Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 07:31
Static task
static1
Behavioral task
behavioral1
Sample
50ee29f571a989518c689f409394d480_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
50ee29f571a989518c689f409394d480_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
50ee29f571a989518c689f409394d480_NeikiAnalytics.exe
-
Size
184KB
-
MD5
50ee29f571a989518c689f409394d480
-
SHA1
d8bc0f95ece06cf2819cbaec4735b63c0172390c
-
SHA256
04c01e1d1e4ff11774c4735fc517ddd198ed733e375fa0a457410511d48d1eae
-
SHA512
95094c73d3c5b7e1915171a0659898665b80dbe867f4b42a5a25410fea3e66feb96d1f5834367a314dda56a385e4ecef0ebb9a8e3d5b922672d240125d4a7ac9
-
SSDEEP
3072:tWMJHxFXEJOJdRpWeRwLR0ofhl2ViFhn3:tWYFjHRpoL+ofhl2ViFh
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2836 Unicorn-31868.exe 2640 Unicorn-20934.exe 2688 Unicorn-50269.exe 2720 Unicorn-8484.exe 2588 Unicorn-21675.exe 2444 Unicorn-41541.exe 964 Unicorn-55132.exe 2760 Unicorn-55324.exe 2144 Unicorn-63492.exe 2824 Unicorn-43626.exe 1688 Unicorn-18930.exe 1760 Unicorn-8845.exe 1736 Unicorn-30889.exe 1260 Unicorn-65062.exe 2336 Unicorn-20500.exe 1448 Unicorn-32198.exe 2104 Unicorn-24030.exe 1680 Unicorn-65254.exe 2240 Unicorn-45389.exe 1836 Unicorn-48420.exe 1812 Unicorn-43546.exe 2156 Unicorn-179.exe 884 Unicorn-65031.exe 2132 Unicorn-12301.exe 1780 Unicorn-16023.exe 1300 Unicorn-37189.exe 1724 Unicorn-65223.exe 2236 Unicorn-32359.exe 2948 Unicorn-8046.exe 2064 Unicorn-53718.exe 2556 Unicorn-729.exe 2096 Unicorn-46401.exe 2468 Unicorn-32717.exe 2464 Unicorn-14372.exe 2924 Unicorn-19395.exe 2476 Unicorn-22925.exe 2268 Unicorn-50724.exe 1052 Unicorn-22816.exe 1992 Unicorn-14647.exe 1252 Unicorn-52151.exe 2832 Unicorn-43791.exe 1484 Unicorn-63656.exe 2716 Unicorn-31176.exe 2312 Unicorn-63848.exe 2288 Unicorn-39344.exe 3016 Unicorn-52535.exe 1428 Unicorn-14839.exe 3044 Unicorn-3334.exe 3068 Unicorn-13853.exe 1832 Unicorn-64974.exe 772 Unicorn-61253.exe 1204 Unicorn-28772.exe 2140 Unicorn-23750.exe 2912 Unicorn-7989.exe 2984 Unicorn-27812.exe 1704 Unicorn-14813.exe 2432 Unicorn-47870.exe 2712 Unicorn-60677.exe 2728 Unicorn-64398.exe 2404 Unicorn-62390.exe 1980 Unicorn-10044.exe 944 Unicorn-2992.exe 2600 Unicorn-52193.exe 2872 Unicorn-60553.exe -
Loads dropped DLL 64 IoCs
pid Process 1340 50ee29f571a989518c689f409394d480_NeikiAnalytics.exe 1340 50ee29f571a989518c689f409394d480_NeikiAnalytics.exe 2836 Unicorn-31868.exe 1340 50ee29f571a989518c689f409394d480_NeikiAnalytics.exe 2836 Unicorn-31868.exe 1340 50ee29f571a989518c689f409394d480_NeikiAnalytics.exe 2640 Unicorn-20934.exe 2640 Unicorn-20934.exe 2836 Unicorn-31868.exe 2836 Unicorn-31868.exe 2688 Unicorn-50269.exe 2688 Unicorn-50269.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 2588 Unicorn-21675.exe 2588 Unicorn-21675.exe 2444 Unicorn-41541.exe 2444 Unicorn-41541.exe 2688 Unicorn-50269.exe 2688 Unicorn-50269.exe 2720 Unicorn-8484.exe 2720 Unicorn-8484.exe 2640 Unicorn-20934.exe 2640 Unicorn-20934.exe 1032 WerFault.exe 1032 WerFault.exe 1032 WerFault.exe 1032 WerFault.exe 764 WerFault.exe 764 WerFault.exe 764 WerFault.exe 764 WerFault.exe 1032 WerFault.exe 764 WerFault.exe 964 Unicorn-55132.exe 2588 Unicorn-21675.exe 964 Unicorn-55132.exe 2588 Unicorn-21675.exe 2824 Unicorn-43626.exe 2824 Unicorn-43626.exe 2144 Unicorn-63492.exe 2144 Unicorn-63492.exe 2720 Unicorn-8484.exe 2720 Unicorn-8484.exe 1688 Unicorn-18930.exe 1688 Unicorn-18930.exe 2760 Unicorn-55324.exe 2444 Unicorn-41541.exe 2760 Unicorn-55324.exe 2444 Unicorn-41541.exe 2352 WerFault.exe 2352 WerFault.exe 2352 WerFault.exe 2352 WerFault.exe 2352 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1344 WerFault.exe -
Program crash 64 IoCs
pid pid_target Process procid_target 2724 1340 WerFault.exe 27 1264 2836 WerFault.exe 28 1032 2640 WerFault.exe 29 764 2688 WerFault.exe 30 2352 1680 WerFault.exe 49 1800 2588 WerFault.exe 33 1344 2444 WerFault.exe 34 1696 2720 WerFault.exe 32 2552 964 WerFault.exe 36 1828 2824 WerFault.exe 38 2616 2144 WerFault.exe 39 2864 1688 WerFault.exe 40 3040 1760 WerFault.exe 43 2036 1736 WerFault.exe 44 1972 1260 WerFault.exe 45 1668 2104 WerFault.exe 48 900 2336 WerFault.exe 47 2748 1448 WerFault.exe 46 2016 2240 WerFault.exe 50 2816 2760 WerFault.exe 37 2300 2948 WerFault.exe 65 812 1812 WerFault.exe 56 2332 884 WerFault.exe 58 528 1836 WerFault.exe 55 2364 2156 WerFault.exe 57 1660 2236 WerFault.exe 63 1288 2064 WerFault.exe 64 652 2132 WerFault.exe 59 1304 1780 WerFault.exe 60 1820 1724 WerFault.exe 62 916 1300 WerFault.exe 61 1060 2096 WerFault.exe 71 2840 2556 WerFault.exe 70 2916 2468 WerFault.exe 72 2848 2464 WerFault.exe 73 2388 2924 WerFault.exe 74 2436 2476 WerFault.exe 75 2672 2296 WerFault.exe 116 1508 2268 WerFault.exe 77 3032 2712 WerFault.exe 106 2496 1992 WerFault.exe 81 3096 1052 WerFault.exe 79 3104 2832 WerFault.exe 82 3276 2288 WerFault.exe 87 3364 2312 WerFault.exe 85 3428 3016 WerFault.exe 89 3476 1428 WerFault.exe 86 3500 3044 WerFault.exe 88 3940 1832 WerFault.exe 94 3964 772 WerFault.exe 95 3972 2432 WerFault.exe 105 4024 1704 WerFault.exe 104 4032 1200 WerFault.exe 118 4056 2728 WerFault.exe 107 4076 2404 WerFault.exe 108 3076 1824 WerFault.exe 120 3112 2392 WerFault.exe 117 3132 2744 WerFault.exe 115 3540 1240 WerFault.exe 122 3716 1888 WerFault.exe 119 2440 2984 WerFault.exe 103 3436 944 WerFault.exe 111 3820 1600 WerFault.exe 127 3868 2872 WerFault.exe 113 -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1340 50ee29f571a989518c689f409394d480_NeikiAnalytics.exe 2836 Unicorn-31868.exe 2688 Unicorn-50269.exe 2640 Unicorn-20934.exe 2720 Unicorn-8484.exe 2588 Unicorn-21675.exe 2444 Unicorn-41541.exe 964 Unicorn-55132.exe 2144 Unicorn-63492.exe 2760 Unicorn-55324.exe 2824 Unicorn-43626.exe 1688 Unicorn-18930.exe 1760 Unicorn-8845.exe 1736 Unicorn-30889.exe 1260 Unicorn-65062.exe 2336 Unicorn-20500.exe 1448 Unicorn-32198.exe 2104 Unicorn-24030.exe 1680 Unicorn-65254.exe 2240 Unicorn-45389.exe 1836 Unicorn-48420.exe 1812 Unicorn-43546.exe 2156 Unicorn-179.exe 884 Unicorn-65031.exe 2132 Unicorn-12301.exe 1300 Unicorn-37189.exe 1780 Unicorn-16023.exe 2236 Unicorn-32359.exe 2948 Unicorn-8046.exe 1724 Unicorn-65223.exe 2064 Unicorn-53718.exe 2096 Unicorn-46401.exe 2556 Unicorn-729.exe 2468 Unicorn-32717.exe 2464 Unicorn-14372.exe 2924 Unicorn-19395.exe 2476 Unicorn-22925.exe 2268 Unicorn-50724.exe 1052 Unicorn-22816.exe 1992 Unicorn-14647.exe 1252 Unicorn-52151.exe 2832 Unicorn-43791.exe 1484 Unicorn-63656.exe 2312 Unicorn-63848.exe 2288 Unicorn-39344.exe 3016 Unicorn-52535.exe 1428 Unicorn-14839.exe 2716 Unicorn-31176.exe 3044 Unicorn-3334.exe 3068 Unicorn-13853.exe 1832 Unicorn-64974.exe 772 Unicorn-61253.exe 1204 Unicorn-28772.exe 2140 Unicorn-23750.exe 2984 Unicorn-27812.exe 1704 Unicorn-14813.exe 2432 Unicorn-47870.exe 2712 Unicorn-60677.exe 2728 Unicorn-64398.exe 2404 Unicorn-62390.exe 1980 Unicorn-10044.exe 944 Unicorn-2992.exe 2872 Unicorn-60553.exe 2600 Unicorn-52193.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1340 wrote to memory of 2836 1340 50ee29f571a989518c689f409394d480_NeikiAnalytics.exe 28 PID 1340 wrote to memory of 2836 1340 50ee29f571a989518c689f409394d480_NeikiAnalytics.exe 28 PID 1340 wrote to memory of 2836 1340 50ee29f571a989518c689f409394d480_NeikiAnalytics.exe 28 PID 1340 wrote to memory of 2836 1340 50ee29f571a989518c689f409394d480_NeikiAnalytics.exe 28 PID 2836 wrote to memory of 2640 2836 Unicorn-31868.exe 29 PID 2836 wrote to memory of 2640 2836 Unicorn-31868.exe 29 PID 2836 wrote to memory of 2640 2836 Unicorn-31868.exe 29 PID 2836 wrote to memory of 2640 2836 Unicorn-31868.exe 29 PID 1340 wrote to memory of 2688 1340 50ee29f571a989518c689f409394d480_NeikiAnalytics.exe 30 PID 1340 wrote to memory of 2688 1340 50ee29f571a989518c689f409394d480_NeikiAnalytics.exe 30 PID 1340 wrote to memory of 2688 1340 50ee29f571a989518c689f409394d480_NeikiAnalytics.exe 30 PID 1340 wrote to memory of 2688 1340 50ee29f571a989518c689f409394d480_NeikiAnalytics.exe 30 PID 1340 wrote to memory of 2724 1340 50ee29f571a989518c689f409394d480_NeikiAnalytics.exe 31 PID 1340 wrote to memory of 2724 1340 50ee29f571a989518c689f409394d480_NeikiAnalytics.exe 31 PID 1340 wrote to memory of 2724 1340 50ee29f571a989518c689f409394d480_NeikiAnalytics.exe 31 PID 1340 wrote to memory of 2724 1340 50ee29f571a989518c689f409394d480_NeikiAnalytics.exe 31 PID 2640 wrote to memory of 2720 2640 Unicorn-20934.exe 32 PID 2640 wrote to memory of 2720 2640 Unicorn-20934.exe 32 PID 2640 wrote to memory of 2720 2640 Unicorn-20934.exe 32 PID 2640 wrote to memory of 2720 2640 Unicorn-20934.exe 32 PID 2836 wrote to memory of 2588 2836 Unicorn-31868.exe 33 PID 2836 wrote to memory of 2588 2836 Unicorn-31868.exe 33 PID 2836 wrote to memory of 2588 2836 Unicorn-31868.exe 33 PID 2836 wrote to memory of 2588 2836 Unicorn-31868.exe 33 PID 2688 wrote to memory of 2444 2688 Unicorn-50269.exe 34 PID 2688 wrote to memory of 2444 2688 Unicorn-50269.exe 34 PID 2688 wrote to memory of 2444 2688 Unicorn-50269.exe 34 PID 2688 wrote to memory of 2444 2688 Unicorn-50269.exe 34 PID 2836 wrote to memory of 1264 2836 Unicorn-31868.exe 35 PID 2836 wrote to memory of 1264 2836 Unicorn-31868.exe 35 PID 2836 wrote to memory of 1264 2836 Unicorn-31868.exe 35 PID 2836 wrote to memory of 1264 2836 Unicorn-31868.exe 35 PID 2588 wrote to memory of 964 2588 Unicorn-21675.exe 36 PID 2588 wrote to memory of 964 2588 Unicorn-21675.exe 36 PID 2588 wrote to memory of 964 2588 Unicorn-21675.exe 36 PID 2588 wrote to memory of 964 2588 Unicorn-21675.exe 36 PID 2444 wrote to memory of 2760 2444 Unicorn-41541.exe 37 PID 2444 wrote to memory of 2760 2444 Unicorn-41541.exe 37 PID 2444 wrote to memory of 2760 2444 Unicorn-41541.exe 37 PID 2444 wrote to memory of 2760 2444 Unicorn-41541.exe 37 PID 2688 wrote to memory of 2824 2688 Unicorn-50269.exe 38 PID 2688 wrote to memory of 2824 2688 Unicorn-50269.exe 38 PID 2688 wrote to memory of 2824 2688 Unicorn-50269.exe 38 PID 2688 wrote to memory of 2824 2688 Unicorn-50269.exe 38 PID 2720 wrote to memory of 2144 2720 Unicorn-8484.exe 39 PID 2720 wrote to memory of 2144 2720 Unicorn-8484.exe 39 PID 2720 wrote to memory of 2144 2720 Unicorn-8484.exe 39 PID 2720 wrote to memory of 2144 2720 Unicorn-8484.exe 39 PID 2640 wrote to memory of 1688 2640 Unicorn-20934.exe 40 PID 2640 wrote to memory of 1688 2640 Unicorn-20934.exe 40 PID 2640 wrote to memory of 1688 2640 Unicorn-20934.exe 40 PID 2640 wrote to memory of 1688 2640 Unicorn-20934.exe 40 PID 2640 wrote to memory of 1032 2640 Unicorn-20934.exe 41 PID 2640 wrote to memory of 1032 2640 Unicorn-20934.exe 41 PID 2640 wrote to memory of 1032 2640 Unicorn-20934.exe 41 PID 2640 wrote to memory of 1032 2640 Unicorn-20934.exe 41 PID 2688 wrote to memory of 764 2688 Unicorn-50269.exe 42 PID 2688 wrote to memory of 764 2688 Unicorn-50269.exe 42 PID 2688 wrote to memory of 764 2688 Unicorn-50269.exe 42 PID 2688 wrote to memory of 764 2688 Unicorn-50269.exe 42 PID 964 wrote to memory of 1760 964 Unicorn-55132.exe 43 PID 964 wrote to memory of 1760 964 Unicorn-55132.exe 43 PID 964 wrote to memory of 1760 964 Unicorn-55132.exe 43 PID 964 wrote to memory of 1760 964 Unicorn-55132.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\50ee29f571a989518c689f409394d480_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\50ee29f571a989518c689f409394d480_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31868.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20934.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-8484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8484.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63492.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-32198.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32198.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-32359.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32359.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-39344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39344.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-5488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5488.exe9⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe10⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33818.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33818.exe11⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36883.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36883.exe12⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30589.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30589.exe13⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15808.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15808.exe14⤵PID:7740
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe15⤵PID:9132
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49551.exe16⤵PID:6388
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7740 -s 21615⤵PID:8920
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5364 -s 21614⤵PID:7332
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 21613⤵PID:6372
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 23612⤵PID:5852
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 23611⤵PID:4896
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 21610⤵
- Program crash
PID:3112
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 2369⤵
- Program crash
PID:3276
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe8⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe9⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10465.exe10⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14687.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14687.exe11⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40983.exe12⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe13⤵PID:6928
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63130.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63130.exe14⤵PID:8580
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60098.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60098.exe15⤵PID:5528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8580 -s 21615⤵PID:6420
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6928 -s 21614⤵PID:8752
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 23613⤵PID:7400
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 21612⤵PID:7060
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 23611⤵PID:5648
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 23610⤵PID:4624
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 2369⤵
- Program crash
PID:4032
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 2408⤵
- Program crash
PID:1660
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46905.exe8⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9946.exe9⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41903.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41903.exe10⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7479.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7479.exe11⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe12⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10441.exe13⤵PID:7368
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18541.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18541.exe14⤵PID:8744
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18516.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18516.exe15⤵PID:8780
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8744 -s 21615⤵PID:6356
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7368 -s 21614⤵PID:8948
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 21613⤵PID:7688
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 23612⤵PID:7112
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 23611⤵PID:5696
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 23610⤵PID:4768
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe9⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55035.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55035.exe10⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16946.exe11⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31677.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31677.exe12⤵PID:7648
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe13⤵PID:8260
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58972.exe14⤵PID:5216
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8260 -s 21614⤵PID:6484
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7648 -s 23613⤵PID:8272
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 23612⤵PID:8148
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 21611⤵PID:7160
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 21610⤵PID:5780
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 2209⤵PID:4808
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 2368⤵
- Program crash
PID:3428
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 2407⤵
- Program crash
PID:2748
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31176.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63049.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63049.exe8⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29853.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29853.exe9⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15063.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15063.exe10⤵PID:3704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 24411⤵PID:5176
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 21610⤵PID:4356
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 2169⤵
- Program crash
PID:3716
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10179.exe8⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15613.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15613.exe9⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60645.exe10⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe11⤵PID:7016
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5164.exe12⤵PID:7924
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe13⤵PID:8548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7924 -s 21613⤵PID:2056
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7016 -s 23612⤵PID:8864
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 23611⤵PID:7548
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 21610⤵PID:6088
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 2169⤵PID:5028
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 2408⤵PID:3948
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe7⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30128.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30128.exe8⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe9⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe10⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39172.exe11⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2299.exe12⤵PID:7024
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13737.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13737.exe13⤵PID:8564
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe14⤵PID:5720
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8564 -s 21614⤵PID:6340
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 21613⤵PID:8652
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6120 -s 23612⤵PID:968
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 23611⤵PID:6732
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 23610⤵PID:5504
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 2369⤵PID:4320
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 2368⤵
- Program crash
PID:3076
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 2407⤵
- Program crash
PID:1288
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 2406⤵
- Program crash
PID:2616
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20500.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20500.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-65223.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65223.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-14647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14647.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-62390.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62390.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20040.exe9⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42837.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42837.exe10⤵PID:3596
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 24411⤵PID:4404
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 23610⤵PID:4300
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 2369⤵
- Program crash
PID:4076
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 2368⤵
- Program crash
PID:2496
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10044.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10044.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe8⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6550.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6550.exe9⤵PID:4408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 22410⤵PID:5772
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 2169⤵PID:4220
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 2368⤵PID:3148
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 2407⤵
- Program crash
PID:1820
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43791.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43791.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-2992.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2992.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:944 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe8⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58291.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58291.exe9⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18378.exe10⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe11⤵PID:6908
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23229.exe12⤵PID:7996
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48712.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48712.exe13⤵PID:8900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7996 -s 21613⤵PID:2508
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6908 -s 23612⤵PID:8856
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 23611⤵PID:7464
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 21610⤵PID:2756
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 2169⤵PID:4700
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 2168⤵
- Program crash
PID:3436
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 2167⤵
- Program crash
PID:3104
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 2406⤵
- Program crash
PID:900
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 2405⤵
- Program crash
PID:1696
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18930.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-16023.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16023.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-14839.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14839.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-12888.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12888.exe8⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19931.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19931.exe9⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39332.exe10⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26079.exe11⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24092.exe12⤵PID:6708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6708 -s 22013⤵PID:7336
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 23612⤵PID:7212
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 23611⤵PID:5804
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 23610⤵PID:5116
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 2169⤵PID:3728
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 2368⤵
- Program crash
PID:3476
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24626.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24626.exe7⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30512.exe8⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7318.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7318.exe9⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe10⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41476.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41476.exe11⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25076.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25076.exe12⤵PID:7032
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62938.exe13⤵PID:8536
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe14⤵PID:8764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8536 -s 21614⤵PID:6496
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7032 -s 21613⤵PID:8644
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5300 -s 23612⤵PID:7244
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 23611⤵PID:6828
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 21610⤵PID:5532
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60167.exe9⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64143.exe10⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33903.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33903.exe11⤵PID:7200
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe12⤵PID:8704
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe13⤵PID:5336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8704 -s 21613⤵PID:6248
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7200 -s 21612⤵PID:3816
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 21611⤵PID:7644
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 21610⤵PID:6864
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 2209⤵PID:5608
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 2368⤵PID:3664
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 2407⤵
- Program crash
PID:1304
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3334.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe7⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35219.exe8⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42863.exe9⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe10⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24647.exe11⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe12⤵PID:7324
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16320.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16320.exe13⤵PID:8772
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35786.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35786.exe14⤵PID:6064
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7324 -s 21613⤵PID:8980
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 21612⤵PID:7712
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 23611⤵PID:7044
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 21610⤵PID:6100
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 2369⤵PID:4684
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47502.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47502.exe8⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38009.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38009.exe9⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21430.exe10⤵PID:6364
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56425.exe11⤵PID:8052
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27176.exe12⤵PID:8876
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50389.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50389.exe13⤵PID:5136
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8052 -s 23612⤵PID:4264
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6364 -s 21611⤵PID:8016
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 23610⤵PID:6792
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 2169⤵PID:5196
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 2408⤵PID:4704
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 2367⤵
- Program crash
PID:3500
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 2406⤵
- Program crash
PID:1668
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37189.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63848.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63848.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-30569.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30569.exe7⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2162.exe8⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe9⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22472.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22472.exe10⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41751.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41751.exe11⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17567.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17567.exe12⤵PID:7236
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4878.exe12⤵PID:7700
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16180.exe13⤵PID:9168
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36118.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36118.exe14⤵PID:5332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9168 -s 23614⤵PID:5580
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7700 -s 21613⤵PID:8884
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5936 -s 24012⤵PID:7288
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 23611⤵PID:6940
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 23610⤵PID:5584
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 2369⤵PID:4612
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13677.exe8⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe9⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe10⤵PID:6432
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64209.exe11⤵PID:7980
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe12⤵PID:8700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7980 -s 23612⤵PID:8408
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6432 -s 21611⤵PID:928
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 21610⤵PID:6836
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 2169⤵PID:5260
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 2408⤵PID:4748
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 2367⤵
- Program crash
PID:3364
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exe6⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45203.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45203.exe7⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35053.exe8⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37023.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37023.exe9⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exe10⤵PID:6196
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23286.exe11⤵PID:7904
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exe12⤵PID:8364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7904 -s 21612⤵PID:4296
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6196 -s 23611⤵PID:7976
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 21610⤵PID:6696
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 2169⤵PID:6004
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 2368⤵PID:5020
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 2367⤵
- Program crash
PID:3540
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 2206⤵
- Program crash
PID:916
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 2405⤵
- Program crash
PID:2864
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 2404⤵
- Loads dropped DLL
- Program crash
PID:1032
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-55132.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55132.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-8845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8845.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-48420.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48420.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23750.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23750.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-62141.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62141.exe9⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe10⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35041.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35041.exe11⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45641.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45641.exe12⤵PID:6972
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19135.exe13⤵PID:8296
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18433.exe14⤵PID:5488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8296 -s 23614⤵PID:6308
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6972 -s 23613⤵PID:8316
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5880 -s 21612⤵PID:8092
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 21611⤵PID:6572
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 21610⤵PID:4604
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 2369⤵PID:3904
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 2368⤵
- Program crash
PID:2840
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61253.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61253.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:772 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-61648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61648.exe8⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe9⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45985.exe10⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17107.exe11⤵PID:6240
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17043.exe12⤵PID:7832
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe13⤵PID:9088
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-350.exe14⤵PID:6320
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7832 -s 21613⤵PID:8848
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6240 -s 21612⤵PID:7460
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 21611⤵PID:6748
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 21610⤵PID:5140
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 2369⤵PID:4716
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 2168⤵
- Program crash
PID:3964
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 2407⤵
- Program crash
PID:528
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46401.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46401.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-13853.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13853.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-22484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22484.exe8⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61181.exe9⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24807.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24807.exe10⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42441.exe11⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37665.exe12⤵PID:7144
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4417.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4417.exe13⤵PID:8396
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3030.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3030.exe14⤵PID:5752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8396 -s 21614⤵PID:7092
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7144 -s 23613⤵PID:8452
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 21612⤵PID:8108
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 21611⤵PID:6604
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 21610⤵PID:5152
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 2369⤵
- Program crash
PID:3820
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe8⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57863.exe9⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59161.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59161.exe10⤵PID:6012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6012 -s 22411⤵PID:7072
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 21610⤵PID:6636
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 2369⤵PID:5160
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 2408⤵PID:3880
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe7⤵PID:1308
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 2407⤵
- Program crash
PID:1060
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 2406⤵
- Program crash
PID:3040
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43546.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43546.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-32717.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32717.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-64974.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64974.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43693.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43693.exe8⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26610.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26610.exe9⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14002.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14002.exe10⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47501.exe11⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe12⤵PID:7404
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26792.exe13⤵PID:8820
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26767.exe14⤵PID:5436
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8820 -s 23614⤵PID:6204
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7404 -s 21613⤵PID:4280
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 23612⤵PID:7756
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 23611⤵PID:6384
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 23610⤵PID:5796
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 2369⤵PID:4872
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 2168⤵
- Program crash
PID:3940
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 2367⤵
- Program crash
PID:2916
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-60029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60029.exe7⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe8⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe9⤵PID:6056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 22410⤵PID:6924
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 2169⤵PID:6672
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 2168⤵PID:5208
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 2167⤵PID:4048
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 2406⤵
- Program crash
PID:812
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 2405⤵
- Program crash
PID:2552
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30889.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30889.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-179.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-14372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14372.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-7989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7989.exe7⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-35992.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35992.exe8⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46540.exe9⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe10⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46632.exe11⤵PID:6452
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36846.exe12⤵PID:7668
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54099.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54099.exe13⤵PID:4108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7668 -s 23613⤵PID:4468
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6452 -s 21612⤵PID:9044
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 21611⤵PID:7776
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 23610⤵PID:6184
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 2169⤵PID:4372
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 2368⤵PID:3180
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 2367⤵
- Program crash
PID:2848
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27812.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27812.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe7⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14762.exe8⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11470.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11470.exe9⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32644.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32644.exe10⤵PID:6764
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe11⤵PID:7364
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe12⤵PID:4992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7364 -s 23612⤵PID:5408
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6764 -s 23611⤵PID:8488
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 21610⤵PID:7280
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 2169⤵PID:6000
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 2168⤵PID:4632
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 2367⤵
- Program crash
PID:2440
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 2406⤵
- Program crash
PID:2364
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19395.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe7⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1721.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1721.exe8⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe9⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64335.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64335.exe10⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58599.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58599.exe11⤵PID:6928
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12963.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12963.exe11⤵PID:7608
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36086.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36086.exe12⤵PID:8988
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27919.exe13⤵PID:4136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8988 -s 21613⤵PID:6932
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7608 -s 23612⤵PID:9196
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 22011⤵PID:8100
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 21610⤵PID:6888
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 2369⤵PID:5540
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 2368⤵PID:4548
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 2167⤵
- Program crash
PID:4024
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 2366⤵
- Program crash
PID:2388
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 2405⤵
- Program crash
PID:2036
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 2404⤵
- Loads dropped DLL
- Program crash
PID:1800
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 2403⤵
- Loads dropped DLL
- Program crash
PID:1264
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-41541.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41541.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-55324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55324.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1680 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 2006⤵
- Loads dropped DLL
- Program crash
PID:2352
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 2365⤵
- Program crash
PID:2816
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-52193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52193.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-28016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28016.exe8⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23546.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23546.exe9⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe10⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe11⤵PID:7040
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12393.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12393.exe12⤵PID:8376
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10648.exe13⤵PID:5548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8376 -s 23613⤵PID:6508
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7040 -s 21612⤵PID:3512
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 21611⤵PID:8084
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 21610⤵PID:6556
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 2369⤵PID:5340
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 2168⤵PID:4040
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 2167⤵
- Program crash
PID:3096
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 2366⤵
- Program crash
PID:2300
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52151.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52151.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-38353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38353.exe6⤵PID:2296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 2407⤵
- Program crash
PID:2672
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48524.exe6⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe7⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18129.exe8⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe9⤵PID:6824
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60634.exe10⤵PID:8444
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8444 -s 22411⤵PID:5604
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6824 -s 23610⤵PID:8520
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 2369⤵PID:8176
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 2168⤵PID:6620
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 2167⤵PID:5236
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 2406⤵PID:3888
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 2405⤵
- Program crash
PID:2016
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 2404⤵
- Loads dropped DLL
- Program crash
PID:1344
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43626.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43626.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-65062.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65062.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:884 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-22925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22925.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-47870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47870.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-61648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61648.exe8⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49879.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49879.exe9⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12352.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12352.exe10⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe11⤵PID:6460
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56425.exe12⤵PID:8044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8044 -s 22013⤵PID:8896
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6460 -s 21612⤵PID:8128
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 21611⤵PID:6896
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 21610⤵PID:5452
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 2369⤵PID:4736
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 2368⤵
- Program crash
PID:3972
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 2367⤵
- Program crash
PID:2436
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60677.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60677.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2712 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 2407⤵
- Program crash
PID:3032
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 2406⤵
- Program crash
PID:2332
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50724.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-64398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64398.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-19189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19189.exe7⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe8⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10510.exe9⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe10⤵PID:6800
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53514.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53514.exe11⤵PID:7524
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15463.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15463.exe12⤵PID:8788
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7524 -s 21612⤵PID:8716
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6800 -s 21611⤵PID:8636
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 21610⤵PID:7348
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 2369⤵PID:5232
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 2368⤵PID:4248
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 2167⤵
- Program crash
PID:4056
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 2366⤵
- Program crash
PID:1508
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 2405⤵
- Program crash
PID:1972
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-29469.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29469.exe7⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56262.exe8⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50666.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50666.exe9⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36295.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36295.exe10⤵PID:6964
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57359.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57359.exe11⤵PID:7240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7240 -s 22412⤵PID:8312
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 21611⤵PID:8476
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 23610⤵PID:7512
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 2169⤵PID:5964
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 2168⤵PID:4904
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 2367⤵
- Program crash
PID:3868
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42275.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42275.exe6⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47199.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47199.exe7⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2285.exe8⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62169.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62169.exe9⤵PID:6904
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20370.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20370.exe10⤵PID:8344
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43295.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43295.exe11⤵PID:5480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8344 -s 21611⤵PID:7152
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6904 -s 21610⤵PID:8428
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5760 -s 2169⤵PID:8068
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 2168⤵PID:6528
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 2367⤵PID:4536
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 2406⤵PID:2812
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50968.exe5⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30320.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30320.exe6⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9121.exe7⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4843.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4843.exe8⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62846.exe9⤵PID:6404
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46996.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46996.exe10⤵PID:8008
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe11⤵PID:8984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8008 -s 21611⤵PID:5252
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6404 -s 21610⤵PID:7932
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 2169⤵PID:6860
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 2168⤵PID:1872
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 2367⤵PID:4912
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 2366⤵
- Program crash
PID:3132
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 2405⤵
- Program crash
PID:652
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 2404⤵
- Program crash
PID:1828
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 2403⤵
- Loads dropped DLL
- Program crash
PID:764
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 2402⤵
- Program crash
PID:2724
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD587940429cac1372bf5b42dc965c5c5e0
SHA184c7c2a6fe98d9fd1ef548b9cbf9378432216cfa
SHA2566d8f1455e16ea3d01ed7e95a8b92ee513a412386fd41ae36b70f260c57087f34
SHA5124a51c13e39ca89653753d7ae842965db8c7706acf432427d9b9b97431e46589e4bdd0501aa759c1ebef2799943c70e0b53b2b4d108bda80768e8f68ee8b459cc
-
Filesize
184KB
MD5a5edf1df1c42008288027f978d272668
SHA10ec21661bf8a0c6ef3e2e3bba079b152a7a59d77
SHA256347a71284632336588d3244f8ab98d8e1a188cd8904a081839eb8b11a7993557
SHA512640edb9fb4934691eb2e3d5a97a4f797db59fd720c1b4f8fdc4a20409f8c06758332be1c9d468f9eea446357bab8ca516125470259de875641232c4597df60e9
-
Filesize
184KB
MD56ee5562a3fd108e6e8ad2406e2fc6234
SHA147bf3b99cc7cbbd46862fc20753a44b1d902606b
SHA256e0ab91bf0cd2cab1d11205dba1ce45527a06ba1fab28f0170ebf675cb5b89819
SHA512db88760d8b3dbc778a39bcd17ac9678721c54fc6b9a77965e5d354e5025081597de898e37267239ad35f001e09f0b366b99e35c980a8b672ab9db37cdc59e664
-
Filesize
184KB
MD59197ee85564b10354b1de380e24863e1
SHA1bb5ce92736626dc82bf3aeffec82a57d2c0592eb
SHA256377e678c09ef5c42bf0f159302e33667220daf1f3aca759b72f3026a180341c0
SHA5124725b6e1bc7ee2984c14e81662ba08488d11997d3dfc7202f5d102b7ec5cbae2aa3124315137da0924d9a66051d73d2ae8d067442faf4de65c67e46b5d493d70
-
Filesize
184KB
MD563eaa484665fd0df65cf6d3d4e8baeb6
SHA16c96d8b4a0bd7508079df8b5c7e99757f2d199f6
SHA256d27375f7e1da260ed016cd40d1f155cd503bf81ce5d124851de0e18d49eef41c
SHA51248d41587054d3413214e3f626dab9999c06a2827592b450e26df21295ddd0d52e6b4476f05d0f2dfd2a5690366272d4e733898491feb05d0761c084ed0cfdce6
-
Filesize
184KB
MD516010db641bb3a2ab9d2797a3bfb76b0
SHA14146ebf62c2412ce7b6b46809058b27c1da1a859
SHA25644903cb46674e458503ecf778e32b9de00aed7876919d1005307d1860bd18ef8
SHA512946cd56f9088afea7098f2e0edfdf8d054e1c7fe38de94a2d97648ab2136d5793f2a54f7de4d26001638248b84c552ef359778d57de9effab222f214ac713dcf
-
Filesize
184KB
MD567b4d007421d349e9c1395aaf1435a11
SHA152d9265205b74ab4beaca2d608b05b074b5c3f9f
SHA256827e499a26e3d4115aae320208f582b79989ab50d8dece27b9a57d6796e58f30
SHA5121cb8d9ad39cea465db22dbdd82d1ed17367769ea154d0ca8f99a42b8cb4ed62e5238ab547f8dbab47c418add29e210c348a3ae530c269848caaa70d46cf3303d
-
Filesize
184KB
MD5c331669ba5327ff09400b942fab39306
SHA149912264f67469da1013c7c3ffd64a03595bed66
SHA2561214dbed769d3284a08865be7e9b19720867c6838c5f0376efb987cf80e807c9
SHA5129f2ccfc03d711dee6f6f9530fd33cc5188e100244aa1673fc0a8aacce1fa013f2f9ef767a0523106d23b3a15a405140dbfbf37038c4710bc1cfbf04113c2dedd
-
Filesize
184KB
MD519964b121d59dcec7790d01aeffa3ae8
SHA16b35eb4724b52947bc13a8824989128bc7854aa0
SHA256d91f0786cc705e4da9a8b74afda5c9e7e0f9ccbbb9850339e7090daaed85c4c5
SHA512a702bb15774e6c2e757d5a2de01ae602511118abe94f9fd8d60304710cfe563a97d2cf2fff33e8e7750026241ae33f6ae0f1958347347fb3ae8544aeb829803b
-
Filesize
184KB
MD5caa841c129f27aaf0774221677e273fb
SHA10f4da9492af356d2230d5140e3fb308f94d4cc52
SHA256762b856bbb01a6923f0008e079e5c4fd8421d774140e503d4c8c41e96362ba02
SHA51294a5a3a6707f9a891f979ddb6a5466f4a82dcb7eae09664441bd11ecb87470ae8075a0f6c5586f9c3262ed2036b1c278873f5fd4be55f3f1e0ffd81ee4e19c14
-
Filesize
184KB
MD5ad83a442f163c5b25302c4aaee30ec3c
SHA12c3fcb7c6251974fdf9c67eea6db177c0b79f197
SHA2566e52705d1588943990430b69826135ce6e1f9adfea5338b83499359b462f350d
SHA512397a476904842b2492cfb24dfbea78a612715129fe8b98e285b6cdd00e4b03aaab9a64c37eea18f98ba0ba21227e2c78283f9720197566b195b7ef73353cf139
-
Filesize
184KB
MD5fb566a19a8f538dc30e5baeaf86e6f22
SHA10d334fdc868266bc599a3bbab163997e2cc331a7
SHA256f7bfe10e778b6db38e4401ae401a11d2a12d5186ddfdbbb40728f730e3a09ac5
SHA512747b4738249dc52eb3fee977c7b0ef1d5c41ecb52e18043dcd16b05cd789273a12f49bb726670ba42c3ae2d60861abfb8c7b806dc7560a3961cf31d7c9f5c0dc
-
Filesize
184KB
MD581e761b57879ff0b1a1633b4505aa522
SHA1e4fc39c4e64dd569f840724f617abb1e2b77d258
SHA256ac8caa587de0629d1bf0b25f5f5e0d45fcc7772326c1552e21524ed5e1013940
SHA5125cdd71742d702437219d328e07e62e006d60493170ca5c4c0206641b94778b0d5747ef0219f13b6547db8de5a1c7d19743b67d0453b9b646679a1704e1d4727b
-
Filesize
184KB
MD5ac55fac1bbafa99188abbd13974ee27d
SHA15bd08f57c1b99e6cd49cddf0442ab826cfb0c4b0
SHA256c665f947d48e0dfa7a0fa5d74e3e849d39f584b3c1e1abf2636d6cde12e048b8
SHA51217c9f328a44eeb3c0e03432f4ae7ca522ff4e514156bb44d23851e4d017fe3b1df0720b9291013f004103f6a5cb897eb91812ce32a834dfaf556eec285dcf8ff
-
Filesize
184KB
MD56a362b50d70ea995cd9f965526b9b8bc
SHA1fb205fc1ce623dbad5cd79b6d3fb84a90fd6fd58
SHA2561c47ad933c6b7da60f0b4bd879571e6380a073674a73d163cb2ba2b297e51bc9
SHA512201a16646a96834fdab09687e8eddd9d15a1d5b505929d050ac91a544bf761ab4d3d3ca546aba85b6c88d30ee175e2a408f63247d2d4ee2d4de1cfff8dbbe6d9
-
Filesize
184KB
MD524d72a422686320b9d5483153ea37e1a
SHA18af7b96e42db98cc2a1905edf492f8cb900c0d42
SHA256bfcc3e27c309ed3a785b2e3a88c5b0a9a8505e8bf65598171be932c9be294c4c
SHA512bc854475c22420a1fce4619a6b295867fa8253a8c6e8d90ff8dcf0421f33d9a5c739097d4095c871daa30a989445f4169d8ba388b626dd52db386be661bb754a