Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:35
Static task
static1
Behavioral task
behavioral1
Sample
7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe
Resource
win10v2004-20240508-en
General
-
Target
7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe
-
Size
184KB
-
MD5
428fdf5376ac24097efb25c09273f1eb
-
SHA1
2bc9ea5e315106e6589d8fd27a07f0ef3023cb39
-
SHA256
7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74
-
SHA512
a22b21665077b84c032e598c341f1ad4937cd6994cf7f8b7a898c523a800a02a85f192d95b1a310db9da77b6189a0e001ff7a4c66752167838b2ffd59245621f
-
SSDEEP
3072:jHP4xQoumhTYmG/WW2S89hHPhlnViF3n3:jHNoXvG//8jHPhlnViF3
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
Unicorn-12521.exeUnicorn-63429.exeUnicorn-17758.exeUnicorn-21925.exeUnicorn-28701.exeUnicorn-17841.exeUnicorn-12962.exeUnicorn-23823.exeUnicorn-43689.exeUnicorn-43689.exeUnicorn-18670.exeUnicorn-23316.exeUnicorn-16278.exeUnicorn-17670.exeUnicorn-17670.exeUnicorn-60648.exeUnicorn-36698.exeUnicorn-3471.exeUnicorn-5972.exeUnicorn-62869.exeUnicorn-4109.exeUnicorn-58785.exeUnicorn-22029.exeUnicorn-10331.exeUnicorn-34281.exeUnicorn-11722.exeUnicorn-7638.exeUnicorn-53310.exeUnicorn-19699.exeUnicorn-54509.exeUnicorn-61286.exeUnicorn-41463.exeUnicorn-56408.exeUnicorn-10736.exeUnicorn-53907.exeUnicorn-3315.exeUnicorn-31349.exeUnicorn-38125.exeUnicorn-39517.exeUnicorn-55661.exeUnicorn-14306.exeUnicorn-29019.exeUnicorn-17321.exeUnicorn-27950.exeUnicorn-27950.exeUnicorn-53715.exeUnicorn-20528.exeUnicorn-20528.exeUnicorn-18905.exeUnicorn-13751.exeUnicorn-28696.exeUnicorn-55744.exeUnicorn-14903.exeUnicorn-10819.exeUnicorn-28286.exeUnicorn-52236.exeUnicorn-21510.exeUnicorn-60404.exeUnicorn-7311.exeUnicorn-22256.exeUnicorn-3227.exeUnicorn-3227.exeUnicorn-18172.exeUnicorn-57067.exepid process 2084 Unicorn-12521.exe 2776 Unicorn-63429.exe 2336 Unicorn-17758.exe 2844 Unicorn-21925.exe 2716 Unicorn-28701.exe 2744 Unicorn-17841.exe 1612 Unicorn-12962.exe 804 Unicorn-23823.exe 2600 Unicorn-43689.exe 1568 Unicorn-43689.exe 1916 Unicorn-18670.exe 1920 Unicorn-23316.exe 1328 Unicorn-16278.exe 2920 Unicorn-17670.exe 2344 Unicorn-17670.exe 2464 Unicorn-60648.exe 2864 Unicorn-36698.exe 1964 Unicorn-3471.exe 2308 Unicorn-5972.exe 1540 Unicorn-62869.exe 1484 Unicorn-4109.exe 3016 Unicorn-58785.exe 1336 Unicorn-22029.exe 1604 Unicorn-10331.exe 2880 Unicorn-34281.exe 820 Unicorn-11722.exe 2992 Unicorn-7638.exe 2584 Unicorn-53310.exe 2312 Unicorn-19699.exe 1812 Unicorn-54509.exe 2028 Unicorn-61286.exe 1708 Unicorn-41463.exe 2328 Unicorn-56408.exe 2704 Unicorn-10736.exe 1808 Unicorn-53907.exe 2288 Unicorn-3315.exe 2556 Unicorn-31349.exe 2496 Unicorn-38125.exe 1728 Unicorn-39517.exe 1200 Unicorn-55661.exe 1504 Unicorn-14306.exe 1620 Unicorn-29019.exe 1792 Unicorn-17321.exe 1844 Unicorn-27950.exe 2976 Unicorn-27950.exe 2224 Unicorn-53715.exe 2424 Unicorn-20528.exe 2244 Unicorn-20528.exe 1280 Unicorn-18905.exe 1352 Unicorn-13751.exe 836 Unicorn-28696.exe 348 Unicorn-55744.exe 1264 Unicorn-14903.exe 884 Unicorn-10819.exe 1960 Unicorn-28286.exe 2736 Unicorn-52236.exe 2144 Unicorn-21510.exe 2260 Unicorn-60404.exe 1456 Unicorn-7311.exe 2284 Unicorn-22256.exe 2644 Unicorn-3227.exe 2700 Unicorn-3227.exe 2724 Unicorn-18172.exe 2672 Unicorn-57067.exe -
Loads dropped DLL 64 IoCs
Processes:
7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exeUnicorn-12521.exeUnicorn-17758.exeUnicorn-63429.exeWerFault.exeUnicorn-21925.exeUnicorn-17841.exeUnicorn-28701.exeWerFault.exeWerFault.exeUnicorn-12962.exeUnicorn-43689.exeUnicorn-18670.exeUnicorn-43689.exeUnicorn-23823.exeWerFault.exeWerFault.exeWerFault.exepid process 1952 7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe 1952 7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe 1952 7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe 2084 Unicorn-12521.exe 1952 7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe 2084 Unicorn-12521.exe 2336 Unicorn-17758.exe 2336 Unicorn-17758.exe 2084 Unicorn-12521.exe 2084 Unicorn-12521.exe 2776 Unicorn-63429.exe 2776 Unicorn-63429.exe 2924 WerFault.exe 2924 WerFault.exe 2924 WerFault.exe 2924 WerFault.exe 2924 WerFault.exe 2844 Unicorn-21925.exe 2844 Unicorn-21925.exe 2336 Unicorn-17758.exe 2336 Unicorn-17758.exe 2744 Unicorn-17841.exe 2716 Unicorn-28701.exe 2776 Unicorn-63429.exe 2744 Unicorn-17841.exe 2776 Unicorn-63429.exe 2716 Unicorn-28701.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2436 WerFault.exe 2436 WerFault.exe 2436 WerFault.exe 2436 WerFault.exe 2436 WerFault.exe 2416 WerFault.exe 1612 Unicorn-12962.exe 1612 Unicorn-12962.exe 2844 Unicorn-21925.exe 2844 Unicorn-21925.exe 1568 Unicorn-43689.exe 1916 Unicorn-18670.exe 1916 Unicorn-18670.exe 1568 Unicorn-43689.exe 2600 Unicorn-43689.exe 2600 Unicorn-43689.exe 804 Unicorn-23823.exe 804 Unicorn-23823.exe 2716 Unicorn-28701.exe 2744 Unicorn-17841.exe 2716 Unicorn-28701.exe 2744 Unicorn-17841.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 688 WerFault.exe 688 WerFault.exe 688 WerFault.exe 688 WerFault.exe 636 WerFault.exe 636 WerFault.exe -
Program crash 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2852 1952 WerFault.exe 7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe 2924 2084 WerFault.exe Unicorn-12521.exe 2416 2336 WerFault.exe Unicorn-17758.exe 2436 2776 WerFault.exe Unicorn-63429.exe 2876 2844 WerFault.exe Unicorn-21925.exe 688 2744 WerFault.exe Unicorn-17841.exe 636 2716 WerFault.exe Unicorn-28701.exe 1584 1612 WerFault.exe Unicorn-12962.exe 2472 1916 WerFault.exe Unicorn-18670.exe 848 1568 WerFault.exe Unicorn-43689.exe 1788 2600 WerFault.exe Unicorn-43689.exe 3064 804 WerFault.exe Unicorn-23823.exe 2812 1920 WerFault.exe Unicorn-23316.exe 380 1328 WerFault.exe Unicorn-16278.exe 1260 2920 WerFault.exe Unicorn-17670.exe 664 2464 WerFault.exe Unicorn-60648.exe 1896 2344 WerFault.exe Unicorn-17670.exe 2140 2864 WerFault.exe Unicorn-36698.exe 1704 2308 WerFault.exe Unicorn-5972.exe 1544 1964 WerFault.exe Unicorn-3471.exe 2856 1540 WerFault.exe Unicorn-62869.exe 2096 1484 WerFault.exe Unicorn-4109.exe 2228 3016 WerFault.exe Unicorn-58785.exe 3028 1336 WerFault.exe Unicorn-22029.exe 2768 1604 WerFault.exe Unicorn-10331.exe 2760 2880 WerFault.exe Unicorn-34281.exe 2748 820 WerFault.exe Unicorn-11722.exe 1656 1812 WerFault.exe Unicorn-54509.exe 1740 2992 WerFault.exe Unicorn-7638.exe 2024 2584 WerFault.exe Unicorn-53310.exe 1064 2028 WerFault.exe Unicorn-61286.exe 2476 2312 WerFault.exe Unicorn-19699.exe 3340 2288 WerFault.exe Unicorn-3315.exe 3372 2496 WerFault.exe Unicorn-38125.exe 3364 1708 WerFault.exe Unicorn-41463.exe 3484 2328 WerFault.exe Unicorn-56408.exe 3492 1808 WerFault.exe Unicorn-53907.exe 3516 1620 WerFault.exe Unicorn-29019.exe 3556 1504 WerFault.exe Unicorn-14306.exe 3564 1844 WerFault.exe Unicorn-27950.exe 3572 2704 WerFault.exe Unicorn-10736.exe 3616 1352 WerFault.exe Unicorn-13751.exe 3764 2424 WerFault.exe Unicorn-20528.exe 3480 836 WerFault.exe Unicorn-28696.exe 3704 2224 WerFault.exe Unicorn-53715.exe 3720 1792 WerFault.exe Unicorn-17321.exe 4020 1728 WerFault.exe Unicorn-39517.exe 4056 1200 WerFault.exe Unicorn-55661.exe 4072 1636 WerFault.exe Unicorn-34747.exe 3116 1280 WerFault.exe Unicorn-18905.exe 3252 2700 WerFault.exe Unicorn-3227.exe 3380 2204 WerFault.exe Unicorn-40346.exe 3440 1968 WerFault.exe Unicorn-32178.exe 3444 1820 WerFault.exe Unicorn-4981.exe 3464 2104 WerFault.exe Unicorn-32178.exe 3476 2596 WerFault.exe Unicorn-32178.exe 3820 2276 WerFault.exe Unicorn-52044.exe 3900 2740 WerFault.exe Unicorn-42676.exe 3872 1456 WerFault.exe Unicorn-7311.exe 3980 1296 WerFault.exe Unicorn-62905.exe 304 1284 WerFault.exe Unicorn-17234.exe 3220 2644 WerFault.exe Unicorn-3227.exe 3272 3008 WerFault.exe Unicorn-58458.exe 3524 2724 WerFault.exe Unicorn-18172.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exeUnicorn-12521.exeUnicorn-17758.exeUnicorn-63429.exeUnicorn-21925.exeUnicorn-28701.exeUnicorn-17841.exeUnicorn-12962.exeUnicorn-43689.exeUnicorn-23823.exeUnicorn-43689.exeUnicorn-18670.exeUnicorn-23316.exeUnicorn-16278.exeUnicorn-17670.exeUnicorn-17670.exeUnicorn-60648.exeUnicorn-3471.exeUnicorn-36698.exeUnicorn-5972.exeUnicorn-62869.exeUnicorn-4109.exeUnicorn-58785.exeUnicorn-22029.exeUnicorn-10331.exeUnicorn-34281.exeUnicorn-11722.exeUnicorn-7638.exeUnicorn-53310.exeUnicorn-19699.exeUnicorn-54509.exeUnicorn-61286.exeUnicorn-41463.exeUnicorn-56408.exeUnicorn-53907.exeUnicorn-10736.exeUnicorn-3315.exeUnicorn-38125.exeUnicorn-31349.exeUnicorn-39517.exeUnicorn-55661.exeUnicorn-14306.exeUnicorn-29019.exeUnicorn-17321.exeUnicorn-27950.exeUnicorn-27950.exeUnicorn-53715.exeUnicorn-20528.exeUnicorn-20528.exeUnicorn-18905.exeUnicorn-13751.exeUnicorn-28696.exeUnicorn-55744.exeUnicorn-14903.exeUnicorn-10819.exeUnicorn-28286.exeUnicorn-52236.exeUnicorn-21510.exeUnicorn-7311.exeUnicorn-60404.exeUnicorn-3227.exeUnicorn-3227.exeUnicorn-22256.exeUnicorn-18172.exepid process 1952 7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe 2084 Unicorn-12521.exe 2336 Unicorn-17758.exe 2776 Unicorn-63429.exe 2844 Unicorn-21925.exe 2716 Unicorn-28701.exe 2744 Unicorn-17841.exe 1612 Unicorn-12962.exe 2600 Unicorn-43689.exe 804 Unicorn-23823.exe 1568 Unicorn-43689.exe 1916 Unicorn-18670.exe 1920 Unicorn-23316.exe 1328 Unicorn-16278.exe 2344 Unicorn-17670.exe 2920 Unicorn-17670.exe 2464 Unicorn-60648.exe 1964 Unicorn-3471.exe 2864 Unicorn-36698.exe 2308 Unicorn-5972.exe 1540 Unicorn-62869.exe 1484 Unicorn-4109.exe 3016 Unicorn-58785.exe 1336 Unicorn-22029.exe 1604 Unicorn-10331.exe 2880 Unicorn-34281.exe 820 Unicorn-11722.exe 2992 Unicorn-7638.exe 2584 Unicorn-53310.exe 2312 Unicorn-19699.exe 1812 Unicorn-54509.exe 2028 Unicorn-61286.exe 1708 Unicorn-41463.exe 2328 Unicorn-56408.exe 1808 Unicorn-53907.exe 2704 Unicorn-10736.exe 2288 Unicorn-3315.exe 2496 Unicorn-38125.exe 2556 Unicorn-31349.exe 1728 Unicorn-39517.exe 1200 Unicorn-55661.exe 1504 Unicorn-14306.exe 1620 Unicorn-29019.exe 1792 Unicorn-17321.exe 1844 Unicorn-27950.exe 2976 Unicorn-27950.exe 2224 Unicorn-53715.exe 2424 Unicorn-20528.exe 2244 Unicorn-20528.exe 1280 Unicorn-18905.exe 1352 Unicorn-13751.exe 836 Unicorn-28696.exe 348 Unicorn-55744.exe 1264 Unicorn-14903.exe 884 Unicorn-10819.exe 1960 Unicorn-28286.exe 2736 Unicorn-52236.exe 2144 Unicorn-21510.exe 1456 Unicorn-7311.exe 2260 Unicorn-60404.exe 2700 Unicorn-3227.exe 2644 Unicorn-3227.exe 2284 Unicorn-22256.exe 2724 Unicorn-18172.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exeUnicorn-12521.exeUnicorn-17758.exeUnicorn-63429.exeUnicorn-21925.exeUnicorn-17841.exeUnicorn-28701.exeUnicorn-12962.exedescription pid process target process PID 1952 wrote to memory of 2084 1952 7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe Unicorn-12521.exe PID 1952 wrote to memory of 2084 1952 7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe Unicorn-12521.exe PID 1952 wrote to memory of 2084 1952 7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe Unicorn-12521.exe PID 1952 wrote to memory of 2084 1952 7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe Unicorn-12521.exe PID 1952 wrote to memory of 2776 1952 7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe Unicorn-63429.exe PID 2084 wrote to memory of 2336 2084 Unicorn-12521.exe Unicorn-17758.exe PID 2084 wrote to memory of 2336 2084 Unicorn-12521.exe Unicorn-17758.exe PID 1952 wrote to memory of 2776 1952 7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe Unicorn-63429.exe PID 2084 wrote to memory of 2336 2084 Unicorn-12521.exe Unicorn-17758.exe PID 1952 wrote to memory of 2776 1952 7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe Unicorn-63429.exe PID 2084 wrote to memory of 2336 2084 Unicorn-12521.exe Unicorn-17758.exe PID 1952 wrote to memory of 2776 1952 7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe Unicorn-63429.exe PID 1952 wrote to memory of 2852 1952 7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe WerFault.exe PID 1952 wrote to memory of 2852 1952 7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe WerFault.exe PID 1952 wrote to memory of 2852 1952 7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe WerFault.exe PID 1952 wrote to memory of 2852 1952 7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe WerFault.exe PID 2336 wrote to memory of 2844 2336 Unicorn-17758.exe Unicorn-21925.exe PID 2336 wrote to memory of 2844 2336 Unicorn-17758.exe Unicorn-21925.exe PID 2336 wrote to memory of 2844 2336 Unicorn-17758.exe Unicorn-21925.exe PID 2336 wrote to memory of 2844 2336 Unicorn-17758.exe Unicorn-21925.exe PID 2084 wrote to memory of 2716 2084 Unicorn-12521.exe Unicorn-28701.exe PID 2084 wrote to memory of 2716 2084 Unicorn-12521.exe Unicorn-28701.exe PID 2084 wrote to memory of 2716 2084 Unicorn-12521.exe Unicorn-28701.exe PID 2084 wrote to memory of 2716 2084 Unicorn-12521.exe Unicorn-28701.exe PID 2776 wrote to memory of 2744 2776 Unicorn-63429.exe Unicorn-17841.exe PID 2776 wrote to memory of 2744 2776 Unicorn-63429.exe Unicorn-17841.exe PID 2776 wrote to memory of 2744 2776 Unicorn-63429.exe Unicorn-17841.exe PID 2776 wrote to memory of 2744 2776 Unicorn-63429.exe Unicorn-17841.exe PID 2084 wrote to memory of 2924 2084 Unicorn-12521.exe WerFault.exe PID 2084 wrote to memory of 2924 2084 Unicorn-12521.exe WerFault.exe PID 2084 wrote to memory of 2924 2084 Unicorn-12521.exe WerFault.exe PID 2084 wrote to memory of 2924 2084 Unicorn-12521.exe WerFault.exe PID 2844 wrote to memory of 1612 2844 Unicorn-21925.exe Unicorn-12962.exe PID 2844 wrote to memory of 1612 2844 Unicorn-21925.exe Unicorn-12962.exe PID 2844 wrote to memory of 1612 2844 Unicorn-21925.exe Unicorn-12962.exe PID 2844 wrote to memory of 1612 2844 Unicorn-21925.exe Unicorn-12962.exe PID 2336 wrote to memory of 804 2336 Unicorn-17758.exe Unicorn-23823.exe PID 2336 wrote to memory of 804 2336 Unicorn-17758.exe Unicorn-23823.exe PID 2336 wrote to memory of 804 2336 Unicorn-17758.exe Unicorn-23823.exe PID 2336 wrote to memory of 804 2336 Unicorn-17758.exe Unicorn-23823.exe PID 2744 wrote to memory of 2600 2744 Unicorn-17841.exe Unicorn-43689.exe PID 2744 wrote to memory of 2600 2744 Unicorn-17841.exe Unicorn-43689.exe PID 2744 wrote to memory of 2600 2744 Unicorn-17841.exe Unicorn-43689.exe PID 2744 wrote to memory of 2600 2744 Unicorn-17841.exe Unicorn-43689.exe PID 2776 wrote to memory of 1916 2776 Unicorn-63429.exe Unicorn-18670.exe PID 2776 wrote to memory of 1916 2776 Unicorn-63429.exe Unicorn-18670.exe PID 2776 wrote to memory of 1916 2776 Unicorn-63429.exe Unicorn-18670.exe PID 2776 wrote to memory of 1916 2776 Unicorn-63429.exe Unicorn-18670.exe PID 2716 wrote to memory of 1568 2716 Unicorn-28701.exe Unicorn-43689.exe PID 2716 wrote to memory of 1568 2716 Unicorn-28701.exe Unicorn-43689.exe PID 2716 wrote to memory of 1568 2716 Unicorn-28701.exe Unicorn-43689.exe PID 2716 wrote to memory of 1568 2716 Unicorn-28701.exe Unicorn-43689.exe PID 2336 wrote to memory of 2416 2336 Unicorn-17758.exe WerFault.exe PID 2336 wrote to memory of 2416 2336 Unicorn-17758.exe WerFault.exe PID 2336 wrote to memory of 2416 2336 Unicorn-17758.exe WerFault.exe PID 2336 wrote to memory of 2416 2336 Unicorn-17758.exe WerFault.exe PID 2776 wrote to memory of 2436 2776 Unicorn-63429.exe WerFault.exe PID 2776 wrote to memory of 2436 2776 Unicorn-63429.exe WerFault.exe PID 2776 wrote to memory of 2436 2776 Unicorn-63429.exe WerFault.exe PID 2776 wrote to memory of 2436 2776 Unicorn-63429.exe WerFault.exe PID 1612 wrote to memory of 1920 1612 Unicorn-12962.exe Unicorn-23316.exe PID 1612 wrote to memory of 1920 1612 Unicorn-12962.exe Unicorn-23316.exe PID 1612 wrote to memory of 1920 1612 Unicorn-12962.exe Unicorn-23316.exe PID 1612 wrote to memory of 1920 1612 Unicorn-12962.exe Unicorn-23316.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe"C:\Users\Admin\AppData\Local\Temp\7e695f1135271611eb1fd144bef6aad1dddad32096d13616b78116d56dd3ce74.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12521.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12521.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17758.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21925.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23316.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23316.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62869.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41463.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41463.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10819.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23586.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28765.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4621.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4621.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-247.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-247.exe15⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10516 -s 21615⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 23611⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27618.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35179.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14818.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14818.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe14⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10640 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7300 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 24010⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29931.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29931.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11333.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11333.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13227.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13227.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46661.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57014.exe14⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11128 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7848 -s 22013⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 2409⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28286.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5303.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29568.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16757.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52400.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52400.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59053.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8468 -s 23613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 24010⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16164.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17089.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17089.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17160.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17160.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11044 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7648 -s 22012⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 2409⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 2408⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56408.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52236.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52236.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9496.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9496.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48282.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28111.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17450.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe14⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10544 -s 23614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6544 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 23610⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24332.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19834.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19834.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27203.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27203.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35971.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35971.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26947.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26947.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10316 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7580 -s 22012⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 2409⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 2168⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4109.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4109.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10736.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54374.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4104.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5443.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5443.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49328.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46661.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11136 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7720 -s 22012⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 2368⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42676.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23887.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41261.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41261.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31596.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31596.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6142.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10888 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8404 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5724 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 2168⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 2407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 2406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53907.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53907.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21510.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44307.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7581.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37701.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7045.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7045.exe14⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10796 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 23610⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7996.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7996.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13267.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10868 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7560 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 2409⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13471.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13471.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46476.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46476.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25665.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43802.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43802.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11020 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7568 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 2408⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22256.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22256.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47021.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49346.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18685.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34451.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34451.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7760 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5756 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 2369⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31130.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31130.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45711.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45711.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33122.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7764 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 2408⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3315.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55744.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47659.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18241.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20841.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20841.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36064.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36064.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50900.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40854.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40854.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9200 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 22012⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 23610⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14192.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14192.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39699.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22442.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22442.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52722.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8796 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 2409⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24219.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52885.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2675.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43755.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43755.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10464 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6644 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 2408⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12402.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20519.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20519.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35179.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24560.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10612 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7292 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 2407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 2406⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 2405⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23823.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23823.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3471.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3471.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54509.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54509.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27950.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1193.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15386.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15386.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6105.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6105.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28026.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8896 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 2369⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18411.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34660.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55568.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13687.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13687.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65348.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65348.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10404 -s 22013⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7540 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 2408⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7866.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20078.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29948.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44777.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44777.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7620 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 22011⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 2369⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12656.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52698.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14517.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18073.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18073.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15597.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11076 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7740 -s 22011⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 2408⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20528.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65111.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28734.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57579.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62888.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62888.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64985.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7820 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 2168⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61390.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61390.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19668.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19668.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9120 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 2406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61286.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18905.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23887.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53980.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16314.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8276 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6528 -s 22011⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 2168⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47000.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47000.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33181.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43866.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8145.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8145.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9196 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6424 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 704 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 2207⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32178.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11634.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41349.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4971.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4971.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65503.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65503.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16890.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8544 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6452 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 2367⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 2406⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 2405⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 2404⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43689.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43689.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11722.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60404.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47021.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53326.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28893.exe14⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11256 -s 21614⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7404 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 23610⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45521.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45521.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51484.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44606.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51171.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7768 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 2209⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27155.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55080.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33010.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33010.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51165.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7273.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20341.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10524 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7480 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 2408⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64919.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19668.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19668.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60311.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60311.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36147.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46884.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46884.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 2368⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58697.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58697.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49517.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15578.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15578.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32255.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32255.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26464.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26464.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8488 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6156 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 2368⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47000.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47000.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53793.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53793.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7986.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61227.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61227.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24482.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24482.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8548 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6252 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 2407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 2406⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 2365⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36698.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7638.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27950.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17234.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21941.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48147.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64478.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64478.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19531.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33584.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9992 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6748 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 2368⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28717.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28717.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30351.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30351.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10276 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7132 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 2207⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32178.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19803.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26959.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26959.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-158.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63028.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63028.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8912 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6212 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 2367⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 2406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20528.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46616.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46616.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44198.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44198.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58152.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58152.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27082.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27082.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10784 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7452 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 2367⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 2366⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 2405⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 2404⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 2403⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43689.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43689.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60648.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34281.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34281.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55661.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56751.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56751.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15277.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11362.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11362.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11025.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11025.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9956 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6836 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 2369⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18411.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25013.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45467.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45467.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9228 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6380 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 2208⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47021.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26492.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4229.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59333.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59333.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15441.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41612.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10564 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7596 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 2369⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18878.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35213.exe10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7920 -s 22011⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 2408⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22408.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49154.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2156.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55104.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21706.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21706.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 2169⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50181.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2091.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2091.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18685.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19910.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11700.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11700.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7752 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5880 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 2408⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 2367⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 2406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53310.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53310.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53715.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44499.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44499.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26876.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49494.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39427.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8340 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 2169⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28006.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28006.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10726.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10726.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53168.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8824 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5304 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 2408⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59444.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53902.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53902.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-420.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-420.exe9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5568 -s 24010⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40346.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25314.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39123.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39123.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30226.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59930.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8636 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 2167⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 2406⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 2405⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5972.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19699.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13751.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13751.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9065.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1520.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1795.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35786.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35786.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10866.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56583.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56583.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10932 -s 21613⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 2369⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55635.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53570.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48970.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48970.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10364 -s 23612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6420 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 2408⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28909.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28909.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51572.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51572.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10643.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44149.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44149.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7476 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5156 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 2407⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62905.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48583.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48583.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51655.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51655.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45812.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45812.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55400.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55400.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8380 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6348 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 2367⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 2406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28696.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28696.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65111.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27068.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27068.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31064.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31064.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7984 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6000 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 2368⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27622.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27622.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12589.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12589.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22660.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7616 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 2207⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34747.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34747.exe6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 2207⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 2406⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 2405⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 2404⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18670.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22029.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31349.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 2208⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15277.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19531.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9079.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9984 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 2407⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26340.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26340.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42361.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42361.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14815.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14815.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5939.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5939.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54995.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54995.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6905.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7772 -s 23611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5420 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 2369⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 2368⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64571.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64571.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43892.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43892.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65446.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65446.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35494.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8204 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 2207⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 2406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14903.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14903.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41629.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41629.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7249.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7249.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43954.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43954.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33425.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7382.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7382.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57460.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57460.exe12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10972 -s 21612⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7692 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 2368⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48837.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48837.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43106.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15982.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15982.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11168 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7796 -s 22010⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 2407⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48406.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3165.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43954.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43954.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-752.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-752.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62073.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62073.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14637.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10708 -s 21611⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7396 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 2367⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 2206⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 2405⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10331.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51551.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7114.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7114.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36967.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36967.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55104.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63807.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63807.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7508 -s 23610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6028 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 2167⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63720.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63720.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4400.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4400.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38713.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61419.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55400.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55400.exe10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8792 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6280 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 2168⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 2167⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 2406⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32178.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65111.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19668.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19668.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43975.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43975.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3043.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18452.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18452.exe10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8320 -s 21610⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5936 -s 2169⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 2368⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 2367⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 2166⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 2405⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 2204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 2403⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 2402⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10866.exeFilesize
184KB
MD5a93775e7401148e017b1d52128aba173
SHA1d6edc0e8f21ad7e2caa7ac88ae576605d9d4d2ec
SHA25691dfb28a4fdb14a802d6a31002cd95860c1a436aa3801785a272d566d2d4c79b
SHA5120a25ec784092b930bf23d915dee6a235f16f228c7f6c5ec48fe60ebe4312c7e7e01046fead6386a4181d6c284c1a74a2f4e172e45118f392cc2ed10d5126970b
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exeFilesize
184KB
MD5a8dcee7fc0340afdd15edbb86707c836
SHA1f98b670635a5b332238dafdbebdb5e77cb528a49
SHA256af02577716c5ea6bc53e6e627e394ce20e674f5044a7a7e80d83e1530843af53
SHA5129cc314cd502efe447f4626a930da596210b6982855cd2ac92e2edc7b32a0c0aa57fe493a6a8093807d509b556fee21da1845994264c5cc5c9c4672e1d601fe4c
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exeFilesize
184KB
MD54ba96bbf53652f3e85735ede5ccd2c9e
SHA1dab05ac1ea34146a95aeac2bb97f7ed558567a50
SHA2562d35d39f4121248e3d7342d8251b9ffca740cd50835f9ddc63e35a62a3474559
SHA51236b4f9816d98600f541f5277f9638846f5dc2ffa5861e95b7c5b603002cf9ab79019fe2e93878282bd524918bae62b6e1457c362dcee6481098292db17cf8667
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40854.exeFilesize
184KB
MD5693124468d014cd923107e6b1595e03f
SHA158ea7cd9a012066fb9e7f64d43b115cfd7941aa5
SHA25667bff4bf418c9844cc365d42ef3c528c241d1482f4409b11c82b109f53b5b81e
SHA51207216ac010b6b8c076c612c6e880a3df3ee9295503af5913c22869c628fc8a5ed3f6efecf4d21978e0ca2212594a9b97b47c08e3491e36b791a97379deaae431
-
\Users\Admin\AppData\Local\Temp\Unicorn-12521.exeFilesize
184KB
MD59d3cf8a243a76e2a28c71ee92d5a3c4a
SHA133128d4cf0a9de0d93b63cedd45faf86844d35a4
SHA256a30d821f19bdecf1a3034dfc1c6e282f0e68ae012bcd839a358a98482868237b
SHA51280d1269b193d1d2c6053690910248814358d7f47361db455ee2f3a7e6010d486d662574b80ce837dc9a5a3260901f74a1f5466ed7b326c4055b87bb628787cc2
-
\Users\Admin\AppData\Local\Temp\Unicorn-17670.exeFilesize
184KB
MD56d42d53f5e120dc86271fb61714d316c
SHA1fc64655fc2b00b76b1d575ec46ac4a91dbbccff2
SHA25664261ad45bf41e3aa04d55fcefb91d7ea11026f7faa836daf3cfdc8aaec80b5d
SHA512e5642744a5b750807960938945603a9399290ee505b59c011709308f20e4a10ddc088dbdb6ab80df6ed1e66cc8f90dd03e5cfc581cd71e2dd115aeedde694fd8
-
\Users\Admin\AppData\Local\Temp\Unicorn-17758.exeFilesize
184KB
MD53c139768f3ada6a6d4b7b0249fe0c4c2
SHA1b5da5d1b4aa0d68c1fbb0cfbcb4bf1009015e8c6
SHA256ad5946e20e1ca1da66f9690c22b49fb7ee83e37e7841353b5cd9582eea18631a
SHA512d3b08a3fefbc4620b4cddeba5759ebc9ac1f9ea85e979606c3ddb0a40cb7402c37a048d2768ace8b06977fac61992507e3d84b60aa5b02f64851c1addfa8e105
-
\Users\Admin\AppData\Local\Temp\Unicorn-17841.exeFilesize
184KB
MD56a24770551cb28a4886200722ae657b3
SHA11a2742a8eff83b7f76ce1bd3371535a7a3f88ee6
SHA256be1d9c0cb1282d71908beb9d9d5fd431d682bce46e5f352ce8fca9b3c298ce7f
SHA512354d6f6b06dcd03fb59848f56e10302092653e2ff42c6fcdf6748573c57e419a705ec3f80ec924f3a52dc2ad91994d87da2426348dba2c4b817c17504de0c984
-
\Users\Admin\AppData\Local\Temp\Unicorn-18670.exeFilesize
184KB
MD5b34b1012f5f4d1878775097ad4df72d2
SHA1b2cd5e8f461a064887b5e638df1cd36b7bbb965d
SHA256298aaa7e94151fbcd6e41df12dd3faab3ddae0958f209c06cbc6359d83fcb45e
SHA5126cf86bc2f0fc50e0a9689dfbd68073a641e8070bfc8cec1717fefe196720c9c7f08410aa23f4b76cbf6a61edbb50150f2cfaaa79025b2af5dc282ce6b7bce929
-
\Users\Admin\AppData\Local\Temp\Unicorn-21925.exeFilesize
184KB
MD54f9ba6bb508269c75b472f3976e71be9
SHA1297af66c8f26a8d46ad8e29346b49b0aee8a3144
SHA256b509becfcf861dd723a80236c510440ab3daf6b06c2b32ed71af2745bf3ad7cf
SHA512f33529042b1dd9c07c3fd9c80e03c6c38d2d49ff39ddb61b70c1df2370867ff644f104d5a21af69423bcc7eea1cbb8d05a5387640f313443b747da4d562ec155
-
\Users\Admin\AppData\Local\Temp\Unicorn-23316.exeFilesize
184KB
MD5d98ffa0585e976a6b6eb939ffe1769d2
SHA1d4bc91e4996b6a5ac85842dad95da201f51c0281
SHA256e16f39c09820672f7320d490d14b53df3b10cf47e27fe6c09f5f587225bd0dea
SHA512513aef1b41bf34dea679ed9d8212ac489ac242a28aa2c28fd602578fdf46fb9f6e1251fc300b9aa9f4af6e53197ef9d2e92eacac2b15d009027d0cd138058918
-
\Users\Admin\AppData\Local\Temp\Unicorn-23823.exeFilesize
184KB
MD509771dd6cc8b62b61e3d4e85ba8b0cbc
SHA16ce149c6b98aa638e94715170e7b10e9f1191894
SHA25660ac242ea96d294319fc0eec089ab2c3d1c0efde45cc79473f2217de04e9ecc6
SHA512391f3249c5a4066e750911382065aac715f09be2768cf9ee534b5927bf2691d8599658b20271f9e28dcc7477ce4b70dcd67a09c0aca55305542a5554985f7c65
-
\Users\Admin\AppData\Local\Temp\Unicorn-28701.exeFilesize
184KB
MD52383c2f5b230a7bb86b0bb9164c3c98b
SHA10580a1a8725cc2992f37d8c0b1d89900c4a75453
SHA256b9211016c35be8d42f917a5321e9a6584430b4ed958f9931857b9cacef793348
SHA5125033dc605575ecec08ee08750db40f268bba1be10bf8572f85a8b28b82b4086c5b2e614d734a3eba28243e4ce1ac6d2bed3e057e3a5240867d3d5cbf3c636a2b
-
\Users\Admin\AppData\Local\Temp\Unicorn-43689.exeFilesize
184KB
MD5a74dfff762017887bb4a62908846d941
SHA1a384efdc38ffe1852cb0e26ca86994c6a929e7c5
SHA25693354daec6c47cc41c0afdb01b0bd0f193c4f019b020522610a40fa01a1ca50e
SHA512bb1254972d4c05d04c8e520d6bac7e02c32122187deae33f333469d980f9d915f5ceeb8de3eb26fbea685cd7c7e804ea8dd139cd60d225dd4206ab6c8ab17c8e
-
\Users\Admin\AppData\Local\Temp\Unicorn-63429.exeFilesize
184KB
MD5c216aa45103f8c17197133c59972839e
SHA18b17de45cffdca8198eb507eeb1d195dd074192e
SHA2566672ba2d29023c0fe96bc68964346c5859141cea33cb9953ce5cd4528ace1e36
SHA512c8452c44c988d4acdb0b8ee7eb34b83df694d744cc338927aab2f07a72c1c955eaf89435955ae6525ca9d1eab9c628e3e25f6ae88468333fb10ebf8bb4fa33dc