Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 22:15
Static task
static1
Behavioral task
behavioral1
Sample
5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe
Resource
win10v2004-20240426-en
General
-
Target
5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe
-
Size
184KB
-
MD5
6f89856f0c9ffd407fde858724d206da
-
SHA1
d5db5ea77db312b7699b9d3c57ccf23b67ed6a58
-
SHA256
5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712
-
SHA512
ee169acd10a2530bfe1d206c7e2d313b3b5bcd02cf659c322682870cfe1fb85fc6c2b2b2b013588ee81686ac7e7a8572934a39e0d4cd58ef40c307dfe65ec21b
-
SSDEEP
3072:hKA3hxoTDJNidHjWed7LRxpGhlnViFME:hK4orOHj/LnpGhlnViFM
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2900 Unicorn-4530.exe 2464 Unicorn-64961.exe 3060 Unicorn-41011.exe 2884 Unicorn-28096.exe 2476 Unicorn-62.exe 1696 Unicorn-42486.exe 556 Unicorn-14556.exe 588 Unicorn-10472.exe 1364 Unicorn-18126.exe 2664 Unicorn-21656.exe 2636 Unicorn-45838.exe 2100 Unicorn-46243.exe 1676 Unicorn-18209.exe 1524 Unicorn-40021.exe 2236 Unicorn-16071.exe 848 Unicorn-62579.exe 2984 Unicorn-7903.exe 2912 Unicorn-20177.exe 3000 Unicorn-42735.exe 1660 Unicorn-17738.exe 1288 Unicorn-63409.exe 1084 Unicorn-5293.exe 1092 Unicorn-49040.exe 1156 Unicorn-63238.exe 820 Unicorn-61847.exe 2032 Unicorn-7815.exe 2208 Unicorn-45319.exe 2724 Unicorn-30374.exe 1504 Unicorn-57016.exe 2096 Unicorn-63793.exe 1604 Unicorn-14037.exe 2892 Unicorn-55433.exe 2512 Unicorn-40919.exe 2376 Unicorn-6108.exe 2836 Unicorn-24583.exe 2952 Unicorn-47696.exe 940 Unicorn-39527.exe 2432 Unicorn-34697.exe 2632 Unicorn-10747.exe 2680 Unicorn-63285.exe 1800 Unicorn-441.exe 2316 Unicorn-20307.exe 2144 Unicorn-63861.exe 2332 Unicorn-31743.exe 608 Unicorn-14468.exe 844 Unicorn-37027.exe 2552 Unicorn-43804.exe 2928 Unicorn-59585.exe 2988 Unicorn-31551.exe 2008 Unicorn-51417.exe 1568 Unicorn-8246.exe 544 Unicorn-64629.exe 2024 Unicorn-44764.exe 3016 Unicorn-56269.exe 3012 Unicorn-65013.exe 2492 Unicorn-41063.exe 1872 Unicorn-17951.exe 2568 Unicorn-40317.exe 1976 Unicorn-43009.exe 2440 Unicorn-15621.exe 2148 Unicorn-57208.exe 752 Unicorn-5314.exe 1656 Unicorn-5568.exe 1576 Unicorn-43908.exe -
Loads dropped DLL 64 IoCs
pid Process 2660 5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe 2660 5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe 2900 Unicorn-4530.exe 2660 5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe 2660 5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe 2900 Unicorn-4530.exe 2464 Unicorn-64961.exe 2464 Unicorn-64961.exe 2900 Unicorn-4530.exe 2900 Unicorn-4530.exe 3060 Unicorn-41011.exe 3060 Unicorn-41011.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 2476 Unicorn-62.exe 2476 Unicorn-62.exe 2884 Unicorn-28096.exe 2884 Unicorn-28096.exe 2464 Unicorn-64961.exe 2464 Unicorn-64961.exe 1696 Unicorn-42486.exe 3060 Unicorn-41011.exe 1696 Unicorn-42486.exe 3060 Unicorn-41011.exe 1652 WerFault.exe 1652 WerFault.exe 1652 WerFault.exe 1652 WerFault.exe 1652 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 588 Unicorn-10472.exe 588 Unicorn-10472.exe 2884 Unicorn-28096.exe 2884 Unicorn-28096.exe 556 Unicorn-14556.exe 556 Unicorn-14556.exe 2476 Unicorn-62.exe 2476 Unicorn-62.exe 2664 Unicorn-21656.exe 2664 Unicorn-21656.exe 1696 Unicorn-42486.exe 1696 Unicorn-42486.exe 2636 Unicorn-45838.exe 1364 Unicorn-18126.exe 1364 Unicorn-18126.exe 2636 Unicorn-45838.exe 3052 WerFault.exe 3068 WerFault.exe 3068 WerFault.exe 3052 WerFault.exe 3068 WerFault.exe 3052 WerFault.exe 3068 WerFault.exe 3052 WerFault.exe 3052 WerFault.exe 3068 WerFault.exe 1988 WerFault.exe -
Program crash 64 IoCs
pid pid_target Process procid_target 2532 2660 WerFault.exe 27 1168 2900 WerFault.exe 28 1652 2464 WerFault.exe 29 1848 3060 WerFault.exe 30 3052 2476 WerFault.exe 33 3068 2884 WerFault.exe 32 1988 1696 WerFault.exe 34 2340 588 WerFault.exe 37 2716 556 WerFault.exe 36 2536 2664 WerFault.exe 39 2412 2636 WerFault.exe 40 2392 1364 WerFault.exe 38 1072 2100 WerFault.exe 43 1080 1676 WerFault.exe 44 2336 2236 WerFault.exe 46 876 1524 WerFault.exe 45 1732 848 WerFault.exe 47 1164 2984 WerFault.exe 48 932 3000 WerFault.exe 50 1592 2912 WerFault.exe 49 2608 1288 WerFault.exe 55 1064 1084 WerFault.exe 56 2560 2492 WerFault.exe 105 2628 1092 WerFault.exe 57 924 1504 WerFault.exe 63 2972 1660 WerFault.exe 54 660 2208 WerFault.exe 61 892 820 WerFault.exe 59 1724 2512 WerFault.exe 73 1016 2952 WerFault.exe 76 1468 2376 WerFault.exe 75 3020 940 WerFault.exe 78 3148 2632 WerFault.exe 80 3328 1568 WerFault.exe 92 3340 2008 WerFault.exe 91 3348 2724 WerFault.exe 62 3360 1604 WerFault.exe 65 3540 844 WerFault.exe 87 3564 3012 WerFault.exe 104 3572 3016 WerFault.exe 102 3612 608 WerFault.exe 86 3672 544 WerFault.exe 95 3708 1800 WerFault.exe 82 3772 2552 WerFault.exe 88 3816 2032 WerFault.exe 60 3852 2892 WerFault.exe 66 3860 1156 WerFault.exe 58 3912 2332 WerFault.exe 85 3948 2144 WerFault.exe 84 3956 2096 WerFault.exe 64 3972 2928 WerFault.exe 89 4072 1976 WerFault.exe 108 2396 2440 WerFault.exe 109 3384 2024 WerFault.exe 97 3292 784 WerFault.exe 115 4000 2836 WerFault.exe 77 3308 1228 WerFault.exe 131 3404 2680 WerFault.exe 81 3736 2988 WerFault.exe 90 4056 1688 WerFault.exe 114 4088 1576 WerFault.exe 113 3280 752 WerFault.exe 111 3460 1872 WerFault.exe 106 3532 2432 WerFault.exe 79 -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2660 5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe 2900 Unicorn-4530.exe 2464 Unicorn-64961.exe 3060 Unicorn-41011.exe 2884 Unicorn-28096.exe 2476 Unicorn-62.exe 1696 Unicorn-42486.exe 556 Unicorn-14556.exe 588 Unicorn-10472.exe 1364 Unicorn-18126.exe 2664 Unicorn-21656.exe 2636 Unicorn-45838.exe 2100 Unicorn-46243.exe 1676 Unicorn-18209.exe 2236 Unicorn-16071.exe 1524 Unicorn-40021.exe 848 Unicorn-62579.exe 2984 Unicorn-7903.exe 2912 Unicorn-20177.exe 3000 Unicorn-42735.exe 1660 Unicorn-17738.exe 1288 Unicorn-63409.exe 1084 Unicorn-5293.exe 1092 Unicorn-49040.exe 1156 Unicorn-63238.exe 820 Unicorn-61847.exe 2032 Unicorn-7815.exe 2208 Unicorn-45319.exe 1504 Unicorn-57016.exe 2724 Unicorn-30374.exe 1604 Unicorn-14037.exe 2892 Unicorn-55433.exe 2096 Unicorn-63793.exe 2512 Unicorn-40919.exe 2376 Unicorn-6108.exe 2836 Unicorn-24583.exe 2952 Unicorn-47696.exe 940 Unicorn-39527.exe 2632 Unicorn-10747.exe 2432 Unicorn-34697.exe 2680 Unicorn-63285.exe 2316 Unicorn-20307.exe 1800 Unicorn-441.exe 2144 Unicorn-63861.exe 2332 Unicorn-31743.exe 608 Unicorn-14468.exe 844 Unicorn-37027.exe 2928 Unicorn-59585.exe 2552 Unicorn-43804.exe 2008 Unicorn-51417.exe 2988 Unicorn-31551.exe 1568 Unicorn-8246.exe 544 Unicorn-64629.exe 2024 Unicorn-44764.exe 3016 Unicorn-56269.exe 3012 Unicorn-65013.exe 2492 Unicorn-41063.exe 1872 Unicorn-17951.exe 2568 Unicorn-40317.exe 1976 Unicorn-43009.exe 2148 Unicorn-57208.exe 2440 Unicorn-15621.exe 752 Unicorn-5314.exe 1656 Unicorn-5568.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2660 wrote to memory of 2900 2660 5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe 28 PID 2660 wrote to memory of 2900 2660 5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe 28 PID 2660 wrote to memory of 2900 2660 5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe 28 PID 2660 wrote to memory of 2900 2660 5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe 28 PID 2660 wrote to memory of 3060 2660 5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe 30 PID 2660 wrote to memory of 3060 2660 5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe 30 PID 2660 wrote to memory of 3060 2660 5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe 30 PID 2660 wrote to memory of 3060 2660 5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe 30 PID 2900 wrote to memory of 2464 2900 Unicorn-4530.exe 29 PID 2900 wrote to memory of 2464 2900 Unicorn-4530.exe 29 PID 2900 wrote to memory of 2464 2900 Unicorn-4530.exe 29 PID 2900 wrote to memory of 2464 2900 Unicorn-4530.exe 29 PID 2660 wrote to memory of 2532 2660 5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe 31 PID 2660 wrote to memory of 2532 2660 5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe 31 PID 2660 wrote to memory of 2532 2660 5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe 31 PID 2660 wrote to memory of 2532 2660 5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe 31 PID 2464 wrote to memory of 2884 2464 Unicorn-64961.exe 32 PID 2464 wrote to memory of 2884 2464 Unicorn-64961.exe 32 PID 2464 wrote to memory of 2884 2464 Unicorn-64961.exe 32 PID 2464 wrote to memory of 2884 2464 Unicorn-64961.exe 32 PID 2900 wrote to memory of 2476 2900 Unicorn-4530.exe 33 PID 2900 wrote to memory of 2476 2900 Unicorn-4530.exe 33 PID 2900 wrote to memory of 2476 2900 Unicorn-4530.exe 33 PID 2900 wrote to memory of 2476 2900 Unicorn-4530.exe 33 PID 3060 wrote to memory of 1696 3060 Unicorn-41011.exe 34 PID 3060 wrote to memory of 1696 3060 Unicorn-41011.exe 34 PID 3060 wrote to memory of 1696 3060 Unicorn-41011.exe 34 PID 3060 wrote to memory of 1696 3060 Unicorn-41011.exe 34 PID 2900 wrote to memory of 1168 2900 Unicorn-4530.exe 35 PID 2900 wrote to memory of 1168 2900 Unicorn-4530.exe 35 PID 2900 wrote to memory of 1168 2900 Unicorn-4530.exe 35 PID 2900 wrote to memory of 1168 2900 Unicorn-4530.exe 35 PID 2476 wrote to memory of 556 2476 Unicorn-62.exe 36 PID 2476 wrote to memory of 556 2476 Unicorn-62.exe 36 PID 2476 wrote to memory of 556 2476 Unicorn-62.exe 36 PID 2476 wrote to memory of 556 2476 Unicorn-62.exe 36 PID 2884 wrote to memory of 588 2884 Unicorn-28096.exe 37 PID 2884 wrote to memory of 588 2884 Unicorn-28096.exe 37 PID 2884 wrote to memory of 588 2884 Unicorn-28096.exe 37 PID 2884 wrote to memory of 588 2884 Unicorn-28096.exe 37 PID 2464 wrote to memory of 1364 2464 Unicorn-64961.exe 38 PID 2464 wrote to memory of 1364 2464 Unicorn-64961.exe 38 PID 2464 wrote to memory of 1364 2464 Unicorn-64961.exe 38 PID 2464 wrote to memory of 1364 2464 Unicorn-64961.exe 38 PID 1696 wrote to memory of 2664 1696 Unicorn-42486.exe 39 PID 1696 wrote to memory of 2664 1696 Unicorn-42486.exe 39 PID 1696 wrote to memory of 2664 1696 Unicorn-42486.exe 39 PID 1696 wrote to memory of 2664 1696 Unicorn-42486.exe 39 PID 3060 wrote to memory of 2636 3060 Unicorn-41011.exe 40 PID 3060 wrote to memory of 2636 3060 Unicorn-41011.exe 40 PID 3060 wrote to memory of 2636 3060 Unicorn-41011.exe 40 PID 3060 wrote to memory of 2636 3060 Unicorn-41011.exe 40 PID 2464 wrote to memory of 1652 2464 Unicorn-64961.exe 41 PID 2464 wrote to memory of 1652 2464 Unicorn-64961.exe 41 PID 2464 wrote to memory of 1652 2464 Unicorn-64961.exe 41 PID 2464 wrote to memory of 1652 2464 Unicorn-64961.exe 41 PID 3060 wrote to memory of 1848 3060 Unicorn-41011.exe 42 PID 3060 wrote to memory of 1848 3060 Unicorn-41011.exe 42 PID 3060 wrote to memory of 1848 3060 Unicorn-41011.exe 42 PID 3060 wrote to memory of 1848 3060 Unicorn-41011.exe 42 PID 588 wrote to memory of 2100 588 Unicorn-10472.exe 43 PID 588 wrote to memory of 2100 588 Unicorn-10472.exe 43 PID 588 wrote to memory of 2100 588 Unicorn-10472.exe 43 PID 588 wrote to memory of 2100 588 Unicorn-10472.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe"C:\Users\Admin\AppData\Local\Temp\5e1d5f7b6613d77286ae143128ed29e37c0d61f2472c9a1fab61b5d8cf6f8712.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-4530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4530.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-64961.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64961.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-10472.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10472.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46243.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46243.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-17738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17738.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-6108.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6108.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-38537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38537.exe10⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26446.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26446.exe11⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8973.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8973.exe12⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62907.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62907.exe13⤵PID:8100
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29667.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29667.exe14⤵PID:5136
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 21613⤵PID:8800
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 21612⤵PID:6564
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 21611⤵PID:5884
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 23610⤵
- Program crash
PID:3460
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 2369⤵
- Program crash
PID:1468
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43009.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43009.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-41059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41059.exe9⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe10⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exe11⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2782.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2782.exe12⤵PID:7156
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe13⤵PID:8884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 21613⤵PID:8508
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 21612⤵PID:8008
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 21611⤵PID:2244
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 23610⤵PID:4688
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 2169⤵
- Program crash
PID:4072
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 2408⤵
- Program crash
PID:2972
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56269.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56269.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-52844.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52844.exe9⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49850.exe10⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe11⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1184.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1184.exe12⤵PID:7056
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36488.exe13⤵PID:9080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7056 -s 21613⤵PID:8672
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5428 -s 21612⤵PID:8052
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 21611⤵PID:5792
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 23610⤵PID:4616
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 2369⤵
- Program crash
PID:3572
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2252.exe8⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8386.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8386.exe9⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23732.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23732.exe10⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38775.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38775.exe11⤵PID:6584
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47723.exe12⤵PID:1252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6584 -s 21612⤵PID:9012
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 21611⤵PID:6976
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 21610⤵PID:5872
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 2169⤵PID:4188
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 2408⤵
- Program crash
PID:1016
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 2407⤵
- Program crash
PID:1072
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63409.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-40919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40919.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:544 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56352.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56352.exe9⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe10⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50566.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50566.exe11⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe12⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51039.exe13⤵PID:7256
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 21613⤵PID:8832
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 23612⤵PID:6728
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 21611⤵PID:5700
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 23610⤵PID:3176
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39667.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39667.exe9⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48288.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48288.exe10⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22527.exe11⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43862.exe12⤵PID:7316
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-559.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-559.exe13⤵PID:8264
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7316 -s 21613⤵PID:8344
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6080 -s 23612⤵PID:7460
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 21611⤵PID:6480
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 23610⤵PID:4776
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 2409⤵
- Program crash
PID:3672
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28318.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28318.exe8⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36975.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36975.exe9⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10955.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10955.exe10⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe11⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13436.exe12⤵PID:6688
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe13⤵PID:8464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 21613⤵PID:8948
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 21612⤵PID:8044
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 21611⤵PID:5300
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 21610⤵PID:4608
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1972.exe9⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4785.exe10⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21496.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21496.exe11⤵PID:7200
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe12⤵PID:8952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7200 -s 21612⤵PID:4216
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 21611⤵PID:7336
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 21610⤵PID:5196
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 2409⤵PID:4664
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 2408⤵
- Program crash
PID:1724
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-50322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50322.exe8⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49248.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49248.exe9⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39980.exe10⤵PID:5508
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe11⤵PID:6972
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe12⤵PID:8768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6972 -s 23612⤵PID:9148
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5508 -s 21611⤵PID:7936
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 21610⤵PID:6056
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 2169⤵PID:4100
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 2368⤵
- Program crash
PID:3384
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 2407⤵
- Program crash
PID:2608
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 2406⤵
- Program crash
PID:2340
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18209.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-24583.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24583.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-9673.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9673.exe9⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49850.exe10⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37074.exe11⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2398.exe12⤵PID:6944
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38543.exe13⤵PID:8740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6944 -s 21613⤵PID:9140
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 21612⤵PID:7904
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 21611⤵PID:6048
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 21610⤵PID:4624
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 2369⤵
- Program crash
PID:3564
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26564.exe8⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe9⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35979.exe10⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2398.exe11⤵PID:6960
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exe12⤵PID:8456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6960 -s 21612⤵PID:8808
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5184 -s 21611⤵PID:7912
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 21610⤵PID:6536
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 2169⤵PID:4888
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 2408⤵
- Program crash
PID:4000
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41063.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41063.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2492 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 2408⤵
- Program crash
PID:2560
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 2407⤵
- Program crash
PID:1064
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:940 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-39305.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39305.exe8⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe9⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31978.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31978.exe10⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exe11⤵PID:8180
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17550.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17550.exe12⤵PID:5524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8180 -s 21612⤵PID:6088
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 21611⤵PID:8268
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 23610⤵PID:6752
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 2169⤵PID:4544
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 2368⤵PID:4116
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 2367⤵
- Program crash
PID:3020
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 2406⤵
- Program crash
PID:1080
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 2205⤵
- Loads dropped DLL
- Program crash
PID:3068
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18126.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18126.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-42735.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42735.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-57016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57016.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-37027.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37027.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:844 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-19020.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19020.exe8⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe9⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32004.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32004.exe10⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37941.exe11⤵PID:7016
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24428.exe12⤵PID:9028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7016 -s 21612⤵PID:8604
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5348 -s 21611⤵PID:8092
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 21610⤵PID:5520
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 2369⤵PID:4512
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 2168⤵
- Program crash
PID:3540
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44847.exe7⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18501.exe8⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11614.exe9⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe10⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22928.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22928.exe11⤵PID:6964
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe12⤵PID:8472
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 21612⤵PID:8776
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 21611⤵PID:7640
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 21610⤵PID:6464
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 2169⤵PID:4480
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 2368⤵
- Program crash
PID:3308
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 2407⤵
- Program crash
PID:924
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 2366⤵
- Program crash
PID:932
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63793.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63793.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-8246.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8246.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe7⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9310.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9310.exe8⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9855.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9855.exe9⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1848.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1848.exe10⤵PID:6668
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2305.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2305.exe11⤵PID:8232
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 21611⤵PID:8300
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 23610⤵PID:7232
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 2169⤵PID:5420
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 2368⤵PID:4336
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 2367⤵
- Program crash
PID:3328
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe6⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe7⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27920.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27920.exe8⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27012.exe9⤵PID:6936
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15902.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15902.exe10⤵PID:8500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6936 -s 21610⤵PID:8724
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5400 -s 2169⤵PID:7624
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 2168⤵PID:5608
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 2167⤵PID:4228
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 2406⤵
- Program crash
PID:3956
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 2405⤵
- Program crash
PID:2392
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 2404⤵
- Loads dropped DLL
- Program crash
PID:1652
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-14556.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14556.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:556 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-40021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40021.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63238.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63238.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20307.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-11043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11043.exe8⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52927.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52927.exe9⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13041.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13041.exe10⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe11⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe12⤵PID:7860
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53299.exe13⤵PID:4840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7860 -s 23613⤵PID:3028
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 23612⤵PID:7636
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 21611⤵PID:7132
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 23610⤵PID:4984
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 2169⤵PID:3792
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47260.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47260.exe8⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12657.exe9⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27920.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27920.exe10⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9523.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9523.exe11⤵PID:6772
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31278.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31278.exe12⤵PID:8328
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6772 -s 21612⤵PID:8540
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5408 -s 21611⤵PID:7480
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 21610⤵PID:5672
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 2369⤵PID:4956
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 2408⤵PID:3320
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48547.exe7⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17946.exe8⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe9⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31480.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31480.exe10⤵PID:7144
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2388.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2388.exe11⤵PID:8592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7144 -s 21611⤵PID:8896
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5676 -s 21610⤵PID:7720
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 2169⤵PID:6184
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 2168⤵PID:5056
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 2407⤵
- Program crash
PID:3860
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-441.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-15621.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15621.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-22502.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22502.exe8⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36996.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36996.exe9⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37157.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37157.exe10⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59814.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59814.exe11⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24680.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24680.exe12⤵PID:9128
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 21612⤵PID:4632
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 21611⤵PID:1480
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 21610⤵PID:6312
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 2169⤵PID:4112
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 2368⤵
- Program crash
PID:2396
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25194.exe7⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17562.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17562.exe8⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63991.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63991.exe9⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe10⤵PID:6992
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39337.exe11⤵PID:8532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6992 -s 21611⤵PID:8880
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 21610⤵PID:7660
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 2169⤵PID:6240
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 2168⤵PID:4784
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2407⤵
- Program crash
PID:3708
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 2406⤵
- Program crash
PID:876
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:820 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43908.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43908.exe7⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-25709.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25709.exe8⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe9⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51376.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51376.exe10⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34874.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34874.exe11⤵PID:8140
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42246.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42246.exe12⤵PID:5340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8140 -s 21612⤵PID:5708
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 23611⤵PID:8220
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 23610⤵PID:7004
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 2169⤵PID:4236
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 2368⤵
- Program crash
PID:4088
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe7⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5968.exe8⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31511.exe9⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54744.exe10⤵PID:7540
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe11⤵PID:9096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7540 -s 23611⤵PID:5260
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6004 -s 21610⤵PID:7732
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 2369⤵PID:6436
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 2368⤵PID:4376
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 2407⤵
- Program crash
PID:3404
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11598.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11598.exe6⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exe7⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe8⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44064.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44064.exe9⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16706.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16706.exe10⤵PID:6904
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exe11⤵PID:8448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6904 -s 21611⤵PID:4128
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 21610⤵PID:7600
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 2169⤵PID:5948
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 2368⤵PID:5004
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 2167⤵
- Program crash
PID:3292
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 2406⤵
- Program crash
PID:892
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 2405⤵
- Program crash
PID:2716
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16071.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16071.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49040.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-34697.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34697.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-5314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5314.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:752 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exe8⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36176.exe9⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41262.exe10⤵PID:6068
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exe11⤵PID:7564
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1161.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1161.exe12⤵PID:6476
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6068 -s 23611⤵PID:8556
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 23610⤵PID:6408
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 2169⤵PID:5864
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 2368⤵
- Program crash
PID:3280
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45314.exe7⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5641.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5641.exe8⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-312.exe9⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe10⤵PID:7448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 21610⤵PID:8840
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 2369⤵PID:6876
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 2168⤵PID:5652
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 2207⤵
- Program crash
PID:3532
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5568.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-1588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1588.exe7⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60488.exe8⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38584.exe9⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43151.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43151.exe10⤵PID:7788
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41732.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41732.exe11⤵PID:9192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7788 -s 21611⤵PID:5332
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 21610⤵PID:2424
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 2369⤵PID:6828
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 2368⤵PID:5160
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 2367⤵PID:3992
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 2406⤵
- Program crash
PID:2628
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43908.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43908.exe6⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39113.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39113.exe7⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42917.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42917.exe8⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62896.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62896.exe9⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe10⤵PID:7960
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2344.exe11⤵PID:5464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7960 -s 21611⤵PID:5952
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 23610⤵PID:7784
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 2169⤵PID:6720
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 2368⤵PID:4768
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 2367⤵
- Program crash
PID:4056
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 2166⤵
- Program crash
PID:3148
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 2405⤵
- Program crash
PID:2336
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 2404⤵
- Loads dropped DLL
- Program crash
PID:3052
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 2403⤵
- Loads dropped DLL
- Program crash
PID:1168
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41011.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-42486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42486.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-21656.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21656.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-62579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62579.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:848 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63861.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63861.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe8⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60924.exe9⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56316.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56316.exe10⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37832.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37832.exe11⤵PID:6600
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64150.exe12⤵PID:8248
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6600 -s 21612⤵PID:9120
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5612 -s 21611⤵PID:7288
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 21610⤵PID:6152
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 2169⤵PID:5112
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 2368⤵
- Program crash
PID:3948
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19766.exe7⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe8⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21013.exe9⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36270.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36270.exe10⤵PID:7532
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20269.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20269.exe11⤵PID:8208
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7532 -s 23611⤵PID:5296
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5764 -s 21610⤵PID:7588
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 2169⤵PID:6212
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 2368⤵PID:4892
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 2407⤵
- Program crash
PID:3816
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31743.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31743.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-2875.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2875.exe7⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38942.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38942.exe8⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe9⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24127.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24127.exe10⤵PID:6308
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14373.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14373.exe11⤵PID:9180
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6308 -s 21611⤵PID:4748
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 21610⤵PID:7184
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 2169⤵PID:5384
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 2168⤵PID:4152
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 2367⤵
- Program crash
PID:3912
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 2406⤵
- Program crash
PID:1732
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45319.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-57208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57208.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe7⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13093.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13093.exe8⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27920.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27920.exe9⤵PID:5376
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54168.exe10⤵PID:7244
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64150.exe11⤵PID:8244
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7244 -s 21611⤵PID:9172
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 21610⤵PID:7376
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 2169⤵PID:5568
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 2368⤵PID:4572
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3342.exe7⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12268.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12268.exe8⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe9⤵PID:7452
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55489.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55489.exe10⤵PID:8628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7452 -s 21610⤵PID:5908
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5592 -s 2169⤵PID:7584
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 2168⤵PID:5776
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 2407⤵PID:4580
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 2366⤵
- Program crash
PID:660
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 2405⤵
- Program crash
PID:2536
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7903.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7903.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-30374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30374.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-59585.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59585.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-61998.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61998.exe7⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe8⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12953.exe9⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57245.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57245.exe10⤵PID:6636
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe11⤵PID:8664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6636 -s 23611⤵PID:9024
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5172 -s 21610⤵PID:7776
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 2169⤵PID:5180
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 2168⤵PID:5104
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 2367⤵
- Program crash
PID:3972
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe6⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10187.exe7⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe8⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27531.exe9⤵PID:6412
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe10⤵PID:7252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6412 -s 23610⤵PID:8976
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 2369⤵PID:6980
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 2168⤵PID:5560
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 2367⤵PID:4368
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 2406⤵
- Program crash
PID:3348
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31551.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe6⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33187.exe7⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe8⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe9⤵PID:7196
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9381.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9381.exe10⤵PID:5320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7196 -s 21610⤵PID:6248
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5628 -s 2169⤵PID:8284
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 2168⤵PID:6820
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 2367⤵PID:4920
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 2366⤵
- Program crash
PID:3736
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 2405⤵
- Program crash
PID:1164
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 2404⤵
- Loads dropped DLL
- Program crash
PID:1988
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45838.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20177.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20177.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-14037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14037.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-14468.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14468.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:608 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-41578.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41578.exe7⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17754.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17754.exe8⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56316.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56316.exe9⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exe10⤵PID:6664
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27936.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27936.exe11⤵PID:8912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6664 -s 21611⤵PID:4144
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 21610⤵PID:8036
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 2169⤵PID:5836
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 2168⤵PID:4672
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 2367⤵
- Program crash
PID:3612
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40762.exe6⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52927.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52927.exe7⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exe8⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44443.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44443.exe9⤵PID:6548
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36924.exe10⤵PID:7400
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6548 -s 23610⤵PID:9156
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 2369⤵PID:7000
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 2168⤵PID:5440
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 2167⤵PID:4860
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 2206⤵
- Program crash
PID:3360
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43804.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe6⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65454.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65454.exe7⤵PID:3184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 2208⤵PID:5920
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 2167⤵PID:4456
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 2366⤵
- Program crash
PID:3772
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 2405⤵
- Program crash
PID:1592
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55433.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-54022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54022.exe6⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53166.exe7⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe8⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53078.exe9⤵PID:6864
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14941.exe10⤵PID:8360
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6864 -s 23610⤵PID:8552
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 2169⤵PID:7592
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 2168⤵PID:5540
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 2167⤵PID:4344
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 2366⤵
- Program crash
PID:3340
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56715.exe5⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48672.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48672.exe6⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21013.exe7⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe8⤵PID:7272
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29148.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29148.exe9⤵PID:8356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7272 -s 2369⤵PID:2140
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5756 -s 2168⤵PID:7368
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 2167⤵PID:6224
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 2166⤵PID:5044
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 2405⤵
- Program crash
PID:3852
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 2404⤵
- Program crash
PID:2412
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 2403⤵
- Loads dropped DLL
- Program crash
PID:1848
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 2402⤵
- Program crash
PID:2532
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD51125b415a4ea14d3505cb7c9eebe4e31
SHA1ac72b27094a54b44d7320130cb9080c300872862
SHA25699c9f73fef807f53be2426a75d988eb9e659604047a512aceeef4a209abe6d33
SHA512507e89230d3b37f8dc0ece7a40e2c6b09af7f963cc4bbc47eede4da8b2158e220f7c7cd2ae952f9b915e60aa84a4b0d0603c005e193119eea6e6ad98203e729d
-
Filesize
184KB
MD50833217f4eb3821511617b87ccab9e41
SHA1f3572a5f93b69c59467f18f037d206ce44a0ba24
SHA2562327302a0814fa6799f7909ae22e3c1e667e802b065746016fdf47109f947849
SHA512fce658a9b34eef1b8ac2d794ed40f13142d3ae6589c4dd10c801986e722c46e660a9a45489bd437315575249a0f61d84e2605887ee6f7e9d27233f363b11857f
-
Filesize
184KB
MD5743453eeeab90297655d56937c86dcf2
SHA1193b7f9db9b2427602c5c75a56eb168ec93053d6
SHA2561f7f7a1c32722ec452a87153942c7235498774d58ef08cb9915c696983811ccd
SHA5120b6002ce21060c42eb94e013c1d6b592bc19b9ecb381e663bb0bfee763e2cd137d1e4ca640206adc3136eb8289d8a7a79ef395ade8c1c24afb6a543479ba8c54
-
Filesize
184KB
MD51fb96986d31854fa88c92e36dbd85e54
SHA14195ab0293db699b59e1c0a8564ba19d19538709
SHA256f1b25640e630db4a901dc21c7a2e2b46e04f82d3af613ed3b82e62e57504df88
SHA51267826b32123c9ed0fe5e3b0c0e569f23f150234e476e115badd2d4a6a01fdee951b72bbd33d6ff0bc48f0e001e5bc59e0f324a26fbc3b75dfd6fb89bc3d4f791
-
Filesize
184KB
MD5d0d14f3da8ce64d08fa5a1459ddee1e9
SHA1a2b645a79ee2cd7d800012ce0315dc4403f24bb2
SHA256391a34041f45536452deb1d53b202e0aebea48bd9098049289731efeae7eebeb
SHA512100f790e234f81ea84e12360fdef8ae3005371ce1fd7c3684282abfa4bdfe2850d6e8e3cf1de721a1d447f94b3efca060a45ff4b7ddc8d89b78eb377b889bd9e
-
Filesize
184KB
MD55f9c993e9f9ecc81eedf43ec8b879a12
SHA19aeae6cdb4ceb6eab243ef2c95b5ba4d6575e225
SHA256197c634406302f05e46fb767931664fafdae6892d8efc517f6314d88af35f607
SHA512112e7226447abfca931e6e09f840c94ff53378d021b1d0b7573eebefb776c0dceba925a614c172017f7d12037add32c8c7d605a238d4d6e6e9635165fc54946b
-
Filesize
184KB
MD5b1b272dc830bb3bbd4026a9d2be3c0b0
SHA1ede06998d51bf0a966125384663c811306aa0b70
SHA25667170d7650cdda81335aa2dd6dd7a5c06b8e7bc441489c35d632b531ee8be30b
SHA51281709ca6e7639ab2a6c898708b2320698c4bef0343e9d0889244a691aeffd665e8d83bc270bf9b79e1985fe70021a02c0e7b5483a25ef701ea01d1ac9c9c6128
-
Filesize
184KB
MD596adfca41cf3560f52031584b7f89903
SHA19b6f50d4e4dc945844d2d9e404f8ffb28a351783
SHA2567d3a098084456707d44dd2833f6167ab667336ead06f8b3a209208c6d9b83817
SHA51264e73808e4b3af74c95fb5db1fe2d8795159aec01a1a834c8fff5cc4f1d31afa8866539f2b2b4bb679e06cc10bc050808a73923c6838a2402b39a285dbf76df3
-
Filesize
184KB
MD579781492ae32ebadf9626852be0330db
SHA1836190e61797aa44484b7c1c003634bab0e5f39f
SHA2563be6b4e73c143e43817e441db46d885d1153f9b104932e9ba9cd824148ef3b26
SHA51216621fb1dd661f3d70af1f300b6b16170f78d134e52abc8d5d399a36deefdc39d57cf6e94332f7fdf2663b86a516db946c028d3a90c883ef9c9e506ad4449573
-
Filesize
184KB
MD50164fd76d4b8525a486ba5b0f78be932
SHA16c67d22b4804c81795f29cb5a105b561c5ff67b7
SHA2561d1dbdffe9bf0b8844990c2ce36591024ffb3241590b23e78275f929a7f5d9b3
SHA512ff9d5918dc3238f5b2ed81ccf1c870215e06c091e6c6f1c8a635d335da6bd4ae3b008f14d8630ca002b8b1666f2995a15e0132d70602cfec59b3b3fc6b9acc88
-
Filesize
184KB
MD5466f2d0d20de1c18ae4ab564f90c957b
SHA1883adcfa38400d3220732458206ddb6aabfe7ae8
SHA256d735a9301dd6c11a242c24dc8944f2da348cb91996ea6d0e72035d43d0ec4b63
SHA51281374628789db712438b44aed0c28d0fcf37339cd063b6df20f36cd71f7bfbbde7c9318bba1934a202f17a4e7dde5a187c199f1dfbb3cb20426fe784eda5a024
-
Filesize
184KB
MD5f40bd895827f566826f1ce86d733af61
SHA10a553267520c3facd96596fec593b88800947fa8
SHA256704a9b41998e0a5c7efb5c1ac8e5c57d1c8680a4576fae26e9ccb54bfa02350a
SHA512e652330be6946d48b370304b678516c6a2bd5d5e672a48b49f95badc7afc05ef3aab157247b1ed6b058ee28df077f73bf9e6f04980b47cde1aefcb6f1c4b2f26
-
Filesize
184KB
MD59e54dd907cdd51009d2dafc0983993ae
SHA1809b4707e61708cc0e7b9a35bced3ff8cf70b70a
SHA25616d94b5d6072f162497b3a86c80f9a144a794a675acc04173640f32d0bcee19e
SHA512be4823e8db934ba0c3ff4925aafd723335992f0eca33dec4a472bee26445ab0e748fe67f159b4499258060d1c2444bc002d826149c6e6179d960e8f911a62d8a
-
Filesize
184KB
MD551603eaedf1c3e828ac8a4f89e6cc154
SHA1d665837a38740c6c24acd920955b8cb8b2ccbb67
SHA256e86aa7b75a2f49458634845e108a91f1d4ae9542a2f5efe75c87708d20797752
SHA51255523720921f878375dd5ae07852cf4118c49461dc5bbef7fb07629c62a89438b4920bcdf9a89c6661b595ae73482d310472c483094074e64d9a58a51ce5d9a8
-
Filesize
184KB
MD55b9c4756c3578d302c1fb69c5c630620
SHA1072518616ede6b843c301b7df17dc186e79982a4
SHA2560e826d6bb98385c4af91e28fa0921c2412f0856b8a1eecf489bd26aae39766d5
SHA5124f1a18ee86f0ccc846bc374f08d7806f53fc4e6a9394f375e9b5ca8916dc0fa6b28a63114d7d1026feee962ee33b33c860261d83880c463982c60c8fabfa4584
-
Filesize
184KB
MD547dd85be9973d18e8b533a7d5e5e79ec
SHA1e113dd8ece414b2de18b5a7fc04e2fe62d46853f
SHA256c9e12b890157a677795dd8ba41828fcbfba25fc2ae89cb1f77feb440c9892ab6
SHA5122a28f875e4c1d605cdfbd66d74fd1d3baf816323026221a02d541ada3ec7b4168ac9312293e3cbf263443289975501006a2c97ca0cc57fbe2d6894e75741cd96
-
Filesize
184KB
MD5210fe789d89eb312e01a420c5bab253c
SHA165c395254d39ee75a2df4daf357db5b18c3d476e
SHA2561c02b5876dd65f74ef7653f4c1128ad0d6ebc23aea9ee96d1ee2c71b439750d5
SHA5126a9edbfd251baa067546500e860a2f49249ebb79f0ddf128dc889bad444f763470bee5ebc7918d58e14ca944b1e9c102f82eb7c194dc4514274962885d379ac2