Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08/09/2024, 19:22
General
-
Target
71df0f0306aaa00566ae77ec85bb2c20N.exe
-
Size
468KB
-
MD5
71df0f0306aaa00566ae77ec85bb2c20
-
SHA1
4842f18a2683d9a5f752c2673838607c567c5779
-
SHA256
31a940e2c6896b047023eb687cdc9caf43116dd9becee8a6d8c24e32a1b46be1
-
SHA512
c0cac30a1d10ebf662937fb4e5b751c839bd6353d0937a1c2b03ca0a5ac937d58471e4c1ab0033fbd40493f3191776371bc44f4f66de410c36f9fd50e5553da5
-
SSDEEP
3072:SO0sogKEvV5jtbY74AcTJf8w4ChCSppLJEHCxVWaJHLLSDqughlf:SO/okjjtw4dTJfhfxVJHPAqug
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
-
Drops file in System32 directory 5 IoCs
-
Program crash 9 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Modifies data under HKEY_USERS 48 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\71df0f0306aaa00566ae77ec85bb2c20N.exe"C:\Users\Admin\AppData\Local\Temp\71df0f0306aaa00566ae77ec85bb2c20N.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13257.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28668.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28668.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 4884⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43202.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43202.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19104.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14713.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25378.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50820.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17676.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18034.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43822.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33087.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33087.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1698.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-319.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47260.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47260.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19528.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39796.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39796.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43150.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43110.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43110.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9913.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9913.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55880.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55880.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28653.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28653.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56178.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38070.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10364.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47094.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39144.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39144.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54999.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39938.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16524.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-947.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-947.exe6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 15668 -s 4647⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40079.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9541.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9541.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29554.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29554.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32290.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32290.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40396.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13919.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40234.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63691.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28155.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27982.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27982.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32859.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62539.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36655.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36655.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61345.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41818.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41818.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60157.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60157.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32169.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32169.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55435.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28944.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28944.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55820.exe6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45803.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16634.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24496.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24496.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8024.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8024.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57826.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11055.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63691.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41778.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41778.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20617.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20617.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28414.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28414.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28278.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28278.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-291.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-291.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12834.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12834.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48718.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48718.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9643.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23370.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23370.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23810.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26393.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26393.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41683.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41683.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44152.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44152.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36655.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36655.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51807.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51807.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51932.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51932.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64049.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64049.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58620.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18112.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18112.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55820.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51545.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23795.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42892.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42892.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30744.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2020.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2020.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60733.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44895.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44895.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12247.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12247.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58850.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64049.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64049.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54606.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45516.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45516.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53724.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44331.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47784.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47784.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37106.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53390.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53390.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11811.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11811.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33515.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33515.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51911.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15755.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15755.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61579.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11811.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11811.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33515.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33515.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35939.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35939.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15049.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15049.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44729.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44729.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28959.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28959.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64085.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16634.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31512.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25346.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55435.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18574.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18574.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9982.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9982.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51728.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51728.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5331.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33669.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33669.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60987.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57854.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57854.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21324.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61584.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12819.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49633.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49633.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13950.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10364.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34956.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35012.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36980.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16634.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12731.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12731.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57713.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8460.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8460.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48000.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48000.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22783.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22783.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54226.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52322.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41166.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-357.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49155.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47194.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43468.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43468.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3603.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40618.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 15740 -s 4567⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32047.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32047.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58797.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58797.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59974.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59974.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3696.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3696.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28959.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28959.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14334.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39580.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39580.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57858.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57858.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32576.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32576.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54999.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16400.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16400.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41386.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41386.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60654.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18574.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18574.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13217.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63276.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46613.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46613.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30955.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30955.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24999.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62706.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62706.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43342.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36854.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36854.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32259.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10795.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51164.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30416.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41324.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51543.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43166.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38035.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38035.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46770.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51392.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51392.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3696.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3696.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37127.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37127.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38064.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38064.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64464.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64464.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63712.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63712.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54292.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54292.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5398.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39763.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39763.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44538.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44538.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57038.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57038.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17158.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59726.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59726.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44734.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45850.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50650.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40514.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40514.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17676.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33754.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33754.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23312.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14219.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7287.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13094.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15833.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15833.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39248.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39248.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40618.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6701.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44091.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44091.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5337.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29104.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40618.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9352.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9352.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47931.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47931.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36316.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36316.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33515.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33515.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22363.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22363.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27696.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27696.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29490.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29490.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38450.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28414.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28414.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7090.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7727.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7727.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42590.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42590.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19286.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45601.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45601.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51090.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60157.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60157.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49118.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49118.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38524.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44572.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44572.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60406.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29134.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61449.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61449.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38070.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30120.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39082.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39082.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25015.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25015.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58984.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58984.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44189.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57962.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57962.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64049.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64049.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58620.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9440.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9440.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29900.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31692.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31692.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63016.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29846.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62321.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46622.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46622.exe8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33515.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33515.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43830.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61257.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65206.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23986.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43664.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43664.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34667.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34667.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47714.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47714.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34956.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32267.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10593.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20764.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20764.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29118.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29118.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-302.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-302.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58622.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58622.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43342.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59713.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56886.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56886.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29680.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29680.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64635.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39078.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35434.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35434.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exe7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55122.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-982.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-982.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9909.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9909.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31464.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31464.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59399.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59399.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31512.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63691.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12120.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20120.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23795.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49986.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63691.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48000.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48000.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3478.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3478.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39082.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39082.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25015.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25015.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46770.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14911.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60157.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60157.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32169.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32169.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61277.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2536.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4074.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1376.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1376.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59726.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59726.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19654.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19400.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19400.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53032.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40344.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20520.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11428.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47032.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62784.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62784.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27084.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31193.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63011.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46187.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11563.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11563.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50820.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55942.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55942.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8627.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17852.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63338.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63338.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24870.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17905.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45497.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45497.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 16936 -s 4448⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46902.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46902.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25378.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19504.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19504.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40514.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40514.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27400.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27400.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29962.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29962.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29144.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29144.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57884.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57884.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60218.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60218.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20566.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20566.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44870.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1070.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38206.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39416.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17676.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24483.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53525.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14947.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14947.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18584.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54346.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64416.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61968.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17594.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16328.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2595.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7464.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7464.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3260.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3260.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47032.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37625.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37625.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18617.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18617.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42206.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53650.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17292.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17292.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20670.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56213.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32345.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17676.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14735.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14735.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21491.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44870.exe5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30908.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30908.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28810.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63766.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 16464 -s 4645⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45428.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46234.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30422.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30422.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26202.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26202.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27895.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27895.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2390.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2390.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37162.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30042.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19286.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20223.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20223.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41735.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41735.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61885.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28601.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28601.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35532.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38620.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39706.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39706.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12928.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12928.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41683.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41683.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4873.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4873.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1688.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1688.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11419.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17135.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11563.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11563.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46239.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63368.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63368.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45793.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45793.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28840.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40271.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10495.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10495.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40128.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40128.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52637.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9477.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25626.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25626.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57146.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-676.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-250.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23702.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23702.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10546.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10546.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-256.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-256.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34667.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34667.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33323.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34956.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23370.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23370.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23810.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28531.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41683.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41683.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19953.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21044.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21044.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7413.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7413.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60421.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60421.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45472.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45472.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55056.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55056.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20084.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61449.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61449.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11095.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64564.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12336.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24442.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24442.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62710.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62710.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28261.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28261.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38097.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38097.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56832.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56832.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16137.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16137.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1944.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1944.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62631.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62631.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 16488 -s 4644⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54992.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54992.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45746.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14609.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52902.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52902.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7723.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41692.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41692.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16328.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56457.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56457.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2595.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24587.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55026.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44785.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49093.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49093.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40312.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2595.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64276.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64180.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26342.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42892.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42892.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43550.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43550.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9062.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9062.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44895.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44895.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12247.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12247.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14481.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14481.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35200.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35200.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51932.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51932.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43628.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43628.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51543.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5180.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35484.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28144.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28144.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48538.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48538.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17698.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56457.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56457.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2595.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51512.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53280.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53280.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7308.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7308.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38794.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38794.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16996.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16996.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24688.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24688.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55855.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55855.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33897.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44605.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44605.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18112.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18112.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55820.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11707.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11707.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65170.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55522.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20084.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58709.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58709.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32859.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62539.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36655.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36655.exe5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60307.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50915.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50915.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25022.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17302.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17302.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24854.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24854.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43110.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43110.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13914.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13914.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22014.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47714.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47714.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34956.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32346.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39300.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39902.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39902.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2797.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2797.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5834.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5834.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59878.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57474.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31512.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25346.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59680.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59680.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63691.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18342.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52304.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52304.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63536.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58849.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37817.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7956.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53774.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53774.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45331.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58184.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58184.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56178.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38070.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36430.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62112.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62112.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5834.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5834.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39266.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14334.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63265.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63265.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23048.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18024.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18024.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32320.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32320.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56178.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 4365⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19404.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20723.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-951.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39710.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39710.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26113.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26113.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 16000 -s 4645⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39535.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61251.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61251.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47045.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47045.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45481.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45481.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14609.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37106.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34942.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34942.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34818.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34818.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-484.exe7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56178.exe6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 4367⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14334.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53343.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53343.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33078.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58184.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58184.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9011.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41718.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41718.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48922.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21262.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15833.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15833.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51512.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13976.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13976.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59886.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59886.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60209.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2679.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22947.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22947.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39352.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39352.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58114.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58114.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5180.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38490.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38490.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33071.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33071.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5485.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12575.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15455.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15455.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39710.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39710.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26113.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26113.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11174.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58797.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58797.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50915.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50915.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11055.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52598.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47931.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47931.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4195.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62482.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62482.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13914.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13914.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13846.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5828.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5828.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18265.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18265.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28270.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28270.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48658.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26198.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26198.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46120.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47324.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49135.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40494.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7090.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51719.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3119.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3119.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34133.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34133.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44625.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44625.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55714.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55714.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14018.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49031.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49031.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20120.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-110.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-110.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63691.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61321.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65332.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21542.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21542.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30731.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30731.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7775.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7775.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21262.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54728.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16400.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16400.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2466.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2466.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48342.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18864.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18864.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15011.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15724.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51278.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51278.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16520.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35434.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35434.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40618.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27786.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27786.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10546.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10546.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58978.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58978.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63271.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29431.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29431.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57858.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57858.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42616.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42616.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35757.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55284.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55284.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2943.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2943.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30838.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48738.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44625.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44625.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5040 -ip 50401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3216 -ip 32161⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 15668 -ip 156681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 15740 -ip 157401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 16532 -ip 165321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 16000 -ip 160001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 15740 -ip 157401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 14856 -ip 148561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4420 -ip 44201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 16936 -ip 169361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 16488 -ip 164881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 16592 -ip 165921⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 16960 -ip 169601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 16952 -ip 169521⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
468KB
MD577fe7328781c044b4587a7adea72d9aa
SHA1dae285751c1f36326b2ab94fdb498988338c9d3b
SHA2563522743b97ec43f87fb249d288f604fc886f75d6af1c6c30bdc990caa12e9abd
SHA512dc11baa22c33da90beece19775573c16edc2939b14879ca0fa6192309c4e6305d60eb48292c93b1263743bf091bded2643fe936aca626ab04ff587620daec003
-
Filesize
468KB
MD568d42f4727fa9e386251f396667f58a6
SHA138bdefa69432f56edb5184b740dabf9b096ec3da
SHA256ba99fbceadaf71d78ba644439b9499681ca53aef204661b0a9b5df8392be576f
SHA512a64ed12e92abd265deab65215187403b280a6acd3bd8580a2cb592f9c658f574d87f0ff29eac3fa6d05ed4da9ab25e48ed43d93cc694b19c8501f0018be1fb7b
-
Filesize
468KB
MD5cd7da7b30987750a90fcc84c93b74d8b
SHA1fa46118c74c06ccba995b48c6427ec66f760233c
SHA25604ae70472517e66d67a8ba9436b8fa6b7fe38a1b0492e8ea5fde39e827ad7bd7
SHA512041fe020f35494c7a8b817d33f9089600e20f7ee39e517d7b3528190868ebefbaf89d106b2522b6091a0c0859884443d9c7138eb39aec4671a42ecbce21c56ad
-
Filesize
468KB
MD5f6c19541184ab86f599ef29baf4105a2
SHA1c5ee17663f24f9186826df7a57718de0b40d72c4
SHA256d91c5ba58a46ee13a22616a3c8b74c13c0f5f3bd3c9232fa387745626eb70742
SHA51257c782f3b1091c2b9213b2840ac5dd7cdfd5e440fb42ed1a9e7d6ebbfed725eb7385c0f0335eea2d0e1e443abe55b9e93ba0fe04a96943cc7a2341021373fc54
-
Filesize
468KB
MD590f8a45c5400fb12d47f2bea5fad4b88
SHA1b2aa07dfd09321dd4a0abcb2255fbfbb69f3724f
SHA256cc78e2ea9cb39639f13327565babdca37427b71f18bf6b1122d88d4c5fcf6213
SHA512bed031e17fbd179eadf875c9af03a1bbd966c939ee458e2a4d5f42f31ab29a8fcabe6442161cdb96c754e70dd9f57761490a36824801e11654b8e86aacdf6942
-
Filesize
468KB
MD5d66765bd87a6600429edc086946a3b72
SHA1c775db7c68244527b892869e4c75d32f203debdf
SHA256f7cf387259ba9363dbdfb17739f1f78366941edad3b3685168c7e96bfbbe2ef7
SHA512d088ccb482f14eb4de4e77d04b68b86b858d061947d8552ad9591bcd50843a7f854fe2663e7fb8708348ac687d966a9a21dae74e22841752653fe8a05dd9ae38
-
Filesize
468KB
MD502749fc2d72b010aeca6c30a9f61486c
SHA12124352e45ab9d204b062fbd813fe37723384a61
SHA2562d20671d5e40f71ebd0d39fba3f0442128102dbcb6c625d6a470142a6369784f
SHA512ae46de0711722021cf84d3d8d984ffdd12a18153aa1686bcaaff4dcb0e046450083c236f0346bf8a7af0dd3ee35a276a7eb5a638eb5c44b6aec112c2bea9ed2d
-
Filesize
468KB
MD550980ce6b41b731f913fc14140fdb09e
SHA1dd76494fcd21ced06e287f33529cdc15672b4db4
SHA2567c95997dabccac4b218270d8272f30278864f37ea8777127cd7e4330fba0df69
SHA51292d05fa9faa1ae87f96d0f4b70a5d6b4704245f77070e5617c312987bb19ab23876c90f79f3b745522f4efb5065b69c5353fc0ca564fa9c7705b9e89bed8246c
-
Filesize
468KB
MD5d5033a2e3046d036627099375bda1041
SHA12415f697da83a35110c35917d846c7c2815d975c
SHA25662425a37a7e01a8df4dc558561c25266ed0688acb042f6739624d8c90ea23b9d
SHA51239ed780b935f621c4611ed6b2b7f21a58065c0758bfc264614c75c5d4368426f68b267397e3cb24fab48af72423a028b069c3fb4c6b3cdd7b6f35eff030d2e4c
-
Filesize
468KB
MD57dba4bb8cf9f55cc89ea80a0fe90d5c8
SHA1b1561bb9f6a7009998b570766032a30e0c087ce7
SHA25650d1d3e08e6c975feca49fe11cc5810085aee6e79430b4467597f0bd6cd3c050
SHA512fbd6c0adfb3452759ff2cea007b37a48e6c7a9d7df14b19db0bd76d8bf380053f4e3b586fe0bd0abf8bfd379f7a9ddec59ba2557d2cc767dfec0581e63bdfc6c
-
Filesize
468KB
MD5e6feeda5021e95df2ee7745f664c22a0
SHA1b06e9e06450ecd09a8d51fdc02486f19f4597bd1
SHA2560655e7ae829db63bd31803289b6b5a03339b59152c109b0d9c7bd312d2afed5f
SHA5129d8d70b568b4cd2813b45fcd7ce2ccf42d0f2626ab87b2198b944779bc98b865952c7be48e5b2d6d9aa67893d45b81581499f41a5f8cad7106f74656d489215a
-
Filesize
468KB
MD56931e330371d19747ff7311bc9761a33
SHA1e01caaa1b5f90287e619747a70a7a5a74f0daa86
SHA256be70ffa57892a76f51bdf4e8002dced1d620e5d5aa7a3726e48d57c9a4216545
SHA5128198092583b08ae606e0383548f748cdb147d89c8d17895aa1ea041d0020cf64077ed8163d4f2447a8877301fe7ce6b9ea059d80a2f256b392b9e2dbb2aaa99a
-
Filesize
468KB
MD5dc9a4b4117b60286a4283aa3bae8479e
SHA147a3496bde25cabe276fd7d07f2f28ce93e0b537
SHA2560ed08331628333c4f148abf1a8834b345ac54346f61d5ce227583d23a41eaf3c
SHA5126a372bee1e825df0a03d1170519484abe84ad565f11fe6a4e51799092e5cec96fe87f0d60da5eda46ef1bb4323255d9caa4dedad95508db8b18d240fdb962c2d
-
Filesize
468KB
MD54d116e7c66f61e336bb3a9f66f632445
SHA138e6bd40d9985f40cdd6351d203e0e45a4bdcf84
SHA2563bcbb0c3cde1242e993bc70b4b42dde0a1704f7484484d967b5c318ff736ea82
SHA51216cd4b521fe32c83a82508d486c859aea15347c8916a9482471732db57c20678fd5ba1b0974ca5bae4432e7438a46c74ee83a2f2a62a01596715ab8afe7cf98c
-
Filesize
468KB
MD5a11bf45e593407bd2fa3fa160734d400
SHA1a6724772b72b5d8cc84bceef0540ac5dbcb5d2ef
SHA25615f65013ba39669c6905c1cf5307a5a3278075b91e3f0356cc53e8c7fed4b7a6
SHA51227439a1e327bea80bb3e4e8accc5e1535e32fc49a707990ce23e45088efe1b907fbe4d4e6d370a20b9e3f0eb720a6e34f97ace1a5474ffb31c814938dc8e279f
-
Filesize
468KB
MD550fc11b46e3e85dd8030586420f6423e
SHA1db86c5f113fa32a60ed131dddf78a31368149eb3
SHA25652733694126bea185230790b83b7b5fb9050275c55494186f967092e1d5edce8
SHA5124eaed6c09e99ccf4098edde73b4a18d96b521e50c5f77d9db03bfda80544cb2f67d903efee82e6afffa1dc4ca744984034e4b5c24962cc38f1d7ea2c797d4e57
-
Filesize
468KB
MD519980e7e9fd8e7ca52da84bcb0ce5d4f
SHA1b2e74990cbf2d0b4d63f13153f1e946679449a60
SHA256f74e927171ca58dea37aedfd55458abde3237403ec7c778494c8ea6f760053e8
SHA5125806bdfe76065d681a6a5b1e7e3d07b763aaa0fa3af2a1cb6ec9050a779ecf638703238ac8bbc1e86a9d66d6e00039ac2367c86aa7b438cc567991091f46c2db
-
Filesize
468KB
MD5b31138f26d72da9da04cfa8c862062ff
SHA1684df48f5acc36983872e2775f729ad5e7165908
SHA256bbaf5573525318972cb6f6564e96deb640bc07fa6837ab868cf0ff194173d82d
SHA512dc4b1a30bd97ef0280e869a7548d4d9577b7f4f9dd834c97184ab6136c81111e1481b207941223c722e0798d046a955bf9350d20d5e67c7d0666a72a2d00c927
-
Filesize
468KB
MD5ad188dce0fc9e9fb1a6990cb2ac95d6d
SHA19fe56872dc10d685003403d9bf6984dd32761e11
SHA256966e2a85cf7350372cb136f5c3703ad7c1459bdacc576e335786e596b463fa7d
SHA5120928ce64ccfb3d6982346444e0d49ae10607331fcff9b99c45a03d4a3eb14bfedce0ee8ea575b0d3e0c93b3fad9b7485c377b4d6275691c455ee63e0cbdff971
-
Filesize
468KB
MD50b442b36c32e9666e97b120ae5c69f9e
SHA159556b1401b27b41f6edfaab7e94c30582b7595a
SHA25647daffa10fe04163514998d51dd8be84c5d5d2c0a44773bf3a3ee6e2bbb8f60a
SHA5128f7b462edf266420bcac39dedf158e2c5d79252e9475b18afbf1e02dd969c0347263b6b4bdeb6f053231ecab6852d14785790a5927c6972e7129cb45420232a1
-
Filesize
468KB
MD51fbbbae1dd8b2444f88aa9eddf9bb962
SHA1058ac60adf75941d41bf1ad966160a8b047209d6
SHA25686947a4d769fe641113516efb2b5788e74cdf6df76b9aef03af929ead3e8b6f2
SHA512c8b2df9ed174ec3da4c529e6b13a943d77e4c2219dc1867b22b9b0513bbda9759a600873cd381469d1077e2125307af6634b89e14547b93afef0ff66fd3eaa5d
-
Filesize
468KB
MD5ab5f99954f967dae7d56c18d303368b5
SHA1cedcc1b9105a48a3e1c1589d7bcab41af7ebe934
SHA256302f6ad5f96a2e683429ce46cd79b9e182c266c7cdd26086e213f0193cb2b749
SHA512632b4f1e0dfc2ed908ad2c92c7e43511c9cc13a8c446563c20c1cd5ffff3d4a7dc77cc87786d3b95a027de48b1d6739b8305755b90ac56ab6838d4e7f66dbb0f
-
Filesize
468KB
MD52021d00e089686f038ad5397ac05c6d8
SHA19f2728c4d4954d28d78ceb10e893c9ee9e61362c
SHA256c6bfbb9b6ee1931367293e121fe5d8bc8e227d73d1f0772add11d83fc07a26e3
SHA5126a9d8d95ccf64c79275d921a60abe7d4c7f5cb0b958e9b008ebf1170df10295b0fa38d341be1a9a8666a4d564dfdfb78ee7e8a1f0f0f192582198b4407c34173
-
Filesize
468KB
MD5cd3bced91207208f2d139fbe544ad4dc
SHA1307c9f99eee956fd559573b3e8fde9446e5e2d04
SHA2565257e12a608ec9b9fca7dc4ddcaeaedef63add76991c89ada50f233ff0c3864b
SHA512c8f6473f4e5dc71f4d667ac9ee8bbd6224e627a02aa69aaca324aa58c19d42ec329e6082ef6f86e3e07e1a7407cd710875356d14020deb74ecbb2dddb3c6fa54
-
Filesize
468KB
MD5990e3a335327d0866236bbb43d7a0f0f
SHA110ec1954948e3da1aa9549947e7bad8a8b7afa5b
SHA256eb7fb8d33a76aba402a4422f5aeaaed502288befd998b04fd0c3304716c7b775
SHA5129cc051f3c8fa2dce647d11282cb94a82e4f7f7ca7f02bea9397a7dbe52eff6bc061f096aa83aab48dab6c7a0150d9b5b6e9965eef23aae3d77d804a607fc2dbf
-
Filesize
468KB
MD5bd46a54b86bd23994f469213f19cdbae
SHA14aa170b65aac9677fd9292a9e62dea19e38ffe5c
SHA256aabbd1e626d956e409771241e51b81bda96cad67bc60b98c85b99f45beea63ac
SHA5122566c8c899f8bd37dde84ba3525de337e8cf5ebf9207efa0e00ee5da19133db6ea87a5a4e10fab037077bf5d77e708d55d2b5e0ad99c6e1caa755cae5d5ce8a8
-
Filesize
468KB
MD55b8dc14bca9c019c43d7b540f24b8198
SHA18d3cc1d3bae53c2b104ba3a762601a9435ee4a3f
SHA256a95521d6d3b89a74fde0852eb40b1522a295c3ccd88f4088bd782df716fcb935
SHA512b8452732d1d02e33155f12c252549f243ab409209cb9bbbeba875ef40cac1895b79151de872febcf796769d50b0d906a0012a4ed87e932930fa6a4691c53eda2
-
Filesize
468KB
MD506410429a5f4cca15bb48d9418d60808
SHA18e0c82d003fb524734426a149ad3801bd792905d
SHA256d0af135bf418a7a700b652ca023fde1adfd18819bd5d6ce80e32351b306b1359
SHA51200a3c79645a4c7685299810bce49821b4eabd91e8313ae9d7f38568db0d96460a0e1b3eefd7fce5e65d6ac58d5d5f0a57dff39cd661666e3a374243d7724f377
-
Filesize
468KB
MD53d559732fe5eba69f5430fa5fd88eb5c
SHA1c210b6b1ddccb25a08c1f8fae322b88462e5029a
SHA25690dc41b9240e1edee293260703dca90e4036732f3c72a7cec769cc447cce0c67
SHA512f8e0682d2fa44dd04f84f2e21ccb3465d915d0c11729ed387425330027675605ae750f7fb3e96d38f10fb12e0ccfece79e4ce93916d49ce410e04d8ff9fe07bd
-
Filesize
468KB
MD5f25c4c1ddd3b6d10f70d06f85f89f374
SHA1435c38b9bde18a5ec60c9df9dc62b004883d989f
SHA256c65707f518d42ea9484e0050465cb21d38d005e7ea11cec9103914a8ff2fc933
SHA5121a38ecd839f2ab507ed68e95f02488711600e3a9d98916d705b7f82240013cc1b1b74b417f9b62ae49173f7786a916e1447c9b380e2dbf019856c7cfced5e27c
-
Filesize
468KB
MD56918ad2d83bc6e67e0d4ab088c66183c
SHA100298617d7e895aa8c1b6a8bf1b02b192ebb88b7
SHA2567779cbbb815fa143c57d151112005ba18673ff17a76f77ca986bc3fbdce0bb78
SHA512af208778e81b39f3242826e3e29cb245bb9ff644548944d8f82c6ad84d7f3ee249d8e91cb1a333e1ebea58df15964089bde744fe460f2008b46699548e4ee7a5
-
Filesize
468KB
MD5db2759cd56fd5e5e9fa9fe190d19d84d
SHA17eaa66d86bde61f67c7116e66663c559b307a50a
SHA2563cb22b28b4fab537b330056a609ad5d020bfb80e873735b34bfac82e303f31e3
SHA512a47048f1e8d91e8e5491c5f77624cc14c3a619a3ad64445d4d1de1899b987b956e9ba344131756cece0ad760c7ac9b91539b6a3201884d9550595785d852dfec
-
Filesize
468KB
MD50f9275ee632e87ec0d6844e1840e65d4
SHA154b2712550da93568659b8a557ec0a697323f957
SHA2564f87ec7a7b4c488fce448557cdbd67b75c8373cba72b1ec66482e1b4392b9a5f
SHA5129c8f4cd5062d1d8c10b2d4a5dbc950cb65fe30a1577a5d23eeb6d76e716e8dbb1b02931b0ff599f1363dc642fc2fb11704c04d333b510d1eb51307e53ad9247e
-
Filesize
468KB
MD504498dddcfc035db0c14e92ca6dfa04f
SHA1aaf20b234a74c526454af203b5bcf9e3951aab2b
SHA256dae7a51e97bf9df1806a1faf3afda128041af0f367619d0a8b7f9f7ed7d0c2b6
SHA5126c97fe16cb472a796a6266eaf2795ce64d207cf461df745a2ffa79038fd537a8455ac8d98f528ae9961fe88e2124bf973625d61cb7971823b2a5965d1c22d8f7