorn-57713.exe	176
PID 548 wrote to memory of 4200	548	Unicorn-21341.exe	177
PID 1112 wrote to memory of 3748	1112	Unicorn-25403.exe	178
PID 4908 wrote to memory of 2728	4908	Unicorn-57713.exe	179
PID 3332 wrote to memory of 4864	3332	Unicorn-4620.exe	181
PID 980 wrote to memory of 4212	980	Unicorn-8704.exe	183
PID 1296 wrote to memory of 4940	1296	Unicorn-37847.exe	182
PID 2424 wrote to memory of 3124	2424	Unicorn-54376.exe	184
PID 1452 wrote to memory of 1988	1452	Unicorn-16873.exe	185
PID 3528 wrote to memory of 3092	3528	Unicorn-16873.exe	186

C:\Users\Admin\AppData\Local\Temp\7a42857108f616884669b24b5bb238678e4d8846085978476d148118d029002f.exe
"C:\Users\Admin\AppData\Local\Temp\7a42857108f616884669b24b5bb238678e4d8846085978476d148118d029002f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58273.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58273.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35845.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38061.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27463.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8704.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61517.exe
        9⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17465.exe
        10⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3816.exe
        11⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        12⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
        13⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41881.exe
        14⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42849.exe
        15⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
        16⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52953.exe
        17⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47385.exe
        18⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19211.exe
        19⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37401.exe
        20⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 716
        16⤵
        Program crash
        
        PID:6252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 712
        13⤵
        Program crash
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25403.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4340.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17465.exe
        9⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40765.exe
        10⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        11⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60433.exe
        12⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
        13⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6668.exe
        14⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exe
        15⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22061.exe
        16⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2740.exe
        17⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35901.exe
        18⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
        19⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14484.exe
        20⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 716
        16⤵
        Program crash
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18339.exe
        15⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        16⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38449.exe
        17⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59549.exe
        18⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        19⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27033.exe
        20⤵
        
        PID:976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6064 -s 692
        13⤵
        Program crash
        
        PID:5972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 624
        10⤵
        Program crash
        
        PID:5388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 728
        7⤵
        Program crash
        
        PID:2060
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 696
        6⤵
        Program crash
        
        PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21341.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4340.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17465.exe
        9⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32213.exe
        10⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        11⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17272.exe
        12⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
        13⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        14⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8884.exe
        15⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        16⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64297.exe
        17⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
        18⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60369.exe
        19⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        14⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        15⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17645.exe
        16⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        17⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29285.exe
        18⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 596
        11⤵
        Program crash
        
        PID:4804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 608
        7⤵
        Program crash
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37847.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61517.exe
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63349.exe
        8⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4584.exe
        9⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        10⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58845.exe
        11⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6336.exe
        12⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35449.exe
        13⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64909.exe
        14⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60737.exe
        15⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35133.exe
        16⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exe
        17⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12128.exe
        18⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 632
        9⤵
        Program crash
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42627.exe
        8⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59317.exe
        9⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        10⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
        11⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62309.exe
        12⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25199.exe
        13⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1230.exe
        14⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50125.exe
        15⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57748.exe
        16⤵
        
        PID:4448
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 656
        6⤵
        Program crash
        
        PID:3636
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 740
        5⤵
        Program crash
        
        PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45025.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57713.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57625.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28674.exe
        9⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15492.exe
        10⤵
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        11⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46785.exe
        12⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63705.exe
        13⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
        14⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15709.exe
        15⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43633.exe
        16⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe
        17⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4380.exe
        18⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22165.exe
        19⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41485.exe
        20⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 724
        13⤵
        Program crash
        
        PID:5744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 724
        13⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 608
        12⤵
        Program crash
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20899.exe
        9⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3728.exe
        10⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53609.exe
        11⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
        12⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        13⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25199.exe
        14⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3560.exe
        15⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45657.exe
        16⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        17⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37261.exe
        18⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38325.exe
        19⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 636
        17⤵
        Program crash
        
        PID:5724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 652
        15⤵
        Program crash
        
        PID:2612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5644 -s 724
        11⤵
        Program crash
        
        PID:4352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 720
        9⤵
        Program crash
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16867.exe
        8⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40957.exe
        9⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48269.exe
        10⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19593.exe
        11⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        12⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
        13⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        14⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        15⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6440.exe
        16⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49305.exe
        17⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19211.exe
        18⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 740
        8⤵
        Program crash
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54376.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61517.exe
        7⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29525.exe
        8⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32213.exe
        9⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        10⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53609.exe
        11⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24201.exe
        12⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
        13⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53233.exe
        14⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        15⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6544.exe
        16⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10924.exe
        17⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27675.exe
        18⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6416 -s 628
        16⤵
        Program crash
        
        PID:5784
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 668
        6⤵
        Program crash
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17257.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52316.exe
        7⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58689.exe
        8⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15212.exe
        9⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11616.exe
        10⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24201.exe
        11⤵
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60581.exe
        12⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        13⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
        14⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        15⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17187.exe
        16⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2896.exe
        17⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44993.exe
        18⤵
        
        PID:6216
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 740
        6⤵
        Program crash
        
        PID:544
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 688
        5⤵
        Program crash
        
        PID:312
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 728
      4⤵
      Program crash
      PID:3660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38061.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45025.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53925.exe
        8⤵
        
        PID:228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26401.exe
        9⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46349.exe
        10⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51341.exe
        11⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58772.exe
        12⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
        13⤵
        
        PID:312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15709.exe
        14⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39741.exe
        15⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        16⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
        17⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54261.exe
        18⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe
        19⤵
        
        PID:6788
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 712
        6⤵
        Program crash
        
        PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16873.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61517.exe
        7⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59265.exe
        8⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51201.exe
        9⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7340.exe
        10⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        11⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe
        12⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47784.exe
        13⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29963.exe
        14⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56321.exe
        15⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19211.exe
        16⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37401.exe
        17⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
        6⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        7⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8668.exe
        8⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45337.exe
        9⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17272.exe
        10⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
        11⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3892.exe
        12⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6663.exe
        13⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64541.exe
        14⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        15⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55605.exe
        16⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 636
        12⤵
        
        PID:5640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 744
        6⤵
        Program crash
        
        PID:4920
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 760
        5⤵
        Program crash
        
        PID:1064
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 724
      4⤵
      Program crash
      PID:4876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 720
    3⤵
    - Program crash
    PID:2828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25491.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25491.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1496.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53193.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15913.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43453.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55077.exe
        9⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50905.exe
        10⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1040.exe
        11⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63593.exe
        12⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46785.exe
        13⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5760.exe
        14⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34105.exe
        15⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18065.exe
        16⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17053.exe
        17⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37769.exe
        18⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17645.exe
        19⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        20⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 636
        20⤵
        Program crash
        
        PID:6632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6372 -s 656
        19⤵
        Program crash
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25583.exe
        16⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58381.exe
        17⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39985.exe
        18⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
        19⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27697.exe
        20⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64392.exe
        10⤵
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
        11⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58845.exe
        12⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
        13⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21469.exe
        14⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        15⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        16⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19425.exe
        17⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57748.exe
        18⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17609.exe
        19⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7303.exe
        9⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59369.exe
        10⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44481.exe
        11⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7288.exe
        12⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
        13⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        14⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        15⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53529.exe
        16⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63529.exe
        17⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        18⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57489.exe
        19⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18481.exe
        20⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 716
        14⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35211.exe
        8⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17849.exe
        9⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55477.exe
        10⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60625.exe
        11⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57833.exe
        12⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37613.exe
        13⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25199.exe
        14⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19705.exe
        15⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17645.exe
        16⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64209.exe
        17⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41153.exe
        18⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38325.exe
        19⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6800 -s 708
        17⤵
        Program crash
        
        PID:5612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5536 -s 752
        13⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 732
        11⤵
        Program crash
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12487.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14044.exe
        8⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59265.exe
        9⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14252.exe
        10⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60625.exe
        11⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
        12⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19113.exe
        13⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        14⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39357.exe
        15⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56565.exe
        16⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9772.exe
        17⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        18⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24189.exe
        19⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 652
        9⤵
        Program crash
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52228.exe
        8⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60521.exe
        9⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        10⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37221.exe
        11⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe
        12⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55013.exe
        13⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15901.exe
        14⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        15⤵
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55937.exe
        16⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11884.exe
        17⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27675.exe
        18⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30541.exe
        19⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
        13⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        14⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55553.exe
        15⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37157.exe
        16⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24189.exe
        17⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 744
        7⤵
        Program crash
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49265.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3676.exe
        8⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40957.exe
        9⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        10⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29681.exe
        11⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe
        11⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe
        12⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52901.exe
        13⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36513.exe
        14⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13456.exe
        15⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55937.exe
        16⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7416.exe
        17⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10208.exe
        18⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 640
        15⤵
        Program crash
        
        PID:2748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 724
        8⤵
        Program crash
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61216.exe
        7⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10256.exe
        8⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19489.exe
        9⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7340.exe
        10⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        11⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7680.exe
        12⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16529.exe
        13⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3264.exe
        14⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56845.exe
        15⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50125.exe
        16⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51573.exe
        17⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45237.exe
        18⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55621.exe
        19⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe
        13⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37385.exe
        14⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34749.exe
        15⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54261.exe
        16⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6892.exe
        17⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 744
        9⤵
        Program crash
        
        PID:6004
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 756
        6⤵
        Program crash
        
        PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29037.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10728.exe
        8⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39229.exe
        9⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10360.exe
        10⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7340.exe
        11⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7864.exe
        12⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        13⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42761.exe
        14⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21329.exe
        15⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        16⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        17⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        18⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27697.exe
        19⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7044 -s 648
        18⤵
        Program crash
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29667.exe
        14⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        15⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17187.exe
        16⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49985.exe
        17⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe
        18⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6568 -s 624
        16⤵
        Program crash
        
        PID:5820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 616
        12⤵
        Program crash
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10811.exe
        8⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        9⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
        10⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57833.exe
        11⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe
        12⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25199.exe
        13⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44401.exe
        14⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50125.exe
        15⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8656.exe
        16⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        17⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37017.exe
        18⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7120 -s 724
        16⤵
        Program crash
        
        PID:6880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 636
        12⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27427.exe
        7⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14340.exe
        8⤵
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64413.exe
        9⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51917.exe
        10⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10796.exe
        11⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10036.exe
        12⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47509.exe
        13⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        14⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65205.exe
        15⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        16⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8656.exe
        17⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31485.exe
        18⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20105.exe
        19⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 656
        9⤵
        Program crash
        
        PID:5188
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 724
        6⤵
        Program crash
        
        PID:2552
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 752
        5⤵
        Program crash
        
        PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12907.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4620.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61517.exe
        7⤵
        Executes dropped EXE
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        8⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40957.exe
        9⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        10⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58845.exe
        11⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10036.exe
        12⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6860.exe
        13⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        14⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48101.exe
        15⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
        16⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        17⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
        18⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 632
        9⤵
        Program crash
        
        PID:5604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 736
        8⤵
        Program crash
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
        6⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59265.exe
        7⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22613.exe
        8⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21217.exe
        9⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        10⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10036.exe
        11⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43617.exe
        12⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        13⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60353.exe
        14⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23701.exe
        15⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21833.exe
        16⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52445.exe
        17⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41485.exe
        18⤵
        
        PID:3888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 740
        6⤵
        Program crash
        
        PID:4460
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 724
        5⤵
        Program crash
        
        PID:688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 740
      4⤵
      Program crash
      PID:5008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45025.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16873.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4148.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        8⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32213.exe
        9⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        10⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20553.exe
        11⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4548.exe
        12⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26513.exe
        13⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        14⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
        15⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56025.exe
        16⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
        17⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45133.exe
        18⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27697.exe
        19⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe
        6⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59265.exe
        7⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-775.exe
        8⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        9⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60389.exe
        10⤵
        
        PID:736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35449.exe
        11⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        12⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57037.exe
        13⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        14⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4380.exe
        15⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42777.exe
        16⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
        17⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 724
        7⤵
        Program crash
        
        PID:5472
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 648
        6⤵
        Program crash
        
        PID:4048
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 652
        5⤵
        Program crash
        
        PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57713.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55160.exe
        7⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        8⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20553.exe
        9⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
        10⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22045.exe
        11⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2112.exe
        12⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31573.exe
        13⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50125.exe
        14⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42637.exe
        15⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2896.exe
        16⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37401.exe
        17⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5904 -s 712
        11⤵
        Program crash
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-723.exe
        6⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23277.exe
        7⤵
        
        PID:60
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        8⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10775.exe
        9⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe
        10⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16145.exe
        11⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6663.exe
        12⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6440.exe
        13⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49305.exe
        14⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
        15⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        16⤵
        
        PID:656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 612
        9⤵
        Program crash
        
        PID:2896
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 756
        6⤵
        Program crash
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
        5⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        6⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4584.exe
        7⤵
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57781.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        9⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58012.exe
        10⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25199.exe
        11⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61889.exe
        12⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26773.exe
        13⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        14⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60369.exe
        15⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18315.exe
        6⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57589.exe
        7⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13920.exe
        8⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30649.exe
        9⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17961.exe
        10⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        11⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21049.exe
        12⤵
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17645.exe
        13⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30385.exe
        14⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
        15⤵
        
        PID:6480
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 752
        5⤵
        Program crash
        
        PID:4996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 708
      4⤵
      Program crash
      PID:2672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 740
    3⤵
    - Program crash
    PID:2504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 736
  2⤵
  - Program crash
  PID:420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3336 -ip 3336
1⤵
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 1856 -ip 1856
1⤵
PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3392 -ip 3392
1⤵
PID:204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4436 -ip 4436
1⤵
PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2016 -ip 2016
1⤵
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 632 -ip 632
1⤵
PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2148 -ip 2148
1⤵
PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1440 -ip 1440
1⤵
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1992 -ip 1992
1⤵
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4428 -ip 4428
1⤵
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2704 -ip 2704
1⤵
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4132 -ip 4132
1⤵
PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2188 -ip 2188
1⤵
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4404 -ip 4404
1⤵
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3756 -ip 3756
1⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3372 -ip 3372
1⤵
PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 684 -ip 684
1⤵
PID:4812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1156 -ip 1156
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1592 -ip 1592
1⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2180 -ip 2180
1⤵
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2008 -ip 2008
1⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2712 -ip 2712
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3916 -ip 3916
1⤵
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2700 -ip 2700
1⤵
PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 620 -ip 620
1⤵
PID:720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4972 -ip 4972
1⤵
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3784 -ip 3784
1⤵
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4496 -ip 4496
1⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3132 -ip 3132
1⤵
PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 2400 -ip 2400
1⤵
PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4424 -ip 4424
1⤵
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 548 -ip 548
1⤵
PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4500 -ip 4500
1⤵
PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1452 -ip 1452
1⤵
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4056 -ip 4056
1⤵
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 1112 -ip 1112
1⤵
PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3528 -ip 3528
1⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 2424 -ip 2424
1⤵
PID:260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 980 -ip 980
1⤵
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3332 -ip 3332
1⤵
PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 1296 -ip 1296
1⤵
PID:2536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2484 -ip 2484
1⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 1248 -ip 1248
1⤵
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 1180 -ip 1180
1⤵
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 4908 -ip 4908
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4740 -ip 4740
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 3748 -ip 3748
1⤵
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 4864 -ip 4864
1⤵
PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4200 -ip 4200
1⤵
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 4212 -ip 4212
1⤵
PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 3124 -ip 3124
1⤵
PID:956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3092 -ip 3092
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2508 -ip 2508
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 3920 -ip 3920
1⤵
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 228 -ip 228
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 1988 -ip 1988
1⤵
PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4800 -ip 4800
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2512 -ip 2512
1⤵
PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3052 -ip 3052
1⤵
PID:5456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3484 -ip 3484
1⤵
PID:5484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4244 -ip 4244
1⤵
PID:5504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4912 -ip 4912
1⤵
PID:5544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3864 -ip 3864
1⤵
PID:5584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 3012 -ip 3012
1⤵
PID:5604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4268 -ip 4268
1⤵
PID:5732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2728 -ip 2728
1⤵
PID:5788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 4988 -ip 4988
1⤵
PID:5840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4472 -ip 4472
1⤵
PID:5848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3660 -ip 3660
1⤵
PID:5908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4612 -ip 4612
1⤵
PID:5956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 1720 -ip 1720
1⤵
PID:6040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 4024 -ip 4024
1⤵
PID:6056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 924 -ip 924
1⤵
PID:2312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 908 -ip 908
1⤵
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4812 -ip 4812
1⤵
PID:5328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2852 -ip 2852
1⤵
PID:5184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 3064 -ip 3064
1⤵
PID:5404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4172 -ip 4172
1⤵
PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 1104 -ip 1104
1⤵
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 4540 -ip 4540
1⤵
PID:5548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4080 -ip 4080
1⤵
PID:5740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5080 -ip 5080
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 908 -ip 908
1⤵
PID:5588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 808 -ip 808
1⤵
PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1320 -ip 1320
1⤵
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4764 -ip 4764
1⤵
PID:6028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4940 -ip 4940
1⤵
PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 1796 -ip 1796
1⤵
PID:5848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 544 -ip 544
1⤵
PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1972 -ip 1972
1⤵
PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 2060 -ip 2060
1⤵
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5000 -ip 5000
1⤵
PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5076 -ip 5076
1⤵
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 3276 -ip 3276
1⤵
PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4700 -ip 4700
1⤵
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3860 -ip 3860
1⤵
PID:5660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1684 -ip 1684
1⤵
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4392 -ip 4392
1⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2848 -ip 2848
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 2228 -ip 2228
1⤵
PID:5732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3884 -ip 3884
1⤵
PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4208 -ip 4208
1⤵
PID:5900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3704 -ip 3704
1⤵
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 60 -ip 60
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 4788 -ip 4788
1⤵
PID:5196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2064 -ip 2064
1⤵
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2904 -ip 2904
1⤵
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4980 -ip 4980
1⤵
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 364 -ip 364
1⤵
PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 1896 -ip 1896
1⤵
PID:5752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 412 -ip 412
1⤵
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 2336 -ip 2336
1⤵
PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4340 -ip 4340
1⤵
PID:6048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1080 -ip 1080
1⤵
PID:5508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4712 -ip 4712
1⤵
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4288 -ip 4288
1⤵
PID:5468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3096 -ip 3096
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3352 -ip 3352
1⤵
PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 700 -ip 700
1⤵
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1808 -ip 1808
1⤵
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 4392 -ip 4392
1⤵
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4048 -ip 4048
1⤵
PID:312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5332 -ip 5332
1⤵
PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4208 -ip 4208
1⤵
PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5216 -ip 5216
1⤵
PID:5964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 2876 -ip 2876
1⤵
PID:5520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5152 -ip 5152
1⤵
PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 3704 -ip 3704
1⤵
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5292 -ip 5292
1⤵
PID:5308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5668 -ip 5668
1⤵
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5684 -ip 5684
1⤵
PID:468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5644 -ip 5644
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5272 -ip 5272
1⤵
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 6140 -ip 6140
1⤵
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5692 -ip 5692
1⤵
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5708 -ip 5708
1⤵
PID:5660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5492 -ip 5492
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 3312 -ip 3312
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5232 -ip 5232
1⤵
PID:5968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5540 -ip 5540
1⤵
PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 6076 -ip 6076
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6104 -ip 6104
1⤵
PID:5520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5420 -ip 5420
1⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 6132 -ip 6132
1⤵
PID:5168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1388 -ip 1388
1⤵
PID:5872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5700 -ip 5700
1⤵
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5016 -ip 5016
1⤵
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5676 -ip 5676
1⤵
PID:2156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 5460 -ip 5460
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2516 -ip 2516
1⤵
PID:5196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5796 -ip 5796
1⤵
PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5668 -ip 5668
1⤵
PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 6140 -ip 6140
1⤵
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5692 -ip 5692
1⤵
PID:6012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5708 -ip 5708
1⤵
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4760 -ip 4760
1⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 6124 -ip 6124
1⤵
PID:5800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 5716 -ip 5716
1⤵
PID:5240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5864 -ip 5864
1⤵
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4072 -ip 4072
1⤵
PID:5516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 5960 -ip 5960
1⤵
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 6132 -ip 6132
1⤵
PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 5700 -ip 5700
1⤵
PID:5920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 6112 -ip 6112
1⤵
PID:5988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5676 -ip 5676
1⤵
PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 2516 -ip 2516
1⤵
PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4780 -ip 4780
1⤵
PID:5296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5132 -ip 5132
1⤵
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2312 -ip 2312
1⤵
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5992 -ip 5992
1⤵
PID:2156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6124 -ip 6124
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 5716 -ip 5716
1⤵
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3580 -ip 3580
1⤵
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4676 -ip 4676
1⤵
PID:5952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 6068 -ip 6068
1⤵
PID:5980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5204 -ip 5204
1⤵
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 2312 -ip 2312
1⤵
PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 6100 -ip 6100
1⤵
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5444 -ip 5444
1⤵
PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 5684 -ip 5684
1⤵
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 5280 -ip 5280
1⤵
PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 6116 -ip 6116
1⤵
PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5524 -ip 5524
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 1020 -ip 1020
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3948 -ip 3948
1⤵
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 5856 -ip 5856
1⤵
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5588 -ip 5588
1⤵
PID:5780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 3080 -ip 3080
1⤵
PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5916 -ip 5916
1⤵
PID:5988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 4676 -ip 4676
1⤵
PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 3580 -ip 3580
1⤵
PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 5596 -ip 5596
1⤵
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5776 -ip 5776
1⤵
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 2272 -ip 2272
1⤵
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5944 -ip 5944
1⤵
PID:5768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 6064 -ip 6064
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 5204 -ip 5204
1⤵
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 6068 -ip 6068
1⤵
PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 5444 -ip 5444
1⤵
PID:5936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5192 -ip 5192
1⤵
PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 5280 -ip 5280
1⤵
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 740 -ip 740
1⤵
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 1996 -ip 1996
1⤵
PID:716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6116 -ip 6116
1⤵
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 3080 -ip 3080
1⤵
PID:5968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3948 -ip 3948
1⤵
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 5316 -ip 5316
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 6088 -ip 6088
1⤵
PID:5172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 5776 -ip 5776
1⤵
PID:5376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5512 -ip 5512
1⤵
PID:5996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4252 -ip 4252
1⤵
PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 5528 -ip 5528
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5396 -ip 5396
1⤵
PID:5648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4000 -ip 4000
1⤵
PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5892 -ip 5892
1⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 6064 -ip 6064
1⤵
PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5792 -ip 5792
1⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3540 -ip 3540
1⤵
PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5536 -ip 5536
1⤵
PID:956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5948 -ip 5948
1⤵
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 2124 -ip 2124
1⤵
PID:5520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 5088 -ip 5088
1⤵
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 6008 -ip 6008
1⤵
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 5940 -ip 5940
1⤵
PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 5924 -ip 5924
1⤵
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3360 -ip 3360
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5316 -ip 5316
1⤵
PID:5276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 6088 -ip 6088
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5904 -ip 5904
1⤵
PID:5344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 4252 -ip 4252
1⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3044 -ip 3044
1⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4476 -ip 4476
1⤵
PID:5228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5528 -ip 5528
1⤵
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5396 -ip 5396
1⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 4000 -ip 4000
1⤵
PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 736 -ip 736
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3304 -ip 3304
1⤵
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5976 -ip 5976
1⤵
PID:5196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5848 -ip 5848
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1240 -ip 1240
1⤵
PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 2136 -ip 2136
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4440 -ip 4440
1⤵
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4984 -ip 4984
1⤵
PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6008 -ip 6008
1⤵
PID:5672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3360 -ip 3360
1⤵
PID:5908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5904 -ip 5904
1⤵
PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3048 -ip 3048
1⤵
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 1368 -ip 1368
1⤵
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5468 -ip 5468
1⤵
PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2752 -ip 2752
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 1904 -ip 1904
1⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3304 -ip 3304
1⤵
PID:5744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 5976 -ip 5976
1⤵
PID:656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 5848 -ip 5848
1⤵
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 2136 -ip 2136
1⤵
PID:5908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 5588 -ip 5588
1⤵
PID:5488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3048 -ip 3048
1⤵
PID:5612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2752 -ip 2752
1⤵
PID:5268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 5220 -ip 5220
1⤵
PID:6128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 5436 -ip 5436
1⤵
PID:5576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6108 -ip 6108
1⤵
PID:6000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 312 -ip 312
1⤵
PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 3308 -ip 3308
1⤵
PID:6152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 2816 -ip 2816
1⤵
PID:6256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5432 -ip 5432
1⤵
PID:6316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 3848 -ip 3848
1⤵
PID:6344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 1504 -ip 1504
1⤵
PID:6476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5320 -ip 5320
1⤵
PID:6580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5260 -ip 5260
1⤵
PID:6664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 4916 -ip 4916
1⤵
PID:6716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 5168 -ip 5168
1⤵
PID:6748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5140 -ip 5140
1⤵
PID:6820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 2000 -ip 2000
1⤵
PID:6876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5808 -ip 5808
1⤵
PID:6896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 5752 -ip 5752
1⤵
PID:6936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5920 -ip 5920
1⤵
PID:6956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3204 -ip 3204
1⤵
PID:6992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 1252 -ip 1252
1⤵
PID:7000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 3472 -ip 3472
1⤵
PID:7044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4604 -ip 4604
1⤵
PID:7104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 468 -ip 468
1⤵
PID:7160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5508 -ip 5508
1⤵
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1928 -ip 1928
1⤵
PID:6072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4956 -ip 4956
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1600 -ip 1600
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4944 -ip 4944
1⤵
PID:5544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3400 -ip 3400
1⤵
PID:5476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5248 -ip 5248
1⤵
PID:5268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 5220 -ip 5220
1⤵
PID:6164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 6108 -ip 6108
1⤵
PID:6188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 1264 -ip 1264
1⤵
PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4296 -ip 4296
1⤵
PID:6520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 6036 -ip 6036
1⤵
PID:6536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5664 -ip 5664
1⤵
PID:6476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 3308 -ip 3308
1⤵
PID:6724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 312 -ip 312
1⤵
PID:6772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 1428 -ip 1428
1⤵
PID:6888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5432 -ip 5432
1⤵
PID:6808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5260 -ip 5260
1⤵
PID:6852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 6096 -ip 6096
1⤵
PID:6980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 3952 -ip 3952
1⤵
PID:6908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 2240 -ip 2240
1⤵
PID:6820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5140 -ip 5140
1⤵
PID:6880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5956 -ip 5956
1⤵
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5920 -ip 5920
1⤵
PID:7140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5752 -ip 5752
1⤵
PID:7112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5808 -ip 5808
1⤵
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2836 -ip 2836
1⤵
PID:5652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 1416 -ip 1416
1⤵
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5256 -ip 5256
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 3472 -ip 3472
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3428 -ip 3428
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4960 -ip 4960
1⤵
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5840 -ip 5840
1⤵
PID:6500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 716 -ip 716
1⤵
PID:5900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 3456 -ip 3456
1⤵
PID:6304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 5844 -ip 5844
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2908 -ip 2908
1⤵
PID:6364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 5180 -ip 5180
1⤵
PID:6552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5248 -ip 5248
1⤵
PID:780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 2756 -ip 2756
1⤵
PID:6836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4296 -ip 4296
1⤵
PID:6784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6120 -ip 6120
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 6036 -ip 6036
1⤵
PID:6892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 3144 -ip 3144
1⤵
PID:4028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5664 -ip 5664
1⤵
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5252 -ip 5252
1⤵
PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4468 -ip 4468
1⤵
PID:5736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 4592 -ip 4592
1⤵
PID:6492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3952 -ip 3952
1⤵
PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5344 -ip 5344
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 5532 -ip 5532
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 4532 -ip 4532
1⤵
PID:6932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1596 -ip 1596
1⤵
PID:5244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 5228 -ip 5228
1⤵
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 2108 -ip 2108
1⤵
PID:7052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 6024 -ip 6024
1⤵
PID:6548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5984 -ip 5984
1⤵
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 4084 -ip 4084
1⤵
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 2836 -ip 2836
1⤵
PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 1448 -ip 1448
1⤵
PID:4028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2856 -ip 2856
1⤵
PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5060 -ip 5060
1⤵
PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5860 -ip 5860
1⤵
PID:5760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 5484 -ip 5484
1⤵
PID:6564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 4180 -ip 4180
1⤵
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 3428 -ip 3428
1⤵
PID:6808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4960 -ip 4960
1⤵
PID:6816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4848 -ip 4848
1⤵
PID:5552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 5844 -ip 5844
1⤵
PID:6788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 2536 -ip 2536
1⤵
PID:6032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 5180 -ip 5180
1⤵
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 1520 -ip 1520
1⤵
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 3244 -ip 3244
1⤵
PID:6548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 2896 -ip 2896
1⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 2756 -ip 2756
1⤵
PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 2468 -ip 2468
1⤵
PID:5820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 6120 -ip 6120
1⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2472 -ip 2472
1⤵
PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5744 -ip 5744
1⤵
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4680 -ip 4680
1⤵
PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1040 -ip 1040
1⤵
PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 1028 -ip 1028
1⤵
PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5764 -ip 5764
1⤵
PID:7148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3844 -ip 3844
1⤵
PID:5312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 4592 -ip 4592
1⤵
PID:5164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 2620 -ip 2620
1⤵
PID:6724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 5908 -ip 5908
1⤵
PID:5876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5344 -ip 5344
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 5428 -ip 5428
1⤵
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5532 -ip 5532
1⤵
PID:5680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 3488 -ip 3488
1⤵
PID:6868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 2504 -ip 2504
1⤵
PID:6164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 5592 -ip 5592
1⤵
PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 5228 -ip 5228
1⤵
PID:5612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 2108 -ip 2108
1⤵
PID:4028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 1836 -ip 1836
1⤵
PID:5236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 6024 -ip 6024
1⤵
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 6440 -ip 6440
1⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1036 -p 5984 -ip 5984
1⤵
PID:5580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1052 -p 6372 -ip 6372
1⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1060 -p 720 -ip 720
1⤵
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1092 -p 1448 -ip 1448
1⤵
PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1124 -p 5060 -ip 5060
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1184 -p 5852 -ip 5852
1⤵
PID:5240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1204 -p 4848 -ip 4848
1⤵
PID:6860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1240 -p 6416 -ip 6416
1⤵
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6236 -ip 6236
1⤵
PID:5188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1520 -ip 1520
1⤵
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2896 -ip 2896
1⤵
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 812 -ip 812
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1156 -p 2472 -ip 2472
1⤵
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1084 -p 5764 -ip 5764
1⤵
PID:5404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6640 -ip 6640
1⤵
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 6596 -ip 6596
1⤵
PID:6784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1208 -p 6180 -ip 6180
1⤵
PID:6444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5908 -ip 5908
1⤵
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2132 -ip 2132
1⤵
PID:6500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6356 -ip 6356
1⤵
PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 6400 -ip 6400
1⤵
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4328 -ip 4328
1⤵
PID:6824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 7076 -ip 7076
1⤵
PID:6204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 6540 -ip 6540
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 6972 -ip 6972
1⤵
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 7028 -ip 7028
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 7084 -ip 7084
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1184 -p 928 -ip 928
1⤵
PID:5612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 6424 -ip 6424
1⤵
PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3620 -ip 3620
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 6432 -ip 6432
1⤵
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 6568 -ip 6568
1⤵
PID:5868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 7120 -ip 7120
1⤵
PID:6048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 6372 -ip 6372
1⤵
PID:6444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5592 -ip 5592
1⤵
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1192 -p 1836 -ip 1836
1⤵
PID:5712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5428 -ip 5428
1⤵
PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1156 -p 6936 -ip 6936
1⤵
PID:5996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 5852 -ip 5852
1⤵
PID:5872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 6236 -ip 6236
1⤵
PID:6612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1160 -p 6688 -ip 6688
1⤵
PID:5580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1144 -p 6220 -ip 6220
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 6408 -ip 6408
1⤵
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1136 -p 6468 -ip 6468
1⤵
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1240 -p 6380 -ip 6380
1⤵
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1128 -p 6180 -ip 6180
1⤵
PID:6216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 6460 -ip 6460
1⤵
PID:6604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 6244 -ip 6244
1⤵
PID:6628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 4328 -ip 4328
1⤵
PID:5456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1160 -p 7076 -ip 7076
1⤵
PID:6636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 6540 -ip 6540
1⤵
PID:6452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 7028 -ip 7028
1⤵
PID:5660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 7084 -ip 7084
1⤵
PID:6656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6396 -ip 6396
1⤵
PID:5304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1068 -p 928 -ip 928
1⤵
PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1160 -p 6800 -ip 6800
1⤵
PID:6360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3144 -ip 3144
1⤵
PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1156 -p 6856 -ip 6856
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 6964 -ip 6964
1⤵
PID:6976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1140 -p 6944 -ip 6944
1⤵
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1068 -p 5224 -ip 5224
1⤵
PID:6548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 3108 -ip 3108
1⤵
PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1728 -ip 1728
1⤵
PID:5236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 6016 -ip 6016
1⤵
PID:5868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4804 -ip 4804
1⤵
PID:6868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4772 -ip 4772
1⤵
PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6220 -ip 6220
1⤵
PID:6032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6688 -ip 6688
1⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 6188 -ip 6188
1⤵
PID:6216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 6468 -ip 6468
1⤵
PID:6444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6328 -ip 6328
1⤵
PID:6528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1196 -p 5980 -ip 5980
1⤵
PID:6248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6524 -ip 6524
1⤵
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6800 -ip 6800
1⤵
PID:7020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1228 -p 6856 -ip 6856
1⤵
PID:6544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1168 -p 5224 -ip 5224
1⤵
PID:7152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 1728 -ip 1728
1⤵
PID:7136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 4772 -ip 4772
1⤵
PID:6736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 6188 -ip 6188
1⤵
PID:5516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5652 -ip 5652
1⤵
PID:6224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 6072 -ip 6072
1⤵
PID:6948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5832 -ip 5832
1⤵
PID:6840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 6716 -ip 6716
1⤵
PID:6184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1040 -p 6820 -ip 6820
1⤵
PID:6888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1148 -p 7008 -ip 7008
1⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1140 -p 5480 -ip 5480
1⤵
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 2880 -ip 2880
1⤵
PID:6204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1196 -p 6728 -ip 6728
1⤵
PID:6544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 7044 -ip 7044
1⤵
PID:5544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5980 -ip 5980
1⤵
PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1160 -p 6156 -ip 6156
1⤵
PID:6896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 7048 -ip 7048
1⤵
PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 6524 -ip 6524
1⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 884 -ip 884
1⤵
PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5380 -ip 5380
1⤵
PID:6732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1048 -p 6844 -ip 6844
1⤵
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1256 -p 4616 -ip 4616
1⤵
PID:5328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4448 -ip 4448
1⤵
PID:5680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 6848 -ip 6848
1⤵
PID:6948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1160 -p 5584 -ip 5584
1⤵
PID:6840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 5652 -ip 5652
1⤵
PID:6648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6772 -ip 6772
1⤵
PID:6888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1256 -p 5452 -ip 5452
1⤵
PID:6252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1172 -p 1108 -ip 1108
1⤵
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 6172 -ip 6172
1⤵
PID:6616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1232 -p 7164 -ip 7164
1⤵
PID:7004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5836 -ip 5836
1⤵
PID:6204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 5356 -ip 5356
1⤵
PID:6148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1144 -p 6924 -ip 6924
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 6352 -ip 6352
1⤵
PID:7088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1048 -p 7008 -ip 7008
1⤵
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1228 -p 6812 -ip 6812
1⤵
PID:644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 444 -ip 444
1⤵
PID:6084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 5480 -ip 5480
1⤵
PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 6156 -ip 6156
1⤵
PID:5472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1172 -p 7048 -ip 7048
1⤵
PID:6500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 884 -ip 884
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5640 -ip 5640
1⤵
PID:6336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 6772 -ip 6772
1⤵
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1156 -p 1108 -ip 1108
1⤵
PID:6948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 5688 -ip 5688
1⤵
PID:6928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1144 -p 1324 -ip 1324
1⤵
PID:6420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1164 -p 5356 -ip 5356
1⤵
PID:3004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-12.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe
Size 468KB
SHA256 872c8c32b507831dd054795972d2d87e417254b259e3ce81729dedea50ab5ff5
MD5 740ffefd64ca1ed971fb40a3d20c7ec3
SHA1 d3fa2cf5b7982e928ebcc50a3f1cb41267702602
SHA512 48cc1750773f144cc0dacbe8070e0b2e6241149c530b3a921dec07ce5e510a3f72d108a206ce855c670511e780a80e2dbe57f0f7e0f19fb51131b161b137528b
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqwaMmgAhW9aAlX:a96oGli6Sfl5Mf4WQAwazxW9a
TLSH
T156A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-12907.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12907.exe
Size 468KB
SHA256 4dd263e3031fbd301c962a7f707bbbc4d544982b5013b898d06f87dea7c48768
MD5 8c58c34b89cbaa1973c089f4ef45a279
SHA1 911b49d2e350d24934511aa37e066f9050297999
SHA512 388ec65a52a7cc8de275be4c9ab22a88ddec142d00ae81b7fa6eaf709bfa9d7acc349352f88518cdd46317535225b0d06ba25ac459913d719de1a4ce9d630573
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqwaMmgWVo9aAlF:a96oGli6Sfl5Mf4WQAwazzo9a
TLSH
T114A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-1496.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1496.exe
Size 468KB
SHA256 95cf56d8c37dc4e9ef86955be66b37274adca6eb21653717f06be0301ea58e1d
MD5 8532c8160e5f8fad938c7eacd92522b1
SHA1 1e6aa521e870dfd5d81f84fc5a79888981898ac3
SHA512 c345f90194dad76295160adf4896a0b28d73690d3b89cd35abcb5ff0abccdb145defc7fd27c2818ee8fbe6c2d4946666707c76ce86610d57e1dbbca0362c34a5
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqwaMmgRVo9aAli:a96oGli6Sfl5Mf4WQAwazeo9a
TLSH
T1BEA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-15913.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15913.exe
Size 468KB
SHA256 28f65f11eb68ad65b21435ea34a52739b345f5c743d412fd2586ece1c0c07aca
MD5 85a4218d1a368d371519fcccd5f3401c
SHA1 049f4c8fd05f7c1d5f691c4c6a23e6d06b36ddfe
SHA512 77035f91f0c2ece70ccca801f8ac1ce627b82180b73d077e3e37edb629f8fd6d25fb4dddd75a228c21337c1777ff9d830103fc93364a695a573e9730df349117
SSDEEP 3072:a9XKoeIhwo8i6bY9fA35Mf5/tMA2mZbhrHe3dPqwaMmgRV19aAli:a96oGli6Sf25Mf4WQAwaze19a
TLSH
T11EA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-16349.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
Size 468KB
SHA256 815f1dd887c46b0beaa4e8bfe120ee9fbd68f4f97441004f9d08c73d8af5982b
MD5 01d75405b1cbf20a2583dedc4375b96e
SHA1 00c62f3da7eae4090c8d7c93fc185a0a5b957f90
SHA512 410ae12db9419b13a01cd28aff5ea874a76b6a08b93a243f63dd757c86fded445de9ffdd35013bdcad6549785c43deaae92f5e38d432319b5584293f27192f8d
SSDEEP 3072:a9XKoeIhwo8i6bY9fV35Mf5/tMA2mZbhrHe3dPqwaMmgRV19aAli:a96oGli6SfB5Mf4WQAwaze19a
TLSH
T1DBA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-17257.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-17257.exe
Size 468KB
SHA256 1b5b5c47430d66c4094b754fb92ce589e1c2e90373d427edf32001a5c7b57e5f
MD5 7ff6d921727ddc8ad5598cd9b1322c69
SHA1 92f9675c818cfacbf38205bfb814fe8ac79ba4cb
SHA512 ca6c36eebcdc068327c3bf714f77f6f2e2e85bfdde29677f42c49b5e64f87cf1f5b87cd2f85875b3d8b359a994d82755fa650cc596e39d860b32847dbc906708
SSDEEP 3072:awXKoeIhwo8i6bY9fVr5xf5/tMA2mZbhrHe3dPqwaMmgRhW9aAlF:aw6oGli6Sfl5xf4WQAwazCW9a
TLSH
T155A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18065.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18065.exe
Size 468KB
SHA256 651740b1b345a28bce4040076efb47475f0f44abcc9ee47787eb3886e770f7e9
MD5 006f6566f1d36ba1da1ae926cc1e0dc0
SHA1 94e253b9637b8686631591b9970e3c0d210688a4
SHA512 52cbf292479c0e7c5ad0fbbae95b65712417c9389c53284048491629b55515d7a4c6e15445fc544ca53000e211f9d8942c4478dae01f6fb37d58df122f13c40f
SSDEEP 3072:t9XdoeIhwo8i6bY9fVr53fx/tMApmZbRrHe3dPuwrMmgQVW9KAlF:t9toGli6Sfl53frWgYwrzhW9K
TLSH
T181A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18195.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
Size 468KB
SHA256 e2fabe4c97389d30ae05d8c78edc0d6c2e58d988d9611991ce3e39540fb30949
MD5 007eab3561c45a9662fd25519c864468
SHA1 f8c827feab0774340a47f13ba7713ac7518ee19b
SHA512 c9ffa93f1e65ec3547e56a30950a25cb8a660d1304a2dc695c819b2b3b2977bff54da01cc785a4b2d92a8cba430bd9b243ba58b3ea46508af593ee0b0510acc2
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqwaMmgRhW9aAlF:a96oGli6Sfl5Mf4WQAwazCW9a
TLSH
T1FDA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-21341.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21341.exe
Size 468KB
SHA256 67fbedd3e12e36fe1197ab8d794d8974d039bab41d2a6952ea66319f417d405e
MD5 f6be1e26314f26bc28d272b61261fa82
SHA1 a580711f3950e7375fdb2d111bbdebb11326c332
SHA512 0a7f50c524c338b9526bf91202277be336b133cbb9574b6bcb0dcb92fac9a1707c624b58d52c441659b1102e4f629ffd770a820b31a4ecf0a8197c550cb5b80c
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr5Mf5/tMAKmZbhrHe3dPqwaMmgAhW9aElF:a96oGli6Sfl5MfEWQAwazxW9a
TLSH
T11FA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-25491.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25491.exe
Size 468KB
SHA256 83376ed85fb3b0ba3565368455a75521dcf533911669c5a0e0765507310e9b49
MD5 a99cfe49c2724fc4c9ff405fc6134462
SHA1 da2d18c313aead42bd539440ce3dcfa4fb569f05
SHA512 f14f820565271d6ea61777939af598b160692f67e4cd46e05ab5071883692b4f3e6c2fb1280e6fa229f03648f1b4b929feb3c30dd6da842bd3e232197016ff11
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqwaMmgRVW9aAlF:a96oGli6Sfl5Mf4WQAwazeW9a
TLSH
T1F4A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-26503.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
Size 468KB
SHA256 9206466f0c4ced290b4e4c2f16eb0b7c5893c1ed7c4b89e9722133b33983cd39
MD5 73a432441adef6da9927b16050e3e6f3
SHA1 cd71d943860d00b22773c6788545becb4b69e26b
SHA512 5ac013fcf0d77b480b48125014bc0c1ab1c1ae7e1756835939a5cc2ecb5a56fe765e487c4cced58a2610a332d86c3510b7427cd7017be0b83b46acb3f640a96f
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqwaMmgRVo9RAlF:a96oGli6Sfl5Mf4WQAwazeo9R
TLSH
T1EEA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-27463.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27463.exe
Size 468KB
SHA256 17568e6c4e172183e9f85ff3ea4ed8fbc13c4f998897af9434824d4040833213
MD5 9b901f5aa65a1597eecfa653c9b660dd
SHA1 c797cd1bc2a952126c0a11f98e05577dec6fbef7
SHA512 60cf58eff0f16f471f6442eb5b0d0014485d4d6d38c5428c11521abd99f82502a5a60631272bd85cff4f6da4b33138ab260c52af7de965e4af8b79f2cea33606
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr53f5/tMA2mZbhrHe3dPqwrMmgRVW9cAlF:a96oGli6Sfl53f4WQAwrzeW9c
TLSH
T18BA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-35845.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35845.exe
Size 468KB
SHA256 e1a929d3c6761e9bfb354474085548f6f1d7250c33b981903cfcfc9681025840
MD5 ce8862c0cf1fc0ed02b9308caac65ef2
SHA1 4f6f07a188b584a78d67a288d6957cbc1a6b17d8
SHA512 6cd1b348f8c13d204d183eaa9afb1a597368aaa0723800c1ea5284bba920a0298649535e10500c1b987dfa23534c9434b228c6bbed2f44b97d1b358d75e0d700
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqhaMmgRVW9fAlF:a96oGli6Sfl5Mf4WQAhazeW9f
TLSH
T13AA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37847.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37847.exe
Size 468KB
SHA256 1a7c2e8975dd2a200f292cccd361ddc7a4c36a095f553daeccffb5f7ca875e04
MD5 fedd6744925a1e25d31593b2b5ceef7c
SHA1 8f817399ed85209d26393ace9f70e60ce3e3f350
SHA512 ea2d4a21f881a345f0c1e2f176b1fc2175cf16235e5a961918bc0e034163afb05d76fb8aa912a3ca058ad11c92871048b7a62c7210f760cda7d325148b1d3275
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqwaMmgRVo9RAlF:a96oGli6Sfl5Mf4WQAwazeo9R
TLSH
T14EA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-38061.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38061.exe
Size 468KB
SHA256 18201e304cf3b30649d6dea037ec9af6ff39e902cf99b63c439709ba3dcb8ace
MD5 098f2382eb011f20e6ff2326ad69cbd9
SHA1 0fb9c1b85895f9ab1ff2c923eeb8e10bc58b8d72
SHA512 281dd22296cf55604c08d8f3655bca7fc5a984c8c54007931679d0c6bf4a02abc35d3de2b90fb14e2ee96413574c7f984a7f5ffc4e0a1342cc2aafb2236e13bd
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr53f5/tMA2mZbhrHe3dPqwrMmgRVW9fAlF:a96oGli6Sfl53f4WQAwrzeW9f
TLSH
T12AA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-38231.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
Size 468KB
SHA256 e54bd7ba331daefd99f5e4e2196db3eae2c53167dc1d09d9a4a3bc94b401f1d5
MD5 400740adb915081b7520b78d4612f6b2
SHA1 cdaa66e11052b011eed38dd721801c9f56c1f725
SHA512 72a6f5ccbf55aa6a25bc943ed3efa59ec6d17338933a24a1cf9130e9784f069c26505d571be9383223273e33258cf28c5757a07a05f9e5587648bb44e799ccf5
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqwaMmgRV19aAlj:a96oGli6Sfl5Mf4WQAwaze19a
TLSH
T11FA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45025.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45025.exe
Size 468KB
SHA256 7327d4029e2be766abec967e4676908d692037cf5711ca429f121803efb4ad0f
MD5 4d77b597f34ec0d848530fe8cf0bc049
SHA1 911b6ab5711dc621b7dca1273cd74ca07da8a671
SHA512 958465e78e3df29f6c66f0b6c35c64b49b5e18f21fc87955513b427b15b8b1c49a4e9f40dcd63858906d3c23e56cc0e8a9b48255341014e08fac8366db4c1eb2
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqwaMmgAhW9aAlF:a96oGli6Sfl5Mf4WQAwazxW9a
TLSH
T1EEA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45492.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
Size 468KB
SHA256 4c354732a1e5db81039dfc122b0cb6fd0231660df8fb606bcf9ae983d7ab83db
MD5 3c3edbabb90a8f76a571790b9916a22c
SHA1 60b4c5aa734b7f6b369b2036640c3025fcda6ca6
SHA512 17d98407a0ba1ca2b02462f999dd7aa869c653eada22ca99a2eb8da0bd84d990c9dc0975ef98f07d3c87e3d9d6479ed6a57815791b535644aa28e91000c62ccb
SSDEEP 3072:awXKoeIhwo8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqwaMmgRhW9aAlF:aw6oGli6Sfl5Mf4WQAwazCW9a
TLSH
T106A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45684.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
Size 468KB
SHA256 4c41b46b122dbf306d98bb09193a15149e7e9913d4cc8feb5e4deaebda28fa7b
MD5 c1ac12dca845c338daa8dc2f970782c0
SHA1 8f3de3996f8e02278a51d71b7afa9f09f0d512a9
SHA512 268ce306a3ed6205eaf09989c0073fbddad930b38286bdf0e7df297a8b1358ef73573c0b0583418b13b3a2922c01dfdfef2252b1b2840a2da2faf81ccb7cc228
SSDEEP 3072:a9XKoeIhwV8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqwaMmgRVo9aAli:a96oGei6Sfl5Mf4WQAwazeo9a
TLSH
T1BFA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-49929.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
Size 468KB
SHA256 7eef3f87a0d14182842515c1cab9ce692809b266854570aee4e6d4a57ad87556
MD5 82f69453bd6d9deaa23d68b516f8fa88
SHA1 29d2737de217d4c812769abb5174518fedaceaaf
SHA512 db597fd3b7587ee91780c57bf9653aa6bc11f18cf84c6c035d79fd7711d17c4027653db8dd8fe4752ce661590c43489d09291da595cc09d1732e434c1804d0d1
SSDEEP 3072:a9XKoeIhwV8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqwaMmgR6o9aAli:a96oGei6Sfl5Mf4WQAwaz5o9a
TLSH
T1F4A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-51361.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
Size 468KB
SHA256 5b44131eef6d7e760e71a6884f4a4bc54ecd00b69958e13c47d26bdd813e816b
MD5 aae9c883ee100ed18722fa3d03c66cb5
SHA1 8baf3d8129a973bd0879e4f6446eef25e5df007d
SHA512 22a47d1e5b5204e5c3e780ab0f49c4baecce6a8397d076d1780253c78ae6573cb4132bfad81f016be582693bea09b246f299528a1ef717a588e684d52e955460
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqwaMmgRVo9aAlF:a96oGli6Sfl5Mf4WQAwazeo9a
TLSH
T1E3A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-51724.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
Size 468KB
SHA256 32498a3c6003c3203060cc1ec93acd4e657e327a4e481efaba111a734bc8bad0
MD5 a5ca795aecde378254990757b8c792bb
SHA1 1e427428f3b91e3841f8c20ed7be4c823fe3a6c8
SHA512 5eb0f03a5cbb2793b940096f2a9ca40bcf7c0f3157f66f5b8b7b0fcdc8817beffe376c305d6b0c296e4651b3526dae5406e452d58aadd8f4f7569acd48bf8edb
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr53f5/tMA2mZbhrHe3dPqwaMmgRVW9fAlF:a96oGli6Sfl53f4WQAwazeW9f
TLSH
T121A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-53193.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53193.exe
Size 468KB
SHA256 b571315969ee521fc84c35484f4fbc73469d83c937b74551be12aaa5102773e3
MD5 f9173aaca0d0b95ff5249985ea5997d4
SHA1 2aa93958430703b96899a05ac78dacaf2f6e8875
SHA512 1670a4a076ece6a009b805e03bad148714215e8033603a79ff6572cd71b74cc1219c4bb9760fbf74a2fd8dc37ac0093c974ce31453ac5b5aff88d2aac161b735
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqwaMmgRV19aAli:a96oGli6Sfl5Mf4WQAwaze19a
TLSH
T19EA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-57713.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57713.exe
Size 468KB
SHA256 fc701038a732dc1e3aa41ac141e9e8d3f3289eb9e5e41dfde5105066f0701ae6
MD5 0f2ee0ad86f285cf476e3c8b7bedf233
SHA1 6021462a860dca4c63a1b8621a56685b260fc1d0
SHA512 a94f280c35c25e909ec6746f750f3476b863d9a976f3ce40e6ed19a0123380d73dc01d095e64a5dc82ae6ea9961e0d1f91dca373eac918e5c5229488b434c08d
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqwlMmgAhW9aElF:a96oGli6Sfl5Mf4WQAwlzxW9a
TLSH
T10FA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-58273.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-58273.exe
Size 468KB
SHA256 ea6a61b71c80ba60fa5464013b8f3c1441ae1780e5a81fa08fde5e8d4bcca2d3
MD5 4bfe1d755ae5dde47577e364823b1f3c
SHA1 60c9b2b13c81b12b7cffba32d7eef48b5b587d34
SHA512 30e94b63925b00c18c71bc65bb5723257c7ed57e6366f1d5d2d6b9b615128cb4c69e3294ad132ea12d0569b9bef22ef63a5d2b03176db9dd11a6dc6debe393eb
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqwaMmgRVW9fAlF:a96oGli6Sfl5Mf4WQAwazeW9f
TLSH
T107A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59373.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59373.exe
Size 468KB
SHA256 f8d6281e8310740fb5493692fabd791d557609c95d4e3657bc15a70a4706e2ea
MD5 81cc40c4c24f3981f103a93276ee8694
SHA1 a795d67d45b0818170ac60c014b733c6f459694a
SHA512 4e9d80e3de40e07eb66560ad5bc16a7842cfe70de1d378007eb3ada1aef3ed910fb7ddcc512061a063b344e665251078a6e954769d2c414cf6876e2424adfb21
SSDEEP 3072:v9XdoeIhwo8i6bY9fVr5grx/tMApmZbRrHe3dPuwlxmgQVW9KPlT:v9toGli6Sfl5grrWgYwlMhW9K
TLSH
T112A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-6016.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
Size 468KB
SHA256 d403fee5c7ff356d30c617e5b8bfb8d3dad9945c1c1ac87d8178af52c11ba700
MD5 a4f1f4e5875148eba5068a31ad29a18a
SHA1 345a0f56052d8aefccbadfcabb7dae09f916f5d3
SHA512 5c18ec8ff2c6ff5cc8ea4239c86124a7878c8e464f6540015b3f29a38a887137173efb5508527e5b91776098983ce9ff05ef190ebfaa42d431d89479097e9a41
SSDEEP 3072:y9XKoeIhwo8i6bY9fVr53f5/tMA2mZbhrHe3dPqwrMmgRVW9cAlF:y96oGli6Sfl53f4WQAwrzeW9c
TLSH
T115A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-61273.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
Size 468KB
SHA256 aaba0679c1b24a30c04741be69121648dbbf4732f868d77fd7e4a8191691f417
MD5 1b6d1ce99e160d41f8d4a96c2e3dcd54
SHA1 cf0c28e83a3615542a17d8bdf9f7ecfd8ddcf833
SHA512 22eaa1dcd80cd1a8cf9e549793baf4f0c741b67a9cec4efecffa29dd8177fcbf68c829c446b8bcc036d1e7167c0d793900cce443e14cd22b306db6f72da6d6b1
SSDEEP 3072:a9XKoeIhwo8i6bY9fVr5Mf5/tMA2mZbhrHe3dPqwaMmgAhW9aElF:a96oGli6Sfl5Mf4WQAwazxW9a
TLSH
T136A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/228-347-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/548-207-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/548-449-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/620-360-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/620-134-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/632-32-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/632-111-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/684-117-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/684-278-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/808-358-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/908-437-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/980-248-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1112-249-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1156-277-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1156-76-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1248-268-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1296-229-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1320-459-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1440-173-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1452-240-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1592-86-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1592-279-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1720-412-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1856-7-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1856-44-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1992-175-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2008-404-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2008-135-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2016-110-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2016-41-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2148-112-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2180-124-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2180-384-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2188-264-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2424-247-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2484-195-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2508-338-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2512-369-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2700-152-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2700-348-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2704-177-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2704-57-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2712-411-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2712-151-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2728-306-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2848-463-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2852-389-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3012-304-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3052-273-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3064-441-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3092-318-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3332-237-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3336-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3336-24-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3372-106-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3372-276-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3392-71-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3392-20-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3484-356-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3528-239-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3756-104-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3756-263-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3864-377-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3916-393-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3920-339-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4024-421-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4056-208-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4080-399-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4132-58-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4132-178-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4172-413-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4200-305-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4244-282-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4268-288-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4404-265-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4424-443-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4424-183-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4428-176-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4428-49-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4436-70-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4436-14-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4472-397-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4500-458-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4500-194-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4540-460-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4612-417-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4740-292-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4764-462-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4800-337-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4812-438-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4864-317-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4908-230-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4912-380-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4972-353-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4988-381-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5076-461-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads