Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2024, 20:51
Static task
static1
Behavioral task
behavioral1
Sample
4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba.exe
Resource
win10v2004-20240802-en
General
-
Target
4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba.exe
-
Size
184KB
-
MD5
5fff4a57bb9b2dd306e7f416687e19b7
-
SHA1
ccb391087a6757ee41762d8f6e613c7da950d750
-
SHA256
4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba
-
SHA512
5714150f5e7a85f0e9ab739a20f9eb0688caf0f7e1b28080615c8b8bf4cbcac26b2e2a669075af0f43332189cabd8acd6e1eb0f59c200cb927fb431cde0434b6
-
SSDEEP
3072:MhGUaSoFy5vYdSyGZPF8trrelvWqnqeu9:MhpoOESyI85rel+qnqeu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4216 Unicorn-37152.exe 3260 Unicorn-21968.exe 4352 Unicorn-54318.exe 1664 Unicorn-7660.exe 3588 Unicorn-7660.exe 4332 Unicorn-35926.exe 4732 Unicorn-36341.exe 1708 Unicorn-61568.exe 2908 Unicorn-28381.exe 5056 Unicorn-52331.exe 4980 Unicorn-10421.exe 1716 Unicorn-56093.exe 3964 Unicorn-52331.exe 4440 Unicorn-62372.exe 3916 Unicorn-56507.exe 4572 Unicorn-25772.exe 2560 Unicorn-21587.exe 3076 Unicorn-42662.exe 2428 Unicorn-52990.exe 2036 Unicorn-774.exe 3268 Unicorn-774.exe 4904 Unicorn-774.exe 3028 Unicorn-4858.exe 2832 Unicorn-4858.exe 2896 Unicorn-8428.exe 4556 Unicorn-60644.exe 5008 Unicorn-60644.exe 3168 Unicorn-14707.exe 4360 Unicorn-6042.exe 2372 Unicorn-56974.exe 2540 Unicorn-28547.exe 1236 Unicorn-10587.exe 4336 Unicorn-60343.exe 2648 Unicorn-47344.exe 2236 Unicorn-33758.exe 1936 Unicorn-38107.exe 5028 Unicorn-21369.exe 4256 Unicorn-4749.exe 2624 Unicorn-38168.exe 2608 Unicorn-50743.exe 4888 Unicorn-58589.exe 1120 Unicorn-38491.exe 4868 Unicorn-43243.exe 2852 Unicorn-39067.exe 4772 Unicorn-29315.exe 2812 Unicorn-49181.exe 5004 Unicorn-64126.exe 1044 Unicorn-46166.exe 3504 Unicorn-61111.exe 4296 Unicorn-2118.exe 2960 Unicorn-29373.exe 3816 Unicorn-16317.exe 3068 Unicorn-25661.exe 2520 Unicorn-29638.exe 4428 Unicorn-55211.exe 4864 Unicorn-35345.exe 3128 Unicorn-49081.exe 1180 Unicorn-56587.exe 4652 Unicorn-65517.exe 1724 Unicorn-28660.exe 3476 Unicorn-15824.exe 1064 Unicorn-23891.exe 1608 Unicorn-364.exe 4308 Unicorn-48496.exe -
Program crash 21 IoCs
pid pid_target Process procid_target 4856 4652 WerFault.exe 144 5168 1912 WerFault.exe 178 5208 1608 WerFault.exe 148 5200 3084 WerFault.exe 165 5792 5756 WerFault.exe 226 6716 5716 WerFault.exe 225 5444 1608 WerFault.exe 148 8552 5472 WerFault.exe 209 16252 7520 WerFault.exe 344 16012 12520 WerFault.exe 695 15424 12636 WerFault.exe 715 15704 13244 WerFault.exe 716 15688 12688 WerFault.exe 700 15796 13360 WerFault.exe 662 15792 13600 WerFault.exe 697 12280 14664 WerFault.exe 724 1312 14704 WerFault.exe 729 9528 7180 WerFault.exe 927 6868 1208 WerFault.exe 998 6916 7020 WerFault.exe 893 6996 14696 WerFault.exe 874 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-40331.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-42525.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-6363.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-64574.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-22266.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-15693.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-29361.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-28660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-403.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-42173.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-32816.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-2052.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-3765.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-62226.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-28673.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-54822.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-26016.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-8501.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-1535.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-11324.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-1736.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-12187.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-21723.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-36196.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-22734.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-7336.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-27396.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-4647.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-36543.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-55333.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-58503.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-8212.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-60014.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-44665.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-40968.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-58124.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-23993.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-17852.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-19820.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-63230.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-7917.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-60343.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-10540.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-19636.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-13898.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-35096.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-38491.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-28574.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-30356.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-720.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-54238.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-45690.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-52582.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-5775.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-49495.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-9910.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-44254.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-46519.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-34094.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-51445.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-48645.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-3381.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-35926.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-49268.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 36 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 14112 Process not Found 14116 Process not Found 14120 Process not Found 14124 Process not Found 14128 Process not Found 14132 Process not Found 14136 Process not Found 14140 Process not Found 14228 Process not Found 14272 Process not Found 14236 Process not Found 8936 Process not Found 10628 Process not Found 12560 Process not Found 12820 Process not Found 12816 Process not Found 4268 Process not Found 13624 Process not Found 12856 Process not Found 13700 Process not Found 4152 Process not Found 8616 Process not Found 1464 Process not Found 16956 Process not Found 13924 Process not Found 14056 Process not Found 14288 Process not Found 14292 Process not Found 14296 Process not Found 14300 Process not Found 8016 Process not Found 9936 Process not Found 13184 Process not Found 12348 Process not Found 10512 Process not Found 13308 Process not Found 13640 Process not Found 13660 Process not Found 13036 Process not Found 14376 Process not Found 4212 Process not Found 4240 Process not Found 3700 Process not Found 5364 Process not Found 10356 Process not Found 10360 Process not Found 9956 Process not Found 10016 Process not Found 14012 Process not Found 9872 Process not Found 10652 Process not Found 10548 Process not Found 3984 Process not Found 10664 Process not Found 10656 Process not Found 9040 Process not Found 3620 Process not Found 9072 Process not Found 7532 Process not Found 8772 Process not Found 10596 Process not Found 10668 Process not Found 10612 Process not Found 10772 Process not Found -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeCreateGlobalPrivilege 2500 dwm.exe Token: SeChangeNotifyPrivilege 2500 dwm.exe Token: 33 2500 dwm.exe Token: SeIncBasePriorityPrivilege 2500 dwm.exe Token: SeCreateGlobalPrivilege 6016 dwm.exe Token: SeChangeNotifyPrivilege 6016 dwm.exe Token: 33 6016 dwm.exe Token: SeIncBasePriorityPrivilege 6016 dwm.exe Token: SeCreateGlobalPrivilege 14244 dwm.exe Token: SeChangeNotifyPrivilege 14244 dwm.exe Token: 33 14244 dwm.exe Token: SeIncBasePriorityPrivilege 14244 dwm.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3668 4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba.exe 4216 Unicorn-37152.exe 3260 Unicorn-21968.exe 4352 Unicorn-54318.exe 1664 Unicorn-7660.exe 4332 Unicorn-35926.exe 3588 Unicorn-7660.exe 4732 Unicorn-36341.exe 1708 Unicorn-61568.exe 2908 Unicorn-28381.exe 3964 Unicorn-52331.exe 1716 Unicorn-56093.exe 3916 Unicorn-56507.exe 4980 Unicorn-10421.exe 4440 Unicorn-62372.exe 5056 Unicorn-52331.exe 4572 Unicorn-25772.exe 2560 Unicorn-21587.exe 3076 Unicorn-42662.exe 2428 Unicorn-52990.exe 2036 Unicorn-774.exe 4904 Unicorn-774.exe 3268 Unicorn-774.exe 3028 Unicorn-4858.exe 5008 Unicorn-60644.exe 2372 Unicorn-56974.exe 3168 Unicorn-14707.exe 2832 Unicorn-4858.exe 2896 Unicorn-8428.exe 4556 Unicorn-60644.exe 4360 Unicorn-6042.exe 2540 Unicorn-28547.exe 1236 Unicorn-10587.exe 4336 Unicorn-60343.exe 2236 Unicorn-33758.exe 1936 Unicorn-38107.exe 2648 Unicorn-47344.exe 5028 Unicorn-21369.exe 4256 Unicorn-4749.exe 2624 Unicorn-38168.exe 2608 Unicorn-50743.exe 4888 Unicorn-58589.exe 1120 Unicorn-38491.exe 4868 Unicorn-43243.exe 2852 Unicorn-39067.exe 2812 Unicorn-49181.exe 4772 Unicorn-29315.exe 1044 Unicorn-46166.exe 5004 Unicorn-64126.exe 3504 Unicorn-61111.exe 2960 Unicorn-29373.exe 4652 Unicorn-65517.exe 4428 Unicorn-55211.exe 3128 Unicorn-49081.exe 2520 Unicorn-29638.exe 3816 Unicorn-16317.exe 3068 Unicorn-25661.exe 4296 Unicorn-2118.exe 1724 Unicorn-28660.exe 4864 Unicorn-35345.exe 1180 Unicorn-56587.exe 3476 Unicorn-15824.exe 1064 Unicorn-23891.exe 1608 Unicorn-364.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3668 wrote to memory of 4216 3668 4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba.exe 86 PID 3668 wrote to memory of 4216 3668 4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba.exe 86 PID 3668 wrote to memory of 4216 3668 4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba.exe 86 PID 4216 wrote to memory of 3260 4216 Unicorn-37152.exe 87 PID 4216 wrote to memory of 3260 4216 Unicorn-37152.exe 87 PID 4216 wrote to memory of 3260 4216 Unicorn-37152.exe 87 PID 3668 wrote to memory of 4352 3668 4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba.exe 88 PID 3668 wrote to memory of 4352 3668 4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba.exe 88 PID 3668 wrote to memory of 4352 3668 4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba.exe 88 PID 3260 wrote to memory of 1664 3260 Unicorn-21968.exe 89 PID 3260 wrote to memory of 1664 3260 Unicorn-21968.exe 89 PID 3260 wrote to memory of 1664 3260 Unicorn-21968.exe 89 PID 4352 wrote to memory of 3588 4352 Unicorn-54318.exe 90 PID 4352 wrote to memory of 3588 4352 Unicorn-54318.exe 90 PID 4352 wrote to memory of 3588 4352 Unicorn-54318.exe 90 PID 4216 wrote to memory of 4332 4216 Unicorn-37152.exe 91 PID 4216 wrote to memory of 4332 4216 Unicorn-37152.exe 91 PID 4216 wrote to memory of 4332 4216 Unicorn-37152.exe 91 PID 3668 wrote to memory of 4732 3668 4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba.exe 92 PID 3668 wrote to memory of 4732 3668 4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba.exe 92 PID 3668 wrote to memory of 4732 3668 4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba.exe 92 PID 1664 wrote to memory of 1708 1664 Unicorn-7660.exe 93 PID 1664 wrote to memory of 1708 1664 Unicorn-7660.exe 93 PID 1664 wrote to memory of 1708 1664 Unicorn-7660.exe 93 PID 3260 wrote to memory of 2908 3260 Unicorn-21968.exe 94 PID 3260 wrote to memory of 2908 3260 Unicorn-21968.exe 94 PID 3260 wrote to memory of 2908 3260 Unicorn-21968.exe 94 PID 4332 wrote to memory of 5056 4332 Unicorn-35926.exe 95 PID 4332 wrote to memory of 5056 4332 Unicorn-35926.exe 95 PID 4332 wrote to memory of 5056 4332 Unicorn-35926.exe 95 PID 4732 wrote to memory of 4980 4732 Unicorn-36341.exe 96 PID 4732 wrote to memory of 4980 4732 Unicorn-36341.exe 96 PID 4732 wrote to memory of 4980 4732 Unicorn-36341.exe 96 PID 4352 wrote to memory of 1716 4352 Unicorn-54318.exe 97 PID 4352 wrote to memory of 1716 4352 Unicorn-54318.exe 97 PID 4352 wrote to memory of 1716 4352 Unicorn-54318.exe 97 PID 3588 wrote to memory of 3964 3588 Unicorn-7660.exe 98 PID 3588 wrote to memory of 3964 3588 Unicorn-7660.exe 98 PID 3588 wrote to memory of 3964 3588 Unicorn-7660.exe 98 PID 3668 wrote to memory of 4440 3668 4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba.exe 99 PID 3668 wrote to memory of 4440 3668 4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba.exe 99 PID 3668 wrote to memory of 4440 3668 4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba.exe 99 PID 4216 wrote to memory of 3916 4216 Unicorn-37152.exe 100 PID 4216 wrote to memory of 3916 4216 Unicorn-37152.exe 100 PID 4216 wrote to memory of 3916 4216 Unicorn-37152.exe 100 PID 1708 wrote to memory of 4572 1708 Unicorn-61568.exe 101 PID 1708 wrote to memory of 4572 1708 Unicorn-61568.exe 101 PID 1708 wrote to memory of 4572 1708 Unicorn-61568.exe 101 PID 3260 wrote to memory of 2560 3260 Unicorn-21968.exe 102 PID 3260 wrote to memory of 2560 3260 Unicorn-21968.exe 102 PID 3260 wrote to memory of 2560 3260 Unicorn-21968.exe 102 PID 1664 wrote to memory of 3076 1664 Unicorn-7660.exe 103 PID 1664 wrote to memory of 3076 1664 Unicorn-7660.exe 103 PID 1664 wrote to memory of 3076 1664 Unicorn-7660.exe 103 PID 3964 wrote to memory of 2428 3964 Unicorn-52331.exe 104 PID 3964 wrote to memory of 2428 3964 Unicorn-52331.exe 104 PID 3964 wrote to memory of 2428 3964 Unicorn-52331.exe 104 PID 4980 wrote to memory of 3268 4980 Unicorn-10421.exe 106 PID 4980 wrote to memory of 3268 4980 Unicorn-10421.exe 106 PID 4980 wrote to memory of 3268 4980 Unicorn-10421.exe 106 PID 3916 wrote to memory of 2036 3916 Unicorn-56507.exe 105 PID 3916 wrote to memory of 2036 3916 Unicorn-56507.exe 105 PID 3916 wrote to memory of 2036 3916 Unicorn-56507.exe 105 PID 1716 wrote to memory of 4904 1716 Unicorn-56093.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba.exe"C:\Users\Admin\AppData\Local\Temp\4041ce3f3796412735ac3b0d127f5996571a97388fa1f5ab9ac49ea9e72e6dba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-37152.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37152.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-21968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21968.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-25772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25772.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-10587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10587.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-364.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1608 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 7249⤵
- Program crash
PID:5208
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 7249⤵
- Program crash
PID:5444
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe8⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe9⤵PID:7368
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-403.exe9⤵PID:10568
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe9⤵
- System Location Discovery: System Language Discovery
PID:15936
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe9⤵PID:13872
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18817.exe8⤵PID:4280
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64597.exe8⤵PID:12480
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60081.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60081.exe8⤵PID:5336
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43596.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43596.exe7⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1407.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1407.exe8⤵PID:1960
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22429.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22429.exe8⤵PID:6164
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe9⤵PID:8368
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43159.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43159.exe9⤵PID:13344
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8941.exe9⤵PID:16680
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27594.exe8⤵PID:10052
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe8⤵PID:13324
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41806.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41806.exe8⤵PID:5208
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47156.exe7⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exe8⤵PID:7556
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe9⤵PID:10828
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25971.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25971.exe9⤵PID:14800
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56221.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56221.exe9⤵PID:2084
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe8⤵PID:11356
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46121.exe8⤵PID:15892
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47556.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47556.exe8⤵PID:14256
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48392.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48392.exe7⤵PID:7508
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe7⤵PID:7932
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe7⤵PID:13616
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50312.exe7⤵PID:7952
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60343.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60343.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-48496.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48496.exe7⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe8⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exe9⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13195.exe10⤵PID:9976
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exe10⤵PID:2800
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38192.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38192.exe10⤵PID:16812
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13750.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13750.exe9⤵PID:8304
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exe9⤵PID:4636
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe9⤵PID:6280
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15112.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15112.exe8⤵PID:6696
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58011.exe9⤵PID:10716
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe9⤵PID:15004
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28845.exe9⤵PID:3448
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2406.exe8⤵PID:11452
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe8⤵PID:16216
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36458.exe8⤵PID:1360
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61962.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61962.exe8⤵PID:8424
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe7⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe8⤵PID:9228
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34886.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34886.exe8⤵PID:12564
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56858.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56858.exe8⤵PID:6576
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15967.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15967.exe7⤵PID:9260
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe7⤵PID:12684
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63885.exe7⤵PID:8684
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57332.exe6⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1407.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1407.exe7⤵PID:3932
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38957.exe7⤵PID:6148
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46444.exe8⤵PID:8288
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exe8⤵PID:14680
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe8⤵PID:9776
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16603.exe7⤵PID:8976
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe7⤵PID:12640
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1847.exe7⤵PID:1540
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25528.exe7⤵PID:7272
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2450.exe6⤵PID:6112
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27168.exe7⤵PID:7988
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe7⤵PID:11976
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54720.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54720.exe7⤵PID:7020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 4688⤵
- Program crash
PID:6916
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35341.exe6⤵PID:9016
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15581.exe6⤵PID:12992
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55854.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55854.exe6⤵PID:4748
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40431.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40431.exe6⤵PID:5960
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42662.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe7⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57022.exe8⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20012.exe9⤵PID:6664
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50336.exe10⤵PID:9540
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exe10⤵
- System Location Discovery: System Language Discovery
PID:14704 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 14704 -s 43611⤵
- Program crash
PID:1312
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-429.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-429.exe9⤵PID:9292
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exe9⤵PID:13496
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27135.exe9⤵PID:1312
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exe8⤵PID:6400
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exe9⤵PID:10320
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe9⤵PID:15012
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9795.exe9⤵PID:7224
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe8⤵PID:11224
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42173.exe8⤵
- System Location Discovery: System Language Discovery
PID:14260
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62226.exe8⤵
- System Location Discovery: System Language Discovery
PID:2108
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56285.exe7⤵PID:6800
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exe8⤵PID:5868
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe8⤵PID:14980
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35374.exe8⤵PID:3436
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exe7⤵PID:10460
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2966.exe7⤵PID:15108
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38252.exe7⤵PID:6588
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe6⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe7⤵
- System Location Discovery: System Language Discovery
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-22734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22734.exe8⤵
- System Location Discovery: System Language Discovery
PID:8440
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37486.exe8⤵PID:13568
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24997.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24997.exe8⤵PID:10100
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe7⤵PID:8984
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe7⤵PID:12952
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15468.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15468.exe7⤵PID:7840
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10591.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10591.exe6⤵PID:6240
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17965.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17965.exe7⤵PID:9060
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8212.exe7⤵
- System Location Discovery: System Language Discovery
PID:13876
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13522.exe7⤵PID:4920
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17123.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17123.exe6⤵PID:10192
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe6⤵PID:13360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13360 -s 4647⤵
- Program crash
PID:15796
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42872.exe6⤵PID:4436
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe6⤵PID:6592
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21369.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exe6⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63244.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63244.exe7⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22150.exe8⤵PID:6628
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17773.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17773.exe9⤵PID:9616
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21757.exe9⤵PID:13728
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exe9⤵PID:7364
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-429.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-429.exe8⤵PID:9448
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exe8⤵PID:13296
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22266.exe8⤵
- System Location Discovery: System Language Discovery
PID:7908
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe7⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28354.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28354.exe8⤵PID:10536
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8566.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8566.exe8⤵PID:13196
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59380.exe8⤵PID:14052
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe7⤵PID:10776
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28167.exe7⤵PID:14852
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45698.exe7⤵PID:8168
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe6⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe7⤵PID:7404
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32262.exe8⤵PID:7804
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-403.exe7⤵PID:11372
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe7⤵PID:15920
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2344.exe7⤵PID:16292
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61432.exe7⤵PID:8420
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21037.exe6⤵PID:8224
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe6⤵PID:11876
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exe6⤵PID:1304
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63005.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63005.exe5⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-193.exe6⤵PID:5472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 6287⤵
- Program crash
PID:8552
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe6⤵PID:6568
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe6⤵PID:11568
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48333.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48333.exe6⤵PID:7860
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47947.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47947.exe5⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49342.exe6⤵PID:6452
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49303.exe6⤵PID:11928
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59878.exe6⤵PID:876
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24997.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24997.exe6⤵PID:16884
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe5⤵PID:8876
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36731.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36731.exe5⤵PID:13052
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63784.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63784.exe5⤵PID:7148
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28381.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28381.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-15824.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15824.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe7⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe8⤵PID:7396
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-403.exe8⤵PID:10436
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe8⤵PID:15636
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11384.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11384.exe8⤵PID:16876
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21037.exe7⤵PID:8216
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe7⤵PID:11384
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45890.exe7⤵PID:7144
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe6⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe7⤵PID:8080
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59609.exe7⤵PID:11740
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45323.exe7⤵PID:2136
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14691.exe7⤵PID:7360
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5661.exe6⤵PID:8716
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exe6⤵PID:12920
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6995.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6995.exe6⤵PID:4588
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23891.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23891.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-54910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54910.exe6⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48574.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48574.exe7⤵PID:7520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7520 -s 6408⤵
- Program crash
PID:16252
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27922.exe7⤵PID:10780
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe7⤵PID:15596
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe6⤵PID:8252
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe6⤵PID:11704
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe5⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56742.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56742.exe6⤵PID:7348
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46226.exe7⤵PID:11576
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe7⤵PID:3104
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-403.exe6⤵PID:11404
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe6⤵PID:15928
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46387.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46387.exe6⤵PID:16972
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe5⤵PID:7960
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17252.exe5⤵PID:11584
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11609.exe5⤵PID:7740
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exe6⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58231.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58231.exe7⤵PID:6596
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1135.exe8⤵PID:10384
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11649.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11649.exe9⤵PID:6224
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe8⤵PID:14956
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60942.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60942.exe8⤵PID:16804
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe7⤵PID:10712
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2966.exe7⤵PID:15100
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1111.exe7⤵PID:7920
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe6⤵PID:5604
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe7⤵PID:7412
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8831.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8831.exe8⤵PID:1188
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-720.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-720.exe8⤵
- System Location Discovery: System Language Discovery
PID:14776
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-403.exe7⤵
- System Location Discovery: System Language Discovery
PID:10428
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe7⤵PID:15608
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe7⤵PID:15340
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe6⤵PID:8076
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe6⤵PID:14656
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50467.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50467.exe6⤵PID:3888
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11962.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11962.exe6⤵PID:10412
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe5⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-577.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-577.exe6⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe7⤵PID:9780
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exe7⤵PID:13524
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62232.exe6⤵PID:8896
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe6⤵PID:12960
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36543.exe6⤵PID:5252
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15251.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15251.exe5⤵PID:6556
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exe6⤵PID:8324
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exe6⤵PID:12456
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8731.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8731.exe6⤵PID:4812
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe5⤵PID:3328
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48645.exe5⤵PID:13592
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe5⤵PID:16420
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33758.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe5⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15990.exe6⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe7⤵PID:7428
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64726.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64726.exe8⤵PID:4648
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exe8⤵PID:14696
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33663.exe8⤵PID:7324
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11202.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11202.exe7⤵PID:11124
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29208.exe7⤵PID:12968
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58639.exe7⤵PID:16900
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exe6⤵PID:7512
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7725.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7725.exe6⤵PID:12464
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe6⤵PID:5768
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe5⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exe6⤵PID:8356
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exe6⤵PID:12396
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10799.exe6⤵PID:11108
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe5⤵PID:9256
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46746.exe5⤵PID:12636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12636 -s 4646⤵
- Program crash
PID:15424
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4362.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4362.exe5⤵PID:4728
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12185.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12185.exe5⤵PID:16588
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57547.exe4⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58091.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58091.exe5⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe6⤵PID:6724
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe7⤵PID:7692
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe7⤵
- System Location Discovery: System Language Discovery
PID:11996
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58124.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58124.exe7⤵
- System Location Discovery: System Language Discovery
PID:2400
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46963.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46963.exe7⤵PID:15152
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37234.exe6⤵PID:9192
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe6⤵
- System Location Discovery: System Language Discovery
PID:13264
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe6⤵PID:7912
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52061.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52061.exe5⤵PID:6228
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48198.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48198.exe6⤵PID:3924
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe6⤵PID:14968
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe5⤵PID:10992
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28167.exe5⤵PID:15116
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4857.exe5⤵PID:6320
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27820.exe4⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe5⤵PID:7384
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-403.exe5⤵PID:10688
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe5⤵PID:15628
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36543.exe5⤵PID:9208
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18767.exe4⤵PID:8116
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe4⤵PID:11956
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35890.exe4⤵PID:2980
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35926.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35926.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-4858.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4858.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-17360.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17360.exe7⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28673.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28673.exe8⤵
- System Location Discovery: System Language Discovery
PID:6456 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-8501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8501.exe9⤵
- System Location Discovery: System Language Discovery
PID:8068 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-40222.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40222.exe10⤵PID:1952
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16829.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16829.exe10⤵PID:17356
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47191.exe9⤵PID:11012
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62610.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62610.exe9⤵PID:8204
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55325.exe8⤵PID:8748
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39001.exe8⤵PID:13088
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe8⤵PID:1608
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2013.exe7⤵PID:7120
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe8⤵PID:10188
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16952.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16952.exe8⤵PID:12472
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7657.exe8⤵PID:9520
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33735.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33735.exe7⤵PID:9700
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe7⤵PID:14836
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6604.exe7⤵PID:5908
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe6⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe7⤵PID:7376
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-403.exe7⤵PID:10552
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe7⤵PID:15644
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28681.exe7⤵PID:16508
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe6⤵PID:7856
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51316.exe6⤵PID:12040
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56534.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56534.exe6⤵PID:6768
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-7053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7053.exe6⤵PID:1912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 4847⤵
- Program crash
PID:5168
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3410.exe6⤵PID:7588
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62846.exe6⤵PID:11964
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40165.exe6⤵PID:6484
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61307.exe5⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54246.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54246.exe6⤵PID:6292
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59251.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59251.exe7⤵PID:10152
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exe7⤵PID:14720
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe7⤵PID:6500
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63060.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63060.exe6⤵PID:10216
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exe6⤵PID:13392
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35889.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35889.exe6⤵PID:6064
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe5⤵PID:6744
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe6⤵PID:1084
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exe6⤵PID:14732
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58043.exe5⤵PID:9000
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57538.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57538.exe5⤵PID:13132
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe5⤵PID:8036
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-65517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65517.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4652 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 6406⤵
- Program crash
PID:4856
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33420.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33420.exe5⤵PID:5716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 4886⤵
- Program crash
PID:6716
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64784.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64784.exe5⤵PID:8800
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44866.exe5⤵PID:13076
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe5⤵PID:6012
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28660.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-17084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17084.exe5⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exe6⤵PID:7576
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61171.exe6⤵PID:11556
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59905.exe6⤵PID:3116
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe6⤵PID:17080
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe5⤵PID:7248
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe5⤵PID:11572
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30627.exe5⤵PID:7156
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60657.exe5⤵PID:8444
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53021.exe4⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49643.exe5⤵PID:7288
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe6⤵PID:6068
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exe5⤵PID:7964
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6650.exe5⤵PID:15524
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe5⤵PID:16780
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41865.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41865.exe4⤵PID:7708
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17252.exe4⤵PID:11460
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39918.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39918.exe4⤵PID:9728
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56507.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-774.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-774.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-50743.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50743.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe6⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-577.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-577.exe7⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17547.exe8⤵PID:6472
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-102.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-102.exe8⤵PID:11844
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7994.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7994.exe8⤵PID:15664
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe8⤵PID:9076
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exe7⤵PID:8820
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe7⤵PID:12984
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2536.exe7⤵PID:4820
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4378.exe7⤵PID:5104
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34380.exe6⤵PID:6300
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39454.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39454.exe7⤵PID:8904
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26033.exe7⤵PID:13652
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe7⤵PID:7220
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11258.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11258.exe6⤵PID:8112
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe6⤵PID:13376
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54058.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54058.exe6⤵PID:3084
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32605.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32605.exe5⤵PID:3084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 4926⤵
- Program crash
PID:5200
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18458.exe5⤵PID:6404
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe6⤵PID:10228
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54477.exe6⤵PID:14324
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe6⤵PID:4048
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20320.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20320.exe6⤵PID:8840
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42697.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42697.exe5⤵PID:9140
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48645.exe5⤵
- System Location Discovery: System Language Discovery
PID:13604
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe5⤵PID:9552
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58589.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58589.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exe5⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe6⤵PID:6488
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13387.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13387.exe7⤵PID:8776
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe7⤵PID:14996
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17963.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17963.exe7⤵PID:6468
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27485.exe6⤵PID:5996
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24301.exe6⤵PID:13200
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe6⤵PID:8600
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17852.exe5⤵
- System Location Discovery: System Language Discovery
PID:6708 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-48657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48657.exe6⤵PID:8092
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe6⤵PID:11988
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe6⤵PID:1672
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe5⤵PID:9200
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7917.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7917.exe5⤵
- System Location Discovery: System Language Discovery
PID:13272
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15163.exe5⤵PID:7028
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe4⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65299.exe5⤵PID:7132
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6363.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6363.exe6⤵
- System Location Discovery: System Language Discovery
PID:7100 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exe7⤵PID:5916
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-102.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-102.exe6⤵PID:12080
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exe6⤵PID:7040
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36196.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36196.exe5⤵
- System Location Discovery: System Language Discovery
PID:8844
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44866.exe5⤵PID:13096
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe5⤵PID:7552
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-120.exe4⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27010.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27010.exe5⤵PID:9328
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63859.exe5⤵PID:13704
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50636.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50636.exe5⤵PID:6992
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe4⤵PID:9460
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48637.exe4⤵PID:12860
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe4⤵PID:16236
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe4⤵PID:8624
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-55211.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55211.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-54910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54910.exe5⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49643.exe6⤵PID:7296
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exe6⤵PID:9716
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6650.exe6⤵PID:15508
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe6⤵PID:16788
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44665.exe5⤵
- System Location Discovery: System Language Discovery
PID:7616
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe5⤵PID:11484
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43752.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43752.exe5⤵PID:6108
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe4⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24589.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24589.exe5⤵PID:6412
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40331.exe6⤵
- System Location Discovery: System Language Discovery
PID:9800
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exe6⤵PID:12048
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35374.exe6⤵PID:1020
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exe5⤵PID:9096
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exe5⤵PID:13368
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60094.exe4⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe5⤵PID:9836
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exe5⤵PID:13600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13600 -s 4486⤵
- Program crash
PID:15792
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54040.exe5⤵PID:1948
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20320.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20320.exe5⤵PID:8380
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25069.exe4⤵PID:8276
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2966.exe4⤵PID:15124
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19777.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19777.exe4⤵PID:5496
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe4⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exe5⤵PID:7448
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46252.exe6⤵PID:9492
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exe6⤵PID:14664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 14664 -s 4647⤵
- Program crash
PID:12280
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23993.exe6⤵
- System Location Discovery: System Language Discovery
PID:16924
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49028.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49028.exe5⤵PID:11032
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54974.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54974.exe5⤵PID:6252
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58447.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58447.exe5⤵PID:7924
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe4⤵PID:8176
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe4⤵PID:11748
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe4⤵PID:4444
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15905.exe3⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50162.exe4⤵PID:6508
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe5⤵PID:1656
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exe5⤵PID:14748
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe5⤵PID:7280
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7336.exe4⤵
- System Location Discovery: System Language Discovery
PID:388
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51445.exe4⤵
- System Location Discovery: System Language Discovery
PID:13560
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1606.exe3⤵PID:6688
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe4⤵
- System Location Discovery: System Language Discovery
PID:8408
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43159.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43159.exe4⤵PID:13160
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43272.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43272.exe4⤵PID:15156
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17307.exe3⤵PID:9300
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19486.exe3⤵PID:12548
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61087.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61087.exe3⤵PID:7284
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54318.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54318.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-4749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4749.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-59186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59186.exe7⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18668.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18668.exe8⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31387.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31387.exe9⤵PID:6268
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48966.exe10⤵PID:10392
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32001.exe10⤵PID:15224
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52582.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52582.exe10⤵
- System Location Discovery: System Language Discovery
PID:5432
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe9⤵PID:8836
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33785.exe9⤵PID:14320
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54555.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54555.exe9⤵PID:16948
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exe8⤵PID:5468
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe8⤵PID:11248
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12515.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12515.exe8⤵PID:15708
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29361.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29361.exe8⤵
- System Location Discovery: System Language Discovery
PID:7188
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37011.exe7⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62396.exe8⤵PID:9568
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4700.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4700.exe8⤵PID:13108
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56123.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56123.exe7⤵PID:2424
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4902.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4902.exe7⤵PID:11712
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exe7⤵PID:9036
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10540.exe6⤵
- System Location Discovery: System Language Discovery
PID:920 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe7⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exe8⤵PID:7500
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62588.exe9⤵PID:10296
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe9⤵PID:15028
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23549.exe9⤵PID:6332
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43875.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43875.exe8⤵PID:11244
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5581.exe8⤵PID:15364
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe7⤵PID:7928
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe8⤵PID:4724
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe7⤵
- System Location Discovery: System Language Discovery
PID:11468
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe7⤵PID:16660
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64068.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64068.exe6⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exe7⤵PID:4244
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29379.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29379.exe7⤵PID:12768
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe7⤵PID:16912
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42061.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42061.exe6⤵PID:8852
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36200.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36200.exe6⤵PID:13060
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe6⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6415.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6415.exe7⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe8⤵PID:7568
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exe9⤵PID:10248
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe9⤵PID:15068
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe9⤵PID:7720
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50974.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50974.exe8⤵PID:11192
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5581.exe8⤵PID:3968
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44249.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44249.exe8⤵PID:7808
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65168.exe7⤵PID:8572
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31353.exe7⤵PID:11180
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35583.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35583.exe7⤵PID:16536
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40903.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40903.exe6⤵PID:6196
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exe7⤵PID:9064
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exe7⤵PID:12408
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe6⤵PID:9428
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52349.exe6⤵PID:12780
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20513.exe6⤵PID:1184
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21762.exe6⤵PID:17376
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13668.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13668.exe5⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20614.exe6⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1052.exe7⤵PID:9704
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exe7⤵PID:13244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13244 -s 4368⤵
- Program crash
PID:15704
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe7⤵PID:5952
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57463.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57463.exe6⤵PID:8724
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe6⤵PID:12908
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14596.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14596.exe6⤵PID:3688
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8462.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8462.exe6⤵PID:9996
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60504.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60504.exe5⤵PID:6188
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29581.exe6⤵PID:9100
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe6⤵PID:13108
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exe6⤵PID:14756
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe5⤵PID:10176
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35124.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35124.exe5⤵PID:13476
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33104.exe5⤵PID:3692
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe5⤵PID:4656
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8428.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-19092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19092.exe5⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27396.exe6⤵
- System Location Discovery: System Language Discovery
PID:7684
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe6⤵PID:11472
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26593.exe6⤵PID:16244
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25528.exe6⤵PID:9444
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe5⤵PID:6780
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe6⤵PID:10140
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe6⤵PID:13116
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40522.exe6⤵PID:5272
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe5⤵
- System Location Discovery: System Language Discovery
PID:9576
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8536.exe5⤵PID:13112
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49967.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49967.exe5⤵PID:15472
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49081.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49081.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-41588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41588.exe5⤵PID:5776
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe6⤵
- System Location Discovery: System Language Discovery
PID:7420 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-7933.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7933.exe7⤵PID:10560
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe7⤵
- System Location Discovery: System Language Discovery
PID:14884
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30023.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30023.exe7⤵PID:13696
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe6⤵PID:10544
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe6⤵PID:15480
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe6⤵PID:4968
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21037.exe5⤵PID:8208
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe5⤵PID:11512
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11079.exe5⤵PID:16632
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49767.exe4⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exe5⤵PID:6536
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53426.exe6⤵PID:5176
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41632.exe6⤵PID:12804
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2536.exe6⤵PID:4876
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41811.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41811.exe5⤵PID:8968
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe5⤵PID:12944
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe5⤵PID:8920
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61652.exe4⤵PID:6660
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16803.exe4⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57435.exe5⤵PID:10416
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe5⤵PID:14948
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54912.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54912.exe5⤵PID:4472
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59725.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59725.exe4⤵PID:10732
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34188.exe4⤵PID:15180
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe4⤵PID:4508
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-774.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-774.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46166.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe6⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20998.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20998.exe7⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33198.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33198.exe8⤵PID:8388
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe8⤵PID:12800
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14883.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14883.exe8⤵PID:16404
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42387.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42387.exe7⤵PID:7232
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64574.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64574.exe7⤵
- System Location Discovery: System Language Discovery
PID:12132
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25095.exe7⤵PID:5228
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24990.exe7⤵PID:8560
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58231.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58231.exe6⤵PID:6720
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14513.exe7⤵PID:12368
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20948.exe7⤵PID:4924
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe6⤵PID:10680
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2966.exe6⤵PID:15092
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7525.exe6⤵PID:5284
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56425.exe5⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19882.exe6⤵PID:8432
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42908.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42908.exe6⤵PID:12624
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21723.exe6⤵
- System Location Discovery: System Language Discovery
PID:5732
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48116.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48116.exe5⤵PID:6284
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7541.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7541.exe6⤵PID:7608
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28733.exe7⤵PID:14812
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9578.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9578.exe7⤵PID:15148
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe7⤵PID:8628
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58649.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58649.exe6⤵PID:11396
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46121.exe6⤵PID:15884
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29179.exe6⤵PID:15256
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe6⤵PID:8632
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62782.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62782.exe5⤵PID:8296
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60430.exe5⤵PID:5756
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60338.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60338.exe5⤵PID:9412
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61111.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-17084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17084.exe5⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60935.exe6⤵PID:6772
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22407.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22407.exe7⤵PID:10608
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe7⤵PID:15488
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58804.exe7⤵PID:7872
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57689.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57689.exe6⤵PID:10492
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22301.exe6⤵PID:14728
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36543.exe6⤵
- System Location Discovery: System Language Discovery
PID:6264
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe5⤵PID:6520
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25718.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25718.exe6⤵PID:14768
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24648.exe6⤵PID:3356
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2214.exe5⤵PID:10932
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55189.exe5⤵PID:14932
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40044.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40044.exe5⤵PID:5484
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19636.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19636.exe4⤵
- System Location Discovery: System Language Discovery
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe5⤵PID:7468
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4342.exe6⤵PID:8316
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exe6⤵PID:14688
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe6⤵PID:5032
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55250.exe5⤵PID:10868
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57989.exe5⤵PID:3612
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe5⤵PID:6364
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48392.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48392.exe4⤵PID:8156
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe4⤵PID:6652
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22872.exe4⤵PID:13584
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50504.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50504.exe4⤵PID:12264
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56974.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56974.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-2118.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2118.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-48086.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48086.exe5⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23520.exe6⤵PID:6340
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exe7⤵PID:6584
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49303.exe7⤵PID:11920
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exe6⤵PID:8828
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe6⤵PID:13000
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17606.exe6⤵PID:8024
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36326.exe5⤵PID:6636
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe6⤵PID:9584
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33288.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33288.exe6⤵PID:12688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12688 -s 4767⤵
- Program crash
PID:15688
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe6⤵
- System Location Discovery: System Language Discovery
PID:16824
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21071.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21071.exe5⤵PID:8884
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57310.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57310.exe5⤵PID:13548
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37721.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37721.exe5⤵PID:2748
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33420.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33420.exe4⤵PID:5756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5756 -s 4885⤵
- Program crash
PID:5792
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26745.exe4⤵PID:9348
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20632.exe4⤵PID:13688
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21186.exe4⤵PID:16672
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29373.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29373.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-13275.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13275.exe4⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35532.exe5⤵PID:6400
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27176.exe5⤵PID:7328
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27726.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27726.exe6⤵PID:13124
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe6⤵
- System Location Discovery: System Language Discovery
PID:7000
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64051.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64051.exe5⤵PID:10472
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6564.exe5⤵PID:15652
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41606.exe5⤵PID:5832
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52663.exe4⤵PID:6752
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39454.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39454.exe5⤵PID:8756
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1535.exe6⤵
- System Location Discovery: System Language Discovery
PID:6528
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21949.exe5⤵PID:13632
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21071.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21071.exe4⤵PID:8032
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48073.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48073.exe4⤵PID:13576
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61747.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61747.exe4⤵PID:16692
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63899.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63899.exe3⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe4⤵PID:7780
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51270.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51270.exe5⤵PID:12508
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-144.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-144.exe5⤵PID:16936
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61171.exe4⤵PID:11548
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe4⤵PID:7900
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44680.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44680.exe3⤵PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34318.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34318.exe3⤵PID:12012
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4277.exe3⤵PID:4576
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-774.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-774.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49181.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-60146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60146.exe6⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60722.exe7⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56475.exe8⤵PID:9472
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54238.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54238.exe8⤵
- System Location Discovery: System Language Discovery
PID:12784
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52774.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52774.exe8⤵PID:6276
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58212.exe7⤵PID:10072
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9910.exe7⤵
- System Location Discovery: System Language Discovery
PID:13300
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31499.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31499.exe7⤵PID:5592
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62393.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62393.exe6⤵PID:6232
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe7⤵PID:9592
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21757.exe7⤵PID:13736
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31678.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31678.exe6⤵PID:10160
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exe6⤵PID:13452
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe6⤵PID:5164
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5775.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5775.exe5⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exe6⤵
- System Location Discovery: System Language Discovery
PID:6180 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-17088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17088.exe7⤵PID:9628
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exe7⤵
- System Location Discovery: System Language Discovery
PID:13212
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3381.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3381.exe7⤵
- System Location Discovery: System Language Discovery
PID:16516
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35239.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35239.exe6⤵PID:8540
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exe6⤵PID:12580
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2536.exe6⤵PID:3020
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe6⤵PID:9336
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32274.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32274.exe5⤵PID:6648
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60450.exe6⤵PID:10272
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe6⤵PID:15060
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19464.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19464.exe6⤵PID:1940
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9501.exe5⤵PID:11196
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe5⤵PID:14428
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10219.exe5⤵PID:16524
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64126.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64126.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-60146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60146.exe5⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe6⤵PID:6504
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43346.exe7⤵PID:9868
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42525.exe7⤵
- System Location Discovery: System Language Discovery
PID:13172
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13879.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13879.exe7⤵PID:9532
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58212.exe6⤵PID:10080
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9910.exe6⤵PID:12260
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1847.exe6⤵PID:3144
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21762.exe6⤵PID:17368
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51214.exe5⤵PID:6732
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19719.exe6⤵PID:9560
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exe6⤵PID:13216
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23621.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23621.exe5⤵PID:9736
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe5⤵PID:14596
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2520.exe5⤵PID:7336
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe4⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exe5⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8234.exe6⤵PID:10396
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe6⤵PID:15020
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1435.exe6⤵PID:5140
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe5⤵PID:10124
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47024.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47024.exe5⤵PID:13236
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59905.exe5⤵PID:4948
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe5⤵PID:8636
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1050.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1050.exe4⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60450.exe5⤵PID:10264
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe5⤵PID:15044
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe5⤵PID:1680
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51047.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51047.exe5⤵PID:6600
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58503.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58503.exe4⤵
- System Location Discovery: System Language Discovery
PID:11212 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-61597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61597.exe5⤵PID:1104
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe4⤵PID:12448
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe4⤵PID:4404
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-26898.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26898.exe5⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe6⤵PID:6388
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55292.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55292.exe7⤵PID:13352
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56578.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56578.exe7⤵PID:1424
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe6⤵PID:10984
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55189.exe6⤵PID:14920
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37522.exe6⤵PID:7180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7180 -s 2127⤵
- Program crash
PID:9528
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34380.exe5⤵PID:6308
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49342.exe6⤵PID:3996
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe6⤵PID:11884
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45209.exe6⤵PID:1624
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38142.exe5⤵PID:9008
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exe5⤵PID:13008
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6995.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6995.exe5⤵PID:3004
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13062.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13062.exe4⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24205.exe5⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe6⤵PID:7544
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2817.exe7⤵PID:7076
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe6⤵PID:11140
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21692.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21692.exe5⤵PID:8260
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe5⤵PID:11316
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe5⤵PID:13320
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50062.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50062.exe4⤵PID:6608
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32046.exe5⤵PID:7592
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44109.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44109.exe6⤵PID:12536
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26786.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26786.exe6⤵PID:6348
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58649.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58649.exe5⤵PID:11388
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46121.exe5⤵PID:15868
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe5⤵PID:16864
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26903.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26903.exe4⤵PID:8008
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33787.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33787.exe4⤵PID:12020
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe4⤵PID:6216
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43243.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43243.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-37012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37012.exe4⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13322.exe5⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exe6⤵PID:7456
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe7⤵PID:10852
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61166.exe7⤵PID:15584
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48690.exe7⤵PID:16888
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-403.exe6⤵PID:10600
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe6⤵PID:15616
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe6⤵PID:14696
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 14696 -s 4647⤵
- Program crash
PID:6996
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe5⤵PID:6448
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36588.exe5⤵PID:11188
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36465.exe5⤵PID:4604
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49268.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49268.exe4⤵
- System Location Discovery: System Language Discovery
PID:6440 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-40414.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40414.exe5⤵PID:11072
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe5⤵PID:15084
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17891.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17891.exe4⤵PID:9360
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5412.exe4⤵PID:11116
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26593.exe4⤵PID:16224
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9663.exe4⤵PID:6816
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33732.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33732.exe3⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2715.exe4⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe5⤵
- System Location Discovery: System Language Discovery
PID:3368
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42888.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42888.exe5⤵PID:11948
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39982.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39982.exe5⤵PID:15204
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5354.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5354.exe5⤵PID:7268
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe4⤵PID:8992
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe4⤵PID:12976
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14596.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14596.exe4⤵PID:1068
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe4⤵PID:9480
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28787.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28787.exe3⤵PID:6736
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe4⤵PID:5720
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exe4⤵PID:12532
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1736.exe3⤵
- System Location Discovery: System Language Discovery
PID:4448
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49175.exe3⤵PID:13532
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe3⤵PID:2492
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35096.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35096.exe3⤵
- System Location Discovery: System Language Discovery
PID:14156
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62372.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-4858.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4858.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-41432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41432.exe5⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19820.exe6⤵
- System Location Discovery: System Language Discovery
PID:6852 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exe7⤵PID:8180
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30828.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30828.exe7⤵PID:11820
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9603.exe7⤵PID:7748
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51049.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51049.exe6⤵PID:8792
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39001.exe6⤵PID:13068
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25095.exe6⤵PID:2124
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe6⤵PID:14672
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64644.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64644.exe5⤵PID:6788
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11708.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11708.exe6⤵PID:8340
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29650.exe6⤵PID:11900
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe6⤵PID:5628
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe5⤵PID:9236
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45822.exe5⤵PID:12576
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45690.exe5⤵
- System Location Discovery: System Language Discovery
PID:9380
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5775.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5775.exe4⤵
- System Location Discovery: System Language Discovery
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-18450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18450.exe5⤵PID:7024
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14757.exe6⤵PID:9248
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18934.exe6⤵PID:13668
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34299.exe6⤵PID:7676
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26386.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26386.exe5⤵PID:9744
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exe5⤵PID:14740
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28574.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28574.exe4⤵
- System Location Discovery: System Language Discovery
PID:6352 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-13387.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13387.exe5⤵PID:9424
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe5⤵PID:15052
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8731.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8731.exe5⤵PID:1196
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27290.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27290.exe4⤵PID:10804
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2966.exe4⤵PID:14868
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe4⤵PID:7904
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29315.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-41432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41432.exe4⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exe5⤵PID:6256
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18541.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18541.exe6⤵PID:10376
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe6⤵PID:14988
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54440.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54440.exe6⤵PID:9756
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe5⤵PID:10116
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47024.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47024.exe5⤵PID:13528
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13522.exe5⤵PID:7508
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28847.exe4⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40968.exe5⤵
- System Location Discovery: System Language Discovery
PID:10924
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57989.exe5⤵PID:15348
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe4⤵PID:11084
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55189.exe4⤵PID:14940
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55997.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55997.exe4⤵PID:16960
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4623.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4623.exe3⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60769.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60769.exe4⤵PID:6204
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3190.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3190.exe5⤵PID:9496
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34694.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34694.exe5⤵PID:13040
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39458.exe5⤵PID:5052
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14883.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14883.exe5⤵PID:8396
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63060.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63060.exe4⤵PID:7972
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe4⤵PID:13872
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe4⤵PID:16580
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55927.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55927.exe3⤵PID:6616
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe4⤵PID:7488
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38525.exe5⤵PID:12744
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe5⤵PID:6496
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27922.exe4⤵PID:10920
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe4⤵PID:15576
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe3⤵PID:8120
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17252.exe3⤵PID:11352
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15693.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15693.exe3⤵
- System Location Discovery: System Language Discovery
PID:5204
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6042.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-16317.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16317.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe4⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57344.exe5⤵PID:6656
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63958.exe6⤵PID:9808
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exe6⤵PID:13048
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26386.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26386.exe5⤵PID:9764
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exe5⤵PID:14712
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26408.exe4⤵PID:6660
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1711.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1711.exe5⤵PID:10696
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe5⤵PID:15076
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21855.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21855.exe5⤵PID:7944
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe4⤵PID:11232
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-835.exe4⤵PID:14908
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe3⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exe4⤵PID:8336
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exe4⤵PID:12492
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe4⤵PID:4580
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5661.exe3⤵PID:8908
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1981.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1981.exe4⤵PID:16136
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61405.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61405.exe4⤵PID:7776
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exe3⤵PID:13016
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36657.exe3⤵PID:4776
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25528.exe3⤵PID:11092
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25661.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe3⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10198.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10198.exe4⤵PID:6356
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33232.exe5⤵PID:9768
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exe5⤵PID:12520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12520 -s 4366⤵
- Program crash
PID:16012
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65026.exe5⤵PID:4076
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63060.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63060.exe4⤵PID:10208
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54460.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54460.exe4⤵PID:13464
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47539.exe4⤵PID:1208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 4645⤵
- Program crash
PID:6868
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2013.exe3⤵PID:7128
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exe4⤵PID:3216
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exe4⤵PID:12500
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4647.exe4⤵
- System Location Discovery: System Language Discovery
PID:16232
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe4⤵PID:16668
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe3⤵PID:9632
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5412.exe3⤵PID:13488
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26593.exe3⤵PID:16232
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36114.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36114.exe3⤵PID:16648
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44886.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44886.exe2⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exe3⤵PID:7440
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53543.exe4⤵PID:9832
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exe4⤵PID:14672
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11741.exe4⤵PID:7304
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28227.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28227.exe3⤵PID:11892
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25967.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25967.exe3⤵PID:3772
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18726.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18726.exe2⤵PID:8140
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe2⤵
- System Location Discovery: System Language Discovery
PID:11312
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40090.exe2⤵PID:13628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1608 -ip 16081⤵PID:4800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4652 -ip 46521⤵PID:4856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1912 -ip 19121⤵PID:2616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3084 -ip 30841⤵PID:1464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5716 -ip 57161⤵PID:6580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5756 -ip 57561⤵PID:7052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1608 -ip 16081⤵PID:5252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4652 -ip 46521⤵PID:5220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5472 -ip 54721⤵PID:7852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5472 -ip 54721⤵PID:8160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 7520 -ip 75201⤵PID:15340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 12520 -ip 125201⤵PID:15756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 13600 -ip 136001⤵PID:15468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 12048 -ip 120481⤵PID:15504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2800 -ip 28001⤵PID:16344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 13872 -ip 138721⤵PID:5228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 14664 -ip 146641⤵PID:16048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 14704 -ip 147041⤵PID:16200
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 14672 -ip 146721⤵PID:14164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 16136 -ip 161361⤵PID:4552
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 7180 -ip 71801⤵PID:9880
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:14244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 7020 -ip 70201⤵PID:4516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1208 -ip 12081⤵PID:6820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 14696 -ip 146961⤵PID:8468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 7808 -ip 78081⤵PID:7080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4724 -ip 47241⤵PID:9052
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:8280
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:7244
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:16956
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:10016
-
C:\Windows\system32\werfault.exewerfault.exe /hc /shared Global\b4ad90ca87714c48ab30bb5ff227e696 /t 1780 /p 40041⤵PID:8152
-
C:\Windows\system32\werfault.exewerfault.exe /hc /shared Global\eeb48ef7ae5546b7826b9824b932f30b /t 3860 /p 38321⤵PID:16932
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:10364
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:12184
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:14004
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:11960
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD503760f372a646b7f07fd95562373692b
SHA1b677e56ae4300b63ce440a3d1305ee9ca706aa7a
SHA256ac9233bab18d472e716bab450e0ff958d5abb1ef2bd957109242a2fddc936a05
SHA5127ac1e7b5511bec3836855637751720655ef9458a0083d7586a1fa75c041b4c65ca67dfba6209d06e5e73f2848d16c4a370d409c03a043154d0d6b963c5c52b01
-
Filesize
184KB
MD5735ecc96c82a77c2e57dc0059f1dbf94
SHA12c02f95cd5b8ae9509efb386d0fd82b5a8dc1239
SHA25627cdbc92c24deaa8c6a5853ec0d01fa8b33ff1d0a3e7ed9236de1aa340f9be34
SHA51223d47fba27445ff24fcdbb3e9fc21c09e27bfc1dd29864a5c9329ac3c54c5afa042b02979b52f313aa488f0519dccdd152832e2e21cf491dc2003699a3fd5061
-
Filesize
184KB
MD5b218a5962cdcd764c3e1fd7e40c1b293
SHA1be106071f8de21045e5578aeb8f5af4982e71754
SHA256ba395472885f1e80aa0a1739fe79591e704b2f61ec6f9046e93199f616933372
SHA5124451fe84ff600489c82e7be98fa62459bcb26ac9c680b9e5698089984fff16e87cf29f2ed1694938abfb4a5751e052d066cb81230bb9e581b8640f19e02737f3
-
Filesize
184KB
MD5883f9ba89bb175a64c675d442587d9cc
SHA1286c7ed3cde27b39a00751c17e7a12cd1857c763
SHA2567310ee454cdb3693d49737112e1ade770ba5e22971586b38fe34dfcb7eb15668
SHA5129614c3e1042e9e45f4397cc5a19c1ccaa91f84a650573f9d12d86240af7fbea22e64ae95bef5c340499becff6cf252bf817cb4beb282148779598c2ac4ed3983
-
Filesize
184KB
MD5be9d4c3336649c527d72b8350645969f
SHA1f948b805216b00e815f670aff8c1c04f06f9a76f
SHA256ab86fb623458d25e9b87da7d830587d777b62c61575ecd52fa38d3377b44da6d
SHA512ddd151f1c433ac34ae018bb5178b2044eaf460a359a07c2ce4c0d462b132721437b7616057cf863f9181303f549fd79ee669ae942b791a2d1601ad6d01c2a9c2
-
Filesize
184KB
MD58d9dfa139cd4cd1e9266b7f727452298
SHA16ae50f71e6843b80e48f44a9436b7738057a776b
SHA256608c3001e77f1edc1de50f3837b1af0f03bd14dfccac38b5a12676782f363ed4
SHA512318f1189fb75fbfbb260a8a7fb6578d849d80cfcf023d3916a3a727232a21bde0e04ee3bb5d6b1cf272e1b7999c96b1bd73705c26a7f0a24463b4cb554b828c6
-
Filesize
184KB
MD5b4a17c398ce809a84b210cda78f4c4d5
SHA17d03b5a951dc1564a7b56c74865e085a6d502989
SHA25682daf296faf5f0e45819317615a719087d0f1333c1bef603228fbe30d1e07bd4
SHA512034a25373a759daef2e9eb096da390266f1b37b363bdd8284a67410fd87eca26d06d3babc4f05cbed84bf944ca1f8b1bf37ac9c0595764e9780820a857081c35
-
Filesize
184KB
MD525e51ba26eb7e7a749b6e66877d09f6f
SHA101c5272952930fcf872e120e93d11300bb78b8c0
SHA25671b864acda3c55b857c1bc86d2cb6ab17a85c8e35144261285b6d945cad914b2
SHA5126c07dc49682163af77ba5e9714fd6b125c5b9ba1f7f9514b9c81840a57004aa0426da1ba524e53d2eeeddc335045b035d79282cb3451750c74893c7c695471cb
-
Filesize
184KB
MD5d175aa7ce8f4baa82b630746c17ce21c
SHA101dbc7c7db0c6b54565c721ce47667825f0374fc
SHA2561ea0db403bcb5d1d73cc3c27c73e228129a297b8b65f6f6ca6af410b23fc2b7f
SHA51217cdc48f7f3cf301338e75498d6017feb2674c02e3fd2c4940efed287533559dc92b9552bb5b5b48338e2aec74176d210ed1081885f82906bedfa97a0c24c409
-
Filesize
184KB
MD515122c6da84b99719051870d8ddc2264
SHA1369d3aba75b03bbedd3c7042379f3e4e381b879c
SHA25679c7b5f2b31c99b87cc315cd4a301fdf400a799f75a801f3bbea69ff06159321
SHA512c2b81382b45ae291c7680eaa9739044030bb525be7bb58ff199982672587acac0343834b74493bcbbb9a8681bd65bb0ffcc4954790de08b5c772726a675b3924
-
Filesize
184KB
MD5ca508b91590ccfa86b4b7d1d22f45756
SHA1b8d2d8d19191abdf49e48d7ad253c54db7170084
SHA256974706632236166438e0597749dd784f05b2df6f7479473d498af2d628411cef
SHA5121b6cd6fa990d0f351b2e2bdc9188a2fd68e3c461ddac7f076a4d628606e9f156e5be39054e624d9b0b73200681c336149abc85b0a29c13cb174298647d94329a
-
Filesize
184KB
MD558a4d6c1901a16a484fd9d7cd0320bd0
SHA1c7f45c1d837545e671169d92805003d1307917de
SHA2569ce7dcf5eacc12de62b1020c19e40c4070df7d7b5d89eabd13c86343d6c01ac3
SHA512f39ff730af21b89c667f5f0a4233098e9218c47861c2888a9a9ac4cc027418e1ab040e7f418454731d15131f90e808a477404219f8d5f6bf3a3fe3d662279e98
-
Filesize
184KB
MD5a4afab1d661e2a69b83ee70deaafcf25
SHA1b05ca68a3741b5e0e288f0478f1d1d76d6bc1ddb
SHA2560839b83ab47db3e4e242bf9f58207693a0ea50797adf27de8fdd6dd0d4540f76
SHA5129a8d7b85dbbe02816984ded4991c4848524b694b452ffd0b634abe38463c57fb9c05e9265a069a2d78489711a7083cfc8a7a68ee386681c09cd590752e7097bd
-
Filesize
184KB
MD5d9754003fe7f9fe650f7f4b1a65cf6f8
SHA1144c85896aa1e8683d83b749d3ca336167ef897f
SHA2562f54dc84dc4c0de2e429816c43089d5fe52bdcc34ecbe6250f91ca63c8a5e94e
SHA512ab47d0c1abf7bc0893a27437100671d16949b1f3bddfe8db28056b4b07ccc811639fbfd945f618e3fa2e83337f4b960bff0c6314058a51e5784c28190c339453
-
Filesize
184KB
MD5b784c8a20b578960aacfab3544fdb523
SHA12191257b1dcbc4be305be216dca4cc97da48ea8b
SHA2569039c04cf9061ccdae71685d98a829fb0377dd07fb7e1ce1a5d4299de27b7983
SHA512300c7c3661151de7a368240bb1a9dba88843f4f8ebb5ee4a4a2b6f42b019d43564137a99d63342eeeec391d1dee8197e579dab30eb617c99fe2875850e9f6ecd
-
Filesize
184KB
MD59c982151a00b01a2d5b15bc0e10ad968
SHA137d2343acba177c69b5e7577d9c49ac5794a76c4
SHA25657ea5ae55a64b8cb2a64994a44609cc778d71b70d7c4dc35b92717e57e356538
SHA512713d95fd470817e584d6bec4ec01d9b61182378952aae4434a2e0df65ca078c5f1d77640c85e3dd9a4e63430844787c6dbb12b7f2d406e53068f762dcc19b8e6
-
Filesize
184KB
MD58100c71ac76cc9d308a786396c24f680
SHA1dcfa225d79a0c080e70568718896f7924bed481f
SHA256f56c318c321e79f9dd67ba2e6a7385b02971b1038c95699d8beb0a4fe0fc14b1
SHA512b70f81ccd56521b2a6e465f485dcff559d0953e4e659dd5237f4c2c458364cc263b58f66909afe9fd6fcd79fc352b6d9408f55ce13701b8c312817c09f6ead18
-
Filesize
184KB
MD53707af4c827339cc757d1fecf1929252
SHA1ccc3340f43c55c60d845a458aec6c1bb582e6ad6
SHA2563a8dd328ae58096fdcd6dcbd12231355f7622ede5a389cb693d24eee414b7d81
SHA5122c5ebdd3768cdb654e9b1d0b575df21482a9aa0b232848ea9ab730ddb90914b6ce6bbd6252476255956a3064dc0fe483d6b13307a2a0128fda9932809ec2c87c
-
Filesize
184KB
MD5fffb53a4a80d45c2f013beea7457161d
SHA1164030cf510196fa79359359b15ee3327acdde12
SHA256be8854b631463dd141063ee74db1aa68ab6c5ddf5deca130fe49211edfd18ebb
SHA512fa98be153ed4633c0ef620d09e1d17be060638d27780733541a0d53e6fdb05fd0f7ec6213e28f299019d967e356089ca4ddd308ad5fe0e9842ed57bad3aed244
-
Filesize
184KB
MD5df2924509049441b44abf9d164eb6371
SHA1ae45bae923765e738afdc1b10c5275293a3decd1
SHA256cf48c7000145bb96dcb15e3d85aafb6de352cbdbd81929d16df1893c286255d4
SHA512049e6af4e343c2f87a292030dc37c7708216d03be47e2c4257a15606d39bff443a99ee950910b8a8c9da6f4e25c30ea8dc51a762e794ef249740cf6edceb1cd0
-
Filesize
184KB
MD536512e8448429a5d1f205a49a29593d6
SHA193d1d9d928595b713dec73030f96bb4b043271eb
SHA25622483e6199c1c8eb7bd3451815a1277d3c8a43740dc43855f7db4a9cdcf14dd0
SHA512f0a946a096decf8a522ec0101b54edf57178f86de2cc87bf689ed57c13b1509019ec7ec309eb1d5f20522ce4c79fbcbf98d5f3a2e750991456c118739cf3abb0
-
Filesize
184KB
MD5dfed9eef946b42ad60dafd3d06ca063c
SHA14ebc4709ab3962714bd3c6e1fb9fd55313ec67b2
SHA2569096467dc3cf4e0637f230f0f0b8a45c51ee36d15e3f8c23d7d6472e7897cac3
SHA512e3e435d4cceb4e8a378f8606724bb4836019d1701f81acc30644bc072e6b297134842a809a5c5af0be736d28cfa473a55e5d102296c92403acb7c386a848610a
-
Filesize
184KB
MD550137d484a8f9c8d732015fca3556fc5
SHA12987de01412ed886e4f03c63a59af20cee25939f
SHA2561d69ef0361783e885507dc95a75716b5a57bd53cb615e702efd8faae8a3d0fae
SHA512ae28bea4f21221f6f7e6e6631fac8310de5f232b6e79b4b15c8a362995cefaa8008bcf6b1800dc1ab0c1f433201bd92e4a55886f48abb7f64c73c48005502647
-
Filesize
184KB
MD5c5541a9d524625ce04a99472da296edc
SHA1b50b8727368d7ef5746797d2fe9f9c7e937ef48d
SHA256e3bc90a38633b7c5667266c9bd55c732efb75a847b85f778094410b9a6e935c8
SHA5121c14edcefd7104ae3e6dcbe296589377e290ca60822cb937e997a175b121d7aeb40394e7752f3d7193d3eb8a587a673ec1a4be04aa5c3cf7fba8660f8ee1903c
-
Filesize
184KB
MD5392896535a25a04d212b984e082752fe
SHA11a12537251391d85ed9aa93029fc9267466ccee9
SHA256574d7b7e445df55d8f89ef3e6d354b261bbd9544c718ec5e4d02e3aef9028982
SHA5128fec4cf4108dc122aae30cb4356a8afa93c259cca2dc08fabb5169954810988b7eb64bf0d6b277fc952b354d85ccdb67b0017c637701f6ab5d7fad5fa8113564
-
Filesize
184KB
MD5a0804a4938d96c8e5d12a5b081b68ad1
SHA1310151dff2f6d29ac4d0b82ae51a5304680a283e
SHA256963922b026ea8869e6c69e9d0afbd2cdcc305e10e06c9efc93ee2aab9323e80c
SHA512f29d85914dc166561bfd27c124123d2fd3114620ca325f24f0f365030ac49737e60eef56ec1d016bd6073bb55437afd6f37fc3aa55e11415c151e5678409e135
-
Filesize
184KB
MD50aa56f30d86015c575d8ce24315c338b
SHA1ed91a788af6aa1edd371102e47ad979971c48ff7
SHA256578dd6d2643c884ce5fb69278491f84dffa575805c38949482ee41848c9f63c8
SHA512f723814c9b96db764d44c056332c75fe77b77b6be22cf335a9debdd58238096196d4982b4127c680a5890f420a6cb363bdc6a6b822f58b7d963aeeaab0a7cf74
-
Filesize
184KB
MD51e38f621c446391ee025d077ae21cf82
SHA1cae8f97679ab5e6c616ea725396dfa5c51761b3b
SHA256179463591c92ed3f57883f35b537f438261e5ce21fb7cd296bc932500dcea87d
SHA5121f8dbe37778f3ad38077234065c9edb71f1fc716cff8830f8671dec6d87aa11477a7afb5249bcc327c57ea22ff7aa0b51f01037bce90d3462102d8516e2fbfd8
-
Filesize
184KB
MD55eff703d75e58063d03ae6dc81d6e84f
SHA13eb50edf4a45774a85063184e31cc7fa3464476b
SHA256852e65f35b70794ebc7b4580a07a66bbfb65d7ee5d761468675c26b51afcacf8
SHA512a1086e7b9da67a782e56e1dcabc6ef36a46962ab8a5577a69e0b3f95131f14bd3f47cb171218d0c0327db3d0f1af2ee6cfa8959c77f85f0347b8fb51750b7db3
-
Filesize
184KB
MD5ffced7b5f915e8de844e83d73d03e85d
SHA111a069129723050f70e00acb9bc12b4dbfd38bc1
SHA256954b3fd31dd8798c99aab92d591bd798de14ed56ee346298f625f6d2b0a154ab
SHA51200356abb16c16a0f9666aff925d352729c157d524afdb48dfc445d2a073c98cd3f3e592441b8ec3681dd7c55d222ba6ba3d3c9986ff2dc8db126d89aa9a9bb99
-
Filesize
184KB
MD5fc7029fd4237ca9999919bc0de038481
SHA11b02e99f6ffcf5c417632b5d532492b429d39687
SHA2565ceaa2fe90facf5e4e7854423bd9d2571fac9731222d5251ae6a617fb445eff9
SHA512b97dab913c6fad84464e65b3b69ddc8f1957982df9f2a4534da41df6c9b897a28fb8f2371d988a2365b1110cb724dbc4af22c9564396dd0020812a34b852905e
-
Filesize
184KB
MD545c22cf21d70c8ea519adab08816ba8f
SHA192fad25fa311040450e9fb7a2e7d6a65c6c9e266
SHA25655f04c26b964df961b93913d1f3e72580c7cc67fb34bc01988e52dd7b042a236
SHA5124683a1d77f104d242f5a87f2708a038df39a18a347f45bde1d7cddd6ec1ab4c0e32f7a634f813b8d9736ab81d751ce267243b65e2a50121a8a81bcadbb55eade