Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 01:38
Static task
static1
Behavioral task
behavioral1
Sample
b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe
Resource
win10v2004-20240426-en
General
-
Target
b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe
-
Size
184KB
-
MD5
257284c91915ef866270c6453637f5f1
-
SHA1
565e6dfe50c14624cb667703c4747cba6a958933
-
SHA256
b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1
-
SHA512
2ea0cf402845543a8d4c0dd3e0cc307fa235b68c86b37420d37f58a688dada4afc7582adb463ab3d0a50310ac9b863ce2e85f039bf17e0c2b665eac350268eb9
-
SSDEEP
3072:ulT2d9vy5oXdPNTet7LMxN6IK4QIS58F+a3A5RV4gbhlnVOFM:ulMDNPNkLIN6IFkrLhlnVOF
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3020 Unicorn-39970.exe 2888 Unicorn-62038.exe 2648 Unicorn-60154.exe 2308 Unicorn-35713.exe 2532 Unicorn-30922.exe 2716 Unicorn-50788.exe 1940 Unicorn-20706.exe 2764 Unicorn-36165.exe 2960 Unicorn-20514.exe 2312 Unicorn-648.exe 2544 Unicorn-648.exe 2492 Unicorn-47891.exe 1528 Unicorn-27833.exe 1432 Unicorn-719.exe 2920 Unicorn-30704.exe 2104 Unicorn-10838.exe 2928 Unicorn-57024.exe 264 Unicorn-31280.exe 1808 Unicorn-35681.exe 448 Unicorn-33796.exe 2380 Unicorn-53470.exe 1324 Unicorn-31492.exe 1364 Unicorn-65063.exe 552 Unicorn-64741.exe 904 Unicorn-19646.exe 2052 Unicorn-35908.exe 292 Unicorn-36423.exe 2420 Unicorn-49806.exe 2176 Unicorn-4134.exe 2908 Unicorn-38533.exe 3028 Unicorn-19186.exe 2404 Unicorn-38860.exe 2452 Unicorn-51859.exe 2688 Unicorn-6763.exe 2840 Unicorn-39628.exe 2528 Unicorn-49996.exe 2508 Unicorn-4324.exe 2624 Unicorn-23794.exe 2996 Unicorn-43468.exe 2756 Unicorn-37992.exe 1976 Unicorn-58626.exe 824 Unicorn-23650.exe 2860 Unicorn-3592.exe 1632 Unicorn-23458.exe 1972 Unicorn-56322.exe 2744 Unicorn-52300.exe 2092 Unicorn-46800.exe 960 Unicorn-38527.exe 2360 Unicorn-50521.exe 1380 Unicorn-4911.exe 1856 Unicorn-37584.exe 2008 Unicorn-15544.exe 2324 Unicorn-32758.exe 2152 Unicorn-48217.exe 2224 Unicorn-48279.exe 2168 Unicorn-61408.exe 1696 Unicorn-469.exe 3016 Unicorn-16313.exe 2256 Unicorn-49177.exe 2644 Unicorn-29119.exe 2656 Unicorn-34102.exe 2816 Unicorn-47101.exe 2516 Unicorn-62176.exe 2580 Unicorn-16505.exe -
Loads dropped DLL 64 IoCs
pid Process 2944 b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe 2944 b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe 3020 Unicorn-39970.exe 3020 Unicorn-39970.exe 2944 b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe 2944 b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe 2888 Unicorn-62038.exe 3020 Unicorn-39970.exe 2648 Unicorn-60154.exe 2648 Unicorn-60154.exe 2888 Unicorn-62038.exe 3020 Unicorn-39970.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2532 Unicorn-30922.exe 2308 Unicorn-35713.exe 2532 Unicorn-30922.exe 2308 Unicorn-35713.exe 2716 Unicorn-50788.exe 2888 Unicorn-62038.exe 2716 Unicorn-50788.exe 2648 Unicorn-60154.exe 2888 Unicorn-62038.exe 2648 Unicorn-60154.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1964 WerFault.exe 1964 WerFault.exe 1964 WerFault.exe 1964 WerFault.exe 1264 WerFault.exe 1964 WerFault.exe 1940 Unicorn-20706.exe 1940 Unicorn-20706.exe 2532 Unicorn-30922.exe 2532 Unicorn-30922.exe 2764 Unicorn-36165.exe 2764 Unicorn-36165.exe 2960 Unicorn-20514.exe 2308 Unicorn-35713.exe 2960 Unicorn-20514.exe 2308 Unicorn-35713.exe 2716 Unicorn-50788.exe 2716 Unicorn-50788.exe 2544 Unicorn-648.exe 2544 Unicorn-648.exe 596 WerFault.exe 596 WerFault.exe 596 WerFault.exe 596 WerFault.exe 1644 WerFault.exe 1644 WerFault.exe 1644 WerFault.exe 1644 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe 1468 WerFault.exe 596 WerFault.exe -
Program crash 64 IoCs
pid pid_target Process procid_target 2652 2944 WerFault.exe 27 2988 3020 WerFault.exe 28 1264 2888 WerFault.exe 29 1964 2648 WerFault.exe 30 596 2532 WerFault.exe 33 1468 2716 WerFault.exe 34 1644 2308 WerFault.exe 32 1552 448 WerFault.exe 54 2456 2312 WerFault.exe 40 2956 2764 WerFault.exe 37 2892 2960 WerFault.exe 38 2596 2544 WerFault.exe 39 1524 2492 WerFault.exe 43 1388 1528 WerFault.exe 44 1352 1432 WerFault.exe 45 1860 2928 WerFault.exe 48 1424 2920 WerFault.exe 46 572 264 WerFault.exe 49 680 2104 WerFault.exe 47 836 1808 WerFault.exe 53 692 2380 WerFault.exe 55 2144 1324 WerFault.exe 56 2460 1364 WerFault.exe 58 2384 552 WerFault.exe 59 1592 904 WerFault.exe 60 984 2052 WerFault.exe 61 1824 292 WerFault.exe 62 2288 2420 WerFault.exe 64 1784 2176 WerFault.exe 63 2616 1940 WerFault.exe 36 1620 2908 WerFault.exe 67 2588 2624 WerFault.exe 77 2948 2528 WerFault.exe 75 2560 2404 WerFault.exe 70 1716 2744 WerFault.exe 85 3084 1976 WerFault.exe 80 3192 1632 WerFault.exe 82 3560 2452 WerFault.exe 72 3584 2996 WerFault.exe 78 3612 2756 WerFault.exe 79 3628 1972 WerFault.exe 84 3644 2508 WerFault.exe 76 3676 2688 WerFault.exe 73 3740 3028 WerFault.exe 68 3776 2860 WerFault.exe 83 3912 2840 WerFault.exe 74 4020 824 WerFault.exe 81 4036 3016 WerFault.exe 104 4052 960 WerFault.exe 94 4060 2092 WerFault.exe 93 4076 2580 WerFault.exe 110 4068 2816 WerFault.exe 108 4092 2332 WerFault.exe 112 3080 2152 WerFault.exe 100 3176 1856 WerFault.exe 97 3180 2516 WerFault.exe 109 3204 2324 WerFault.exe 99 3260 2836 WerFault.exe 116 3284 2256 WerFault.exe 105 3292 2844 WerFault.exe 114 3312 2168 WerFault.exe 102 3372 2224 WerFault.exe 101 3456 2656 WerFault.exe 107 3468 2524 WerFault.exe 111 -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2944 b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe 3020 Unicorn-39970.exe 2888 Unicorn-62038.exe 2648 Unicorn-60154.exe 2308 Unicorn-35713.exe 2532 Unicorn-30922.exe 2716 Unicorn-50788.exe 1940 Unicorn-20706.exe 2764 Unicorn-36165.exe 2312 Unicorn-648.exe 2960 Unicorn-20514.exe 2544 Unicorn-648.exe 2492 Unicorn-47891.exe 1528 Unicorn-27833.exe 1432 Unicorn-719.exe 2928 Unicorn-57024.exe 2920 Unicorn-30704.exe 2104 Unicorn-10838.exe 264 Unicorn-31280.exe 1808 Unicorn-35681.exe 448 Unicorn-33796.exe 2380 Unicorn-53470.exe 1324 Unicorn-31492.exe 1364 Unicorn-65063.exe 552 Unicorn-64741.exe 904 Unicorn-19646.exe 2052 Unicorn-35908.exe 292 Unicorn-36423.exe 2420 Unicorn-49806.exe 2176 Unicorn-4134.exe 2908 Unicorn-38533.exe 3028 Unicorn-19186.exe 2404 Unicorn-38860.exe 2452 Unicorn-51859.exe 2688 Unicorn-6763.exe 2840 Unicorn-39628.exe 2528 Unicorn-49996.exe 2508 Unicorn-4324.exe 2624 Unicorn-23794.exe 2996 Unicorn-43468.exe 2756 Unicorn-37992.exe 1976 Unicorn-58626.exe 824 Unicorn-23650.exe 2860 Unicorn-3592.exe 1632 Unicorn-23458.exe 1972 Unicorn-56322.exe 2744 Unicorn-52300.exe 2092 Unicorn-46800.exe 960 Unicorn-38527.exe 2360 Unicorn-50521.exe 1380 Unicorn-4911.exe 2008 Unicorn-15544.exe 1856 Unicorn-37584.exe 2324 Unicorn-32758.exe 2152 Unicorn-48217.exe 2224 Unicorn-48279.exe 2168 Unicorn-61408.exe 1696 Unicorn-469.exe 3016 Unicorn-16313.exe 2256 Unicorn-49177.exe 2644 Unicorn-29119.exe 2656 Unicorn-34102.exe 2816 Unicorn-47101.exe 2516 Unicorn-62176.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2944 wrote to memory of 3020 2944 b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe 28 PID 2944 wrote to memory of 3020 2944 b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe 28 PID 2944 wrote to memory of 3020 2944 b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe 28 PID 2944 wrote to memory of 3020 2944 b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe 28 PID 3020 wrote to memory of 2888 3020 Unicorn-39970.exe 29 PID 3020 wrote to memory of 2888 3020 Unicorn-39970.exe 29 PID 3020 wrote to memory of 2888 3020 Unicorn-39970.exe 29 PID 3020 wrote to memory of 2888 3020 Unicorn-39970.exe 29 PID 2944 wrote to memory of 2648 2944 b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe 30 PID 2944 wrote to memory of 2648 2944 b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe 30 PID 2944 wrote to memory of 2648 2944 b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe 30 PID 2944 wrote to memory of 2648 2944 b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe 30 PID 2944 wrote to memory of 2652 2944 b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe 31 PID 2944 wrote to memory of 2652 2944 b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe 31 PID 2944 wrote to memory of 2652 2944 b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe 31 PID 2944 wrote to memory of 2652 2944 b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe 31 PID 2888 wrote to memory of 2308 2888 Unicorn-62038.exe 32 PID 2888 wrote to memory of 2308 2888 Unicorn-62038.exe 32 PID 2888 wrote to memory of 2308 2888 Unicorn-62038.exe 32 PID 2648 wrote to memory of 2716 2648 Unicorn-60154.exe 34 PID 2888 wrote to memory of 2308 2888 Unicorn-62038.exe 32 PID 2648 wrote to memory of 2716 2648 Unicorn-60154.exe 34 PID 2648 wrote to memory of 2716 2648 Unicorn-60154.exe 34 PID 2648 wrote to memory of 2716 2648 Unicorn-60154.exe 34 PID 3020 wrote to memory of 2532 3020 Unicorn-39970.exe 33 PID 3020 wrote to memory of 2532 3020 Unicorn-39970.exe 33 PID 3020 wrote to memory of 2532 3020 Unicorn-39970.exe 33 PID 3020 wrote to memory of 2532 3020 Unicorn-39970.exe 33 PID 3020 wrote to memory of 2988 3020 Unicorn-39970.exe 35 PID 3020 wrote to memory of 2988 3020 Unicorn-39970.exe 35 PID 3020 wrote to memory of 2988 3020 Unicorn-39970.exe 35 PID 3020 wrote to memory of 2988 3020 Unicorn-39970.exe 35 PID 2532 wrote to memory of 1940 2532 Unicorn-30922.exe 36 PID 2532 wrote to memory of 1940 2532 Unicorn-30922.exe 36 PID 2532 wrote to memory of 1940 2532 Unicorn-30922.exe 36 PID 2532 wrote to memory of 1940 2532 Unicorn-30922.exe 36 PID 2308 wrote to memory of 2764 2308 Unicorn-35713.exe 37 PID 2308 wrote to memory of 2764 2308 Unicorn-35713.exe 37 PID 2308 wrote to memory of 2764 2308 Unicorn-35713.exe 37 PID 2308 wrote to memory of 2764 2308 Unicorn-35713.exe 37 PID 2716 wrote to memory of 2960 2716 Unicorn-50788.exe 38 PID 2716 wrote to memory of 2960 2716 Unicorn-50788.exe 38 PID 2716 wrote to memory of 2960 2716 Unicorn-50788.exe 38 PID 2716 wrote to memory of 2960 2716 Unicorn-50788.exe 38 PID 2888 wrote to memory of 2544 2888 Unicorn-62038.exe 39 PID 2888 wrote to memory of 2544 2888 Unicorn-62038.exe 39 PID 2888 wrote to memory of 2544 2888 Unicorn-62038.exe 39 PID 2888 wrote to memory of 2544 2888 Unicorn-62038.exe 39 PID 2648 wrote to memory of 2312 2648 Unicorn-60154.exe 40 PID 2648 wrote to memory of 2312 2648 Unicorn-60154.exe 40 PID 2648 wrote to memory of 2312 2648 Unicorn-60154.exe 40 PID 2648 wrote to memory of 2312 2648 Unicorn-60154.exe 40 PID 2888 wrote to memory of 1264 2888 Unicorn-62038.exe 41 PID 2888 wrote to memory of 1264 2888 Unicorn-62038.exe 41 PID 2888 wrote to memory of 1264 2888 Unicorn-62038.exe 41 PID 2888 wrote to memory of 1264 2888 Unicorn-62038.exe 41 PID 2648 wrote to memory of 1964 2648 Unicorn-60154.exe 42 PID 2648 wrote to memory of 1964 2648 Unicorn-60154.exe 42 PID 2648 wrote to memory of 1964 2648 Unicorn-60154.exe 42 PID 2648 wrote to memory of 1964 2648 Unicorn-60154.exe 42 PID 1940 wrote to memory of 2492 1940 Unicorn-20706.exe 43 PID 1940 wrote to memory of 2492 1940 Unicorn-20706.exe 43 PID 1940 wrote to memory of 2492 1940 Unicorn-20706.exe 43 PID 1940 wrote to memory of 2492 1940 Unicorn-20706.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe"C:\Users\Admin\AppData\Local\Temp\b96986de9e64b3c0ffee9396e43dc37a26502754a724484f0a24662e6b8f0bd1.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-39970.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39970.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-62038.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62038.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-35713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35713.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-36165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36165.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-719.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-65063.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65063.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-39628.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39628.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-34102.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34102.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-11240.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11240.exe10⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57508.exe11⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18831.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18831.exe12⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exe13⤵PID:8036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8036 -s 21214⤵PID:9908
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5584 -s 21613⤵PID:9008
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 21612⤵PID:6940
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 21611⤵PID:5916
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 21610⤵
- Program crash
PID:3456
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56912.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56912.exe9⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38302.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38302.exe10⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55239.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55239.exe11⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59886.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59886.exe12⤵PID:7332
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22583.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22583.exe13⤵PID:9712
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30540.exe14⤵PID:11912
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe15⤵PID:7980
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9712 -s 21614⤵PID:12788
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7332 -s 21613⤵PID:10484
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 21612⤵PID:8536
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 21611⤵PID:6716
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 23610⤵PID:4124
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 2409⤵
- Program crash
PID:3912
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-15106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15106.exe9⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48961.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48961.exe10⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe11⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55397.exe12⤵PID:6532
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exe13⤵PID:9512
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe14⤵PID:12120
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30704.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30704.exe15⤵PID:13124
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9512 -s 21614⤵PID:6352
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6532 -s 22013⤵PID:10316
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 21612⤵PID:8348
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 21611⤵PID:7080
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 21610⤵PID:5292
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 2169⤵
- Program crash
PID:3180
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 2408⤵
- Program crash
PID:2460
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49996.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49996.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-50521.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50521.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe9⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10986.exe10⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40295.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40295.exe11⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36620.exe12⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55932.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55932.exe13⤵PID:7832
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48761.exe14⤵PID:10184
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exe15⤵PID:11724
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10818.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10818.exe16⤵PID:7620
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10184 -s 21615⤵PID:12728
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7832 -s 22014⤵PID:10840
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 21613⤵PID:8880
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 21612⤵PID:6952
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 23611⤵PID:6016
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 23610⤵PID:3508
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10664.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10664.exe9⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2137.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2137.exe10⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52349.exe11⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3337.exe12⤵PID:7720
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10953.exe13⤵PID:9976
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19568.exe14⤵PID:12104
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe15⤵PID:7672
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9976 -s 21614⤵PID:5384
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7720 -s 21613⤵PID:10796
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5172 -s 21612⤵PID:8792
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 21611⤵PID:6536
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 21610⤵PID:5692
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 2409⤵PID:3988
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37674.exe8⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50696.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50696.exe9⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37135.exe10⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16133.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16133.exe11⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34659.exe12⤵PID:7532
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54792.exe13⤵PID:9956
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21604.exe14⤵PID:5528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9956 -s 21614⤵PID:13144
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7532 -s 21613⤵PID:11188
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5520 -s 21612⤵PID:1480
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 21611⤵PID:7480
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 21610⤵PID:5860
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 2369⤵PID:4228
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 2208⤵
- Program crash
PID:2948
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 2407⤵
- Program crash
PID:1352
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64741.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:552 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-4324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4324.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-32758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32758.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-65376.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65376.exe9⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25941.exe10⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe11⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe12⤵PID:6272
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe13⤵PID:8776
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23363.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23363.exe14⤵PID:11328
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56408.exe15⤵PID:13172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11328 -s 21615⤵PID:8388
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8776 -s 21614⤵PID:11976
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6272 -s 21613⤵PID:9264
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5536 -s 21612⤵PID:7680
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 21611⤵PID:6608
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 21610⤵PID:4192
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 2369⤵
- Program crash
PID:3204
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe8⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe9⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe10⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64660.exe11⤵PID:6616
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55618.exe12⤵PID:9484
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52048.exe13⤵PID:12036
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25535.exe14⤵PID:7976
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9484 -s 21613⤵PID:4740
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6616 -s 22012⤵PID:10304
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5360 -s 21611⤵PID:8308
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 23610⤵PID:6392
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 2369⤵PID:4604
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 2408⤵
- Program crash
PID:3644
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61408.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe8⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2199.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2199.exe9⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13760.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13760.exe10⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe11⤵PID:7440
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62193.exe12⤵PID:9824
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19812.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19812.exe13⤵PID:11412
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42811.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42811.exe14⤵PID:12400
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9824 -s 21613⤵PID:12556
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 21612⤵PID:10600
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 21611⤵PID:8636
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 23610⤵PID:6884
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 2369⤵PID:4968
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 2368⤵
- Program crash
PID:3312
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 2407⤵
- Program crash
PID:2384
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 2206⤵
- Program crash
PID:2956
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10838.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-4134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4134.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56322.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe8⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe9⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27332.exe10⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32012.exe11⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe12⤵PID:6440
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34949.exe13⤵PID:9276
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6386.exe14⤵PID:12180
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13671.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13671.exe15⤵PID:6180
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9276 -s 21614⤵PID:6400
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6440 -s 21613⤵PID:9948
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 21612⤵PID:8008
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 21611⤵PID:6892
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 21610⤵PID:5788
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 2369⤵
- Program crash
PID:3260
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe8⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60725.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60725.exe9⤵PID:3944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 18810⤵PID:3836
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 2369⤵PID:5484
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 2408⤵
- Program crash
PID:3628
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe7⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-436.exe8⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13741.exe9⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46816.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46816.exe10⤵PID:6636
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53132.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53132.exe11⤵PID:8708
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exe12⤵PID:11640
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe13⤵PID:7808
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8708 -s 21612⤵PID:11572
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6636 -s 21611⤵PID:9860
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 23610⤵PID:7712
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 2369⤵PID:5320
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 2368⤵PID:4792
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 2407⤵
- Program crash
PID:1784
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-17005.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17005.exe7⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe8⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8774.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8774.exe9⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe10⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36404.exe11⤵PID:6644
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14497.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14497.exe12⤵PID:9580
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39827.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39827.exe13⤵PID:12220
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29412.exe14⤵PID:13244
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9580 -s 21613⤵PID:12296
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6644 -s 22012⤵PID:10396
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 21611⤵PID:8340
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 21610⤵PID:4668
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 2368⤵PID:3720
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 2167⤵
- Program crash
PID:1716
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 2406⤵
- Program crash
PID:680
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 2405⤵
- Loads dropped DLL
- Program crash
PID:1644
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-648.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31280.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31280.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:264 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-36423.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36423.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:292 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23650.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:824 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-16505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16505.exe8⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe9⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe10⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe11⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2003.exe12⤵PID:7176
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12385.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12385.exe13⤵PID:9624
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4492.exe14⤵PID:12052
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe15⤵PID:7500
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9624 -s 21614⤵PID:12004
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7176 -s 22013⤵PID:10412
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 21612⤵PID:8380
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 21611⤵PID:7032
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 23610⤵PID:5176
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 2169⤵
- Program crash
PID:4076
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27721.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27721.exe8⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43112.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43112.exe9⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40749.exe10⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52049.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52049.exe11⤵PID:8424
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54655.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54655.exe12⤵PID:10668
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46648.exe13⤵PID:12596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10668 -s 23613⤵PID:13268
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8424 -s 23612⤵PID:11148
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 21611⤵PID:10108
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 21610⤵PID:7984
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 2169⤵PID:5608
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 2408⤵
- Program crash
PID:4020
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe7⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47395.exe8⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39757.exe9⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15451.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15451.exe10⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9125.exe11⤵PID:7068
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9162.exe12⤵PID:8720
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64694.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64694.exe13⤵PID:11712
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exe14⤵PID:13004
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8720 -s 21613⤵PID:11832
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7068 -s 21612⤵PID:8688
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 21611⤵PID:8064
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 21610⤵PID:5912
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 2369⤵PID:5016
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52948.exe8⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48508.exe9⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9125.exe10⤵PID:7060
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50470.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50470.exe11⤵PID:8448
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3838.exe12⤵PID:11840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11840 -s 21213⤵PID:12528
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8448 -s 21612⤵PID:11988
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7060 -s 21611⤵PID:10044
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 21610⤵PID:8076
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 2169⤵PID:5796
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 2208⤵PID:5024
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 292 -s 2407⤵
- Program crash
PID:1824
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3592.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-18207.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18207.exe7⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44297.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44297.exe8⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16016.exe9⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22520.exe10⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9159.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9159.exe11⤵PID:6576
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2276.exe12⤵PID:9240
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe13⤵PID:11784
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59935.exe14⤵PID:12964
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9240 -s 21613⤵PID:11932
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6576 -s 21612⤵PID:9764
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 21611⤵PID:7872
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 23610⤵PID:6204
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 2369⤵PID:4344
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62263.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62263.exe8⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41046.exe9⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23485.exe10⤵PID:6904
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50470.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50470.exe11⤵PID:8440
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34326.exe12⤵PID:11684
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe13⤵PID:12940
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8440 -s 21612⤵PID:11720
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6904 -s 21611⤵PID:10060
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 21610⤵PID:7916
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 2369⤵PID:6156
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 2408⤵PID:4108
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43783.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43783.exe7⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46034.exe8⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe9⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54204.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54204.exe10⤵PID:7892
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46265.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46265.exe11⤵PID:10204
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59259.exe12⤵PID:11748
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30545.exe13⤵PID:6800
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10204 -s 21612⤵PID:12740
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7892 -s 22011⤵PID:10852
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5428 -s 21610⤵PID:8912
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 2169⤵PID:6920
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 2368⤵PID:4416
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 2407⤵
- Program crash
PID:3776
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 264 -s 2406⤵
- Program crash
PID:572
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23458.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49177.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49177.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-29632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29632.exe8⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exe9⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4409.exe10⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41625.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41625.exe11⤵PID:7952
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exe12⤵PID:9300
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28123.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28123.exe13⤵PID:11792
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29350.exe14⤵PID:12572
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9300 -s 24013⤵PID:12804
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7952 -s 22012⤵PID:10980
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5232 -s 22011⤵PID:8980
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 21610⤵PID:6676
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 2169⤵PID:5684
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 2168⤵
- Program crash
PID:3284
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe7⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32627.exe8⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57081.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57081.exe9⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe10⤵PID:7100
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65353.exe11⤵PID:9180
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe12⤵PID:11812
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39370.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39370.exe13⤵PID:8136
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9180 -s 21612⤵PID:11948
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 21611⤵PID:10008
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 23610⤵PID:936
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 2369⤵PID:6172
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 2368⤵PID:4132
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 2407⤵
- Program crash
PID:3192
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47101.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47101.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-14338.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14338.exe7⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63548.exe8⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe9⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65350.exe10⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1674.exe11⤵PID:8676
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exe12⤵PID:11632
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7515.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7515.exe13⤵PID:12996
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11632 -s 21613⤵PID:7276
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 21611⤵PID:9612
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 2169⤵PID:6580
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 2368⤵PID:4160
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 2367⤵
- Program crash
PID:4068
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 2406⤵
- Program crash
PID:2288
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 2405⤵
- Program crash
PID:2596
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 2404⤵
- Loads dropped DLL
- Program crash
PID:1264
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30922.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-47891.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47891.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-35681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35681.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-38533.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38533.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-14880.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14880.exe9⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe10⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38460.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38460.exe11⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12291.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12291.exe12⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51087.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51087.exe13⤵PID:6960
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-776.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-776.exe14⤵PID:8612
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exe15⤵PID:11612
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61227.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61227.exe16⤵PID:7120
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8612 -s 21615⤵PID:11596
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6960 -s 21614⤵PID:10224
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5392 -s 21613⤵PID:7960
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 21612⤵PID:6224
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 23611⤵PID:4824
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34245.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34245.exe10⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36900.exe11⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62283.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62283.exe12⤵PID:7016
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54632.exe13⤵PID:9336
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32652.exe14⤵PID:11836
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61872.exe15⤵PID:13040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11836 -s 21615⤵PID:13220
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9336 -s 21614⤵PID:12772
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7016 -s 22013⤵PID:10004
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5452 -s 21612⤵PID:8088
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 21611⤵PID:6480
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 24010⤵PID:4892
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40373.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40373.exe9⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57508.exe10⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35852.exe11⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35839.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35839.exe12⤵PID:7864
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48761.exe13⤵PID:10192
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2790.exe14⤵PID:11456
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61638.exe15⤵PID:8480
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10192 -s 21614⤵PID:12576
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7864 -s 22013⤵PID:10876
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5544 -s 21612⤵PID:8896
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 22011⤵PID:6780
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 21610⤵PID:5900
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 2409⤵
- Program crash
PID:4060
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45285.exe8⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe9⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15110.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15110.exe10⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28206.exe11⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6667.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6667.exe12⤵PID:7796
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26178.exe13⤵PID:10180
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55454.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55454.exe14⤵PID:11804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10180 -s 23614⤵PID:13136
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7796 -s 23613⤵PID:10312
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5868 -s 21612⤵PID:9360
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 21611⤵PID:7632
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 21610⤵PID:5204
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 2369⤵PID:3728
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 2208⤵
- Program crash
PID:1620
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38527.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:960 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe8⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9092.exe9⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29179.exe10⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2883.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2883.exe11⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-581.exe12⤵PID:6336
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe13⤵PID:8420
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19568.exe14⤵PID:12080
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15026.exe15⤵PID:13100
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8420 -s 21614⤵PID:8944
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6336 -s 21613⤵PID:10216
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5628 -s 21612⤵PID:7508
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 21611⤵PID:6684
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 23610⤵PID:4288
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7777.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7777.exe9⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65467.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65467.exe10⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35820.exe11⤵PID:6996
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30953.exe12⤵PID:8464
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7958.exe13⤵PID:11560
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52609.exe14⤵PID:13088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11560 -s 23614⤵PID:6404
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8464 -s 23613⤵PID:11356
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 21612⤵PID:10156
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5304 -s 23611⤵PID:7968
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 23610⤵PID:6248
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 2409⤵PID:4568
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58355.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58355.exe8⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57508.exe9⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36428.exe10⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51251.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51251.exe11⤵PID:7648
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe12⤵PID:9940
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe13⤵PID:12164
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64990.exe14⤵PID:13188
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9940 -s 21613⤵PID:11980
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7648 -s 21612⤵PID:10780
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5664 -s 21611⤵PID:8784
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 21610⤵PID:7112
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 2169⤵PID:5956
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 2408⤵
- Program crash
PID:4052
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 2407⤵
- Program crash
PID:836
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19186.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-48217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48217.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe8⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26709.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26709.exe9⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe10⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18537.exe11⤵PID:6812
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe12⤵PID:9308
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9494.exe13⤵PID:11512
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe14⤵PID:12332
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9308 -s 21613⤵PID:12252
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6812 -s 21612⤵PID:9984
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 21611⤵PID:8032
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 21610⤵PID:6668
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 2369⤵PID:4224
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 2168⤵
- Program crash
PID:3080
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45511.exe7⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11415.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11415.exe8⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe9⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47473.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47473.exe10⤵PID:7412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7412 -s 20011⤵PID:8600
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5676 -s 21610⤵PID:8692
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 2169⤵PID:6692
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 2168⤵PID:4168
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 2407⤵
- Program crash
PID:3740
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 2406⤵
- Program crash
PID:1524
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33796.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33796.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:448 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 2006⤵
- Program crash
PID:1552
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 2405⤵
- Program crash
PID:2616
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27833.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27833.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe8⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63633.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63633.exe9⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48131.exe10⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe11⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39959.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39959.exe12⤵PID:7320
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe13⤵PID:9232
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17944.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17944.exe14⤵PID:11588
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43055.exe15⤵PID:8564
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9232 -s 22014⤵PID:12684
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7320 -s 21613⤵PID:10940
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 21612⤵PID:8520
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 21611⤵PID:6700
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 21610⤵PID:5040
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 300 -s 2369⤵PID:4432
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1230.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1230.exe8⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1520.exe9⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41284.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41284.exe10⤵PID:6316
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe11⤵PID:9172
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63874.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63874.exe12⤵PID:11532
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12755.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12755.exe13⤵PID:12504
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9172 -s 21612⤵PID:11348
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6316 -s 21611⤵PID:9700
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 21610⤵PID:7460
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 2169⤵PID:5992
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 2408⤵PID:4680
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22921.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22921.exe7⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18958.exe8⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54286.exe9⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11325.exe10⤵PID:6552
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe11⤵PID:8472
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9494.exe12⤵PID:11504
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe13⤵PID:12756
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8472 -s 21612⤵PID:12236
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6552 -s 23611⤵PID:9816
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 23610⤵PID:7644
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 2169⤵PID:6128
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2368⤵PID:4752
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 2407⤵
- Program crash
PID:2560
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48279.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48279.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-62880.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62880.exe7⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28245.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28245.exe8⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15441.exe9⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59403.exe10⤵PID:7124
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54632.exe11⤵PID:9344
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32266.exe12⤵PID:11876
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57875.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57875.exe13⤵PID:7340
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9344 -s 21612⤵PID:5468
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7124 -s 21611⤵PID:10144
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5252 -s 21610⤵PID:5500
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 2169⤵PID:6304
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 2168⤵PID:4028
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 2367⤵
- Program crash
PID:3372
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 2406⤵
- Program crash
PID:692
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51859.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-37584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37584.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-47395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47395.exe7⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59620.exe8⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19869.exe9⤵PID:5248
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe10⤵PID:7372
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22775.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22775.exe11⤵PID:9684
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22282.exe12⤵PID:11968
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15026.exe13⤵PID:13104
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9684 -s 21612⤵PID:5980
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7372 -s 21611⤵PID:10468
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5248 -s 21610⤵PID:8544
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 2169⤵PID:6560
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 2168⤵PID:5740
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 2167⤵
- Program crash
PID:3176
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe6⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5595.exe7⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe8⤵PID:5192
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19627.exe9⤵PID:6956
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe10⤵PID:9376
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24150.exe11⤵PID:11756
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exe12⤵PID:13016
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9376 -s 21611⤵PID:11856
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6956 -s 21610⤵PID:9808
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5192 -s 2169⤵PID:8244
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 2168⤵PID:6264
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 2367⤵PID:1380
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 2206⤵
- Program crash
PID:3560
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 2405⤵
- Program crash
PID:1388
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 2404⤵
- Loads dropped DLL
- Program crash
PID:596
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 2403⤵
- Loads dropped DLL
- Program crash
PID:2988
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60154.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20514.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20514.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-30704.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30704.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23794.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23794.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-4911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4911.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-13788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13788.exe8⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe9⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57996.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57996.exe10⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35458.exe11⤵PID:5400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5400 -s 18812⤵PID:5648
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48486.exe11⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23181.exe12⤵PID:8668
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10907.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10907.exe13⤵PID:10696
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24485.exe14⤵PID:12948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10696 -s 21614⤵PID:8132
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8668 -s 21613⤵PID:4440
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 23612⤵PID:9272
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 22011⤵PID:7232
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 21610⤵PID:5816
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 2369⤵PID:4308
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47250.exe8⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe9⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60878.exe10⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22319.exe11⤵PID:7844
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11123.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11123.exe12⤵PID:9388
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19736.exe13⤵PID:12508
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9388 -s 23613⤵PID:13236
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7844 -s 23612⤵PID:10664
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 21611⤵PID:9420
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 21610⤵PID:7608
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 2169⤵PID:5288
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11712.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11712.exe7⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31947.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31947.exe8⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exe9⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe10⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16497.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16497.exe11⤵PID:8452
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11716.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11716.exe12⤵PID:11108
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42196.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42196.exe13⤵PID:12912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11108 -s 21613⤵PID:12908
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8452 -s 21612⤵PID:11624
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 23611⤵PID:10100
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 21610⤵PID:8012
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 2169⤵PID:5572
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 2368⤵PID:4632
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 2407⤵
- Program crash
PID:2588
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 2366⤵
- Program crash
PID:1424
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-16505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16505.exe7⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11240.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11240.exe8⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe9⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe10⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6113.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6113.exe11⤵PID:6648
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21602.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21602.exe12⤵PID:9444
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30540.exe13⤵PID:11892
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe14⤵PID:8176
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9444 -s 21613⤵PID:12780
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6648 -s 21612⤵PID:10280
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5152 -s 21611⤵PID:8204
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 21610⤵PID:6256
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 2169⤵PID:4412
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 2368⤵
- Program crash
PID:3468
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe7⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31309.exe8⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63967.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63967.exe9⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17455.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17455.exe10⤵PID:6932
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-584.exe11⤵PID:8844
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8446.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8446.exe12⤵PID:11904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11904 -s 20013⤵PID:6464
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8844 -s 21612⤵PID:12160
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6932 -s 21611⤵PID:10088
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 21610⤵PID:7936
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 2169⤵PID:5660
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 2368⤵PID:5048
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 2407⤵
- Program crash
PID:3084
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe6⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe7⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8966.exe8⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20637.exe9⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42393.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42393.exe10⤵PID:8000
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exe11⤵PID:9316
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exe12⤵PID:11700
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11305.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11305.exe13⤵PID:8168
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9316 -s 21612⤵PID:12720
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8000 -s 21611⤵PID:10972
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5492 -s 21610⤵PID:8996
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 2169⤵PID:6992
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 2168⤵PID:5892
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 2167⤵
- Program crash
PID:3292
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 2406⤵
- Program crash
PID:984
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 2405⤵
- Program crash
PID:2892
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-19646.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19646.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:904 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43468.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43468.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe7⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14146.exe8⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41831.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41831.exe9⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe10⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2195.exe11⤵PID:7240
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39557.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39557.exe12⤵PID:9408
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe13⤵PID:12008
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe14⤵PID:13036
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9408 -s 21613⤵PID:12248
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7240 -s 21612⤵PID:10272
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5356 -s 23611⤵PID:8396
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 21610⤵PID:6656
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 2169⤵PID:5772
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 2168⤵
- Program crash
PID:4092
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60778.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60778.exe7⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6363.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6363.exe8⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57813.exe9⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65350.exe10⤵PID:7156
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe11⤵PID:8444
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9494.exe12⤵PID:11520
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19746.exe13⤵PID:2204
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8444 -s 21612⤵PID:12260
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 21611⤵PID:2184
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5420 -s 21610⤵PID:7576
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 2169⤵PID:6472
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 2368⤵PID:4864
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 2407⤵
- Program crash
PID:3584
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 2366⤵
- Program crash
PID:1592
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37992.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37992.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-29850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29850.exe7⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61322.exe8⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42863.exe9⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe10⤵PID:7512
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe11⤵PID:9780
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43651.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43651.exe12⤵PID:11428
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21728.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21728.exe13⤵PID:6416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11428 -s 23613⤵PID:8164
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9780 -s 23612⤵PID:12144
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7512 -s 21611⤵PID:10556
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5936 -s 23610⤵PID:8744
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 2169⤵PID:7152
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 2168⤵PID:6096
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 2367⤵
- Program crash
PID:4036
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46113.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46113.exe6⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28053.exe7⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9484.exe8⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37738.exe9⤵PID:7684
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40938.exe10⤵PID:10016
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60647.exe11⤵PID:11464
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30424.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30424.exe12⤵PID:12544
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10016 -s 21611⤵PID:12620
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7684 -s 22010⤵PID:10788
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 2169⤵PID:8752
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 2168⤵PID:6240
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 2167⤵PID:4920
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 2206⤵
- Program crash
PID:3612
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 2405⤵
- Program crash
PID:1860
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 2404⤵
- Loads dropped DLL
- Program crash
PID:1468
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-648.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31492.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-6763.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6763.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-469.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-469.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe7⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57166.exe8⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26593.exe9⤵PID:6520
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20896.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20896.exe10⤵PID:8432
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4927.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4927.exe11⤵PID:11400
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21562.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21562.exe12⤵PID:13284
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11400 -s 21612⤵PID:8968
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8432 -s 23611⤵PID:12096
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6520 -s 21610⤵PID:9768
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 2169⤵PID:7628
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 2368⤵PID:6088
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 2367⤵PID:4732
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45319.exe6⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10673.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10673.exe7⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28379.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28379.exe8⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8993.exe9⤵PID:6564
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exe10⤵PID:9544
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59709.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59709.exe11⤵PID:11360
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exe12⤵PID:13200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11360 -s 21612⤵PID:8576
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9544 -s 23611⤵PID:12032
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6564 -s 22010⤵PID:10352
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5224 -s 2169⤵PID:8324
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 2168⤵PID:6288
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 2367⤵PID:4468
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 2406⤵
- Program crash
PID:3676
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29119.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29119.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-44297.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44297.exe6⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe7⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42494.exe8⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39959.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39959.exe9⤵PID:7312
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43636.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43636.exe10⤵PID:9740
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21348.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21348.exe11⤵PID:11368
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30424.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30424.exe12⤵PID:12604
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9740 -s 22011⤵PID:12536
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7312 -s 21610⤵PID:10508
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5732 -s 2169⤵PID:8528
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 2368⤵PID:6736
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 2167⤵PID:4216
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 2366⤵PID:3516
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 2405⤵
- Program crash
PID:2144
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 2364⤵
- Program crash
PID:2456
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 2403⤵
- Loads dropped DLL
- Program crash
PID:1964
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 2402⤵
- Program crash
PID:2652
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD5d6b1f72821ea3295dafa2d896665f4d7
SHA1465597e5be06c351ba3ef08cc91d4aaff4af6ae1
SHA256d60911c6a9aae32eb800d579959e76eea500bf077093d9e29ce9132bc3e4abfc
SHA512900c1063b34b4fb0909d4fb162431c2218b43f02c6fba691667b0be59807ba831cd1031407f7c5d9c3382fa82688c54f7fd7e91355955e826c56af720c912f0c
-
Filesize
184KB
MD5df5857881397592b750c451cf55a7c89
SHA1f01c342e8c80e8d8195c6ad736222dd9d5f29d77
SHA256616232c6e48f3fd95877dcd65855225d952f697a88a9bf5ec81c64cb3db8b299
SHA5122aababc7bd0d8e326beb001ea5d4ca1944bb05dca21f5ef6ad92ff81fea2425da0cc6d12dd7d0a5e460ab3eb34c52b081f753a06817228cbeb43af13626867e8
-
Filesize
184KB
MD59ee1d5a34cc7951204a8678dacd7f6ff
SHA1f075dff63e4b3ca8e198894c543eb3820d84d8d1
SHA256290dd2103b34d1adc15267af08bc57141caa768ee15ea35e31fff428db494c34
SHA512c236653b400c691c7179d47004366d8ef310051fd95e4674867580a30fca0f895733db35d258214cef75b20d747a2ff10bf4ce8bc0c791ac5b0f253b0f9be9de
-
Filesize
184KB
MD5da6e09ad44f030b2af64756dc9a5f175
SHA11a219de9ede111d33bbddc2d9f68220df08aa580
SHA256b46a56647b813e2133a35f1137f2cf7f2423ab7637456e84d00bf0a2a5ccd4be
SHA5120f582e1ba8bcbf7f369af5c5791979b65a5b254a4bf8a10616355bcc6cfdc0fc1adebc5243c39ef709b5d725837c1b4cec4b695ecc67e293765a5a7a3ed973ab
-
Filesize
184KB
MD571ed5b9617191fded4d46ea01e8e2990
SHA15ce8303642df1db38aeb9a0c10271b22ee511ecf
SHA25655c1aa13d6b32dbf56f96c1d3226405c9f3ef77b72a2891efa9477c9f0a678de
SHA5128dbcc2753e3a3ef6e4f678e887b5098cd93f280e97fdce448cee328074f43c730d9cadb63ac4d810b0d05dbe83a51df351ded5f9f4083eb9a09243788988b949
-
Filesize
184KB
MD588d8e7dfac06e2a4368aed80e8bea1a3
SHA13482084dfed4ebe842c19e4b5b8d9be242780578
SHA2560ab0a902f8aa58a6aec640cf0b22f62cbefa1fbd4396185ea144c25bc33a7344
SHA5128e4617baace5ba4aa16361bfa2457b8eaeb7045443acd02cacd84e07a84492ab5de147227dc0f4b653d005a5339738df34d8c86694510d525cb75e847ee1546c
-
Filesize
184KB
MD50937d92b7b750f62405fb8374b793ed6
SHA1cad3bf1e98ec248bc49c9199af0d0da66bdd07cd
SHA25689925d91f02eaa84b43eb430c073df8cfc722b417d586e63bd8150539d5118ee
SHA512ee7b5aab4e94cbe7d303ec73c3faec32b77187e790c2cc8d9b4ed9face18aaf1eca5fc7e5dee5d73c6b60da3b52c4ef08102d1d1e028c5c10527027a09e02014
-
Filesize
184KB
MD5a602ccdb5bb7fd4bfc5ab83d6b94aabd
SHA11aa326d4f7f862b3da52848ad82cd8d98a71d195
SHA2564cc67a886a68c6b4a5c4912161b10c5fab2c29ec3e7f9bb073b1789fa8ff4f20
SHA512d7bb89dda91fdf879a4e319e5381a65d40af5ad8332ca457842802805f642e68fecc9129ee2ffcfc765506d176f69003d88df914533d48d9ef6ced82d8e395df
-
Filesize
184KB
MD5fb605dae89bb318adf2ac8184f9e3d5c
SHA1d7c3ec1a0c5d6d43c957dbea2eac0ab2572d19e4
SHA2566ba91a11ab6942b7df49966702821117e63d2e5fe91ce927f7aed2ba3668653d
SHA51219b228559c85c70979721ec625b498c436497b978737ee927ea1e06228598ff9aad8547197c1aaa5b339f552e00b2adc6a1707294658f186a1b650a2d1828642
-
Filesize
184KB
MD5e9c4f621f041f99367ca38435781bafb
SHA1b682afcb80103560f1f70dfa81ef296a80b13855
SHA2560bc192407073fb176b0310df557f6d2cd4b6fba34f4ece76797e722c1975edff
SHA5120c3cadbf30df4983e1963ff11e5a7578fe7b38af9ea5269472abbe1381c0c8b0f0f00d5b71542425dd4437d63ccc8865fd569f68f250ed5cf690159e0ceba78e
-
Filesize
184KB
MD5e6396b8d38064087faef3062947e41bc
SHA140bcd563a6e5d9062e732bb68cafc6a5bd7b2c81
SHA25628f284b1023f4cdf692a44fe3009d3cb344a36096f5d5b3566e3a1c57e0a6e74
SHA5128902888b0a37eb20c29545b70aed4d59a6b175560bdf12ff6bf954aac38c20fc9e8bbb88d976f671a075ce9669482796a411a7d373d505ff3cb0f6d9a4ef94c2
-
Filesize
184KB
MD53123a38097b99112adb8689b204f3435
SHA158415d4951ace8fa2d55f5fe89cdd876430be5a6
SHA256e65c49544bb2d25288a89225d5c664c5bfbf795758b1f79700b3cabca6262e1c
SHA512d24d0de47b167ed2e701011d9873089395726f65c7d049d118caa3ed86d95e88b0403e14df1e3898448a6a3c8d1fd7be2a9291ee7c32e3c5152cc109cf8459e0
-
Filesize
184KB
MD5092cf3e5f9b672f91d29f4b5ead620d0
SHA124424c6255acc1c83e306f82b51c8dcad4881b3d
SHA2564d3563c44c6f73c5f0076cc5f0c90331df9e60ca0c485b9a0419a5619ebfe265
SHA5128cdd7daa5a0fc0d6140965fd30f12dd6dd9e71c439cab3b211cefeb03482785f1a21cf86e5695c96820668e14f288534dd51b9358c6500ef4045fbd1f107bef9
-
Filesize
184KB
MD57033dcc0c67d83fcb6528a6203106f81
SHA1c1ca952d987c5293cd07d2813c538e780003ce72
SHA2564b8281e20710f9a2b501616d0eb00193d9e9d17ee5405043b638573edc1244ca
SHA5124c2dcecb286e4c899aa84957515f5de6d6112c4c27a106cfba81a5d5012741a6cbaee306fd7bde5347aa49755ad53ffcba95b5b203110ef79d3f696c1fa77df5
-
Filesize
184KB
MD58fb65b8f174e10859ba86e3881ac8a70
SHA1705d9ff2c29b5ac8c127b2beaeccff6e6ae42f0b
SHA2563155f1bbf1215a26c3d42a5843886f29aea8bfd4136d1539ce034200856684e5
SHA512d6bd506e7881949873f34b878d6547196644e1051fa2dcfa4dcd5fb45ac857165ffe7de28d552437eb100252139b3e75f5fc74e046b5f5e48ddeccc856713a84
-
Filesize
184KB
MD5eb652cef74a43cb6cb847b7462aee8f5
SHA13920d154b4624a8c33e525cfc9ad320a90e61ffb
SHA2565b045592e0ce07de518859070ea94e7f6106de546f04a330864f183eebe1dd87
SHA512964bf1c7f321c50c0bc8e4cb7f7ccb97191117ed2ee88823192a1fb9bfd0b81a15415d60359b850972652e1434de0d3ba134b2399624f7e1463fb20845d1fff1
-
Filesize
184KB
MD5b8095a63f42e4eb076ddf8c5f2a8366e
SHA1259ef51c4ded44ee98edb54eb1a656e0e7093943
SHA256dd1b4d4e9b3a8ae4087c278e6da7fe06639e1c44f352a2e8f980646bd0d7f36b
SHA5125182719ae094c40a2074b072a2a3f5d8a13af8a5f57d25d2122a9b442bcf522ac79dd29621a5e0e433fa2eb1cbedda315f66c803ed1ac0b9bb8ae99ab7157d69
-
Filesize
184KB
MD5b5e91b2affab23e281f6bdc8cff0ac77
SHA1e23407953b11bc8d9306fba1a6b0a872bc36cb95
SHA25693ac02e3ddd9ea2447b3c4307d89f4c3d5f9c7d95a7d949792fe1aae58ecfd61
SHA512c9d3796876ce247616bda2318f10cfa4db2c44de16fafedb480b914a5694a7bf75fb11a00b19e26a7c6593973b3d80dc9e667f0edf8d35be4b7b0ef3efb96aae
-
Filesize
184KB
MD57721a1449560c0c35c071b404e9c7f0d
SHA18b304b6344bff877caf2c68643376822e655f4dc
SHA256e69466ec33927ebf60645edff57b2934b84b9dee41899d6f743335fc7ae36892
SHA512c149ac13a9bbf74cf5e39ff273aee61fdffbd32eb420a53aac82d745814e8de1022085f79a9fab1f941d1af7d2e76c3230494ea1647dd457ab35e5bdee25dded
-
Filesize
184KB
MD5a008c0bf38c4dfba4c6d418fe753ddf0
SHA1d05b15ead2b432275c6aeb827fcdc91f7f5a17aa
SHA256f4ee33f019f03404eb1624d62fa1a22053baa1a0e2470fe00798b1c327dcafbc
SHA51259218e4b4df24316dad521eb26ad5b0ae8ecc933e542fbeeffb118ed99b5b0e376af85eceea4e1a374b446d12d08df428dc4c806dbd5b4f85ec92e0472d07172
-
Filesize
184KB
MD543cf442823d122be0e3c8efbb2d73c8a
SHA1a651b82bae4d56f6928985355aee7efad6737cc0
SHA2568ac2cd4623d4291c8fbcf621be79ed8a6efc8a8fe2992cabbe18e72be58de582
SHA512829a88ca0de14eac80a6135bd36e92ea24843cabe3f0d71eff8472689d315d6898e10fa3989d1b3a10b3cd7733e377625d6ed69b16a3dddefd51b7017394b49b
-
Filesize
184KB
MD5d60c68546588d540328f5710566b292c
SHA1dfe217e7c1ee080d6b759495d3f1704986584d4a
SHA256e3b3081e1770ee352b30467ee7ca4e2d2dbb5cf366dc07fe628c0440edd85d24
SHA5120c2b2fb80b4abe0a80e9bd3e23d102f144b66e338e74f1b360a60221e2042589767dac733611e97aac253b5b7aa5d29ababaabdb755292fcd30c10ab466dd27d