Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 22:57
Static task
static1
Behavioral task
behavioral1
Sample
6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe
Resource
win10v2004-20240226-en
General
-
Target
6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe
-
Size
184KB
-
MD5
b5c116950102623636d3e0f2b7bfa152
-
SHA1
08d5c5b473ccfcbb9876329898747364517d31ec
-
SHA256
6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83
-
SHA512
17d259d2872b84dfaa3bb5ec874f34d20de88f0313888341cb4cba68c37837b269f262f4972ab7d7d358520c740508a3a7968d5518d177056d447ed932b5357b
-
SSDEEP
1536:QBSj66ZluRzxo+x1tJCAl+wSF29yvZc8Smd9jwL+2Vz/tGhl59j5nizpQD:kJ7Rzxo67JCXjF4WeMwL+KVGhlLViFK
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2836 Unicorn-15924.exe 2628 Unicorn-14120.exe 2692 Unicorn-63876.exe 2664 Unicorn-22948.exe 1808 Unicorn-11250.exe 2696 Unicorn-4473.exe 636 Unicorn-15740.exe 2760 Unicorn-16294.exe 2772 Unicorn-62802.exe 2136 Unicorn-55189.exe 3028 Unicorn-5433.exe 2708 Unicorn-62885.exe 1952 Unicorn-47296.exe 1784 Unicorn-44603.exe 468 Unicorn-63461.exe 2880 Unicorn-45179.exe 3020 Unicorn-14452.exe 1680 Unicorn-64208.exe 652 Unicorn-33481.exe 2776 Unicorn-26752.exe 2088 Unicorn-49865.exe 1816 Unicorn-16638.exe 1844 Unicorn-43835.exe 884 Unicorn-40950.exe 2960 Unicorn-28698.exe 1780 Unicorn-12916.exe 588 Unicorn-6715.exe 616 Unicorn-29828.exe 2888 Unicorn-31220.exe 2220 Unicorn-15438.exe 2688 Unicorn-48516.exe 2528 Unicorn-6092.exe 2704 Unicorn-19544.exe 2444 Unicorn-53285.exe 2488 Unicorn-37695.exe 2472 Unicorn-52408.exe 1704 Unicorn-25766.exe 1604 Unicorn-9984.exe 2788 Unicorn-45693.exe 956 Unicorn-23327.exe 2672 Unicorn-15713.exe 1996 Unicorn-55807.exe 2180 Unicorn-9299.exe 1740 Unicorn-14774.exe 1732 Unicorn-18859.exe 2392 Unicorn-7353.exe 2636 Unicorn-62029.exe 2140 Unicorn-32647.exe 1764 Unicorn-51676.exe 2900 Unicorn-59097.exe 1628 Unicorn-61619.exe 2304 Unicorn-23279.exe 1572 Unicorn-6388.exe 2644 Unicorn-13295.exe 2604 Unicorn-36408.exe 2592 Unicorn-47037.exe 2944 Unicorn-4805.exe 2428 Unicorn-63565.exe 308 Unicorn-54328.exe 1608 Unicorn-54328.exe 1616 Unicorn-59543.exe 2824 Unicorn-52766.exe 1652 Unicorn-41068.exe 2828 Unicorn-30208.exe -
Loads dropped DLL 64 IoCs
pid Process 1340 6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe 1340 6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe 2836 Unicorn-15924.exe 1340 6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe 1340 6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe 2836 Unicorn-15924.exe 2628 Unicorn-14120.exe 2628 Unicorn-14120.exe 2836 Unicorn-15924.exe 2692 Unicorn-63876.exe 2836 Unicorn-15924.exe 2692 Unicorn-63876.exe 240 WerFault.exe 240 WerFault.exe 240 WerFault.exe 240 WerFault.exe 240 WerFault.exe 1808 Unicorn-11250.exe 1808 Unicorn-11250.exe 2628 Unicorn-14120.exe 2664 Unicorn-22948.exe 2628 Unicorn-14120.exe 2664 Unicorn-22948.exe 2696 Unicorn-4473.exe 2692 Unicorn-63876.exe 2696 Unicorn-4473.exe 2692 Unicorn-63876.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 1376 WerFault.exe 636 Unicorn-15740.exe 1808 Unicorn-11250.exe 636 Unicorn-15740.exe 1808 Unicorn-11250.exe 2760 Unicorn-16294.exe 2760 Unicorn-16294.exe 2136 Unicorn-55189.exe 2136 Unicorn-55189.exe 3028 Unicorn-5433.exe 3028 Unicorn-5433.exe 2772 Unicorn-62802.exe 2772 Unicorn-62802.exe 2696 Unicorn-4473.exe 2696 Unicorn-4473.exe 2664 Unicorn-22948.exe 2664 Unicorn-22948.exe 3068 WerFault.exe 3068 WerFault.exe 3068 WerFault.exe 3068 WerFault.exe 3068 WerFault.exe 1444 WerFault.exe 1444 WerFault.exe 1444 WerFault.exe 1444 WerFault.exe 1444 WerFault.exe 1976 WerFault.exe -
Program crash 64 IoCs
pid pid_target Process procid_target 2540 1340 WerFault.exe 27 240 2836 WerFault.exe 28 1376 2628 WerFault.exe 29 2272 2692 WerFault.exe 30 3068 1808 WerFault.exe 33 1444 2664 WerFault.exe 32 1976 2696 WerFault.exe 34 2984 636 WerFault.exe 36 2264 2760 WerFault.exe 37 2216 2136 WerFault.exe 40 1684 2772 WerFault.exe 38 2532 3028 WerFault.exe 39 380 2708 WerFault.exe 43 2040 1784 WerFault.exe 45 1356 1952 WerFault.exe 44 856 2880 WerFault.exe 47 1644 468 WerFault.exe 46 1756 652 WerFault.exe 50 976 1680 WerFault.exe 49 960 3020 WerFault.exe 48 2524 2776 WerFault.exe 54 1268 2088 WerFault.exe 55 2868 616 WerFault.exe 62 108 2888 WerFault.exe 63 1840 1816 WerFault.exe 56 2916 588 WerFault.exe 61 1568 2688 WerFault.exe 69 2596 2528 WerFault.exe 71 2920 884 WerFault.exe 58 2492 1704 WerFault.exe 76 1412 1604 WerFault.exe 77 2624 2180 WerFault.exe 84 1428 2444 WerFault.exe 73 2332 1732 WerFault.exe 86 1972 1996 WerFault.exe 83 1308 956 WerFault.exe 80 2404 2672 WerFault.exe 81 2376 1740 WerFault.exe 85 3348 2140 WerFault.exe 97 3568 2304 WerFault.exe 101 3668 2220 WerFault.exe 64 3684 2636 WerFault.exe 88 3708 1780 WerFault.exe 60 3728 2472 WerFault.exe 75 3748 1844 WerFault.exe 57 3796 2960 WerFault.exe 59 3824 2704 WerFault.exe 72 3840 2392 WerFault.exe 87 3848 2436 WerFault.exe 128 3924 1764 WerFault.exe 98 3940 2488 WerFault.exe 74 3244 2788 WerFault.exe 79 3264 2428 WerFault.exe 107 3392 2604 WerFault.exe 104 3424 2592 WerFault.exe 105 3512 2796 WerFault.exe 131 3524 1052 WerFault.exe 130 3560 2900 WerFault.exe 99 3584 2644 WerFault.exe 103 3592 760 WerFault.exe 132 3600 1628 WerFault.exe 100 3644 276 WerFault.exe 114 3640 2132 WerFault.exe 124 3676 1660 WerFault.exe 133 -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1340 6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe 2836 Unicorn-15924.exe 2628 Unicorn-14120.exe 2692 Unicorn-63876.exe 2664 Unicorn-22948.exe 1808 Unicorn-11250.exe 2696 Unicorn-4473.exe 636 Unicorn-15740.exe 2760 Unicorn-16294.exe 2772 Unicorn-62802.exe 2136 Unicorn-55189.exe 3028 Unicorn-5433.exe 2708 Unicorn-62885.exe 1952 Unicorn-47296.exe 1784 Unicorn-44603.exe 468 Unicorn-63461.exe 2880 Unicorn-45179.exe 3020 Unicorn-14452.exe 1680 Unicorn-64208.exe 652 Unicorn-33481.exe 2776 Unicorn-26752.exe 2088 Unicorn-49865.exe 1816 Unicorn-16638.exe 1844 Unicorn-43835.exe 884 Unicorn-40950.exe 2960 Unicorn-28698.exe 1780 Unicorn-12916.exe 588 Unicorn-6715.exe 616 Unicorn-29828.exe 2888 Unicorn-31220.exe 2220 Unicorn-15438.exe 2688 Unicorn-48516.exe 2528 Unicorn-6092.exe 2704 Unicorn-19544.exe 2444 Unicorn-53285.exe 2488 Unicorn-37695.exe 1604 Unicorn-9984.exe 1704 Unicorn-25766.exe 2472 Unicorn-52408.exe 2788 Unicorn-45693.exe 956 Unicorn-23327.exe 2672 Unicorn-15713.exe 1996 Unicorn-55807.exe 2180 Unicorn-9299.exe 1740 Unicorn-14774.exe 1732 Unicorn-18859.exe 2392 Unicorn-7353.exe 2636 Unicorn-62029.exe 2140 Unicorn-32647.exe 1764 Unicorn-51676.exe 2900 Unicorn-59097.exe 1628 Unicorn-61619.exe 2304 Unicorn-23279.exe 1572 Unicorn-6388.exe 2644 Unicorn-13295.exe 2604 Unicorn-36408.exe 2592 Unicorn-47037.exe 2944 Unicorn-4805.exe 1608 Unicorn-54328.exe 2428 Unicorn-63565.exe 308 Unicorn-54328.exe 1616 Unicorn-59543.exe 2824 Unicorn-52766.exe 1652 Unicorn-41068.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1340 wrote to memory of 2836 1340 6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe 28 PID 1340 wrote to memory of 2836 1340 6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe 28 PID 1340 wrote to memory of 2836 1340 6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe 28 PID 1340 wrote to memory of 2836 1340 6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe 28 PID 1340 wrote to memory of 2692 1340 6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe 30 PID 1340 wrote to memory of 2692 1340 6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe 30 PID 1340 wrote to memory of 2692 1340 6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe 30 PID 1340 wrote to memory of 2692 1340 6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe 30 PID 2836 wrote to memory of 2628 2836 Unicorn-15924.exe 29 PID 2836 wrote to memory of 2628 2836 Unicorn-15924.exe 29 PID 2836 wrote to memory of 2628 2836 Unicorn-15924.exe 29 PID 2836 wrote to memory of 2628 2836 Unicorn-15924.exe 29 PID 1340 wrote to memory of 2540 1340 6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe 31 PID 1340 wrote to memory of 2540 1340 6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe 31 PID 1340 wrote to memory of 2540 1340 6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe 31 PID 1340 wrote to memory of 2540 1340 6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe 31 PID 2628 wrote to memory of 2664 2628 Unicorn-14120.exe 32 PID 2628 wrote to memory of 2664 2628 Unicorn-14120.exe 32 PID 2628 wrote to memory of 2664 2628 Unicorn-14120.exe 32 PID 2628 wrote to memory of 2664 2628 Unicorn-14120.exe 32 PID 2836 wrote to memory of 1808 2836 Unicorn-15924.exe 33 PID 2836 wrote to memory of 1808 2836 Unicorn-15924.exe 33 PID 2836 wrote to memory of 1808 2836 Unicorn-15924.exe 33 PID 2836 wrote to memory of 1808 2836 Unicorn-15924.exe 33 PID 2692 wrote to memory of 2696 2692 Unicorn-63876.exe 34 PID 2692 wrote to memory of 2696 2692 Unicorn-63876.exe 34 PID 2692 wrote to memory of 2696 2692 Unicorn-63876.exe 34 PID 2692 wrote to memory of 2696 2692 Unicorn-63876.exe 34 PID 2836 wrote to memory of 240 2836 Unicorn-15924.exe 35 PID 2836 wrote to memory of 240 2836 Unicorn-15924.exe 35 PID 2836 wrote to memory of 240 2836 Unicorn-15924.exe 35 PID 2836 wrote to memory of 240 2836 Unicorn-15924.exe 35 PID 1808 wrote to memory of 636 1808 Unicorn-11250.exe 36 PID 1808 wrote to memory of 636 1808 Unicorn-11250.exe 36 PID 1808 wrote to memory of 636 1808 Unicorn-11250.exe 36 PID 1808 wrote to memory of 636 1808 Unicorn-11250.exe 36 PID 2628 wrote to memory of 2760 2628 Unicorn-14120.exe 37 PID 2628 wrote to memory of 2760 2628 Unicorn-14120.exe 37 PID 2628 wrote to memory of 2760 2628 Unicorn-14120.exe 37 PID 2628 wrote to memory of 2760 2628 Unicorn-14120.exe 37 PID 2664 wrote to memory of 2772 2664 Unicorn-22948.exe 38 PID 2664 wrote to memory of 2772 2664 Unicorn-22948.exe 38 PID 2664 wrote to memory of 2772 2664 Unicorn-22948.exe 38 PID 2664 wrote to memory of 2772 2664 Unicorn-22948.exe 38 PID 2692 wrote to memory of 2136 2692 Unicorn-63876.exe 40 PID 2692 wrote to memory of 2136 2692 Unicorn-63876.exe 40 PID 2692 wrote to memory of 2136 2692 Unicorn-63876.exe 40 PID 2692 wrote to memory of 2136 2692 Unicorn-63876.exe 40 PID 2696 wrote to memory of 3028 2696 Unicorn-4473.exe 39 PID 2696 wrote to memory of 3028 2696 Unicorn-4473.exe 39 PID 2696 wrote to memory of 3028 2696 Unicorn-4473.exe 39 PID 2696 wrote to memory of 3028 2696 Unicorn-4473.exe 39 PID 2628 wrote to memory of 1376 2628 Unicorn-14120.exe 41 PID 2628 wrote to memory of 1376 2628 Unicorn-14120.exe 41 PID 2628 wrote to memory of 1376 2628 Unicorn-14120.exe 41 PID 2628 wrote to memory of 1376 2628 Unicorn-14120.exe 41 PID 2692 wrote to memory of 2272 2692 Unicorn-63876.exe 42 PID 2692 wrote to memory of 2272 2692 Unicorn-63876.exe 42 PID 2692 wrote to memory of 2272 2692 Unicorn-63876.exe 42 PID 2692 wrote to memory of 2272 2692 Unicorn-63876.exe 42 PID 636 wrote to memory of 2708 636 Unicorn-15740.exe 43 PID 636 wrote to memory of 2708 636 Unicorn-15740.exe 43 PID 636 wrote to memory of 2708 636 Unicorn-15740.exe 43 PID 636 wrote to memory of 2708 636 Unicorn-15740.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe"C:\Users\Admin\AppData\Local\Temp\6da43367c4ad0f345daad105c842ad76a9ae8cacb7b8b291f24c281f70ae5c83.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-15924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15924.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-14120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14120.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-22948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22948.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-14452.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14452.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31220.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31220.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-14774.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14774.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe9⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe10⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55003.exe11⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe12⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56176.exe13⤵PID:7836
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44791.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44791.exe14⤵PID:8576
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7836 -s 21614⤵PID:4380
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 21613⤵PID:7440
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 21612⤵PID:6336
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 21611⤵PID:5664
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 23610⤵PID:4308
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 2369⤵
- Program crash
PID:2376
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exe8⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18999.exe9⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9886.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9886.exe10⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe11⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exe12⤵PID:7308
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exe13⤵PID:7824
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7308 -s 23613⤵PID:9116
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6052 -s 23612⤵PID:7792
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 21611⤵PID:7032
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 21610⤵PID:5416
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 2369⤵PID:3152
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 2408⤵
- Program crash
PID:108
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7353.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe8⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10166.exe9⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29212.exe10⤵PID:4756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 18811⤵PID:4832
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 21610⤵PID:5152
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 2169⤵PID:4204
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 2168⤵
- Program crash
PID:3840
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 2407⤵
- Program crash
PID:960
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15438.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-62029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62029.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe8⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24474.exe9⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45465.exe10⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29975.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29975.exe11⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36441.exe12⤵PID:7756
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64033.exe13⤵PID:8848
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7756 -s 21613⤵PID:9088
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 23612⤵PID:8168
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 21611⤵PID:6380
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 23610⤵PID:5780
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 2369⤵PID:4664
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 2368⤵
- Program crash
PID:3684
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39122.exe7⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe8⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12875.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12875.exe9⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57551.exe10⤵PID:6792
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe11⤵PID:8196
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe12⤵PID:4812
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8196 -s 21612⤵PID:6412
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6792 -s 21611⤵PID:9056
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 21610⤵PID:7188
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 2369⤵PID:5364
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 2168⤵PID:4648
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 2407⤵
- Program crash
PID:3668
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 2406⤵
- Program crash
PID:1684
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33481.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33481.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:652 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 2206⤵
- Program crash
PID:1756
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 2205⤵
- Loads dropped DLL
- Program crash
PID:1444
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16294.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16294.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-44603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44603.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-16638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16638.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-53285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53285.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-52766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52766.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-8884.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8884.exe9⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48267.exe10⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16441.exe11⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe12⤵PID:6800
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49975.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49975.exe13⤵PID:7832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6800 -s 21613⤵PID:8832
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 21612⤵PID:7976
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 21611⤵PID:1292
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 21610⤵PID:4856
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 2369⤵PID:3932
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 2368⤵
- Program crash
PID:1428
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-35527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35527.exe8⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe9⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62948.exe10⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11936.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11936.exe11⤵PID:7636
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59072.exe12⤵PID:9084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7636 -s 21612⤵PID:5716
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 23611⤵PID:7656
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 21610⤵PID:6936
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 2169⤵PID:5376
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 2368⤵PID:3204
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 2407⤵
- Program crash
PID:1840
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37695.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37695.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-6388.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6388.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31360.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31360.exe8⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64115.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64115.exe9⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58272.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58272.exe10⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31734.exe11⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37131.exe12⤵PID:6868
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6612.exe13⤵PID:7708
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe14⤵PID:5164
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6868 -s 21613⤵PID:8756
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 23612⤵PID:7220
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 23611⤵PID:5688
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 23610⤵PID:4640
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 2369⤵PID:3984
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17607.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17607.exe8⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29300.exe9⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16441.exe10⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60504.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60504.exe11⤵PID:6932
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28652.exe12⤵PID:8460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6932 -s 21612⤵PID:8340
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 21611⤵PID:8024
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 21610⤵PID:5836
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 2169⤵PID:4156
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 2408⤵PID:4016
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe7⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24749.exe8⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47795.exe9⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50971.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50971.exe10⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe11⤵PID:7608
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46218.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46218.exe12⤵PID:3220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7608 -s 23612⤵PID:5712
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 21611⤵PID:7528
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 21610⤵PID:6620
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 2369⤵PID:5888
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 2168⤵PID:5044
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 2407⤵
- Program crash
PID:3940
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 2406⤵
- Program crash
PID:2040
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-52408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52408.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-2190.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2190.exe8⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52154.exe9⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17287.exe10⤵PID:6948
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21662.exe11⤵PID:8088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6948 -s 21611⤵PID:9004
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 21610⤵PID:7272
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 2369⤵PID:5760
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 2168⤵PID:3388
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 2167⤵
- Program crash
PID:3728
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59543.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-28942.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28942.exe7⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-623.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-623.exe8⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11173.exe9⤵PID:6636
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56088.exe10⤵PID:7772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6636 -s 21610⤵PID:8900
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 2169⤵PID:7156
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 2168⤵PID:5456
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 2367⤵PID:4932
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 2406⤵
- Program crash
PID:3748
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 2405⤵
- Program crash
PID:2264
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 2404⤵
- Loads dropped DLL
- Program crash
PID:1376
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-62885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62885.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-26752.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26752.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-48516.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48516.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-32647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32647.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-52958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52958.exe9⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe10⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe11⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe12⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15829.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15829.exe13⤵PID:7712
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe14⤵PID:8624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 21614⤵PID:2936
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 21613⤵PID:8108
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 21612⤵PID:6816
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 21611⤵PID:5392
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 23610⤵PID:3476
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 2369⤵
- Program crash
PID:3348
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41260.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41260.exe8⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38013.exe9⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44505.exe10⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe11⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33919.exe12⤵PID:7512
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45092.exe13⤵PID:8296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7512 -s 21613⤵PID:9208
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 23612⤵PID:8068
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 23611⤵PID:6852
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 23610⤵PID:5480
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 2369⤵PID:3492
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 2408⤵
- Program crash
PID:1568
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51676.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-30400.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30400.exe8⤵PID:2436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 2009⤵
- Program crash
PID:3848
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 2368⤵
- Program crash
PID:3924
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 2407⤵
- Program crash
PID:2524
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6092.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-59097.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59097.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-5895.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5895.exe8⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25029.exe9⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29300.exe10⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10986.exe11⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1002.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1002.exe12⤵PID:5140
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51801.exe12⤵PID:6500
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40224.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40224.exe13⤵PID:8048
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2746.exe14⤵PID:4776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8048 -s 21614⤵PID:5996
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6500 -s 23613⤵PID:8408
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6012 -s 24012⤵PID:6712
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 21611⤵PID:6116
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 21610⤵PID:5112
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 2369⤵
- Program crash
PID:3524
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe8⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65262.exe9⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29020.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29020.exe10⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe11⤵PID:6664
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63597.exe12⤵PID:7620
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42936.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42936.exe13⤵PID:8328
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6664 -s 21612⤵PID:8684
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 21611⤵PID:6776
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 21610⤵PID:5188
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 2369⤵PID:4384
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 2408⤵
- Program crash
PID:3560
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29584.exe7⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8692.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8692.exe8⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe9⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58926.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58926.exe10⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe11⤵PID:6644
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe12⤵PID:9068
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6644 -s 23612⤵PID:8608
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 21611⤵PID:7532
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 23610⤵PID:6528
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 2369⤵PID:5060
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 2368⤵
- Program crash
PID:3512
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 2407⤵
- Program crash
PID:2596
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 2406⤵
- Program crash
PID:380
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-24946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24946.exe8⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe9⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exe10⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56103.exe11⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe12⤵PID:7140
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe13⤵PID:7724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 21613⤵PID:8908
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 21612⤵PID:7260
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 21611⤵PID:6440
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 21610⤵PID:4800
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 2369⤵
- Program crash
PID:3592
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58256.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58256.exe8⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50872.exe9⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5558.exe10⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40385.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40385.exe11⤵PID:6632
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38081.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38081.exe12⤵PID:8600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 23612⤵PID:8492
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5528 -s 23611⤵PID:7744
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 21610⤵PID:6084
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 2369⤵PID:5304
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 2408⤵
- Program crash
PID:3600
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exe7⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57530.exe8⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27266.exe9⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe10⤵PID:6760
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11163.exe11⤵PID:7948
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe12⤵PID:9108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7948 -s 21612⤵PID:6464
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 23611⤵PID:8932
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 21610⤵PID:7180
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 2169⤵PID:5608
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 2368⤵PID:4900
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 2407⤵
- Program crash
PID:3824
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23279.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23279.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-37198.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37198.exe7⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63093.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63093.exe8⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5288.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5288.exe9⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18003.exe10⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46306.exe11⤵PID:6836
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31257.exe12⤵PID:8696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6836 -s 23612⤵PID:8952
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 21611⤵PID:7984
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 21610⤵PID:6124
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 2169⤵PID:4836
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 2368⤵
- Program crash
PID:3676
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 2367⤵
- Program crash
PID:3568
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 2406⤵
- Program crash
PID:1268
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 2405⤵
- Program crash
PID:2984
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47296.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47296.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-40950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40950.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:884 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-25766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25766.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-13295.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13295.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-22699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22699.exe8⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25408.exe9⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18304.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18304.exe10⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25803.exe11⤵PID:7148
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exe12⤵PID:8252
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58888.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58888.exe13⤵PID:9184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8252 -s 21613⤵PID:5800
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 21612⤵PID:9120
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 21611⤵PID:7460
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 21610⤵PID:5520
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 2169⤵PID:4232
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 2368⤵
- Program crash
PID:3584
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 2367⤵
- Program crash
PID:2492
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36408.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-41905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41905.exe7⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56627.exe8⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47551.exe9⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe10⤵PID:7080
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43945.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43945.exe11⤵PID:7920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 23611⤵PID:8840
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 23610⤵PID:8080
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 2369⤵PID:6328
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 2368⤵PID:4604
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 2367⤵
- Program crash
PID:3392
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 2406⤵
- Program crash
PID:2920
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9984.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9984.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63565.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63565.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-34313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34313.exe7⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe8⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45413.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45413.exe9⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28216.exe10⤵PID:6456
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe11⤵PID:7564
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe12⤵PID:9136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7564 -s 21612⤵PID:5332
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6456 -s 21611⤵PID:7340
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5848 -s 23610⤵PID:7364
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 2169⤵PID:6344
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 2168⤵PID:4572
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 2367⤵
- Program crash
PID:3264
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 2166⤵
- Program crash
PID:1412
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 2405⤵
- Program crash
PID:1356
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 2404⤵
- Loads dropped DLL
- Program crash
PID:3068
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 2403⤵
- Loads dropped DLL
- Program crash
PID:240
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63876.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-4473.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4473.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-5433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5433.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-45179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45179.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-28698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28698.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23327.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23327.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:956 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exe8⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe9⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7234.exe10⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61993.exe11⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29975.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29975.exe12⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exe13⤵PID:8152
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58613.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58613.exe14⤵PID:8420
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8152 -s 23614⤵PID:5352
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5204 -s 23613⤵PID:8504
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 21612⤵PID:6564
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 21611⤵PID:6060
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 21610⤵PID:5072
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 2369⤵
- Program crash
PID:3640
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 2368⤵
- Program crash
PID:1308
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24540.exe7⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49362.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49362.exe8⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49440.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49440.exe9⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52014.exe10⤵PID:6604
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe11⤵PID:8136
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12860.exe12⤵PID:4968
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8136 -s 21612⤵PID:5976
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6604 -s 21611⤵PID:8884
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 23610⤵PID:7108
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 2169⤵PID:5240
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 2368⤵PID:4892
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 2407⤵
- Program crash
PID:3796
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exe7⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18999.exe8⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35522.exe9⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25377.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25377.exe10⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14785.exe11⤵PID:6960
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe12⤵PID:7428
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe13⤵PID:9172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 23613⤵PID:4456
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6960 -s 23612⤵PID:7908
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51194.exe11⤵PID:7472
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52492.exe12⤵PID:9024
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7472 -s 23612⤵PID:8488
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 22011⤵PID:8008
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 21610⤵PID:6432
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 2369⤵PID:4324
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 2368⤵PID:3160
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 2367⤵
- Program crash
PID:2404
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 2406⤵
- Program crash
PID:856
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12916.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-47037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47037.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20369.exe8⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48267.exe9⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56103.exe10⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10701.exe11⤵PID:6876
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe12⤵PID:7884
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57702.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57702.exe13⤵PID:4860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7884 -s 21613⤵PID:5596
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6876 -s 23612⤵PID:8236
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5956 -s 21611⤵PID:7660
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 21610⤵PID:6424
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 2169⤵PID:4912
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 2168⤵
- Program crash
PID:3424
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe7⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe8⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33872.exe9⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9118.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9118.exe10⤵PID:6912
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30214.exe11⤵PID:8308
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6912 -s 21611⤵PID:9148
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5168 -s 21610⤵PID:7228
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 2369⤵PID:5772
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 2368⤵PID:4556
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 2407⤵
- Program crash
PID:3244
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4805.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4805.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-39440.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39440.exe7⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49440.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49440.exe8⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22933.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22933.exe9⤵PID:6700
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2611.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2611.exe10⤵PID:3784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6700 -s 23610⤵PID:8964
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 2169⤵PID:848
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 2168⤵PID:5224
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 2167⤵PID:4704
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 2406⤵
- Program crash
PID:3708
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 2405⤵
- Program crash
PID:2532
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64208.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1680 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 2405⤵
- Program crash
PID:976
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 2404⤵
- Loads dropped DLL
- Program crash
PID:1976
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55189.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:468 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-6715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6715.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:588 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-55807.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55807.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-50820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50820.exe7⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe8⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58272.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58272.exe9⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36202.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36202.exe10⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe11⤵PID:7088
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24376.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24376.exe12⤵PID:8520
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46226.exe13⤵PID:5680
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7088 -s 23612⤵PID:8404
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5228 -s 23611⤵PID:7392
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 23610⤵PID:5932
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 2169⤵PID:5080
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 2368⤵PID:3308
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 2167⤵
- Program crash
PID:1972
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4312.exe6⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exe7⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25216.exe8⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22663.exe9⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53021.exe10⤵PID:6744
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46742.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46742.exe11⤵PID:8360
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6744 -s 23611⤵PID:9156
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 21610⤵PID:7924
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 2169⤵PID:6188
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2168⤵PID:5008
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 2367⤵PID:4044
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 2406⤵
- Program crash
PID:2916
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9299.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:308 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-48127.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48127.exe7⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe8⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64017.exe9⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50146.exe10⤵PID:7800
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe11⤵PID:4060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7800 -s 21611⤵PID:4024
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6108 -s 23610⤵PID:2360
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 2369⤵PID:7056
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 2168⤵PID:5368
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 308 -s 2367⤵PID:3376
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 2366⤵
- Program crash
PID:2624
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 2405⤵
- Program crash
PID:1644
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29828.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29828.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:616 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-30208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30208.exe6⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-58433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58433.exe7⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18055.exe8⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44474.exe9⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64920.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64920.exe10⤵PID:7936
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe11⤵PID:4540
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7936 -s 21611⤵PID:5792
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 23610⤵PID:8288
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 2369⤵PID:6976
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 2168⤵PID:5440
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 2367⤵PID:1688
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 2366⤵
- Program crash
PID:2332
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe5⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15106.exe6⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22201.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22201.exe7⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exe8⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24516.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24516.exe9⤵PID:6964
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10696.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10696.exe10⤵PID:7752
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46309.exe11⤵PID:4512
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 21610⤵PID:8772
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 2169⤵PID:7356
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 2168⤵PID:6396
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 2167⤵PID:4928
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 276 -s 2366⤵
- Program crash
PID:3644
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 616 -s 2405⤵
- Program crash
PID:2868
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 2404⤵
- Program crash
PID:2216
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 2403⤵
- Loads dropped DLL
- Program crash
PID:2272
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 2402⤵
- Program crash
PID:2540
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD541fa08e9869b9c4b88c43e41670b8022
SHA1b374b153a9c1e1861f9d2125efeda34cadb5111e
SHA256a83863059a3f2282b18cc4dc84105964dbaf2f411badbf3096232e13a491bf0d
SHA51252ee611da08d2e881b932961568867ec7ca4b074ab921ce010e6efe181ca27f3f8f9544195372ddd0f0f6ce86896a79435d42631a6d365096f5395be8351a969
-
Filesize
184KB
MD53b50fdf1fe425edaab428e471f649553
SHA1f0585895e6f7b83cae6ea9f7b4719d011319f9b1
SHA256485215ae31bddadf41140ecad9e3a2f642bb8430950832deacaa84b96ec742e9
SHA5120157ad94357a8cc2cdf67dd4b2dda2f9eedf50ce8e539298586454228dbc458d0c95928738bc54e51e305ef5dbbac7fc0aa5d3dbaa9dae1c1b1986792fe455e8
-
Filesize
184KB
MD5babf218aa55c99dd6af7ed37f8d99836
SHA1f7f7931166a36b86acb6873cc85889d13ca22d58
SHA2567febeee9299dcfa84055ebb70eb8dd0fc49a0732566cf63ac189a9037b41c7c1
SHA5128f413dca7b6a684ed3c1edcc92ac2cbd9c0d53e13d96c73488f068976369caa54831e441b3f65dc61f6aac4785be5ce905e427130ee9be71779797c7a336bd68
-
Filesize
184KB
MD5947856de865c955a77efc5b4c26b9bca
SHA10a2a23d760310bcf1bea8f7d4358e1a6dbb27d0d
SHA2563905716cc3ecace26a9d5c7a738756d406919b7b57ab222287381eb2569522e1
SHA512f05d2f7130d33ac553d9df6e65776809a812d9fff4bcbc34903e10e9428da39bc8d9753213add0fe92965ab70e61e38e3653866a1bc61a975b945d8d0d012237
-
Filesize
184KB
MD58c75d20a950288ae13a0fd53053747b9
SHA130bd83fca2500aacd7f89d176e92a3b5c0a42bc0
SHA25691770d9a32d2b6e300e09951aa0da20fc7ead0c3ceb7143362d440e90d5da60d
SHA5126d7de5642548e4132ed2b716fdda86339c76c3a703e4fadf4a9d3ec4a76ee7983bf0ac7df841a873a8797a9bb7a5081ba98383bbf9e9df41379e591b2e0489a3
-
Filesize
184KB
MD58c73decb01ea053c5c72a50d1b5c4b25
SHA14e37e393f2de7f19b8136801065ae24c5628b5d2
SHA25689e48da8a394fccafb7ad45bf627ccb1e5769acdf60bc032760d2469e882ce2a
SHA512b206f7b95f9652e47ab90e8ce77282a27d93cfdebaed301d58fae2e59999241ea5c5d614f34c350141cf1aaccb21c00927da8b6e411c35e2f82e7b6bfc240e79
-
Filesize
184KB
MD5a6b50cd3b1e31511b3715eeb882d6801
SHA1791ed479f314b67039d46ceff0275d0569d734c7
SHA2566f4ba6610551cc5ab006af992bbe32f87ea6d29299515a771bc6b575c97de144
SHA512156e00392b412fb80a433ed942de82b8feafac07676f00f5c35e7f3eee807e0ac960cf906ef0c14b3b3d8d6eb0c41f514b9c294fe022caed795803fc7d6545a3
-
Filesize
184KB
MD501517fc8bfa0b28f29ceb45fa6be92b4
SHA176e64df98f298a79e4ff2f6845681e16ed16c98d
SHA256465362452be23b877c682d359a01dec1d8f8d485f11add8a00eea96e43cdf167
SHA51268e682d23e2f3e96b43627760bd5697d39d56301c50e0f80171f00a25dc34c56e4b82f8960e9976224bf8aefd584007d859ca55ab0145aa8e5e7fea2a2b9ba5c
-
Filesize
184KB
MD5acdc3b5b22bedd2ab2827b62b9d7efb9
SHA1fc3a04c0555d1af8d54171959a0e1194fb232a31
SHA256d05772bc0e7166e29fa5b273fabb73b0e1ba4ba1d8c2f051b13cfbab3d035f91
SHA5122f0a4395fca7583e1384cc15119ffa571fd1e6ad4465aea79d5a625fc25b25faea16c1b70f7912f02d78c96d4ae358a254127839dea8826d6a4ceba4a687c1d6
-
Filesize
184KB
MD5d4810a8128094943f7447b889f621303
SHA1cc042f69e969b5a962e7092128eda4d9e05c55fc
SHA2562a63ec8b6ed1018d1eb04aaa2d5127a28e979b20c83b6a937e4949a4d6fb14a6
SHA5122c99a070bcc30a0fd99260a4f6bf293e81355641f1893635f9fa2f19ae5d475d830b4ff7b7e01ecab86772ac8945946c9c4f1b277621818248d0e5f657a0d6df
-
Filesize
184KB
MD520eb98b27c34cb66ded4829e457522d1
SHA1e29c25a1ac6661d5012990e5bacf880d11e64891
SHA25622e07f97c4ed28954e899d537da1f94c6184ecf436e67d8a3252dd95d8186d7e
SHA512741f93466583e6ef95b3e5fe3e9ebe20362d96879e3090148a4290edd070ba35b1129a01d23055c0b5eab39fc3f238e32d6e70c14e5d3b4af587b37da09dfa94
-
Filesize
184KB
MD529335a088fc6e5c4c171aca5b3d16772
SHA14c2e14ed00dbb6fc5ce511588b45cafdf868ce91
SHA256dabbab6343143c1548701412b9538147c2703ecf98aa535bde73ff420095222d
SHA5124be1f7b286e2ac8c465df266c389b3d41c7b0c2a48d08be21b7ef27aaca5963c49b4fe140a891720faf456812017a90a60857175f1cd61d74bdeda55bab0bcc0
-
Filesize
184KB
MD5ac3e1f477ef277d80f68596ca6fe4d50
SHA15a15f24ea54490d48703532bc1a3a0291c41b30a
SHA256019f7307b813366ad83dac91438f947be80b030c30b54d09a90e4f69ee446e6e
SHA5124f08596e6889fd23ee967162514de136366c04bbdd93a7c11628f21acadd28f7da21c61ed047919d1fffb124429078cffceaf4e837fd8fa95c0cec7604200900
-
Filesize
184KB
MD572ff3686d509f51aa10510c4df4aa80e
SHA1e0bcc370496f29f21a72e607c92c6ba62f9c46fb
SHA256eeb92b0b3a91c5602e1ab2c0c9fc39c146a3fa03466a535b9f66c8332d1015f4
SHA512264a40bba12cda896f7730fd4d9a5f0781cf95ea4963e2c31a8938803d9e0fb9010dc7184fc7599232605d7c10986e5a7c9b7babe191f8b7104a53aa116c721d
-
Filesize
184KB
MD5ea06d31dcd657115bc79ea2923790022
SHA1e7898af401165df1b9345d386e4efb67f9a321bc
SHA256e09d0b567b8d0b0e8b7becce3e796a8bd6205277cec7da5ffd766567bc7bb4d8
SHA512827a5d882346ff2d50d14285bf6b22181dc52d9d11c4a4fd27f45736f8446dbcf54b70aee4a3e9c8e835576a8970950e848bfe5f98c298700fba3f394bf20291
-
Filesize
184KB
MD55b3559c7ba862fc7986aa52e40e6f260
SHA1db7bdef4f49ea0e43906be227deb4a85d87d04a6
SHA25623e299caff51010d61e4d85b929259545d8e9bef97a5d8bf32e2e71caf5777ff
SHA51290a314062608c6d6cef742d9da3ee3538298a3186ef023d7153344164f1c1fb2f091387c336d6472ceb1d6127a2916113b90e12034ae28410284fef9dbb9b1bb
-
Filesize
184KB
MD52b95de7b0f7bd414ea04faebfe7a2e6a
SHA1ccff76dc78b8b2bf9dde75fd7930dd15172657ab
SHA2565844cc9d2620b1922392dc8b92b6791cbf49766bf7c759116359f26a44b3eed7
SHA512ee7b92ecd5a29272ed1792cdcfa9d72222b41e1a82fbbebb31f141aa8c9425eb8ca1a5ad519b554b6b8082a97cb615b6a0eb5871b5a239ce20e3d773b62d9be4
-
Filesize
184KB
MD5651dd51b8ba2357316518b46f0b8e40c
SHA114952cf486a66c35205708ef6f9d44e850a3ee0b
SHA25674867b0ae63f4574d8fc5ab8793d88d9423c7a8fabe713de979a52a1acff2f59
SHA512a4d6984cdd21c1ac4dc327fccc3c1226cecf626f367e4fc04955d6daafb6732f7cea5e621ad79479c818dfb89c44285b13e09e5351f6bcc2eaaf8e6a45258247
-
Filesize
184KB
MD54a9a8094a03697aa4a354a31b0a9a2c7
SHA193d8a926404171bad132ffeab07e9c47318ec5c6
SHA256c4ada52e3954f83116c69b9c9da29327d3986324d03386ba14f5d30c700c451b
SHA512a9b3bcae6f5ee8fd39d951896cf12ca8bd0713377dd7dffba0509899991bc00aad9ad800fc102cd92410f359277038e594d2318b0e4b7128c3a970814bdc5362
-
Filesize
184KB
MD59578a1b00a7a2e0d4e23a2d1eaebe832
SHA1a2980e7bdb1d8a02b4d6dd8726d6fd7634956477
SHA256047f2e047ea75c5e36149666ddae8ae0970d70cc7024f446a982c16fa20728cd
SHA512b3f9212af819264313010ceff0341aa318a0197c8dad21981d71a6e2e5f32ace824c6018163cbbd62a49369bfd5922167f2edf99ee32f088088a3566daed2751
-
Filesize
184KB
MD57d0855f93f98c510cdbd13ab062b01fb
SHA1dffc68e8669c191f5f93492f8b5c36bf197b721c
SHA25642ed6e078983d256ba5af266865dd29cb6f236d94ce601b730a9323ca216258f
SHA512eb7c022b5ad5fda513ed60c55408db5eac94a259dd4ae0672ee74541cf87535203e62b64c649074866909bdc6cd4df541e230f87b4518466fed6975bd978cf43