Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:06
Static task
static1
Behavioral task
behavioral1
Sample
722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe
Resource
win10v2004-20240508-en
General
-
Target
722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe
-
Size
184KB
-
MD5
9e06ca1e4cb253d3f861e5c695878c99
-
SHA1
446ad71cd3fe33d29adb2e3c98d9236b5f1ac34f
-
SHA256
722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a
-
SHA512
325a1426def4075c5c1d81d79944d7499f26ebe35d31c065e47981f9036d83fea3e4e9ce36e9bb2f5f4526a6d68b73a1dd2819c96ab7a01c01d1fb3ee62b03b1
-
SSDEEP
1536:87S/6FZAf3Lxotx3t19AlawM+2+yvZcl6mdMxdLR2Dzetihlwhj5nizpv/:yda3LxoT919Td+nWeYdLRksihl+ViFn
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
Unicorn-12283.exeUnicorn-8282.exeUnicorn-27311.exeUnicorn-64857.exeUnicorn-30047.exeUnicorn-53160.exeUnicorn-42382.exeUnicorn-11655.exeUnicorn-46466.exeUnicorn-26600.exeUnicorn-61987.exeUnicorn-59377.exeUnicorn-20483.exeUnicorn-4701.exeUnicorn-43595.exeUnicorn-24567.exeUnicorn-13061.exeUnicorn-32927.exeUnicorn-32927.exeUnicorn-54271.exeUnicorn-11847.exeUnicorn-39881.exeUnicorn-43965.exeUnicorn-54826.exeUnicorn-13238.exeUnicorn-52133.exeUnicorn-56409.exeUnicorn-36543.exeUnicorn-1733.exeUnicorn-60493.exeUnicorn-40627.exeUnicorn-50270.exeUnicorn-61131.exeUnicorn-58438.exeUnicorn-27712.exeUnicorn-46741.exeUnicorn-55101.exeUnicorn-40156.exeUnicorn-1816.exeUnicorn-11951.exeUnicorn-1645.exeUnicorn-1645.exeUnicorn-1645.exeUnicorn-1645.exeUnicorn-55677.exeUnicorn-40732.exeUnicorn-59761.exeUnicorn-14089.exeUnicorn-18174.exeUnicorn-63845.exeUnicorn-11458.exeUnicorn-11458.exeUnicorn-61214.exeUnicorn-36155.exeUnicorn-20373.exeUnicorn-13596.exeUnicorn-63352.exeUnicorn-26425.exeUnicorn-57151.exeUnicorn-61235.exeUnicorn-14727.exeUnicorn-65319.exeUnicorn-53622.exeUnicorn-7950.exepid process 1324 Unicorn-12283.exe 2596 Unicorn-8282.exe 2988 Unicorn-27311.exe 2288 Unicorn-64857.exe 2480 Unicorn-30047.exe 2676 Unicorn-53160.exe 2776 Unicorn-42382.exe 2936 Unicorn-11655.exe 2804 Unicorn-46466.exe 1708 Unicorn-26600.exe 2340 Unicorn-61987.exe 1548 Unicorn-59377.exe 1572 Unicorn-20483.exe 2852 Unicorn-4701.exe 2292 Unicorn-43595.exe 2052 Unicorn-24567.exe 600 Unicorn-13061.exe 604 Unicorn-32927.exe 324 Unicorn-32927.exe 1156 Unicorn-54271.exe 2020 Unicorn-11847.exe 1788 Unicorn-39881.exe 1380 Unicorn-43965.exe 1048 Unicorn-54826.exe 1640 Unicorn-13238.exe 592 Unicorn-52133.exe 1984 Unicorn-56409.exe 572 Unicorn-36543.exe 2272 Unicorn-1733.exe 912 Unicorn-60493.exe 1528 Unicorn-40627.exe 3008 Unicorn-50270.exe 2848 Unicorn-61131.exe 2484 Unicorn-58438.exe 2520 Unicorn-27712.exe 2500 Unicorn-46741.exe 2204 Unicorn-55101.exe 2924 Unicorn-40156.exe 2932 Unicorn-1816.exe 2552 Unicorn-11951.exe 2348 Unicorn-1645.exe 2780 Unicorn-1645.exe 2808 Unicorn-1645.exe 2904 Unicorn-1645.exe 376 Unicorn-55677.exe 2336 Unicorn-40732.exe 1052 Unicorn-59761.exe 2748 Unicorn-14089.exe 1580 Unicorn-18174.exe 2044 Unicorn-63845.exe 588 Unicorn-11458.exe 1504 Unicorn-11458.exe 1884 Unicorn-61214.exe 1688 Unicorn-36155.exe 1684 Unicorn-20373.exe 1620 Unicorn-13596.exe 2888 Unicorn-63352.exe 2112 Unicorn-26425.exe 1848 Unicorn-57151.exe 3024 Unicorn-61235.exe 2372 Unicorn-14727.exe 2672 Unicorn-65319.exe 2496 Unicorn-53622.exe 2476 Unicorn-7950.exe -
Loads dropped DLL 64 IoCs
Processes:
722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exeUnicorn-12283.exeUnicorn-27311.exeUnicorn-8282.exeWerFault.exeUnicorn-30047.exeUnicorn-53160.exeUnicorn-64857.exeWerFault.exeWerFault.exeUnicorn-42382.exeUnicorn-11655.exeUnicorn-26600.exeUnicorn-46466.exeUnicorn-61987.exeWerFault.exeWerFault.exeWerFault.exepid process 2980 722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe 2980 722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe 1324 Unicorn-12283.exe 2980 722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe 1324 Unicorn-12283.exe 2980 722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe 2988 Unicorn-27311.exe 2988 Unicorn-27311.exe 2596 Unicorn-8282.exe 2596 Unicorn-8282.exe 1324 Unicorn-12283.exe 1324 Unicorn-12283.exe 2692 WerFault.exe 2692 WerFault.exe 2692 WerFault.exe 2692 WerFault.exe 2692 WerFault.exe 2480 Unicorn-30047.exe 2480 Unicorn-30047.exe 2676 Unicorn-53160.exe 2288 Unicorn-64857.exe 2676 Unicorn-53160.exe 2288 Unicorn-64857.exe 2596 Unicorn-8282.exe 2596 Unicorn-8282.exe 2988 Unicorn-27311.exe 2988 Unicorn-27311.exe 1072 WerFault.exe 1072 WerFault.exe 1072 WerFault.exe 1072 WerFault.exe 2704 WerFault.exe 2704 WerFault.exe 2704 WerFault.exe 2704 WerFault.exe 1072 WerFault.exe 2704 WerFault.exe 2776 Unicorn-42382.exe 2936 Unicorn-11655.exe 2776 Unicorn-42382.exe 2936 Unicorn-11655.exe 2288 Unicorn-64857.exe 1708 Unicorn-26600.exe 2480 Unicorn-30047.exe 2288 Unicorn-64857.exe 2480 Unicorn-30047.exe 1708 Unicorn-26600.exe 2676 Unicorn-53160.exe 2804 Unicorn-46466.exe 2340 Unicorn-61987.exe 2676 Unicorn-53160.exe 2804 Unicorn-46466.exe 2340 Unicorn-61987.exe 856 WerFault.exe 856 WerFault.exe 856 WerFault.exe 856 WerFault.exe 856 WerFault.exe 1100 WerFault.exe 1100 WerFault.exe 1100 WerFault.exe 1100 WerFault.exe 932 WerFault.exe 932 WerFault.exe -
Program crash 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2080 2980 WerFault.exe 722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe 2692 1324 WerFault.exe Unicorn-12283.exe 1072 2988 WerFault.exe Unicorn-27311.exe 2704 2596 WerFault.exe Unicorn-8282.exe 856 2480 WerFault.exe Unicorn-30047.exe 1100 2676 WerFault.exe Unicorn-53160.exe 932 2288 WerFault.exe Unicorn-64857.exe 3020 2776 WerFault.exe Unicorn-42382.exe 2940 2936 WerFault.exe Unicorn-11655.exe 2992 1708 WerFault.exe Unicorn-26600.exe 2548 2340 WerFault.exe Unicorn-61987.exe 1760 2804 WerFault.exe Unicorn-46466.exe 1756 1548 WerFault.exe Unicorn-59377.exe 2308 2052 WerFault.exe Unicorn-24567.exe 1780 2852 WerFault.exe Unicorn-4701.exe 1128 2292 WerFault.exe Unicorn-43595.exe 2144 324 WerFault.exe Unicorn-32927.exe 860 1572 WerFault.exe Unicorn-20483.exe 3068 604 WerFault.exe Unicorn-32927.exe 1576 600 WerFault.exe Unicorn-13061.exe 1720 1156 WerFault.exe Unicorn-54271.exe 2324 2020 WerFault.exe Unicorn-11847.exe 1916 1788 WerFault.exe Unicorn-39881.exe 3032 1380 WerFault.exe Unicorn-43965.exe 2452 1048 WerFault.exe Unicorn-54826.exe 2800 1640 WerFault.exe Unicorn-13238.exe 2916 2272 WerFault.exe Unicorn-1733.exe 2624 572 WerFault.exe Unicorn-36543.exe 2516 592 WerFault.exe Unicorn-52133.exe 2072 912 WerFault.exe Unicorn-60493.exe 824 1984 WerFault.exe Unicorn-56409.exe 888 1528 WerFault.exe Unicorn-40627.exe 3208 2848 WerFault.exe Unicorn-61131.exe 3220 3008 WerFault.exe Unicorn-50270.exe 3432 2500 WerFault.exe Unicorn-46741.exe 3540 2748 WerFault.exe Unicorn-14089.exe 3628 2808 WerFault.exe Unicorn-1645.exe 3644 2552 WerFault.exe Unicorn-11951.exe 3668 1580 WerFault.exe Unicorn-18174.exe 3708 2924 WerFault.exe Unicorn-40156.exe 3988 1052 WerFault.exe Unicorn-59761.exe 4008 2044 WerFault.exe Unicorn-63845.exe 4044 1504 WerFault.exe Unicorn-11458.exe 4036 588 WerFault.exe Unicorn-11458.exe 4052 2780 WerFault.exe Unicorn-1645.exe 3104 2520 WerFault.exe Unicorn-27712.exe 3136 2484 WerFault.exe Unicorn-58438.exe 3232 2904 WerFault.exe Unicorn-1645.exe 3248 2336 WerFault.exe Unicorn-40732.exe 3260 1884 WerFault.exe Unicorn-61214.exe 3328 2932 WerFault.exe Unicorn-1816.exe 3340 2348 WerFault.exe Unicorn-1645.exe 3596 376 WerFault.exe Unicorn-55677.exe 3116 2496 WerFault.exe Unicorn-53622.exe 3172 2888 WerFault.exe Unicorn-63352.exe 3492 2204 WerFault.exe Unicorn-55101.exe 2428 1620 WerFault.exe Unicorn-13596.exe 3124 2112 WerFault.exe Unicorn-26425.exe 3616 3024 WerFault.exe Unicorn-61235.exe 3812 1688 WerFault.exe Unicorn-36155.exe 3900 1848 WerFault.exe Unicorn-57151.exe 3948 1988 WerFault.exe Unicorn-11842.exe 3972 2768 WerFault.exe Unicorn-18619.exe 3276 2372 WerFault.exe Unicorn-14727.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exeUnicorn-12283.exeUnicorn-8282.exeUnicorn-27311.exeUnicorn-64857.exeUnicorn-30047.exeUnicorn-53160.exeUnicorn-42382.exeUnicorn-11655.exeUnicorn-46466.exeUnicorn-26600.exeUnicorn-61987.exeUnicorn-59377.exeUnicorn-24567.exeUnicorn-43595.exeUnicorn-32927.exeUnicorn-32927.exeUnicorn-4701.exeUnicorn-13061.exeUnicorn-20483.exeUnicorn-54271.exeUnicorn-11847.exeUnicorn-39881.exeUnicorn-43965.exeUnicorn-54826.exeUnicorn-13238.exeUnicorn-52133.exeUnicorn-36543.exeUnicorn-56409.exeUnicorn-1733.exeUnicorn-60493.exeUnicorn-40627.exeUnicorn-50270.exeUnicorn-61131.exeUnicorn-58438.exeUnicorn-27712.exeUnicorn-46741.exeUnicorn-55101.exeUnicorn-40156.exeUnicorn-1816.exeUnicorn-11951.exeUnicorn-1645.exeUnicorn-1645.exeUnicorn-1645.exeUnicorn-1645.exeUnicorn-55677.exeUnicorn-14089.exeUnicorn-40732.exeUnicorn-59761.exeUnicorn-18174.exeUnicorn-63845.exeUnicorn-11458.exeUnicorn-11458.exeUnicorn-61214.exeUnicorn-20373.exeUnicorn-36155.exeUnicorn-13596.exeUnicorn-63352.exeUnicorn-26425.exeUnicorn-57151.exeUnicorn-61235.exeUnicorn-14727.exeUnicorn-65319.exeUnicorn-53622.exepid process 2980 722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe 1324 Unicorn-12283.exe 2596 Unicorn-8282.exe 2988 Unicorn-27311.exe 2288 Unicorn-64857.exe 2480 Unicorn-30047.exe 2676 Unicorn-53160.exe 2776 Unicorn-42382.exe 2936 Unicorn-11655.exe 2804 Unicorn-46466.exe 1708 Unicorn-26600.exe 2340 Unicorn-61987.exe 1548 Unicorn-59377.exe 2052 Unicorn-24567.exe 2292 Unicorn-43595.exe 604 Unicorn-32927.exe 324 Unicorn-32927.exe 2852 Unicorn-4701.exe 600 Unicorn-13061.exe 1572 Unicorn-20483.exe 1156 Unicorn-54271.exe 2020 Unicorn-11847.exe 1788 Unicorn-39881.exe 1380 Unicorn-43965.exe 1048 Unicorn-54826.exe 1640 Unicorn-13238.exe 592 Unicorn-52133.exe 572 Unicorn-36543.exe 1984 Unicorn-56409.exe 2272 Unicorn-1733.exe 912 Unicorn-60493.exe 1528 Unicorn-40627.exe 3008 Unicorn-50270.exe 2848 Unicorn-61131.exe 2484 Unicorn-58438.exe 2520 Unicorn-27712.exe 2500 Unicorn-46741.exe 2204 Unicorn-55101.exe 2924 Unicorn-40156.exe 2932 Unicorn-1816.exe 2552 Unicorn-11951.exe 2780 Unicorn-1645.exe 2904 Unicorn-1645.exe 2348 Unicorn-1645.exe 2808 Unicorn-1645.exe 376 Unicorn-55677.exe 2748 Unicorn-14089.exe 2336 Unicorn-40732.exe 1052 Unicorn-59761.exe 1580 Unicorn-18174.exe 2044 Unicorn-63845.exe 588 Unicorn-11458.exe 1504 Unicorn-11458.exe 1884 Unicorn-61214.exe 1684 Unicorn-20373.exe 1688 Unicorn-36155.exe 1620 Unicorn-13596.exe 2888 Unicorn-63352.exe 2112 Unicorn-26425.exe 1848 Unicorn-57151.exe 3024 Unicorn-61235.exe 2372 Unicorn-14727.exe 2672 Unicorn-65319.exe 2496 Unicorn-53622.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exeUnicorn-12283.exeUnicorn-27311.exeUnicorn-8282.exeUnicorn-30047.exeUnicorn-53160.exeUnicorn-64857.exeUnicorn-42382.exedescription pid process target process PID 2980 wrote to memory of 1324 2980 722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe Unicorn-12283.exe PID 2980 wrote to memory of 1324 2980 722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe Unicorn-12283.exe PID 2980 wrote to memory of 1324 2980 722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe Unicorn-12283.exe PID 2980 wrote to memory of 1324 2980 722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe Unicorn-12283.exe PID 1324 wrote to memory of 2596 1324 Unicorn-12283.exe Unicorn-8282.exe PID 1324 wrote to memory of 2596 1324 Unicorn-12283.exe Unicorn-8282.exe PID 1324 wrote to memory of 2596 1324 Unicorn-12283.exe Unicorn-8282.exe PID 1324 wrote to memory of 2596 1324 Unicorn-12283.exe Unicorn-8282.exe PID 2980 wrote to memory of 2988 2980 722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe Unicorn-27311.exe PID 2980 wrote to memory of 2988 2980 722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe Unicorn-27311.exe PID 2980 wrote to memory of 2988 2980 722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe Unicorn-27311.exe PID 2980 wrote to memory of 2988 2980 722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe Unicorn-27311.exe PID 2980 wrote to memory of 2080 2980 722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe WerFault.exe PID 2980 wrote to memory of 2080 2980 722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe WerFault.exe PID 2980 wrote to memory of 2080 2980 722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe WerFault.exe PID 2980 wrote to memory of 2080 2980 722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe WerFault.exe PID 2988 wrote to memory of 2288 2988 Unicorn-27311.exe Unicorn-64857.exe PID 2988 wrote to memory of 2288 2988 Unicorn-27311.exe Unicorn-64857.exe PID 2988 wrote to memory of 2288 2988 Unicorn-27311.exe Unicorn-64857.exe PID 2988 wrote to memory of 2288 2988 Unicorn-27311.exe Unicorn-64857.exe PID 2596 wrote to memory of 2480 2596 Unicorn-8282.exe Unicorn-30047.exe PID 2596 wrote to memory of 2480 2596 Unicorn-8282.exe Unicorn-30047.exe PID 2596 wrote to memory of 2480 2596 Unicorn-8282.exe Unicorn-30047.exe PID 2596 wrote to memory of 2480 2596 Unicorn-8282.exe Unicorn-30047.exe PID 1324 wrote to memory of 2676 1324 Unicorn-12283.exe Unicorn-53160.exe PID 1324 wrote to memory of 2676 1324 Unicorn-12283.exe Unicorn-53160.exe PID 1324 wrote to memory of 2676 1324 Unicorn-12283.exe Unicorn-53160.exe PID 1324 wrote to memory of 2676 1324 Unicorn-12283.exe Unicorn-53160.exe PID 1324 wrote to memory of 2692 1324 Unicorn-12283.exe WerFault.exe PID 1324 wrote to memory of 2692 1324 Unicorn-12283.exe WerFault.exe PID 1324 wrote to memory of 2692 1324 Unicorn-12283.exe WerFault.exe PID 1324 wrote to memory of 2692 1324 Unicorn-12283.exe WerFault.exe PID 2480 wrote to memory of 2776 2480 Unicorn-30047.exe Unicorn-42382.exe PID 2480 wrote to memory of 2776 2480 Unicorn-30047.exe Unicorn-42382.exe PID 2480 wrote to memory of 2776 2480 Unicorn-30047.exe Unicorn-42382.exe PID 2480 wrote to memory of 2776 2480 Unicorn-30047.exe Unicorn-42382.exe PID 2676 wrote to memory of 2804 2676 Unicorn-53160.exe Unicorn-46466.exe PID 2676 wrote to memory of 2804 2676 Unicorn-53160.exe Unicorn-46466.exe PID 2676 wrote to memory of 2804 2676 Unicorn-53160.exe Unicorn-46466.exe PID 2676 wrote to memory of 2804 2676 Unicorn-53160.exe Unicorn-46466.exe PID 2288 wrote to memory of 2936 2288 Unicorn-64857.exe Unicorn-11655.exe PID 2288 wrote to memory of 2936 2288 Unicorn-64857.exe Unicorn-11655.exe PID 2288 wrote to memory of 2936 2288 Unicorn-64857.exe Unicorn-11655.exe PID 2288 wrote to memory of 2936 2288 Unicorn-64857.exe Unicorn-11655.exe PID 2596 wrote to memory of 1708 2596 Unicorn-8282.exe Unicorn-26600.exe PID 2596 wrote to memory of 1708 2596 Unicorn-8282.exe Unicorn-26600.exe PID 2596 wrote to memory of 1708 2596 Unicorn-8282.exe Unicorn-26600.exe PID 2596 wrote to memory of 1708 2596 Unicorn-8282.exe Unicorn-26600.exe PID 2988 wrote to memory of 2340 2988 Unicorn-27311.exe Unicorn-61987.exe PID 2988 wrote to memory of 2340 2988 Unicorn-27311.exe Unicorn-61987.exe PID 2988 wrote to memory of 2340 2988 Unicorn-27311.exe Unicorn-61987.exe PID 2988 wrote to memory of 2340 2988 Unicorn-27311.exe Unicorn-61987.exe PID 2988 wrote to memory of 1072 2988 Unicorn-27311.exe WerFault.exe PID 2988 wrote to memory of 1072 2988 Unicorn-27311.exe WerFault.exe PID 2988 wrote to memory of 1072 2988 Unicorn-27311.exe WerFault.exe PID 2988 wrote to memory of 1072 2988 Unicorn-27311.exe WerFault.exe PID 2596 wrote to memory of 2704 2596 Unicorn-8282.exe WerFault.exe PID 2596 wrote to memory of 2704 2596 Unicorn-8282.exe WerFault.exe PID 2596 wrote to memory of 2704 2596 Unicorn-8282.exe WerFault.exe PID 2596 wrote to memory of 2704 2596 Unicorn-8282.exe WerFault.exe PID 2776 wrote to memory of 1572 2776 Unicorn-42382.exe Unicorn-20483.exe PID 2776 wrote to memory of 1572 2776 Unicorn-42382.exe Unicorn-20483.exe PID 2776 wrote to memory of 1572 2776 Unicorn-42382.exe Unicorn-20483.exe PID 2776 wrote to memory of 1572 2776 Unicorn-42382.exe Unicorn-20483.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe"C:\Users\Admin\AppData\Local\Temp\722207466cd0600fa0c1c60e49ec801efda33365e5aab995bd5c49c410b0417a.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12283.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12283.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30047.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30047.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42382.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42382.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20483.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55101.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55101.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49258.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49258.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30805.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30805.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35543.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60758.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15928.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15928.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9276 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6260 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 2369⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37560.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32943.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32943.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40203.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40203.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13161.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13161.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10132 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7064 -s 22011⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 2408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 2167⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1733.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16586.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33789.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33789.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38584.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9732 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6592 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 2169⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8972.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57017.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9472 -s 22012⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7116 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 2408⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-145.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-145.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19108.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19108.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64053.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25325.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12185.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12185.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29228.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29228.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8728 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 2407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 2406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34401.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34401.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45750.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45750.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35875.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35875.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29098.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29098.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8760 -s 23613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 21610⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41089.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41089.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64048.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37925.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29742.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29742.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9200 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6488 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 2409⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60695.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60695.exe8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 2209⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 2408⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18619.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47312.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20883.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20883.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46425.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9984 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6988 -s 22011⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 2368⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 2207⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55677.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55677.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24287.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37006.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37006.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23021.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24817.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9300 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 22010⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 2368⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51951.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43057.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43057.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12086.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12086.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40665.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9044 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5172 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 2207⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 2406⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 2405⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26600.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26600.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39881.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57426.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19923.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10763.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10763.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14250.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59373.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59373.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9304 -s 22013⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6556 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 2369⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4608.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4608.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32497.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4038.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4038.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8948 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 2408⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20373.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20373.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63840.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31936.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31936.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31568.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36924.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8936 -s 22013⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6828 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 21610⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13269.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13269.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49933.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49933.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32264.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32264.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9628 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7088 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 2409⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20814.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20814.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24339.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13783.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13783.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56145.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56145.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8636 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 2408⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46741.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57151.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57151.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16218.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16218.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14832.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14832.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9516 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7152 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 2168⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8972.exe7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 2407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 2406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54826.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11951.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7950.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27707.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27707.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28662.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64469.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64469.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8944 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6412 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 2169⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6279.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6279.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41490.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41490.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44625.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44625.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9116 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6520 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 2408⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19662.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19539.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-265.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-265.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41817.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63291.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63291.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8988 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6328 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53622.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53622.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47504.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47504.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64992.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64992.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61993.exe10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6464 -s 20811⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 2169⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31743.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31743.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61142.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39337.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9656 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6368 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 2408⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18484.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3446.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3446.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44614.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62990.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9588 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6808 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 2209⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 2407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 2406⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 2405⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 2404⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53160.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53160.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24287.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5532.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19124.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19124.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60374.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9152 -s 21213⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6796 -s 22012⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 21610⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33305.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33305.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42258.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42258.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45984.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45984.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63950.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8816 -s 22012⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6868 -s 22011⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 21610⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14115.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14115.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60338.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60338.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8456 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 2208⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8505.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43804.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22061.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22061.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24054.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24054.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28268.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28268.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8504 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 2369⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53342.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29985.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18408.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26431.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26431.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8592 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 2408⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6279.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6279.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22393.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22393.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53301.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35533.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35533.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9188 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6136 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 2368⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25884.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25884.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16773.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16773.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8472 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 2407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 2406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40627.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18174.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24287.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31360.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31360.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37692.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37692.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8672 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6684 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 2169⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41682.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24096.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24096.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8624 -s 22011⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 2408⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19662.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1064.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1064.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62465.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24630.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24630.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8552 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12589.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12589.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27276.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34069.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16846.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41288.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41288.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8828 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 2367⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 2406⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 2405⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13061.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13061.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60493.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49834.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49834.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44661.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6560.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9944 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6936 -s 22011⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 2368⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64779.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64779.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15257.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9148 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6676 -s 22010⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 2207⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34955.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34955.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61531.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47001.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39913.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39913.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9376 -s 22011⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6400 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 708 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 2167⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 2406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59761.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24287.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34868.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53415.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53415.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35881.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9408 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6992 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 2367⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42237.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16846.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8836 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 2367⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 2206⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 600 -s 2405⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 2404⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 2403⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27311.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27311.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64857.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59377.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59377.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54271.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50270.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50270.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11458.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1188.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35875.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35875.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17697.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17697.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8920 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6440 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 2369⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46949.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14546.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14546.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34116.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34116.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49643.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9324 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7004 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 23610⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43611.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43611.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65226.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9762.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9672 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6352 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 2409⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 2408⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55973.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55973.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48080.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3778.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3778.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35149.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35149.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9076 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5952 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 23610⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39335.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39335.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64219.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30852.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61625.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61625.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8628 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 2409⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32298.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32298.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48895.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48895.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41682.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35870.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9184 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6768 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 2408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61131.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11458.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2496.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2496.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59948.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65423.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65423.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56051.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56051.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51272.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51272.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55486.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8664 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 23610⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46705.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46705.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37650.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8912 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 712 -s 2409⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13440.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13440.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28091.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28091.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39243.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39243.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19918.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19918.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5019.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5019.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9228 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6944 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 2208⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6663.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7670.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31184.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31184.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8956 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6624 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 2169⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64432.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61697.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61697.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17547.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9748 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 2408⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 2207⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 2406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58438.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9284.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9284.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32362.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32362.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-530.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9552 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6724 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 22010⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 2368⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24967.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24967.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7042.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26384.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26384.exe10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8444 -s 20011⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63352.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63352.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20862.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3539.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10576.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10576.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3446.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3446.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44661.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54495.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54495.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9936 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6824 -s 22011⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 22010⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 2369⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10939.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10939.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25398.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63737.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63737.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9004 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 2408⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22568.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7862.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9855.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9855.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8416 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 2407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 2406⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 2205⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43965.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43965.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40156.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53342.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40997.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40997.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26140.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43037.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9132 -s 20412⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6976 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 2368⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2750.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2750.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56871.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56871.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64432.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28948.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9172 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6660 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3832 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44935.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7862.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9040 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6900 -s 22010⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 2367⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 2406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65319.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26700.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26700.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11754.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11754.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15231.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15231.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14873.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14873.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53431.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53431.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9088 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6712 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 2368⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48651.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48651.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exe10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9104 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 2407⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10918.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10918.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3830.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19576.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19576.exe10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10040 -s 22010⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6272 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 2167⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 2406⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 2405⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 2404⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61987.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52133.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52133.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16586.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23021.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26088.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24428.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10120 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 22011⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 2168⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8972.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25237.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14079.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49347.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49347.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9444 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7056 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 2407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 592 -s 2166⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 2365⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36543.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35787.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35787.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2118.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2118.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8700 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6264 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 2368⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52766.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18875.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18875.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38019.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38019.exe10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8492 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6356 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 2207⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19539.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47328.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21683.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21683.exe10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8768 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6384 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 2167⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 2206⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 2365⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 2404⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 2403⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 2402⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exeFilesize
184KB
MD54d7f45a56bd0f2cffafb5ca869c1bc65
SHA18d5fdc054f0d23e94222734a386ab567b648bce5
SHA256e64797157713222f196cb95c0a0886616629f46243c42269448eedb94152ac14
SHA5129d6de99e1b6f0f23c79b19b54de5259f9dd887906d2e627a58696b80e27f492e73b63414301ea9a1aed7bd023ee40d9c617e70b60ed72fddf2f5bb65733c219a
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26600.exeFilesize
184KB
MD5e6fbb46973bc4d8d30dba42d40445ba0
SHA18b4dfae9683499e37e3a2f85c4ab8197de1e827f
SHA25695058afe4fb293f70399d2ddd7c0d5983b9d123e617812c32e0844479adf33d0
SHA51242243cd9e9bb3c412509a9b7189e2c5b52cb7aa7a442171a33ed13435303170e2c1a6f45f05f541de936b3b9710fcdb3073a20790cc295da947cf917afbd68a3
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exeFilesize
184KB
MD53e96a9ce56886783d7810e118e09d7e6
SHA15f8268a5fd1d207cb15cee909d5a4afd58f855fd
SHA256be004d33df6b6b90668cc4275313a075cce0f2302794de52e23e9c720f3eb951
SHA5129afd0d8014ffc3c4f03134df327701c31092fbc3982d946937748fc0a62d5fb56203428d158cb04d5df93e68275afbf619284bd5c66f459d2f149f742cb08e46
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30047.exeFilesize
184KB
MD55a349b74fb36d3b63965339baecf4d2d
SHA1bfc2a518886fff686c477ab411309d0ae2349b66
SHA25699b481327b72a538f77d4eca90cc9284ead346114fade5a55de12e0d7e2a7d5f
SHA512c9e02c557d5547d12997969642e00e46a01e08babc78f9414fe4188b6ad66fd1e72badf8f621f561a476fe6855308619d83e3cb7f1a8ef9159a40a3af1391e35
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32943.exeFilesize
184KB
MD56d59283a578927e69414a8b328ca2a54
SHA19c9eb2aa29a300d877215559a67425d3f82b9060
SHA2564564c9126922fc5008c6903efbac64654fd6400831efa8704f08133b3c2d4120
SHA51206ce2514494b09062acc3cc9fcd3bdf8ba2fd319d3224bb0c2e525ba78403f975f5f1e5b3222871e38adbbc7caff62d4d707c5c85fc5fb1771fb33b6366e22ee
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40627.exeFilesize
184KB
MD531262450053cf391386dfaf2cd2950a0
SHA113f748be887858c8813df33f082904cfefb41b92
SHA2562536c3e9f627f39daf4480f60a04d6167ef0ae8c82f819a05064e4c92a771603
SHA5122d92e079474368858186a3e7bd22d858459a190c761f9f33c937e572edf47321c32d2d62082109b7cae47e3b5476e6f86b26329edbadc790a2877ffa5bc0a836
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exeFilesize
184KB
MD561fc8be0c86ee64f26801cdc8b9ee7a7
SHA11337e7d7d268964ff079c22f8bdf88161da840f2
SHA25653a85ee8375f3e87a402cc7cdb99ad65cd133743dc1bc2bc20a1e44a5562a9e9
SHA512d0c9257e7e8c0275466f15f9892626cfcd5c493c8da62a310ce9a0f92bb0812c12ce856255bb9de41d76625b60918cf501ac5a3b02ef74727e9255c4ab19cd28
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59377.exeFilesize
184KB
MD5b105694e50ae36e543ff336a07caec59
SHA10e93a83189cdb5896613a60723f4b9f34bb1a4ec
SHA2566ab673b7844dadc776b1640da1bf6e28ea3e4413d77237d675539630553e2263
SHA512be07740b71918e45bc0aa7e410b943d37375a80b1be957314d9d526bf930a64d200e66de151de313e1957e44bf3b57e6a546b6f69302944d489b08fbbb1eb30d
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61987.exeFilesize
184KB
MD5b6df4802db8b8522df630aa8d485618a
SHA1c1726117e70bef5dde8afae1eb0b1d4c6db65246
SHA256da8cb25968446e1645e0d74f9e7a5bdb56337900d7adc8960915ac02b26facab
SHA512c236481e290b748ae7eaf1a41e7abcf2314d3cd6148d7ae30d380b3e682984ffba0cc2419147d5d9ab58eab0fa7d0171a40b4ae590f7871bc3cd88e44ccdfd99
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exeFilesize
184KB
MD513bcdffc85b59ede12d513b67c45aba2
SHA1dc06b8d66a3d329c66ebd3e745cdc65a6b294d1c
SHA25618c0e43a56e58a396196c69bd7f36b20d320e5898f2abd9506fbdc1f4da4a510
SHA5122d1c33c8ab7eb3640645d220fbb3ee91fd32a184a230988f51b8b44e7a52e9ba59a0dabcb341c08004f667d3825641b4b499eb147ef13825d239b982cde7eec9
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6663.exeFilesize
184KB
MD562c8f1c5eacecda8019e72e63ec45c3c
SHA1d5201c39cda98d14f5f0a5494c3d76efab6d9301
SHA2560c7c2ade4952f9cd2b51bafa8cadf8d3ecbf6eea1acbd2b065105050f806b7f4
SHA5128f1180bbabb705d73f66ff1338ec1c5a6b1ddf9865c1f716ca82f6730577cd30ec7ea5bf5e035c3b7d128724d0be9984e0415af3f06a91416c30cd52e5bdbdfd
-
\Users\Admin\AppData\Local\Temp\Unicorn-12283.exeFilesize
184KB
MD53b3cf453e4637e9ece87c9cc1b8fc4e6
SHA1c5067b55246e2d376928fba8297d731c18221533
SHA25696cd0730b795fac4f879a1848ff137d7a00a01b2666cb2bf73bddc89ea5ca0ca
SHA512c49a41453a4e160d3575f0befd6e8fa3c0a4af5f810e3901207b47dd106ffdcdf1210aeb7a28473b508903341745aa481bf7ef19ed15d4d2ee1d1bfa07a57699
-
\Users\Admin\AppData\Local\Temp\Unicorn-20483.exeFilesize
184KB
MD589a11e4b11609048752849a69b377912
SHA1898eb85356edcc3e06c06218c38337d22227d86e
SHA25682464b637b71ff753374be2d9f7c37933a9e90a29fecd1f96b4b8da87246a09a
SHA5124888bf05bc1d1b38f790060cb845e3a431ba51aeee7d2756e514d5a23526c5a5be9f26fce0dc48baf6f576a523507e519ed03616c9e434df20d5727b45a6f7b5
-
\Users\Admin\AppData\Local\Temp\Unicorn-27311.exeFilesize
184KB
MD585f943be114b4d51b70a05f47eaf36eb
SHA1cf08afd362847a8b9cdd0c92cd7c259479f82183
SHA2563bc19a6e8c45cfd585c6c46405783fa112faef8b4dd8a3fbecee44ab869f08fe
SHA512f145eb4ade88af1010d27e84dab78a8debcc9b308651c5f428a9c41d0d4c952d0dc3fb6344434123474be91bf9caeb868b86efef68971fc254994691b496434d
-
\Users\Admin\AppData\Local\Temp\Unicorn-42382.exeFilesize
184KB
MD55821624f9dbaad428651cbe970d78c93
SHA1fe4a938d739a815bac666a8fd107d233a9254194
SHA256af8a622f9e374ed3eacc08098413e8233226cfd50a298f0822ed8eb0d2e51c80
SHA512553e5450bb4a4cdd107d3521f86022dc45873b340008372f609bd4d807e6ab22ead4ea6f4376d43758e4290dd1e11d866ed2ca8b82355234251c6c9822d95852
-
\Users\Admin\AppData\Local\Temp\Unicorn-46466.exeFilesize
184KB
MD56beb3e83a5b8f887a3b770b5bcbc6732
SHA1339f1d403f882809ae3b81ff84b6307f1323ab73
SHA2561d7474cda1c2f250c6c39ea0a6f84fb78497687dba64fc5671cc53e29c2e6511
SHA512f5dc9dfa9d105163cbb50bba6e9c229951ca1fba5a5ea9dc8635cf9b8bd2c1282355bb7bee7dbee5aa8765ea5a7f1889d5d0f2f5bb881ccff6a4e9db42c3bc4b
-
\Users\Admin\AppData\Local\Temp\Unicorn-4701.exeFilesize
184KB
MD5828832fca61567b471729e09631a053a
SHA1c26f489bad20d82a751e56ecdd2083aed0f4401e
SHA256b0b086a57372739ee2b8d58ff642950f2d506bdc45191ddef270e261bcb843ff
SHA5121fdd8c979755f252657754de82eb515ce0cf350738d1b00137b0210cdd699e47a3f5a4430ee40c33ea047b2503f412f356423b30eefe8fc9944ad45b0e61b721
-
\Users\Admin\AppData\Local\Temp\Unicorn-53160.exeFilesize
184KB
MD58e9de485bd55b41d344f2c244107f44e
SHA1a8f1bad471621384554359cc26f57d445a7778b4
SHA256a36bac9d1389aa69cdeb4b035905e697d72156a8a7e98fef46198b07f7672051
SHA512b46fc3419c2e39bbc33ad383aa60b32a17ffe039d3f22f5c8627833ea6f19dd9b94035fc2dfd9b93f210a7a32f262d96ebaea6c4b73352bb3a61e26feae0b78a
-
\Users\Admin\AppData\Local\Temp\Unicorn-64857.exeFilesize
184KB
MD5704207395a1ea49544fc64d993daae4a
SHA1c5275914947bd812f6c50225214bbdf7359ec1b4
SHA2567e936260a9d0adb8ea6d90bd6428fefe89778fd09f6913d18939893eb4da43f9
SHA512f8a5a1b7935066ee8956be49473b9f8ede8d83e90bd25f67e1b2fecc281e3391ee5b5d2d814b00a4e908bfc0ce4e25b0e6b715b835e56e4e1cd6c47c0cce5828
-
\Users\Admin\AppData\Local\Temp\Unicorn-8282.exeFilesize
184KB
MD572e5df9855f3d2a4b0156791125ebb31
SHA138ac4af6f08f7515d43cd884444409ba72e3e3c6
SHA256419f1694ca5c97212e6cde19a741c0e4e5dcc0c900cf30ea3e9190eeeb727e45
SHA5127f9cb02039174af229cc6d5f9dc94908bfe88b9632971be219c6559c8dc7576c8856106b66b0a33aa1fa0cf91e39a34ca7c8567b68b9c4bf07688dd7752faa67