Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 01:45
Static task
static1
Behavioral task
behavioral1
Sample
169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe
-
Size
184KB
-
MD5
169daaaa7536d8ca4b4ccc7836fb0f40
-
SHA1
84f84dda90501f2a39882875d88953b300888a77
-
SHA256
d3de929c71d3577b23c17f3cdc3c0cceb2b3466c747f13be7858fc7c09bbd29b
-
SHA512
5948ec1ca82fdb201ed2af9fbeda9d68c057ae5a4515677b5c76c1bf5b04fe21de894f2317436a6fb546c5e44d815f0cd0f349617aa29eee761fd0c39c277268
-
SSDEEP
1536:l7Rt6j5Zu3RxoJ0ZtQvAoYwmHDGyGZclOmd5S0La2RzeHohlShj5m3zpvQ:FOm3RxoSHQvmPHSfeQ0LaWqohlow3Fo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1668 Unicorn-389.exe 2708 Unicorn-4603.exe 2584 Unicorn-4723.exe 2472 Unicorn-46496.exe 2044 Unicorn-57549.exe 896 Unicorn-60923.exe 1640 Unicorn-8385.exe 2732 Unicorn-47986.exe 628 Unicorn-189.exe 1960 Unicorn-18794.exe 2008 Unicorn-26033.exe 2028 Unicorn-24855.exe 1616 Unicorn-22586.exe 2168 Unicorn-17414.exe 844 Unicorn-392.exe 2880 Unicorn-48394.exe 1576 Unicorn-32899.exe 2992 Unicorn-61357.exe 964 Unicorn-15878.exe 940 Unicorn-63879.exe 1748 Unicorn-33667.exe 892 Unicorn-23896.exe 2228 Unicorn-21627.exe 1444 Unicorn-41493.exe 560 Unicorn-41685.exe 2968 Unicorn-37470.exe 1680 Unicorn-18738.exe 2760 Unicorn-34005.exe 1672 Unicorn-31736.exe 1568 Unicorn-31736.exe 3024 Unicorn-1716.exe 3020 Unicorn-16434.exe 2572 Unicorn-62297.exe 652 Unicorn-57879.exe 2820 Unicorn-9939.exe 2960 Unicorn-5917.exe 1652 Unicorn-25975.exe 2516 Unicorn-39357.exe 1792 Unicorn-57111.exe 2636 Unicorn-42036.exe 2672 Unicorn-22362.exe 1620 Unicorn-63857.exe 2320 Unicorn-15918.exe 1756 Unicorn-11703.exe 2868 Unicorn-28689.exe 1192 Unicorn-61361.exe 2316 Unicorn-26420.exe 2128 Unicorn-61553.exe 1704 Unicorn-13613.exe 1108 Unicorn-13805.exe 1504 Unicorn-59477.exe 1604 Unicorn-11537.exe 2036 Unicorn-49836.exe 1544 Unicorn-49836.exe 2564 Unicorn-31916.exe 2428 Unicorn-49670.exe 1800 Unicorn-47402.exe 860 Unicorn-17382.exe 2952 Unicorn-50246.exe 1936 Unicorn-21222.exe 2160 Unicorn-18953.exe 1864 Unicorn-56608.exe 2668 Unicorn-52010.exe 2156 Unicorn-6530.exe -
Loads dropped DLL 64 IoCs
pid Process 1760 169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe 1760 169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe 1760 169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe 1760 169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe 2692 WerFault.exe 2692 WerFault.exe 2692 WerFault.exe 2692 WerFault.exe 2692 WerFault.exe 2692 WerFault.exe 2692 WerFault.exe 2708 Unicorn-4603.exe 2708 Unicorn-4603.exe 2584 Unicorn-4723.exe 2584 Unicorn-4723.exe 2708 Unicorn-4603.exe 2708 Unicorn-4603.exe 2404 WerFault.exe 2404 WerFault.exe 2404 WerFault.exe 2404 WerFault.exe 2404 WerFault.exe 2472 Unicorn-46496.exe 2472 Unicorn-46496.exe 2584 Unicorn-4723.exe 2044 Unicorn-57549.exe 2584 Unicorn-4723.exe 2044 Unicorn-57549.exe 2608 WerFault.exe 2608 WerFault.exe 2608 WerFault.exe 2608 WerFault.exe 2608 WerFault.exe 896 Unicorn-60923.exe 2472 Unicorn-46496.exe 896 Unicorn-60923.exe 2472 Unicorn-46496.exe 1640 Unicorn-8385.exe 1640 Unicorn-8385.exe 2732 Unicorn-47986.exe 2732 Unicorn-47986.exe 2044 Unicorn-57549.exe 2044 Unicorn-57549.exe 1932 WerFault.exe 1932 WerFault.exe 1932 WerFault.exe 1932 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 1932 WerFault.exe 2312 WerFault.exe 628 Unicorn-189.exe 628 Unicorn-189.exe 1960 Unicorn-18794.exe 1960 Unicorn-18794.exe 896 Unicorn-60923.exe 896 Unicorn-60923.exe 2028 Unicorn-24855.exe 2028 Unicorn-24855.exe 2732 Unicorn-47986.exe 2732 Unicorn-47986.exe 2008 Unicorn-26033.exe -
Program crash 64 IoCs
pid pid_target Process procid_target 2692 1668 WerFault.exe 28 2620 1760 WerFault.exe 27 2404 2708 WerFault.exe 30 2608 2584 WerFault.exe 32 1932 2472 WerFault.exe 33 2312 2044 WerFault.exe 34 1780 896 WerFault.exe 36 1272 1640 WerFault.exe 37 1268 2732 WerFault.exe 38 2464 628 WerFault.exe 41 1488 1960 WerFault.exe 40 580 2028 WerFault.exe 43 2212 2008 WerFault.exe 42 1996 1616 WerFault.exe 44 1764 2168 WerFault.exe 47 2908 2880 WerFault.exe 49 1736 1576 WerFault.exe 50 900 964 WerFault.exe 52 1644 2992 WerFault.exe 51 2152 940 WerFault.exe 53 2548 1748 WerFault.exe 54 2144 560 WerFault.exe 61 1428 3024 WerFault.exe 67 2188 2572 WerFault.exe 69 1592 1444 WerFault.exe 60 1344 2228 WerFault.exe 59 700 2968 WerFault.exe 62 1880 2760 WerFault.exe 64 608 1672 WerFault.exe 65 1556 1680 WerFault.exe 63 1876 1568 WerFault.exe 66 2712 3020 WerFault.exe 68 1828 2960 WerFault.exe 79 2632 2636 WerFault.exe 83 2508 1620 WerFault.exe 85 3364 2320 WerFault.exe 86 3396 2820 WerFault.exe 78 3432 2868 WerFault.exe 88 3600 2128 WerFault.exe 91 3796 1108 WerFault.exe 93 3812 1192 WerFault.exe 89 3736 1604 WerFault.exe 95 3724 2316 WerFault.exe 90 3716 1704 WerFault.exe 92 2476 1792 WerFault.exe 82 3424 1800 WerFault.exe 107 3464 1152 WerFault.exe 122 3480 2564 WerFault.exe 105 3488 1500 WerFault.exe 118 3520 2668 WerFault.exe 113 3572 432 WerFault.exe 117 3580 1752 WerFault.exe 130 3632 2544 WerFault.exe 124 3664 2672 WerFault.exe 84 3684 2268 WerFault.exe 115 3712 2076 WerFault.exe 129 3820 2952 WerFault.exe 109 3836 1720 WerFault.exe 126 3872 1652 WerFault.exe 80 3880 2640 WerFault.exe 119 3984 2944 WerFault.exe 144 4012 2160 WerFault.exe 111 4004 2036 WerFault.exe 103 3996 2440 WerFault.exe 143 -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1760 169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe 1668 Unicorn-389.exe 2708 Unicorn-4603.exe 2584 Unicorn-4723.exe 2472 Unicorn-46496.exe 2044 Unicorn-57549.exe 896 Unicorn-60923.exe 1640 Unicorn-8385.exe 2732 Unicorn-47986.exe 628 Unicorn-189.exe 1960 Unicorn-18794.exe 2008 Unicorn-26033.exe 2028 Unicorn-24855.exe 1616 Unicorn-22586.exe 2168 Unicorn-17414.exe 844 Unicorn-392.exe 2880 Unicorn-48394.exe 1576 Unicorn-32899.exe 2992 Unicorn-61357.exe 964 Unicorn-15878.exe 940 Unicorn-63879.exe 1748 Unicorn-33667.exe 892 Unicorn-23896.exe 2228 Unicorn-21627.exe 560 Unicorn-41685.exe 1444 Unicorn-41493.exe 2968 Unicorn-37470.exe 1680 Unicorn-18738.exe 1672 Unicorn-31736.exe 2760 Unicorn-34005.exe 3024 Unicorn-1716.exe 1568 Unicorn-31736.exe 2572 Unicorn-62297.exe 3020 Unicorn-16434.exe 652 Unicorn-57879.exe 2820 Unicorn-9939.exe 2960 Unicorn-5917.exe 1652 Unicorn-25975.exe 2516 Unicorn-39357.exe 1792 Unicorn-57111.exe 2636 Unicorn-42036.exe 2672 Unicorn-22362.exe 1620 Unicorn-63857.exe 2320 Unicorn-15918.exe 2868 Unicorn-28689.exe 1756 Unicorn-11703.exe 2316 Unicorn-26420.exe 1704 Unicorn-13613.exe 1192 Unicorn-61361.exe 2128 Unicorn-61553.exe 1504 Unicorn-59477.exe 1108 Unicorn-13805.exe 1604 Unicorn-11537.exe 1544 Unicorn-49836.exe 2036 Unicorn-49836.exe 2564 Unicorn-31916.exe 2428 Unicorn-49670.exe 1800 Unicorn-47402.exe 860 Unicorn-17382.exe 2952 Unicorn-50246.exe 1936 Unicorn-21222.exe 2160 Unicorn-18953.exe 1864 Unicorn-56608.exe 2668 Unicorn-52010.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1668 1760 169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe 28 PID 1760 wrote to memory of 1668 1760 169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe 28 PID 1760 wrote to memory of 1668 1760 169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe 28 PID 1760 wrote to memory of 1668 1760 169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe 28 PID 1760 wrote to memory of 2708 1760 169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe 30 PID 1760 wrote to memory of 2708 1760 169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe 30 PID 1760 wrote to memory of 2708 1760 169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe 30 PID 1760 wrote to memory of 2708 1760 169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe 30 PID 1668 wrote to memory of 2692 1668 Unicorn-389.exe 29 PID 1668 wrote to memory of 2692 1668 Unicorn-389.exe 29 PID 1668 wrote to memory of 2692 1668 Unicorn-389.exe 29 PID 1668 wrote to memory of 2692 1668 Unicorn-389.exe 29 PID 1760 wrote to memory of 2620 1760 169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe 31 PID 1760 wrote to memory of 2620 1760 169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe 31 PID 1760 wrote to memory of 2620 1760 169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe 31 PID 1760 wrote to memory of 2620 1760 169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe 31 PID 2708 wrote to memory of 2584 2708 Unicorn-4603.exe 32 PID 2708 wrote to memory of 2584 2708 Unicorn-4603.exe 32 PID 2708 wrote to memory of 2584 2708 Unicorn-4603.exe 32 PID 2708 wrote to memory of 2584 2708 Unicorn-4603.exe 32 PID 2584 wrote to memory of 2472 2584 Unicorn-4723.exe 33 PID 2584 wrote to memory of 2472 2584 Unicorn-4723.exe 33 PID 2584 wrote to memory of 2472 2584 Unicorn-4723.exe 33 PID 2584 wrote to memory of 2472 2584 Unicorn-4723.exe 33 PID 2708 wrote to memory of 2044 2708 Unicorn-4603.exe 34 PID 2708 wrote to memory of 2044 2708 Unicorn-4603.exe 34 PID 2708 wrote to memory of 2044 2708 Unicorn-4603.exe 34 PID 2708 wrote to memory of 2044 2708 Unicorn-4603.exe 34 PID 2708 wrote to memory of 2404 2708 Unicorn-4603.exe 35 PID 2708 wrote to memory of 2404 2708 Unicorn-4603.exe 35 PID 2708 wrote to memory of 2404 2708 Unicorn-4603.exe 35 PID 2708 wrote to memory of 2404 2708 Unicorn-4603.exe 35 PID 2472 wrote to memory of 896 2472 Unicorn-46496.exe 36 PID 2472 wrote to memory of 896 2472 Unicorn-46496.exe 36 PID 2472 wrote to memory of 896 2472 Unicorn-46496.exe 36 PID 2472 wrote to memory of 896 2472 Unicorn-46496.exe 36 PID 2584 wrote to memory of 1640 2584 Unicorn-4723.exe 37 PID 2584 wrote to memory of 1640 2584 Unicorn-4723.exe 37 PID 2584 wrote to memory of 1640 2584 Unicorn-4723.exe 37 PID 2584 wrote to memory of 1640 2584 Unicorn-4723.exe 37 PID 2044 wrote to memory of 2732 2044 Unicorn-57549.exe 38 PID 2044 wrote to memory of 2732 2044 Unicorn-57549.exe 38 PID 2044 wrote to memory of 2732 2044 Unicorn-57549.exe 38 PID 2044 wrote to memory of 2732 2044 Unicorn-57549.exe 38 PID 2584 wrote to memory of 2608 2584 Unicorn-4723.exe 39 PID 2584 wrote to memory of 2608 2584 Unicorn-4723.exe 39 PID 2584 wrote to memory of 2608 2584 Unicorn-4723.exe 39 PID 2584 wrote to memory of 2608 2584 Unicorn-4723.exe 39 PID 896 wrote to memory of 1960 896 Unicorn-60923.exe 40 PID 896 wrote to memory of 1960 896 Unicorn-60923.exe 40 PID 896 wrote to memory of 1960 896 Unicorn-60923.exe 40 PID 896 wrote to memory of 1960 896 Unicorn-60923.exe 40 PID 2472 wrote to memory of 628 2472 Unicorn-46496.exe 41 PID 2472 wrote to memory of 628 2472 Unicorn-46496.exe 41 PID 2472 wrote to memory of 628 2472 Unicorn-46496.exe 41 PID 2472 wrote to memory of 628 2472 Unicorn-46496.exe 41 PID 1640 wrote to memory of 2008 1640 Unicorn-8385.exe 42 PID 1640 wrote to memory of 2008 1640 Unicorn-8385.exe 42 PID 1640 wrote to memory of 2008 1640 Unicorn-8385.exe 42 PID 1640 wrote to memory of 2008 1640 Unicorn-8385.exe 42 PID 2732 wrote to memory of 2028 2732 Unicorn-47986.exe 43 PID 2732 wrote to memory of 2028 2732 Unicorn-47986.exe 43 PID 2732 wrote to memory of 2028 2732 Unicorn-47986.exe 43 PID 2732 wrote to memory of 2028 2732 Unicorn-47986.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\169daaaa7536d8ca4b4ccc7836fb0f40_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-389.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-389.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 2403⤵
- Loads dropped DLL
- Program crash
PID:2692
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4603.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-4723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4723.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46496.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46496.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-60923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60923.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-18794.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18794.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-392.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-392.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:844 -
C:\Unicorn-23896.exe\Unicorn-23896.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:892 -
C:\Unicorn-57879.exe\Unicorn-57879.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:652 -
C:\Unicorn-49836.exe\Unicorn-49836.exe10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1544 -
C:\Unicorn-32938.exe\Unicorn-32938.exe11⤵PID:2384
-
C:\Unicorn-47246.exe\Unicorn-47246.exe12⤵PID:4948
-
C:\Unicorn-18427.exe\Unicorn-18427.exe13⤵PID:2384
-
C:\Unicorn-26384.exe\Unicorn-26384.exe14⤵PID:7388
-
C:\Unicorn-58032.exe\Unicorn-58032.exe15⤵PID:3008
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49836.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49836.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-32336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32336.exe10⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1136.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1136.exe11⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30306.exe12⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe13⤵PID:6876
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43604.exe14⤵PID:8360
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6876 -s 21614⤵PID:5012
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 23613⤵PID:7280
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 21612⤵PID:6652
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 21611⤵PID:4368
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 21610⤵
- Program crash
PID:4004
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 2369⤵
- Program crash
PID:3396
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31916.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe9⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe10⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26353.exe11⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54288.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54288.exe12⤵PID:6280
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-524.exe13⤵PID:8412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6280 -s 23613⤵PID:8384
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5628 -s 23612⤵PID:7468
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 23611⤵PID:6140
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 23610⤵PID:4964
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 2169⤵
- Program crash
PID:3480
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 2408⤵
- Program crash
PID:1344
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 2407⤵
- Program crash
PID:1488
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48394.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48394.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:560 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-25975.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25975.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49670.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exe10⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe11⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe12⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe13⤵PID:6500
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12294.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12294.exe14⤵PID:8728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6500 -s 21614⤵PID:8784
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5536 -s 21613⤵PID:7888
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 21612⤵PID:5448
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 21611⤵PID:5320
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 23610⤵PID:4480
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13430.exe9⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18132.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18132.exe10⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63597.exe11⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe12⤵PID:6832
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45522.exe13⤵PID:8600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 23613⤵PID:8548
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 21612⤵PID:7704
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 21611⤵PID:6212
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 23610⤵PID:4224
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 2409⤵
- Program crash
PID:3872
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49357.exe9⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13839.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13839.exe10⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36555.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36555.exe11⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe12⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55833.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55833.exe13⤵PID:8508
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 23613⤵PID:5220
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 21612⤵PID:7772
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 23611⤵PID:5688
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 21610⤵PID:4940
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2369⤵
- Program crash
PID:3424
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 2408⤵
- Program crash
PID:2144
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39357.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23955.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23955.exe9⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26580.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26580.exe10⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe11⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40343.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40343.exe12⤵PID:7212
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22150.exe13⤵PID:9112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7212 -s 23613⤵PID:4176
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 21612⤵PID:7356
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 23611⤵PID:6428
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 21610⤵PID:4168
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 2369⤵
- Program crash
PID:3820
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe8⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40116.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40116.exe9⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe10⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11214.exe11⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exe12⤵PID:8820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 21612⤵PID:8892
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 21611⤵PID:8052
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 23610⤵PID:6408
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 2169⤵PID:5700
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 2408⤵PID:4472
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 2407⤵
- Program crash
PID:2908
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 2406⤵
- Program crash
PID:1780
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-189.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:628 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-17414.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17414.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-41493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41493.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-42036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42036.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56608.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56608.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-53389.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53389.exe10⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe11⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exe12⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4165.exe13⤵PID:6708
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63816.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63816.exe14⤵PID:8312
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2298.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2298.exe15⤵PID:8440
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6708 -s 21614⤵PID:9184
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 21613⤵PID:6912
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 21612⤵PID:6324
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 23611⤵PID:4552
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 21610⤵PID:4024
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 2369⤵
- Program crash
PID:2632
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52010.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52010.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-38506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38506.exe9⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38007.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38007.exe10⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45808.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45808.exe11⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62698.exe12⤵PID:5972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 18813⤵PID:6168
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 23612⤵PID:792
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 23611⤵PID:5328
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 23610⤵PID:5056
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 2369⤵
- Program crash
PID:3520
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 2408⤵
- Program crash
PID:1592
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22362.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22362.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-6530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6530.exe8⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe9⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31339.exe10⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5621.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5621.exe11⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe12⤵PID:6560
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe13⤵PID:8872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6560 -s 23613⤵PID:8896
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5952 -s 21612⤵PID:7228
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 23611⤵PID:6300
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 21610⤵PID:4560
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 2369⤵PID:3220
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33523.exe8⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43601.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43601.exe9⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe10⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28647.exe11⤵PID:7636
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50456.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50456.exe12⤵PID:8420
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5920 -s 21611⤵PID:8036
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 21610⤵PID:6992
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 2169⤵PID:4156
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 2408⤵
- Program crash
PID:3664
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 2407⤵
- Program crash
PID:1764
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37470.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37470.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-21222.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21222.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-25299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25299.exe9⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40930.exe10⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe11⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24172.exe12⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4290.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4290.exe13⤵PID:7740
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26627.exe14⤵PID:5312
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 23613⤵PID:8108
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 21612⤵PID:6864
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 21611⤵PID:4972
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 23610⤵
- Program crash
PID:3984
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe9⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40308.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40308.exe10⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe11⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe12⤵PID:6716
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35870.exe13⤵PID:8792
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 21613⤵PID:8808
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 21612⤵PID:8044
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 23611⤵PID:6548
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 21610⤵PID:5780
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 2409⤵PID:4816
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35417.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35417.exe8⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe9⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20109.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20109.exe10⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52225.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52225.exe11⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36571.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36571.exe12⤵PID:7540
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe13⤵PID:5116
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5932 -s 23612⤵PID:7920
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 23611⤵PID:6608
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 23610⤵PID:5072
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 2369⤵
- Program crash
PID:3996
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 2408⤵
- Program crash
PID:2476
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18953.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-37463.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37463.exe8⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15098.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15098.exe9⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe10⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29134.exe11⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18595.exe12⤵PID:8932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 23612⤵PID:9076
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6064 -s 21611⤵PID:7240
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 23610⤵PID:6380
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 2169⤵PID:4312
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 2368⤵
- Program crash
PID:4012
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 2407⤵
- Program crash
PID:700
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 2406⤵
- Program crash
PID:2464
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 2405⤵
- Loads dropped DLL
- Program crash
PID:1932
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8385.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8385.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-26033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26033.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-15878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15878.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:964 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-34005.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34005.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-15918.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15918.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-65181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65181.exe9⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34417.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34417.exe10⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe11⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53569.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53569.exe12⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34832.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34832.exe13⤵PID:7348
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe14⤵PID:8212
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 21613⤵PID:7580
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 23612⤵PID:6592
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 23611⤵PID:5000
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 23610⤵
- Program crash
PID:3488
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 2369⤵
- Program crash
PID:3364
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60775.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60775.exe8⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe9⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2672.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2672.exe10⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11358.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11358.exe11⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11344.exe12⤵PID:6732
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58252.exe13⤵PID:9084
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 21612⤵PID:7220
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 23611⤵PID:6492
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 21610⤵PID:4228
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 2369⤵
- Program crash
PID:3880
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 2408⤵
- Program crash
PID:1880
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11703.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11703.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe8⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32938.exe9⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42423.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42423.exe10⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63597.exe11⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62444.exe12⤵PID:6264
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35424.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35424.exe13⤵PID:8900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6264 -s 21613⤵PID:5380
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5848 -s 21612⤵PID:8124
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 23611⤵PID:6220
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 23610⤵PID:5096
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 2169⤵
- Program crash
PID:3572
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13840.exe8⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54065.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54065.exe9⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36331.exe10⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe11⤵PID:7908
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2298.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2298.exe12⤵PID:8444
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 21611⤵PID:7200
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 23610⤵PID:7116
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 2169⤵PID:5692
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 2408⤵PID:4420
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 2207⤵
- Program crash
PID:900
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31736.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63857.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe8⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54484.exe9⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43601.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43601.exe10⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20110.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20110.exe11⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20978.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20978.exe12⤵PID:7140
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe13⤵PID:8648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 21613⤵PID:8644
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 21612⤵PID:7608
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 23611⤵PID:5832
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 21610⤵PID:4144
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 2169⤵
- Program crash
PID:3684
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 2368⤵
- Program crash
PID:2508
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35398.exe7⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29809.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29809.exe8⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32389.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32389.exe9⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8373.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8373.exe10⤵PID:6248
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22413.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22413.exe11⤵PID:8188
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exe12⤵PID:5396
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6248 -s 21611⤵PID:4860
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 23610⤵PID:7032
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 2169⤵PID:5492
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 2168⤵PID:4504
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 2407⤵
- Program crash
PID:608
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 2406⤵
- Program crash
PID:2212
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:940 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1716.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-61361.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61361.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-52986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52986.exe8⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35595.exe9⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60404.exe10⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42606.exe11⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe12⤵PID:6556
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4245.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4245.exe13⤵PID:8448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6556 -s 21613⤵PID:5188
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 21612⤵PID:7488
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 23611⤵PID:968
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 21610⤵PID:4116
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 2169⤵
- Program crash
PID:3580
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 2368⤵
- Program crash
PID:3812
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 2367⤵
- Program crash
PID:1428
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-19738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19738.exe7⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24323.exe8⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe9⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe10⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54823.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54823.exe11⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe12⤵PID:8664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 23612⤵PID:8656
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 21611⤵PID:7688
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 23610⤵PID:5268
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5719.exe9⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26271.exe10⤵PID:6768
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2517.exe11⤵PID:8476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6768 -s 23611⤵PID:8464
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5592 -s 23610⤵PID:7512
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 2209⤵PID:5820
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 2168⤵PID:4804
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 2167⤵
- Program crash
PID:3724
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 2406⤵
- Program crash
PID:2152
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 2405⤵
- Program crash
PID:1272
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 2404⤵
- Loads dropped DLL
- Program crash
PID:2608
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-47986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47986.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24855.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-32899.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32899.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-5917.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5917.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-17382.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17382.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:860 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-8978.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8978.exe9⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40555.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40555.exe10⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23603.exe11⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe12⤵PID:7072
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe13⤵PID:8200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7072 -s 21613⤵PID:8580
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 21612⤵PID:7268
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 21611⤵PID:6340
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 21610⤵PID:4336
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 2169⤵PID:4032
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 2368⤵
- Program crash
PID:1828
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 2367⤵
- Program crash
PID:1736
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31736.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-28689.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28689.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-62877.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62877.exe8⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52206.exe9⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7059.exe10⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14820.exe11⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61737.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61737.exe12⤵PID:7844
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30773.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30773.exe13⤵PID:5236
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5664 -s 23612⤵PID:8152
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 21611⤵PID:7008
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 21610⤵PID:5812
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 2169⤵PID:4428
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 2368⤵
- Program crash
PID:3432
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58471.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58471.exe7⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48174.exe8⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-420.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-420.exe9⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11748.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11748.exe10⤵PID:5588
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53534.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53534.exe11⤵PID:7244
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27500.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27500.exe12⤵PID:9028
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 21611⤵PID:7260
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 21610⤵PID:6932
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 2169⤵PID:4636
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 2168⤵PID:3284
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 2207⤵
- Program crash
PID:1876
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 2406⤵
- Program crash
PID:580
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61357.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-18738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18738.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-13805.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13805.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe8⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2730.exe9⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10928.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10928.exe10⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16933.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16933.exe11⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33964.exe12⤵PID:7956
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe13⤵PID:4956
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 21612⤵PID:7192
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 21611⤵PID:6968
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 21610⤵PID:1572
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 2169⤵
- Program crash
PID:3712
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 2368⤵
- Program crash
PID:3796
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31309.exe7⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe8⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2451.exe9⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30410.exe10⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44919.exe11⤵PID:8144
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46287.exe12⤵PID:8952
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 21611⤵PID:7736
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 23610⤵PID:6436
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 2169⤵PID:5728
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 2368⤵PID:4464
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 2407⤵
- Program crash
PID:1556
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11537.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-19930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19930.exe7⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe8⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17634.exe9⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe10⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21539.exe11⤵PID:6620
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe12⤵PID:8864
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6620 -s 21612⤵PID:8916
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 21611⤵PID:7896
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 21610⤵PID:6284
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 2169⤵PID:4668
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 2168⤵PID:3732
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 2167⤵
- Program crash
PID:3736
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 2406⤵
- Program crash
PID:1644
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 2405⤵
- Program crash
PID:1268
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-16434.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16434.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-13613.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13613.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-52218.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52218.exe8⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60011.exe9⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe10⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4085.exe11⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43614.exe12⤵PID:6332
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54297.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54297.exe13⤵PID:8536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6332 -s 23613⤵PID:5232
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 21612⤵PID:7676
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 23611⤵PID:6360
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 23610⤵PID:4120
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 2169⤵
- Program crash
PID:3632
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 2368⤵
- Program crash
PID:3716
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe7⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52206.exe8⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53822.exe9⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17125.exe10⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41286.exe11⤵PID:7816
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1803.exe12⤵PID:8964
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 23611⤵PID:8076
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 21610⤵PID:6976
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 2369⤵PID:5016
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 2168⤵PID:3308
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 2407⤵
- Program crash
PID:2712
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59477.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-19930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19930.exe7⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe8⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe9⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12209.exe10⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42566.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42566.exe11⤵PID:6700
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48807.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48807.exe12⤵PID:8764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6700 -s 21612⤵PID:8800
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 21611⤵PID:8012
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 21610⤵PID:6476
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 2169⤵PID:4212
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 2168⤵
- Program crash
PID:3836
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9341.exe7⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe8⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14820.exe9⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe10⤵PID:7984
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35262.exe11⤵PID:8676
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6052 -s 21610⤵PID:3532
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 2169⤵PID:7000
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 2168⤵PID:4660
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 2407⤵PID:3608
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 2406⤵
- Program crash
PID:2548
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-61553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61553.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-48186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48186.exe7⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30385.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30385.exe8⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31437.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31437.exe9⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe10⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37505.exe11⤵PID:7584
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49735.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49735.exe12⤵PID:8596
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 21611⤵PID:7964
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 23610⤵PID:6804
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 2369⤵PID:4932
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 2368⤵
- Program crash
PID:3464
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 2367⤵
- Program crash
PID:3600
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64641.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64641.exe6⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38999.exe7⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64459.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64459.exe8⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28215.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28215.exe9⤵PID:5604
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24753.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24753.exe10⤵PID:8092
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57574.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57574.exe11⤵PID:9132
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5604 -s 23610⤵PID:8176
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2369⤵PID:6244
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 2168⤵PID:5680
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 2367⤵PID:4440
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 2406⤵
- Program crash
PID:2188
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 2405⤵
- Program crash
PID:1996
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 2404⤵
- Loads dropped DLL
- Program crash
PID:2312
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 2403⤵
- Loads dropped DLL
- Program crash
PID:2404
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 2402⤵
- Program crash
PID:2620
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD5955c37a4b1207821f77abcd91369d8fa
SHA108699db3ca1024eb6bf470a24cda5aa0fc8e4d7c
SHA2566564e3e16e0250a27b600385e85e3f4ed07a44534c5ab3a0c27efb7f4f58f9ba
SHA5121b5cc5d703d46aab674e5a437d4b607201de8c39b209bbfd356839a67ff38dfeb49cf4ecfbc3169cc46d2c5273107a901f02f1e1b3c1496c1c634b79052df189
-
Filesize
184KB
MD5a1dd983c895b524498f43f4084c37abb
SHA1dafa6feb3ccb6a38c929b4cb8b772ac9bababbda
SHA25680eb13450581a4e631cecb9ff4be1f058bea92f7e4300ee7ae54cba9a8fe78ab
SHA512677fef1436598ddc46c96b82533f5f04495f0cdc8a883cd4845d5a7d182626439744455c37639c55755c18552b9e5f46a8e5d2fc0cf3cd6ed00cad9f1e3eec35
-
Filesize
184KB
MD56c9cf14523bc00c29c4ed32fec5d29b9
SHA1a239fa4574171e6c0ceb295b9a9c7666f9d87347
SHA25675f090bd8c5e0a5af3baf5578133d234d83f8d60c73d397371ed62c5d71b44f3
SHA512aa06016ec3461ccbd13829bfcd37c58f9c18bfad80d0d3d15697c869bfc3c49e7702dc8c0d00f3812df3a4eaa3705e4f6e61df8a1d2201b826ddfa29725d8651
-
Filesize
184KB
MD58f5a75dab02a6164e27e6b2ee166ccdf
SHA18b190966a468bd740a49fa74828a8bcbf73fa828
SHA2567bd7bec1fd483f4e00471ff15a017717a4425d1dd0d284226ccfb9cc01328ed3
SHA51267772fd0f3139aae0ea07b6ebdd5f729dc6d8f66e5644b4a0d499f9839d5b49abfb7b6145e32baa356bed1a1846ffdb996f85aabfffade80ec6434600784b8bb
-
Filesize
184KB
MD515d413d8e184f48898d08610135e581c
SHA145ad44ad0ddd8a40052379c4b8e9b09cd3380c7b
SHA256082bbc37deecb92d74454d54b0a9c50ac93bb483cc453c2d90c9f879491a8845
SHA51227b312382686dfd04bc2d006b1d79015ec6c1039dcdd19199a2e15b675f0a768c777d6dc30087335974af412df84ab41e9a9e140066cb0b574e3057487848f18
-
Filesize
184KB
MD55e024bd531aef32fc70aceab3fd77029
SHA12a5898a27240ce076f2ad8a24257e5fca3c3f5ea
SHA2568bcc0cd6b9768f086868eb3c5ecaa93dba1ba4bbec4cfecbe6ed4d9e041c4ae3
SHA512e540339e938c03a9493a9801e073349941c8e3c8946d4b03da78e7a4143819923f54b043963e9d20337268facaa8cc2b234b337f9728f58a6d88578e1e73a22d
-
Filesize
184KB
MD51180af0bd1ef98d7b3f403be0a43e10d
SHA1a755e1d2f9b06661fbbdd8ce5b9236fa1295c3da
SHA2561335c6171ab3e3dbb493390f387825b2c68c02d8973aa9e7591644ac109733cb
SHA512214041e4deb132192a2f9833dc6d779c20ced3887508436cf552808d08f10e00f28bcbfd54a39509951b4385d667c21090c8a89c32404bf7d00c06836bc02e45
-
Filesize
184KB
MD581857ce65e738188212e7638280b7854
SHA11c41399529b643142de6217b132957d0ba9a69e9
SHA256e2df04e0cc4fce705d16e853a03a2cb0ec8c1c3bf893e124be312d6e61ce1359
SHA512a83883e2e03006ff6344d486c14cc3d9057f8c6cd5febd67c63253b6642891b6014fa8db6e6ccef11a9a945c70cc5b82a8a46deec567a5497c36319f8fd042ab
-
Filesize
184KB
MD55eb69b40f227b9cecf1ba926385ee6b1
SHA13cbe6be69143a5b15ec2feabd2846eae2c9afccf
SHA256c0e881b25873cd973b75b4482476b324619d78b4b3cd708888892f2d0df95825
SHA512f526f8fe6d1ca0599d53da90138e36bd5e60db0a4264c0b02260f0a65800183186bd1e7a8c5050b10fd61c8cce01f27c22f725faece85260eee23488102ca505
-
Filesize
184KB
MD5fab32f7f6e877ae94e1c2bfdbc2cb1c6
SHA12e90213a87aa2c12358badc49046df51abd4da37
SHA256492b6e11dfd30a52c7176ebfdc0d1ee7fa815dcf18be4a1345dce65c33c52c4b
SHA5120fcf1198f9f879c1ac2250adf826041bd89382ee5ebc0ff367f541d8cf21fd0d145eeb62c3a284c4e68bfaf346e915b42498ecbc404b84348cd2280129c14639
-
Filesize
184KB
MD5f3380bacee9e6e24c125ea00013bcafc
SHA1876210d07485d52a99791ff1df1f49749327812f
SHA256b18d730a5e64120a1bc4e1e524edde44665721f8e7f4078a7a19e0c34e75f541
SHA51208baf4d89bea106aa2b29eb09ff1d085b96cab2d86bca22dda06ad692d3dbe81b0761f38c1a477d6a8b26dfa69eacf619817bd73ae51a6928f1d4a2672e11311
-
Filesize
184KB
MD5dca339739fa1e0a40a74c296effc156f
SHA198c008f48b993177db2da780764280047d106507
SHA2562e71ff89d77e8b5e4d8e8e11c53854703bc693b3695e5b78165d83adb6200284
SHA512e7eeb6d083b84d539f37f8da783f7c38424f38ac4577e2b14ff968f4b748c55c5534635286fb43ab30d5bc629c08fb372a676768fbfea1e6a7e8de7b8aaab2a3
-
Filesize
184KB
MD591adf64ae5a7eaf5a6486f309b01da08
SHA18082ee92b12501ef9f48ccc2aa97018bc48a209b
SHA25623edc5346e687b5116d478fdbf5937cee6e8a813a2e07f5622f62da6ca30613e
SHA51276113b04c75ae8b6b9f7b733ca3b7f121ef35bb94b7871fc4583009d66c836d8c18d89d701a376695b40ae6f1dd359295d2e957f261c24eed9ba76c477050e82
-
Filesize
184KB
MD5ea91e35bc979c568e5c145e3ccbc9713
SHA1ceb8b4f3f55b7c88ea78ce07776458de2d031a28
SHA256be1cb0246f0082f72ab261660f7749716c94cb17e5a06952efee4836781fbcaf
SHA512a702bed7ac22e724f20a8d462c4db0d9233ee38c636c48c77273ca12f90e72cd1ae090741434cbe65c25617d8794b4da5145b6f2b8afffbb2364132d96b60a69
-
Filesize
184KB
MD5539fa6f04964face75b61a45753c3928
SHA1e2b94b5f8f7f571d329ac0891c9160cbe02c9511
SHA25649f48bfe63c4486532fb6e6bd8c0db5b7d038b540d623325b7c2b7f9aaaadfe0
SHA51248b1906ccc67dd5fe6e0afb2b5e52123d58eedfd38870201d5e51ad4a5aeacbd7423660c9ce6f4c95e7959fa7e6787361f9b51445c2d4bd1e64c0b27983953e5
-
Filesize
184KB
MD5c3318c4df812eece32abaabf3c099b0a
SHA1655b2246cd9912031bee5cf5fb7ad4199e4699da
SHA256e070fa8fa80fbefcabedef69adfcd0d901bb6d223c889f91008157b619846591
SHA512d5c7392d70edf47446c229a664eebb9eee49c5d6fe0ce0624c5059490747c2a4f3dea3e41ab9c68afc4770e00a775201af7524f1b16aad2bdc38d54766b78c53
-
Filesize
184KB
MD5df2b666ae9bef45081efd4f1bb0e3d99
SHA128af2c21a0adbf2f3d791fbaec171002e96b8546
SHA256f8a177bbe38be18968873340be32c9a0bfac3893f4d3807f512b1d760cc143bc
SHA5125f79ce6c1ef74a87c05e98d67040edb228d4c84e3c79bc5854ceff1bd4386fa378b0e3ed094d6ea996774023078251e3850e46b8aaaa75a7d7c20984b04189ab
-
Filesize
184KB
MD56b52cf24be6d84454a685fa314602adf
SHA1ee370af316d00662244387a45b39266fc2826867
SHA2568e39afb501ccff0092720aa47277c020cb61e1bf7d8674a4e8a39cece143405d
SHA5120d41c4af17779f8aa8927c2ab6182dbb5b960c1ce0f584f7819d6eba362bcca24fb58fb4ac241b67aabc1b057a125e0f706a90a6f62fc5e1dabbfdcb7b5c770b