Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 10:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
168b1859b24ffb57f57dbe7b2171c413.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
168b1859b24ffb57f57dbe7b2171c413.exe
Resource
win10v2004-20231215-en
0 signatures
150 seconds
General
-
Target
168b1859b24ffb57f57dbe7b2171c413.exe
-
Size
184KB
-
MD5
168b1859b24ffb57f57dbe7b2171c413
-
SHA1
cab8145fcf05e900c83d23d556012284a3406adf
-
SHA256
3c5e88aff4ec77c709347e107224494ad2c20848d4f41b8d8b230ba546d77886
-
SHA512
eba10ac480653b0d66f95f278e16637fe2f47c80aa454f2e4ea47952fb678052298224abfd149c7b0f39f97060a3a6608d3f7c1f9f645c390254a900608560f3
-
SSDEEP
3072:v0CYomu+Nsr3tOjRo3yK6J+LQXTMC2ZeZxxvLFvg9lvvpFJ:v0poyW3tGoiK6JrKc69lvvpF
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 2960 Unicorn-17260.exe 2876 Unicorn-14410.exe 2740 Unicorn-35577.exe 2972 Unicorn-18817.exe 2076 Unicorn-3035.exe 2840 Unicorn-63165.exe 2720 Unicorn-57988.exe -
Loads dropped DLL 15 IoCs
pid Process 2156 168b1859b24ffb57f57dbe7b2171c413.exe 2156 168b1859b24ffb57f57dbe7b2171c413.exe 2960 Unicorn-17260.exe 2960 Unicorn-17260.exe 2156 168b1859b24ffb57f57dbe7b2171c413.exe 2156 168b1859b24ffb57f57dbe7b2171c413.exe 2876 Unicorn-14410.exe 2876 Unicorn-14410.exe 2960 Unicorn-17260.exe 2960 Unicorn-17260.exe 2740 Unicorn-25492.exe 2740 Unicorn-25492.exe 2972 Unicorn-18817.exe 2972 Unicorn-18817.exe 2876 Unicorn-47061.exe -
Program crash 6 IoCs
pid pid_target Process procid_target 1624 2776 WerFault.exe 68 1960 2868 WerFault.exe 231 1792 1028 WerFault.exe 232 2608 2464 WerFault.exe 313 2420 1740 WerFault.exe 292 1872 2968 WerFault.exe 306 -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2156 168b1859b24ffb57f57dbe7b2171c413.exe 2960 Unicorn-17260.exe 2876 Unicorn-14410.exe 2740 Unicorn-35577.exe 2972 Unicorn-18817.exe 2076 Unicorn-3035.exe 2840 Unicorn-63165.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2960 2156 168b1859b24ffb57f57dbe7b2171c413.exe 28 PID 2156 wrote to memory of 2960 2156 168b1859b24ffb57f57dbe7b2171c413.exe 28 PID 2156 wrote to memory of 2960 2156 168b1859b24ffb57f57dbe7b2171c413.exe 28 PID 2156 wrote to memory of 2960 2156 168b1859b24ffb57f57dbe7b2171c413.exe 28 PID 2960 wrote to memory of 2876 2960 Unicorn-17260.exe 30 PID 2960 wrote to memory of 2876 2960 Unicorn-17260.exe 30 PID 2960 wrote to memory of 2876 2960 Unicorn-17260.exe 30 PID 2960 wrote to memory of 2876 2960 Unicorn-17260.exe 30 PID 2156 wrote to memory of 2740 2156 168b1859b24ffb57f57dbe7b2171c413.exe 29 PID 2156 wrote to memory of 2740 2156 168b1859b24ffb57f57dbe7b2171c413.exe 29 PID 2156 wrote to memory of 2740 2156 168b1859b24ffb57f57dbe7b2171c413.exe 29 PID 2156 wrote to memory of 2740 2156 168b1859b24ffb57f57dbe7b2171c413.exe 29 PID 2876 wrote to memory of 2972 2876 Unicorn-14410.exe 33 PID 2876 wrote to memory of 2972 2876 Unicorn-14410.exe 33 PID 2876 wrote to memory of 2972 2876 Unicorn-14410.exe 33 PID 2876 wrote to memory of 2972 2876 Unicorn-14410.exe 33 PID 2960 wrote to memory of 2076 2960 Unicorn-17260.exe 32 PID 2960 wrote to memory of 2076 2960 Unicorn-17260.exe 32 PID 2960 wrote to memory of 2076 2960 Unicorn-17260.exe 32 PID 2960 wrote to memory of 2076 2960 Unicorn-17260.exe 32 PID 2740 wrote to memory of 2840 2740 Unicorn-25492.exe 31 PID 2740 wrote to memory of 2840 2740 Unicorn-25492.exe 31 PID 2740 wrote to memory of 2840 2740 Unicorn-25492.exe 31 PID 2740 wrote to memory of 2840 2740 Unicorn-25492.exe 31 PID 2972 wrote to memory of 2720 2972 Unicorn-18817.exe 255 PID 2972 wrote to memory of 2720 2972 Unicorn-18817.exe 255 PID 2972 wrote to memory of 2720 2972 Unicorn-18817.exe 255 PID 2972 wrote to memory of 2720 2972 Unicorn-18817.exe 255
Processes
-
C:\Users\Admin\AppData\Local\Temp\168b1859b24ffb57f57dbe7b2171c413.exe"C:\Users\Admin\AppData\Local\Temp\168b1859b24ffb57f57dbe7b2171c413.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-14410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14410.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-18817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18817.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe5⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3771.exe6⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe7⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe8⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe9⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4874.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4874.exe10⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43162.exe11⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8948.exe12⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe13⤵PID:2428
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe8⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28476.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28476.exe9⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47236.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47236.exe10⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53785.exe11⤵PID:1100
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20452.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20452.exe7⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55170.exe8⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe9⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61553.exe10⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65461.exe11⤵PID:2968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 24412⤵
- Program crash
PID:1872
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8659.exe6⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12663.exe7⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22855.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22855.exe8⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48331.exe9⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exe10⤵PID:956
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28198.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28198.exe4⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45407.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45407.exe5⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54966.exe6⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25920.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25920.exe7⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1389.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1389.exe8⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47941.exe9⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52539.exe10⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22877.exe11⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30137.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30137.exe12⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51320.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51320.exe13⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14942.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14942.exe14⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58248.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58248.exe15⤵PID:1576
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39383.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39383.exe10⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27532.exe11⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exe12⤵PID:2348
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13213.exe9⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55736.exe10⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe11⤵PID:1028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 24012⤵
- Program crash
PID:1792
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47061.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47061.exe7⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51278.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51278.exe8⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43292.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43292.exe9⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe10⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-879.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-879.exe11⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe12⤵PID:776
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52493.exe11⤵PID:556
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43268.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43268.exe5⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41160.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41160.exe6⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe7⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43709.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43709.exe8⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2025.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2025.exe9⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64604.exe10⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26582.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26582.exe11⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exe12⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27340.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27340.exe13⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29556.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29556.exe14⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64517.exe15⤵PID:2192
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16394.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16394.exe11⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5632.exe12⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47428.exe13⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49644.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49644.exe14⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56790.exe15⤵PID:2028
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39004.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39004.exe10⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49628.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49628.exe11⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16406.exe12⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exe13⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exe14⤵PID:856
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5113.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5113.exe12⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe13⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32405.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32405.exe14⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65264.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65264.exe15⤵PID:2716
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65351.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65351.exe9⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe10⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25679.exe11⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61553.exe12⤵PID:2244
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe10⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe11⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe12⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59540.exe13⤵PID:3000
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exe8⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20448.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20448.exe9⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1309.exe10⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe11⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8424.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8424.exe12⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46707.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46707.exe13⤵PID:2436
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9648.exe9⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe10⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe11⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31424.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31424.exe12⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49846.exe13⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34246.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34246.exe14⤵PID:1740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 24015⤵
- Program crash
PID:2420
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55554.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55554.exe12⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14366.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14366.exe13⤵PID:2080
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe7⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26722.exe8⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61501.exe9⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60375.exe10⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60235.exe11⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46136.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46136.exe12⤵PID:3016
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3035.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3035.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56232.exe4⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61935.exe5⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17141.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17141.exe6⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25349.exe7⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40720.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40720.exe8⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57305.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57305.exe9⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54983.exe10⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50894.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50894.exe11⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48704.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48704.exe12⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2477.exe13⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12742.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12742.exe14⤵PID:2996
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53535.exe11⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30137.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30137.exe12⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42441.exe13⤵PID:1552
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47562.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47562.exe9⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48896.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48896.exe10⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17693.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17693.exe11⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe12⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exe13⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25576.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25576.exe14⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46702.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46702.exe15⤵PID:1032
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe14⤵PID:1608
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21103.exe8⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe9⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60349.exe10⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26577.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26577.exe11⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10863.exe12⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4195.exe13⤵PID:1268
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe9⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53307.exe10⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46229.exe11⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe12⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe13⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49120.exe14⤵PID:1948
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26363.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26363.exe10⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64672.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64672.exe11⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe12⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exe13⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe14⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49120.exe15⤵PID:2740
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7313.exe11⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7158.exe12⤵PID:1648
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31099.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31099.exe5⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3449.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3449.exe6⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12899.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12899.exe7⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40969.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40969.exe8⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58683.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58683.exe9⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59809.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59809.exe10⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe11⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31813.exe12⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64672.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64672.exe13⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27200.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27200.exe14⤵PID:1504
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40841.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40841.exe10⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27392.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27392.exe11⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10090.exe12⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49120.exe13⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6629.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6629.exe14⤵PID:2792
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24147.exe9⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55357.exe10⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe11⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22203.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22203.exe12⤵PID:964
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8851.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8851.exe7⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24283.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24283.exe8⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1309.exe9⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8948.exe10⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22732.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22732.exe11⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33334.exe12⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48741.exe13⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60106.exe14⤵PID:884
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5793.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5793.exe11⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20034.exe12⤵PID:2564
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54322.exe4⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1188.exe5⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59645.exe6⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44648.exe7⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56462.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56462.exe8⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25492.exe9⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-51465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51465.exe10⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe11⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48554.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48554.exe12⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46136.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46136.exe13⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7013.exe14⤵PID:1992
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11086.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11086.exe12⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9374.exe13⤵PID:3060
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29938.exe8⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11179.exe9⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2643.exe10⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26816.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26816.exe11⤵PID:2888
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63165.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31728.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31728.exe4⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45599.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45599.exe5⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe6⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe7⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61140.exe8⤵PID:2776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 2409⤵
- Program crash
PID:1624
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe8⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19680.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19680.exe9⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe10⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24211.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24211.exe11⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe12⤵PID:1300
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe5⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24305.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24305.exe6⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe7⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13667.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13667.exe8⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1389.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1389.exe9⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22119.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22119.exe10⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47941.exe11⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26577.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26577.exe12⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1911.exe13⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4916.exe14⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16453.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16453.exe15⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61372.exe16⤵PID:2664
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4905.exe12⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29618.exe13⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10474.exe14⤵PID:1488
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7271.exe10⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31813.exe11⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe12⤵PID:1548
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35117.exe9⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7863.exe10⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63930.exe11⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exe12⤵PID:1656
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47061.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47061.exe8⤵
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-1890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1890.exe9⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46291.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46291.exe10⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18404.exe11⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe12⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24232.exe13⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6821.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6821.exe14⤵PID:888
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64745.exe13⤵PID:1616
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34834.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34834.exe7⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17629.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17629.exe8⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19867.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19867.exe9⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24979.exe10⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36686.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36686.exe11⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4335.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4335.exe12⤵PID:2440
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29778.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29778.exe11⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33495.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33495.exe12⤵PID:2764
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60796.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60796.exe7⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20448.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20448.exe8⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22680.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22680.exe9⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe10⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7158.exe11⤵PID:2564
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1961.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1961.exe4⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23145.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23145.exe5⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55224.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55224.exe6⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62100.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62100.exe7⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28717.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28717.exe8⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe9⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe10⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe11⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21829.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21829.exe12⤵PID:3036
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62136.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62136.exe7⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25819.exe8⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exe9⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5300.exe10⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63754.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63754.exe11⤵PID:2464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 18812⤵
- Program crash
PID:2608
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe3⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25911.exe4⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe5⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32360.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32360.exe6⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27565.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27565.exe7⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59586.exe8⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe9⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62819.exe10⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27200.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27200.exe11⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49644.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49644.exe12⤵PID:2548
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58335.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58335.exe8⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55357.exe9⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39950.exe10⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exe11⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exe12⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe13⤵PID:3020
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe7⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64817.exe8⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55720.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55720.exe9⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe10⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60038.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60038.exe11⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38347.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38347.exe12⤵PID:1956
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60984.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60984.exe6⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15429.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15429.exe7⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe8⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57391.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57391.exe9⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55357.exe10⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64672.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64672.exe11⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe12⤵PID:2868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 24013⤵
- Program crash
PID:1960
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19155.exe9⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32939.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32939.exe10⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe11⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14942.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14942.exe12⤵PID:2744
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25273.exe8⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56857.exe9⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1922.exe10⤵PID:536
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52288.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52288.exe4⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29428.exe5⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61581.exe6⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40483.exe7⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40344.exe8⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18404.exe9⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37013.exe10⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3624.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3624.exe11⤵PID:1016
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24611.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24611.exe5⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54023.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54023.exe6⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33079.exe7⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe8⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe9⤵PID:1860
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe8⤵PID:1428
-
-
-
-
-
-
-