Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:03
Static task
static1
Behavioral task
behavioral1
Sample
714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe
Resource
win10v2004-20240508-en
General
-
Target
714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe
-
Size
184KB
-
MD5
2e49c585e9ea22e805f2b4fb78e16f9c
-
SHA1
ad1c93f74bf1cce3b755723f66a9dc466b3cf7b4
-
SHA256
714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d
-
SHA512
b24b748db75ab3ce365d6a974dbda5ecbbc59716e1b51d57d345a69518d0649717b8a3b9c331373c37768a7597be6b6325371f3d8ba24430fe4e11b5b3c6020c
-
SSDEEP
3072:LKH3JkoT2k4TbG4We/nLRbs+hs2ViFgnd:LKyoC/G4dLZs+hs2ViFg
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
Unicorn-32998.exeUnicorn-7507.exeUnicorn-57263.exeUnicorn-30511.exeUnicorn-50377.exeUnicorn-11565.exeUnicorn-14772.exeUnicorn-12312.exeUnicorn-21078.exeUnicorn-5296.exeUnicorn-29800.exeUnicorn-49666.exeUnicorn-10771.exeUnicorn-47803.exeUnicorn-1295.exeUnicorn-51887.exeUnicorn-38037.exeUnicorn-42121.exeUnicorn-22255.exeUnicorn-52982.exeUnicorn-46205.exeUnicorn-22277.exeUnicorn-26937.exeUnicorn-7071.exeUnicorn-57663.exeUnicorn-11155.exeUnicorn-47357.exeUnicorn-58218.exeUnicorn-29075.exeUnicorn-13293.exeUnicorn-13293.exeUnicorn-6516.exeUnicorn-16906.exeUnicorn-47632.exeUnicorn-31850.exeUnicorn-37326.exeUnicorn-2515.exeUnicorn-41410.exeUnicorn-29520.exeUnicorn-29520.exeUnicorn-22744.exeUnicorn-45857.exeUnicorn-34996.exeUnicorn-8353.exeUnicorn-12629.exeUnicorn-58301.exeUnicorn-23490.exeUnicorn-43356.exeUnicorn-8820.exeUnicorn-19681.exeUnicorn-16989.exeUnicorn-47715.exeUnicorn-27849.exeUnicorn-59775.exeUnicorn-13267.exeUnicorn-37217.exeUnicorn-52162.exeUnicorn-14658.exeUnicorn-64414.exeUnicorn-57637.exeUnicorn-31187.exeUnicorn-64435.exeUnicorn-48654.exeUnicorn-7066.exepid process 2296 Unicorn-32998.exe 2216 Unicorn-7507.exe 2480 Unicorn-57263.exe 2740 Unicorn-30511.exe 2868 Unicorn-50377.exe 2548 Unicorn-11565.exe 2560 Unicorn-14772.exe 1996 Unicorn-12312.exe 2012 Unicorn-21078.exe 1440 Unicorn-5296.exe 1620 Unicorn-29800.exe 1544 Unicorn-49666.exe 1716 Unicorn-10771.exe 2376 Unicorn-47803.exe 780 Unicorn-1295.exe 1144 Unicorn-51887.exe 1692 Unicorn-38037.exe 2812 Unicorn-42121.exe 1860 Unicorn-22255.exe 1132 Unicorn-52982.exe 2284 Unicorn-46205.exe 3068 Unicorn-22277.exe 1632 Unicorn-26937.exe 2392 Unicorn-7071.exe 2064 Unicorn-57663.exe 2280 Unicorn-11155.exe 2272 Unicorn-47357.exe 2292 Unicorn-58218.exe 2196 Unicorn-29075.exe 2984 Unicorn-13293.exe 2928 Unicorn-13293.exe 2996 Unicorn-6516.exe 1152 Unicorn-16906.exe 2764 Unicorn-47632.exe 2628 Unicorn-31850.exe 2592 Unicorn-37326.exe 2960 Unicorn-2515.exe 1796 Unicorn-41410.exe 1968 Unicorn-29520.exe 1936 Unicorn-29520.exe 624 Unicorn-22744.exe 888 Unicorn-45857.exe 2820 Unicorn-34996.exe 1564 Unicorn-8353.exe 1776 Unicorn-12629.exe 1264 Unicorn-58301.exe 1260 Unicorn-23490.exe 264 Unicorn-43356.exe 1628 Unicorn-8820.exe 2368 Unicorn-19681.exe 556 Unicorn-16989.exe 2468 Unicorn-47715.exe 2248 Unicorn-27849.exe 1948 Unicorn-59775.exe 2420 Unicorn-13267.exe 1068 Unicorn-37217.exe 2728 Unicorn-52162.exe 2652 Unicorn-14658.exe 2684 Unicorn-64414.exe 2952 Unicorn-57637.exe 1696 Unicorn-31187.exe 2504 Unicorn-64435.exe 2252 Unicorn-48654.exe 2576 Unicorn-7066.exe -
Loads dropped DLL 64 IoCs
Processes:
714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exeUnicorn-32998.exeUnicorn-57263.exeWerFault.exeWerFault.exeUnicorn-30511.exeUnicorn-50377.exeWerFault.exeUnicorn-11565.exeUnicorn-14772.exeUnicorn-12312.exeWerFault.exeWerFault.exeUnicorn-21078.exeUnicorn-5296.exeUnicorn-10771.exeUnicorn-49666.exepid process 2444 714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe 2444 714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe 2296 Unicorn-32998.exe 2296 Unicorn-32998.exe 2444 714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe 2444 714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe 2296 Unicorn-32998.exe 2296 Unicorn-32998.exe 2480 Unicorn-57263.exe 2480 Unicorn-57263.exe 2872 WerFault.exe 2872 WerFault.exe 2872 WerFault.exe 2872 WerFault.exe 2872 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2740 Unicorn-30511.exe 2740 Unicorn-30511.exe 2868 Unicorn-50377.exe 2868 Unicorn-50377.exe 2480 Unicorn-57263.exe 2480 Unicorn-57263.exe 344 WerFault.exe 344 WerFault.exe 344 WerFault.exe 344 WerFault.exe 344 WerFault.exe 2548 Unicorn-11565.exe 2548 Unicorn-11565.exe 2740 Unicorn-30511.exe 2740 Unicorn-30511.exe 2560 Unicorn-14772.exe 2868 Unicorn-50377.exe 2868 Unicorn-50377.exe 1996 Unicorn-12312.exe 2560 Unicorn-14772.exe 1996 Unicorn-12312.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2012 Unicorn-21078.exe 2012 Unicorn-21078.exe 2548 Unicorn-11565.exe 2548 Unicorn-11565.exe 1440 Unicorn-5296.exe 1440 Unicorn-5296.exe 1716 Unicorn-10771.exe 1716 Unicorn-10771.exe 1544 Unicorn-49666.exe 1544 Unicorn-49666.exe 2560 Unicorn-14772.exe 2560 Unicorn-14772.exe 1996 Unicorn-12312.exe -
Program crash 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1300 2444 WerFault.exe 714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe 2872 2216 WerFault.exe Unicorn-7507.exe 2680 2296 WerFault.exe Unicorn-32998.exe 344 2480 WerFault.exe Unicorn-57263.exe 2268 2740 WerFault.exe Unicorn-30511.exe 2112 2868 WerFault.exe Unicorn-50377.exe 1524 2548 WerFault.exe Unicorn-11565.exe 1356 2560 WerFault.exe Unicorn-14772.exe 1868 1996 WerFault.exe Unicorn-12312.exe 1588 2284 WerFault.exe Unicorn-46205.exe 300 1132 WerFault.exe Unicorn-52982.exe 2100 2012 WerFault.exe Unicorn-21078.exe 2796 1440 WerFault.exe Unicorn-5296.exe 2708 1716 WerFault.exe Unicorn-10771.exe 2716 1544 WerFault.exe Unicorn-49666.exe 2788 1620 WerFault.exe Unicorn-29800.exe 304 2292 WerFault.exe Unicorn-58218.exe 632 780 WerFault.exe Unicorn-1295.exe 2380 2376 WerFault.exe Unicorn-47803.exe 2288 1144 WerFault.exe Unicorn-51887.exe 820 1692 WerFault.exe Unicorn-38037.exe 1360 2812 WerFault.exe Unicorn-42121.exe 1540 1860 WerFault.exe Unicorn-22255.exe 1724 2820 WerFault.exe Unicorn-34996.exe 2304 2196 WerFault.exe Unicorn-29075.exe 2156 2064 WerFault.exe Unicorn-57663.exe 1040 2392 WerFault.exe Unicorn-7071.exe 2916 2280 WerFault.exe Unicorn-11155.exe 2920 1632 WerFault.exe Unicorn-26937.exe 2668 3068 WerFault.exe Unicorn-22277.exe 2244 1628 WerFault.exe Unicorn-8820.exe 2536 2272 WerFault.exe Unicorn-47357.exe 812 1152 WerFault.exe Unicorn-16906.exe 2008 2984 WerFault.exe Unicorn-13293.exe 292 2996 WerFault.exe Unicorn-6516.exe 2372 2928 WerFault.exe Unicorn-13293.exe 992 264 WerFault.exe Unicorn-43356.exe 756 2628 WerFault.exe Unicorn-31850.exe 660 2592 WerFault.exe Unicorn-37326.exe 3096 2764 WerFault.exe Unicorn-47632.exe 3104 2960 WerFault.exe Unicorn-2515.exe 3136 1796 WerFault.exe Unicorn-41410.exe 3208 1936 WerFault.exe Unicorn-29520.exe 3248 1968 WerFault.exe Unicorn-29520.exe 3300 1260 WerFault.exe Unicorn-23490.exe 3316 1264 WerFault.exe Unicorn-58301.exe 3340 624 WerFault.exe Unicorn-22744.exe 3364 888 WerFault.exe Unicorn-45857.exe 3396 1776 WerFault.exe Unicorn-12629.exe 3404 1564 WerFault.exe Unicorn-8353.exe 3452 1832 WerFault.exe Unicorn-58789.exe 3748 3064 WerFault.exe Unicorn-45167.exe 3896 1700 WerFault.exe Unicorn-31331.exe 3880 2504 WerFault.exe Unicorn-64435.exe 3872 752 WerFault.exe Unicorn-54129.exe 4016 2240 WerFault.exe Unicorn-927.exe 4076 2468 WerFault.exe Unicorn-47715.exe 3496 2368 WerFault.exe Unicorn-19681.exe 3324 2248 WerFault.exe Unicorn-27849.exe 3644 1068 WerFault.exe Unicorn-37217.exe 3660 2684 WerFault.exe Unicorn-64414.exe 3844 1668 WerFault.exe Unicorn-45961.exe 3904 2420 WerFault.exe Unicorn-13267.exe 4032 2652 WerFault.exe Unicorn-14658.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exeUnicorn-32998.exeUnicorn-7507.exeUnicorn-57263.exeUnicorn-30511.exeUnicorn-50377.exeUnicorn-11565.exeUnicorn-14772.exeUnicorn-12312.exeUnicorn-21078.exeUnicorn-5296.exeUnicorn-49666.exeUnicorn-10771.exeUnicorn-29800.exeUnicorn-47803.exeUnicorn-1295.exeUnicorn-51887.exeUnicorn-38037.exeUnicorn-42121.exeUnicorn-22255.exeUnicorn-52982.exeUnicorn-46205.exeUnicorn-22277.exeUnicorn-7071.exeUnicorn-26937.exeUnicorn-57663.exeUnicorn-11155.exeUnicorn-47357.exeUnicorn-58218.exeUnicorn-29075.exeUnicorn-13293.exeUnicorn-6516.exeUnicorn-13293.exeUnicorn-16906.exeUnicorn-47632.exeUnicorn-31850.exeUnicorn-37326.exeUnicorn-2515.exeUnicorn-41410.exeUnicorn-29520.exeUnicorn-29520.exeUnicorn-22744.exeUnicorn-45857.exeUnicorn-34996.exeUnicorn-8353.exeUnicorn-12629.exeUnicorn-58301.exeUnicorn-23490.exeUnicorn-43356.exeUnicorn-8820.exeUnicorn-19681.exeUnicorn-47715.exeUnicorn-16989.exeUnicorn-27849.exeUnicorn-59775.exeUnicorn-13267.exeUnicorn-37217.exeUnicorn-52162.exeUnicorn-14658.exeUnicorn-64414.exeUnicorn-57637.exeUnicorn-31187.exeUnicorn-64435.exeUnicorn-48654.exepid process 2444 714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe 2296 Unicorn-32998.exe 2216 Unicorn-7507.exe 2480 Unicorn-57263.exe 2740 Unicorn-30511.exe 2868 Unicorn-50377.exe 2548 Unicorn-11565.exe 2560 Unicorn-14772.exe 1996 Unicorn-12312.exe 2012 Unicorn-21078.exe 1440 Unicorn-5296.exe 1544 Unicorn-49666.exe 1716 Unicorn-10771.exe 1620 Unicorn-29800.exe 2376 Unicorn-47803.exe 780 Unicorn-1295.exe 1144 Unicorn-51887.exe 1692 Unicorn-38037.exe 2812 Unicorn-42121.exe 1860 Unicorn-22255.exe 1132 Unicorn-52982.exe 2284 Unicorn-46205.exe 3068 Unicorn-22277.exe 2392 Unicorn-7071.exe 1632 Unicorn-26937.exe 2064 Unicorn-57663.exe 2280 Unicorn-11155.exe 2272 Unicorn-47357.exe 2292 Unicorn-58218.exe 2196 Unicorn-29075.exe 2984 Unicorn-13293.exe 2996 Unicorn-6516.exe 2928 Unicorn-13293.exe 1152 Unicorn-16906.exe 2764 Unicorn-47632.exe 2628 Unicorn-31850.exe 2592 Unicorn-37326.exe 2960 Unicorn-2515.exe 1796 Unicorn-41410.exe 1936 Unicorn-29520.exe 1968 Unicorn-29520.exe 624 Unicorn-22744.exe 888 Unicorn-45857.exe 2820 Unicorn-34996.exe 1564 Unicorn-8353.exe 1776 Unicorn-12629.exe 1264 Unicorn-58301.exe 1260 Unicorn-23490.exe 264 Unicorn-43356.exe 1628 Unicorn-8820.exe 2368 Unicorn-19681.exe 2468 Unicorn-47715.exe 556 Unicorn-16989.exe 2248 Unicorn-27849.exe 1948 Unicorn-59775.exe 2420 Unicorn-13267.exe 1068 Unicorn-37217.exe 2728 Unicorn-52162.exe 2652 Unicorn-14658.exe 2684 Unicorn-64414.exe 2952 Unicorn-57637.exe 1696 Unicorn-31187.exe 2504 Unicorn-64435.exe 2252 Unicorn-48654.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exeUnicorn-32998.exeUnicorn-7507.exeUnicorn-57263.exeUnicorn-30511.exeUnicorn-50377.exeUnicorn-11565.exeUnicorn-14772.exedescription pid process target process PID 2444 wrote to memory of 2296 2444 714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe Unicorn-32998.exe PID 2444 wrote to memory of 2296 2444 714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe Unicorn-32998.exe PID 2444 wrote to memory of 2296 2444 714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe Unicorn-32998.exe PID 2444 wrote to memory of 2296 2444 714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe Unicorn-32998.exe PID 2296 wrote to memory of 2216 2296 Unicorn-32998.exe Unicorn-7507.exe PID 2296 wrote to memory of 2216 2296 Unicorn-32998.exe Unicorn-7507.exe PID 2296 wrote to memory of 2216 2296 Unicorn-32998.exe Unicorn-7507.exe PID 2296 wrote to memory of 2216 2296 Unicorn-32998.exe Unicorn-7507.exe PID 2444 wrote to memory of 2480 2444 714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe Unicorn-57263.exe PID 2444 wrote to memory of 2480 2444 714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe Unicorn-57263.exe PID 2444 wrote to memory of 2480 2444 714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe Unicorn-57263.exe PID 2444 wrote to memory of 2480 2444 714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe Unicorn-57263.exe PID 2444 wrote to memory of 1300 2444 714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe WerFault.exe PID 2444 wrote to memory of 1300 2444 714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe WerFault.exe PID 2444 wrote to memory of 1300 2444 714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe WerFault.exe PID 2444 wrote to memory of 1300 2444 714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe WerFault.exe PID 2296 wrote to memory of 2740 2296 Unicorn-32998.exe Unicorn-30511.exe PID 2296 wrote to memory of 2740 2296 Unicorn-32998.exe Unicorn-30511.exe PID 2296 wrote to memory of 2740 2296 Unicorn-32998.exe Unicorn-30511.exe PID 2296 wrote to memory of 2740 2296 Unicorn-32998.exe Unicorn-30511.exe PID 2216 wrote to memory of 2872 2216 Unicorn-7507.exe WerFault.exe PID 2216 wrote to memory of 2872 2216 Unicorn-7507.exe WerFault.exe PID 2216 wrote to memory of 2872 2216 Unicorn-7507.exe WerFault.exe PID 2216 wrote to memory of 2872 2216 Unicorn-7507.exe WerFault.exe PID 2480 wrote to memory of 2868 2480 Unicorn-57263.exe Unicorn-50377.exe PID 2480 wrote to memory of 2868 2480 Unicorn-57263.exe Unicorn-50377.exe PID 2480 wrote to memory of 2868 2480 Unicorn-57263.exe Unicorn-50377.exe PID 2480 wrote to memory of 2868 2480 Unicorn-57263.exe Unicorn-50377.exe PID 2296 wrote to memory of 2680 2296 Unicorn-32998.exe WerFault.exe PID 2296 wrote to memory of 2680 2296 Unicorn-32998.exe WerFault.exe PID 2296 wrote to memory of 2680 2296 Unicorn-32998.exe WerFault.exe PID 2296 wrote to memory of 2680 2296 Unicorn-32998.exe WerFault.exe PID 2740 wrote to memory of 2548 2740 Unicorn-30511.exe Unicorn-11565.exe PID 2740 wrote to memory of 2548 2740 Unicorn-30511.exe Unicorn-11565.exe PID 2740 wrote to memory of 2548 2740 Unicorn-30511.exe Unicorn-11565.exe PID 2740 wrote to memory of 2548 2740 Unicorn-30511.exe Unicorn-11565.exe PID 2868 wrote to memory of 2560 2868 Unicorn-50377.exe Unicorn-14772.exe PID 2868 wrote to memory of 2560 2868 Unicorn-50377.exe Unicorn-14772.exe PID 2868 wrote to memory of 2560 2868 Unicorn-50377.exe Unicorn-14772.exe PID 2868 wrote to memory of 2560 2868 Unicorn-50377.exe Unicorn-14772.exe PID 2480 wrote to memory of 1996 2480 Unicorn-57263.exe Unicorn-12312.exe PID 2480 wrote to memory of 1996 2480 Unicorn-57263.exe Unicorn-12312.exe PID 2480 wrote to memory of 1996 2480 Unicorn-57263.exe Unicorn-12312.exe PID 2480 wrote to memory of 1996 2480 Unicorn-57263.exe Unicorn-12312.exe PID 2480 wrote to memory of 344 2480 Unicorn-57263.exe WerFault.exe PID 2480 wrote to memory of 344 2480 Unicorn-57263.exe WerFault.exe PID 2480 wrote to memory of 344 2480 Unicorn-57263.exe WerFault.exe PID 2480 wrote to memory of 344 2480 Unicorn-57263.exe WerFault.exe PID 2548 wrote to memory of 2012 2548 Unicorn-11565.exe Unicorn-21078.exe PID 2548 wrote to memory of 2012 2548 Unicorn-11565.exe Unicorn-21078.exe PID 2548 wrote to memory of 2012 2548 Unicorn-11565.exe Unicorn-21078.exe PID 2548 wrote to memory of 2012 2548 Unicorn-11565.exe Unicorn-21078.exe PID 2740 wrote to memory of 1440 2740 Unicorn-30511.exe Unicorn-5296.exe PID 2740 wrote to memory of 1440 2740 Unicorn-30511.exe Unicorn-5296.exe PID 2740 wrote to memory of 1440 2740 Unicorn-30511.exe Unicorn-5296.exe PID 2740 wrote to memory of 1440 2740 Unicorn-30511.exe Unicorn-5296.exe PID 2868 wrote to memory of 1620 2868 Unicorn-50377.exe Unicorn-29800.exe PID 2868 wrote to memory of 1620 2868 Unicorn-50377.exe Unicorn-29800.exe PID 2868 wrote to memory of 1620 2868 Unicorn-50377.exe Unicorn-29800.exe PID 2868 wrote to memory of 1620 2868 Unicorn-50377.exe Unicorn-29800.exe PID 2560 wrote to memory of 1716 2560 Unicorn-14772.exe Unicorn-10771.exe PID 2560 wrote to memory of 1716 2560 Unicorn-14772.exe Unicorn-10771.exe PID 2560 wrote to memory of 1716 2560 Unicorn-14772.exe Unicorn-10771.exe PID 2560 wrote to memory of 1716 2560 Unicorn-14772.exe Unicorn-10771.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe"C:\Users\Admin\AppData\Local\Temp\714f8448018293b3b4a2b4285bc4d4c2a48071ffdba45c2715c7108b6de3c21d.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32998.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32998.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7507.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 2404⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11565.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11565.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21078.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47803.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2515.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2515.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37217.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41322.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5115.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5115.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14443.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14443.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31704.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31704.exe15⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43432.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exe17⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55456.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55456.exe18⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11828 -s 21617⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8468 -s 21615⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6620 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 23611⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60351.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60351.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25536.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3260.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3260.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58979.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50422.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50422.exe15⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50713.exe16⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11692 -s 21616⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10464 -s 21615⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6452 -s 23613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 24010⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41637.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40829.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40829.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40502.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40502.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14438.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24304.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24304.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63302.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63302.exe15⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33142.exe16⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11800 -s 21616⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10948 -s 21615⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8572 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6872 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 2409⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52162.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56158.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13994.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13994.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61114.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61114.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 22412⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 23610⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49552.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49552.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42832.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42832.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42539.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49249.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49249.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54221.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54221.exe15⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12304 -s 21615⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11208 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8520 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6460 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5592 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 2409⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 2208⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57637.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57658.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31950.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13675.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6004 -s 24413⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 23610⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exe9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 22010⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 2409⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23163.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63387.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63387.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9967.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9967.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30204.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30204.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53084.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32602.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32602.exe15⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35851.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35851.exe16⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12368 -s 21615⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11040 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8264 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6336 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5392 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 2408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7071.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7071.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16989.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17949.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59303.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 22013⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 23610⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55774.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55774.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30388.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30388.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18035.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18035.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22498.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22498.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4267.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59680.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59680.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe15⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10512 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9088 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6352 -s 22012⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5512 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 2209⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47051.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47051.exe9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 24010⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 2408⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27849.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1612.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64046.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57422.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57422.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6656 -s 22012⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 2369⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33708.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33708.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42347.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42347.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8156 -s 22412⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7040 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 2408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 2407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 2406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1295.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1295.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41410.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14658.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4134.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29262.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51711.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51711.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47718.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47718.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37983.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38502.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38502.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exe15⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39831.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39831.exe16⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12264 -s 21616⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10652 -s 21615⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7456 -s 23614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5952 -s 23613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 23611⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7872 -s 24013⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 24010⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17372.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7829.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7829.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10436 -s 22014⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8976 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 2409⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31331.exe8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 2409⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 2408⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64414.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64414.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 2209⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50237.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62767.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30239.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30239.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14905.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61527.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45394.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45394.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19084.exe15⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11876 -s 23614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9204 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6504 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 22010⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 2408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31187.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43029.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45982.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45982.exe9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 22410⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 2169⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56646.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56646.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36125.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10624 -s 24013⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8008 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 2408⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35415.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35415.exe7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 2407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 2406⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 2405⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57663.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16906.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16906.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8820.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 2409⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 2368⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19681.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58789.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58789.exe8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 2409⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60543.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27539.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7036 -s 24012⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5572 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 2408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47715.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30284.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30284.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14378.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23071.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23071.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26115.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26115.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26058.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26058.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37594.exe15⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25197.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25197.exe17⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11676 -s 23616⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10812 -s 21615⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7984 -s 23614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7472 -s 23613⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4303.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9005.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9005.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4314.exe15⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54709.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54709.exe16⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12072 -s 21615⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10852 -s 23614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8024 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 22012⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 23610⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64326.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65473.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65473.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37360.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37360.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8028 -s 22013⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7400 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5208 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 2409⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53397.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22739.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54262.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57822.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe15⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37880.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37880.exe16⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11720 -s 23615⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10492 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8796 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6208 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5344 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 2208⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8265.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8265.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60071.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60071.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47383.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47383.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7593.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23261.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23261.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12529.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12529.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe15⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11344 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9364 -s 23613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7620 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5520 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 2369⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13563.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13563.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52043.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13758.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10930.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39872.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38414.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38414.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27112.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27112.exe14⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11656 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10552 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8720 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6912 -s 22011⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2208⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 2407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 2406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37326.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59775.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59775.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48675.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16818.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16818.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26112.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26112.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17651.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17651.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40889.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40889.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8128 -s 22013⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 2169⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22525.exe8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 2249⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 2408⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32893.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17944.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17944.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65289.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65289.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47749.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24112.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24112.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10596 -s 24013⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7972 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6896 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26117.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20902.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20902.exe8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 2209⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 2168⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13288.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13288.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26112.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26112.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40318.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40318.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19836.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19836.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29862.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4169.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4169.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32343.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32343.exe14⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11456 -s 23613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10728 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8112 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5760 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 2407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 2206⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 2405⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 2404⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 2403⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57263.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57263.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50377.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50377.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14772.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10771.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38037.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47357.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22744.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64435.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23486.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15613.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15613.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1999.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe14⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8660 -s 22015⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6800 -s 22014⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 24810⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41213.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8597.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51475.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7060 -s 22413⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5732 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 2409⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39822.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32469.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32469.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54892.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54892.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40510.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28445.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12051.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12051.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe15⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40926.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40926.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46733.exe17⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11696 -s 21616⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11084 -s 23615⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8332 -s 22014⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6444 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 23610⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4321.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50899.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50899.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8676 -s 22413⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6616 -s 22012⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5700 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 2409⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 2208⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7066.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7066.exe8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1742.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1742.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13283.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13283.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 22012⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 23610⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41383.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41383.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19789.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19789.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43795.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44724.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3245.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3245.exe15⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11548 -s 23615⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11000 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8840 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6584 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5652 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 2409⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59427.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49381.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49381.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20658.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37085.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61392.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61392.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55414.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55414.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37698.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60744.exe15⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe16⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12584 -s 21615⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11252 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8292 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6164 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 2208⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58218.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58218.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 2407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 2406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22255.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22255.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6516.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6516.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62380.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7087.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7087.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44202.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44202.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62876.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39009.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39009.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8159.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8159.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1081.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1081.exe15⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11372 -s 24416⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10924 -s 23615⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8016 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 23613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 24012⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 23610⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65011.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48670.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64905.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36504.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36504.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41024.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41024.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10288 -s 22014⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8900 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6972 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 2409⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19956.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59495.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59495.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 22012⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 2208⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60906.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60906.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-927.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-927.exe8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 2449⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35161.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35161.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26011.exe10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6944 -s 22411⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 2408⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23490.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23490.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41768.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41768.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30715.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48761.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16276.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6789.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6789.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16624.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16624.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44662.exe15⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33604.exe16⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11968 -s 23615⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10608 -s 23614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8388 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6156 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 2369⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36226.exe9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 22410⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 2408⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30262.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57165.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31758.exe9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 22010⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 2207⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 2406⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 2405⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46205.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 2206⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43356.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11150.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21924.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40777.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40777.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59835.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6120 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 2369⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55175.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5969.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5969.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29810.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-744.exe14⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11976 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10700 -s 23613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8208 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7052 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5336 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 2408⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 264 -s 2487⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60906.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60906.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15317.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15317.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16709.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16709.exe8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 2209⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 2368⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4819.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59443.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59443.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63810.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1610.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1610.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62814.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62814.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8221.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8221.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15331.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10752 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8108 -s 24011⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7320 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 2407⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 2406⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 2405⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 2404⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12312.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49666.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49666.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42121.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29075.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29075.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34996.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34996.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7066.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7066.exe8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 2168⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 2167⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58301.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58213.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52650.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45297.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45297.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38748.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38748.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2876.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6764 -s 22412⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 2169⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3065.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3065.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18611.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18611.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49000.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49000.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61164.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39172.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2555.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2555.exe15⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11528 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10880 -s 23613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8232 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6772 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 2408⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2058.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2058.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8156.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24166.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1231.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1231.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1994.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1994.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53084.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14755.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14755.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15435.exe14⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12456 -s 23614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11048 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 2407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 2406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8353.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54129.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13755.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13755.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25920.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25920.exe10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 22011⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 2488⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59635.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37853.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37853.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30194.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16889.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16889.exe14⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10692 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7204 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7208 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64990.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58296.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58296.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44594.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1802.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1802.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8368 -s 22412⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6472 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 2368⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53828.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53828.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7637.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63343.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63343.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38450.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11164 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8940 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7120 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 2407⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 2406⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 2405⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 2445⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 2404⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 2403⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 2402⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exeFilesize
184KB
MD545c7fffa099508d78ab1c8fb4a305322
SHA154ab811f885d2b2b36c1723b61872ffa8a0b9868
SHA256bf223a20acda3d867305160d8cfb868c941794c25756c7c6d2978c7bb642b094
SHA5123142db5d1187ef6dedf45551b6990db2fa10efb8e3a1d2ea56b63ca0a111de116a292d6510e20db45ec56c212ecd7df13775832a93d71515f79dd0b9042e2915
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1994.exeFilesize
184KB
MD54062e5684c78f43eefaaea339bd7155b
SHA18cc6c40b8b7bb6e34ca4a09f4310d5f784ef3eef
SHA2565e5542f3fbe8ad6dcc18ef0070718f8b57857a400fe2c4006e57eb2f08ea42af
SHA5120af6b4d0d620f9fb6c0f83dd0d7ea85419953793e37dbf041ecffaec22b241290e3543c42c9794d773f576b0980a3c7388d89c2d5ede5f3eb23b285d1df6fe4a
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2555.exeFilesize
184KB
MD54a4b99bf95a362ab86838269c9c56f77
SHA178fa7b3985beb0ce5c997a0d137b4d1dbc645593
SHA25663561993584070031d7ed7efccbc6ffd8a66937ffc97142a0dbf0c3b058e0762
SHA512f49955f11449cc04f10da0e950039b8952c46d33ccf268eb3792c604f5fefca61ba51ce80c39cffe5ae8c601461fce4895c9426c0cbcb8498d7d7ba0e30ecdad
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32343.exeFilesize
184KB
MD5cb79827be0c796f7a4a126c19c13d887
SHA11ce6bb8a8629fc0437dedff65f1d7285fd1303c5
SHA25632e5b9968b8ffeee9ad122910face827120fd4ee6977581c91d9240eef90a800
SHA51220ce5be2c69c2433d007256cab0dade06f5775913df3f68eaac1274378af80ecae9aa01291099c1c296efb126b0a3d3e7b9dcb615f576d98c61a30b3005dfcc3
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36226.exeFilesize
184KB
MD5714936edc43d1fd23113871321a778d1
SHA109712585f91e44f461854ee36a8733bcb8e65ae3
SHA25672d9577380696381236fba93f3689640505decef634bf11402090f84cdb91034
SHA5124c86ba125192eb2524708a15164411a3c91330cb31eb093d7ff9fb9ce0f9649a82a7c5f9d3bf7c1706a25a224ef08856394b658a56620fb1202ad627ff6bfb51
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40318.exeFilesize
184KB
MD589ce9660594ded1178e28c5f84b72106
SHA1be07031ad35e7cda739a6b3f6109173adf9fb7a1
SHA25628b77671b51a84996b4a7463599aa9d7bc32ca100c26f89c35ced99ec7847c15
SHA5126a381115c34d09c95bc025028a0c8d3914e1b4639efcc7ad9bb5f82fceed6c8f9e6d078625a81b5551b0d379a0a00d249345e3d13ffc3b3debb8f3cdcddc43df
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40777.exeFilesize
184KB
MD5da22fda3903ee381fcb2347f98d538ab
SHA1905c81984bfcb6d7b2fc686955156ecc1fd32769
SHA256220d0d563276a4a490a0510c2a8d0a11cb13bf6cb5a238b97a920bcbdfb2a841
SHA51276eafe96d9b3d3782b87cad72023f4b0ffd1a97d8eecccc5bbf3985db8317b24a62604de7b6bad1136f6bc77967dec7f76efc86dd8d6cbd2f786fcb83574fcca
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49666.exeFilesize
184KB
MD541e426756a9d590decacc1a02ac82b0b
SHA1e1dc291cd3e0f3c6a173a31c0eb834fc1897f236
SHA256f4916a2c2cea0b25ff65060caf0b25ad445b08acae6d3cce66d33d97949d621e
SHA512c79e624626b54787072ad61042787201da07f27a0fe3346b3183ef57c6004ce21feedd3e79885990d3b563f6b7822d57a3a27a6e30a17d063c4ded88f96d7279
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50377.exeFilesize
184KB
MD54d40b09837e3bc03f68b83efd39886d7
SHA10931fdc241db2765b4608730ff08aaf0f1e0ae2d
SHA25679bcf07fd0582335fca9dfca6b5ec313357f99fdf5a98ec53edc6a883fa77563
SHA512c118e0e9ef4907ac683d3b1446cd0f4f017e0a9548143ae6fbf8716c7c6ad1ab935131829176dc5b6ca8f06b878ded7f7cd1e2a0e9733026c06206bc7ecef6b3
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63302.exeFilesize
184KB
MD537cd5e3fbafd262f544ebf9d7fd604d3
SHA1d2685b32cd8e27faccef0e200b610c3b679dfa62
SHA25601a30f1f14b6c492de7dc485bf64e2f5cdbaecc9b772fa2852f6e0ce959cb9d9
SHA512e8adf3ecbe1d8c156ca626f0e95048a3db79fa9fb4b8b6b23d8a900025ee77fe6461fff414f80a64a65213e181134c67c0ecb312ba86b1a87d3154b4bfaf3fc2
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exeFilesize
184KB
MD5fb58a78bfb3b432aec8107676b036fff
SHA1c285edf22d0f762bdd2e6583f5bcc869557c491e
SHA25674487b082eba26f18db5782be21b2151d9414657b062634299ae5b622d76f3b5
SHA5127bb530160ecbd756b51756086a43154e10fe87cd4485853bc27dac3bef42ad44b3e58c5aae7d6fa4fa1590fa06b814b8f4e11e90492b11c87320e94e147addf2
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exeFilesize
184KB
MD5f25e769d263aaf16dea1fd248408cf0b
SHA1b1d3edf3f5ed05954ee0bb9b848b904f58e1abdf
SHA256ab770188a59e006bc09d86284fd30c2be5a7647a0e0b427067e6506384f513a6
SHA5120dbb14a9ad45e43353d54a1f819bdab0e8acbb9c6073187026640d34516b9bfaac2c3cdc6558aaab5429953de37f1a454dd493037ebbe2f9351cc16b2d02ee51
-
\Users\Admin\AppData\Local\Temp\Unicorn-10771.exeFilesize
184KB
MD58ab4b7323acca34886c91bfdc661151a
SHA1128b2dd857b00b53ffbdf440b0d70a30cff1227b
SHA25670efbcc1a1c646db6fec30aca70e7f5d8202fe397c799eb9f938b74d28f5e3da
SHA51209f6cfe9de4a7535f7acde88cc9de7f4df4ac0541d2421475b9a9737356365513e13a5e50a09627c1a3f6d4045ff4c36bb2313494ab880f3248c7a34200f4f36
-
\Users\Admin\AppData\Local\Temp\Unicorn-11565.exeFilesize
184KB
MD582a98ea74e10728c41de48b3d7d5c9f8
SHA1ce1da9c993fbb1a614d2341afaf152dd303236c1
SHA25622caea715fdc1ffc0fd81f1038276fcc88f40584fee083c66930207d7cb31e6a
SHA5125be84577390412a42dc50275f49ea6182f993011ad9eb3cb5d2d623ca072614e5320732e250aa102eb70ae31b5f66c01d4321ac28939173a198a4ac29b4244e9
-
\Users\Admin\AppData\Local\Temp\Unicorn-12312.exeFilesize
184KB
MD5d8c7ef04fc27efb584df6ead1dbbc118
SHA1a4c42dcc1a2930775e5951429d7b561e7635c3fe
SHA256061b2c293001b867bbddecc1667b3c85c744d94838361aa179ded3e94c521d1c
SHA512cbb59441637579cfc0c7bc91e9f13b151c0bdf919de1f91d51c042efb496ffebfaab43d42677a2c0611369494f069a0001a15262d9277df7f1800d2d303bbcf1
-
\Users\Admin\AppData\Local\Temp\Unicorn-14772.exeFilesize
184KB
MD55a84d68c84436856c4bc1c1330775ca0
SHA1659f4ca8189d6b6e51201615d7aec38265515a48
SHA256319ca64f21f142c91091590d61bf2c8b2a7a37eaa54ec102754354ddb1e76195
SHA512af7945072a3a6c4ac3ae9827612cf65b7f8524c76346619cef35fbaa8ffd0a479eeedab3e77af26f0f61862c39b2569f071695cd223f4017fd229560c5c7017d
-
\Users\Admin\AppData\Local\Temp\Unicorn-21078.exeFilesize
184KB
MD5542466cc95aee2ab47a48903ba87a1e0
SHA14aea7ec62b495b1aa9e148f693bc37a4827ddebb
SHA2561bb98575364eb1e1a3402cec88fd28b2c57dcaba7a7da9cda93afacfdb0a0574
SHA5122a6ccee6df53de364855022c6123bf659f481297587253413687a818b91c0c5b39161d9acc9495d90f6a6edab0d1cfba8d43ea953a3882e8f950aec380a12642
-
\Users\Admin\AppData\Local\Temp\Unicorn-29800.exeFilesize
184KB
MD55cad22e91d2bd3b4dcd596731a98310a
SHA1daa1a7b8abf68e180c1cd58a896413f972934762
SHA25665e1f0e3c3e7c9a01fd4d67bfd91dff18d45cc314458c099016769afc32548af
SHA512cd3951c82a402ebef24b110154eceafa887801dce285314eb6adde9b09ce588f4c4ebe28601ecb97ef2a1e640d823dca1265e7e19910b87099ab018a698e69d1
-
\Users\Admin\AppData\Local\Temp\Unicorn-30511.exeFilesize
184KB
MD54df41fefea35c66d0c1349797fdd5c54
SHA1ff3d0bd599c8ad891b30e2af070c814a57e3f578
SHA256376212f58374ef44860e1ae29a6955aadf25295a8490bd428e96d4eee5157c08
SHA512f3ea16ef58c66f30af60a054ea5205744e534aac843c814c50ea8a14f43fd61778df0a1f1425e43feb3b629af49db9878d081a1210dad3c165d59f3ea4711ab3
-
\Users\Admin\AppData\Local\Temp\Unicorn-32998.exeFilesize
184KB
MD5c3008219879a501e92dc4e32b0d6d03c
SHA1b34013ec4ee6c4d234452af47a7fc7ff9c6f49e8
SHA2561425ea29cd12140b11c0ed6d1749c3e3419bc5dd890fbf8645c09a1013ebebbd
SHA512d1d317ab2310b501839b6639b16e2d1d1f97eccab296e6c593db062a68b1550cb12e47ed22be132d5631ff6c921b15e06e5be5488726791b5fa526c48b72efea
-
\Users\Admin\AppData\Local\Temp\Unicorn-5296.exeFilesize
184KB
MD51ee8aa712636a28cb40b8717e4550555
SHA15cd02aeed546ccda2e15590f7b2f1f3c741857d0
SHA256c90c16c7f51e785cf9bafd44f581ad04a39e4f217f34724f7f15966b89d91521
SHA512fac855e1da0803311d41753cad3602ae0d72a285164487b5066c5771b47d526096ec5ad7432222bc7e9c9f5c45ad16d643a2c96ec76c6b4256990dea87a65868
-
\Users\Admin\AppData\Local\Temp\Unicorn-57263.exeFilesize
184KB
MD57d9bbf5963c83118732ca3d83eb0e0ee
SHA1c66aff25db8715a2f3e35de81cf7488cba51e2a3
SHA256baf7f49ee326c7eb52fab89f0a7796aebacbed3b16fc7fab8c434a02563b8a53
SHA51269a4c327edec0bac5063978c9fdd99a88d24768f166781a161240d0daf354b56bf5234880209593b59ec2e35e1acccbfc2c05201e6ba51ba56a3a40250eb19d9
-
\Users\Admin\AppData\Local\Temp\Unicorn-7507.exeFilesize
184KB
MD5717f1f69e658a6c8bea4b8e2e1b6d5d8
SHA1647f2593b319edcd5ff5e3b51c2ed1bdbc910458
SHA25603978fbec47e97c6553d070e5bbc365935273a2a781ddf0c31838cf8cab624a9
SHA51263902bd880f071ef0e42b9e77a9fb3475a899b86a7bd257c46b7e6b167a15cc54aee8cae1a1e4b858fb716a81d462f18183d9e0513441720c57067b05464b23c