Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/09/2024, 05:53
Static task
static1
Behavioral task
behavioral1
Sample
7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe
Resource
win10v2004-20240802-en
General
-
Target
7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe
-
Size
468KB
-
MD5
7b773f78a7a3cb3f5bd6e8fe39a134f0
-
SHA1
44b12b8de115bec9970a1ec149effc1d247d76a4
-
SHA256
859e5c9600386a4d2746dafa518d02437a874002a6ce4fc8485b840e619f0928
-
SHA512
766fe6b2cc8b44c8c4bf9affcf148b511781b9273e8141481cccfddb96532ee8ff4c8b0c01a0070ebcc1b73bd7edc7d35cb0c9600b043fd3b89f3368387bab14
-
SSDEEP
3072:1G3HogISIE5TtbY2HncOcf8/vChaP0p2JVHeTVPsQ7EL6KNgEElc:1G3obMTtxHcOcfSYHqQ7+BNgE
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2632 Unicorn-34680.exe 2676 Unicorn-46159.exe 2712 Unicorn-50990.exe 2688 Unicorn-27405.exe 2636 Unicorn-33112.exe 2536 Unicorn-52978.exe 2052 Unicorn-63184.exe 2408 Unicorn-43544.exe 2164 Unicorn-12909.exe 2820 Unicorn-43352.exe 1664 Unicorn-59423.exe 1660 Unicorn-2511.exe 380 Unicorn-51520.exe 2940 Unicorn-41934.exe 1308 Unicorn-41934.exe 1784 Unicorn-51167.exe 2180 Unicorn-16413.exe 2108 Unicorn-16679.exe 408 Unicorn-62158.exe 2304 Unicorn-57519.exe 268 Unicorn-9396.exe 1524 Unicorn-34092.exe 1800 Unicorn-48391.exe 1788 Unicorn-6404.exe 1616 Unicorn-28333.exe 1280 Unicorn-48199.exe 552 Unicorn-15911.exe 3032 Unicorn-20741.exe 2156 Unicorn-37077.exe 1700 Unicorn-10596.exe 900 Unicorn-31571.exe 1288 Unicorn-35677.exe 1640 Unicorn-52128.exe 2728 Unicorn-19066.exe 2652 Unicorn-4575.exe 2880 Unicorn-19450.exe 2700 Unicorn-18992.exe 2520 Unicorn-43954.exe 2976 Unicorn-30440.exe 2992 Unicorn-50306.exe 1352 Unicorn-24577.exe 3008 Unicorn-46331.exe 2084 Unicorn-46139.exe 2828 Unicorn-32416.exe 2856 Unicorn-59330.exe 568 Unicorn-7528.exe 1684 Unicorn-29995.exe 2952 Unicorn-38355.exe 1168 Unicorn-61442.exe 2500 Unicorn-40467.exe 2092 Unicorn-63818.exe 2288 Unicorn-31915.exe 2944 Unicorn-42313.exe 2204 Unicorn-12625.exe 1760 Unicorn-15230.exe 916 Unicorn-35096.exe 756 Unicorn-12629.exe 876 Unicorn-59600.exe 2044 Unicorn-30414.exe 1880 Unicorn-9439.exe 2504 Unicorn-41150.exe 1016 Unicorn-9247.exe 1644 Unicorn-63663.exe 1588 Unicorn-42304.exe -
Loads dropped DLL 64 IoCs
pid Process 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 2632 Unicorn-34680.exe 2632 Unicorn-34680.exe 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 2676 Unicorn-46159.exe 2676 Unicorn-46159.exe 2632 Unicorn-34680.exe 2712 Unicorn-50990.exe 2632 Unicorn-34680.exe 2712 Unicorn-50990.exe 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 2636 Unicorn-33112.exe 2636 Unicorn-33112.exe 2632 Unicorn-34680.exe 2632 Unicorn-34680.exe 2052 Unicorn-63184.exe 2052 Unicorn-63184.exe 2536 Unicorn-52978.exe 2688 Unicorn-27405.exe 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 2688 Unicorn-27405.exe 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 2536 Unicorn-52978.exe 2712 Unicorn-50990.exe 2676 Unicorn-46159.exe 2676 Unicorn-46159.exe 2712 Unicorn-50990.exe 2164 Unicorn-12909.exe 2164 Unicorn-12909.exe 2632 Unicorn-34680.exe 2408 Unicorn-43544.exe 2632 Unicorn-34680.exe 2408 Unicorn-43544.exe 2636 Unicorn-33112.exe 2636 Unicorn-33112.exe 2940 Unicorn-41934.exe 2940 Unicorn-41934.exe 1200 WerFault.exe 1200 WerFault.exe 1200 WerFault.exe 1200 WerFault.exe 2712 Unicorn-50990.exe 2676 Unicorn-46159.exe 2676 Unicorn-46159.exe 2712 Unicorn-50990.exe 2820 Unicorn-43352.exe 2820 Unicorn-43352.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 1200 WerFault.exe 1532 WerFault.exe 2052 Unicorn-63184.exe 380 Unicorn-51520.exe 380 Unicorn-51520.exe 2052 Unicorn-63184.exe 1660 Unicorn-2511.exe 1660 Unicorn-2511.exe -
Program crash 64 IoCs
pid pid_target Process procid_target 1200 1308 WerFault.exe 44 1532 1664 WerFault.exe 42 2012 3032 WerFault.exe 59 2136 2304 WerFault.exe 50 2420 380 WerFault.exe 40 2020 1700 WerFault.exe 61 2396 2944 WerFault.exe 87 2076 1800 WerFault.exe 53 2340 2500 WerFault.exe 84 1680 2092 WerFault.exe 85 2184 2224 WerFault.exe 101 1216 2008 WerFault.exe 110 2832 1028 WerFault.exe 124 1808 2244 WerFault.exe 125 2416 2788 WerFault.exe 100 2236 1456 WerFault.exe 114 2476 1880 WerFault.exe 95 644 756 WerFault.exe 92 3120 2388 WerFault.exe 121 3564 1252 WerFault.exe 139 3584 1096 WerFault.exe 136 3608 2776 WerFault.exe 144 3612 1716 WerFault.exe 140 3588 2592 WerFault.exe 132 3712 2060 WerFault.exe 130 3976 2000 WerFault.exe 106 3972 2504 WerFault.exe 96 4056 2652 WerFault.exe 66 4100 2408 WerFault.exe 37 4272 2412 WerFault.exe 160 4472 1516 WerFault.exe 174 4740 1288 WerFault.exe 63 4768 1044 WerFault.exe 168 4784 2772 WerFault.exe 184 4800 2404 WerFault.exe 169 4808 684 WerFault.exe 159 4900 1696 WerFault.exe 170 4528 1616 WerFault.exe 56 4456 2156 WerFault.exe 60 4436 900 WerFault.exe 62 4632 1280 WerFault.exe 57 4608 2940 WerFault.exe 43 4640 492 WerFault.exe 134 4624 2440 WerFault.exe 120 4612 2552 WerFault.exe 128 4672 2044 WerFault.exe 94 4664 2084 WerFault.exe 76 4712 2288 WerFault.exe 86 4820 2144 WerFault.exe 105 4776 1760 WerFault.exe 89 4756 2828 WerFault.exe 77 4732 1836 WerFault.exe 116 4856 1316 WerFault.exe 118 4860 1668 WerFault.exe 119 4868 1392 WerFault.exe 123 4896 2656 WerFault.exe 127 4888 2600 WerFault.exe 167 4944 3008 WerFault.exe 73 4956 2856 WerFault.exe 79 4952 1684 WerFault.exe 81 4924 2628 WerFault.exe 143 4908 2352 WerFault.exe 117 4920 872 WerFault.exe 153 4816 1168 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-53089.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-25972.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-46159.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-52128.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-65137.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-19836.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-35908.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-1245.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-30440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-7528.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-6533.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-5894.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-44280.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-29427.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-32100.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-37360.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-60998.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-51200.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-39017.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-23613.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-61152.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-48010.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-20470.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-63184.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-37077.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-43954.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-17450.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-49780.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-4495.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-14218.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-6641.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-31716.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-18722.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-46892.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-18992.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-22219.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-62333.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-61683.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-61569.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-60998.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-37754.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-62491.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-60703.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-53452.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-2971.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-2383.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-52965.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-38838.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-27535.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-10625.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-29211.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-64499.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-48055.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-40338.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-53194.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-7754.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-61442.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-20660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-29914.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-33638.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-35096.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-35161.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-2518.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-62356.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 2632 Unicorn-34680.exe 2676 Unicorn-46159.exe 2712 Unicorn-50990.exe 2636 Unicorn-33112.exe 2688 Unicorn-27405.exe 2536 Unicorn-52978.exe 2052 Unicorn-63184.exe 2408 Unicorn-43544.exe 2164 Unicorn-12909.exe 1664 Unicorn-59423.exe 380 Unicorn-51520.exe 2820 Unicorn-43352.exe 2940 Unicorn-41934.exe 1660 Unicorn-2511.exe 1308 Unicorn-41934.exe 1784 Unicorn-51167.exe 2180 Unicorn-16413.exe 2108 Unicorn-16679.exe 408 Unicorn-62158.exe 2304 Unicorn-57519.exe 268 Unicorn-9396.exe 1524 Unicorn-34092.exe 1800 Unicorn-48391.exe 1788 Unicorn-6404.exe 1616 Unicorn-28333.exe 1280 Unicorn-48199.exe 552 Unicorn-15911.exe 3032 Unicorn-20741.exe 2156 Unicorn-37077.exe 1700 Unicorn-10596.exe 900 Unicorn-31571.exe 1288 Unicorn-35677.exe 1640 Unicorn-52128.exe 2728 Unicorn-19066.exe 2652 Unicorn-4575.exe 2880 Unicorn-19450.exe 2700 Unicorn-18992.exe 2520 Unicorn-43954.exe 2976 Unicorn-30440.exe 2992 Unicorn-50306.exe 2084 Unicorn-46139.exe 1352 Unicorn-24577.exe 3008 Unicorn-46331.exe 2828 Unicorn-32416.exe 2856 Unicorn-59330.exe 568 Unicorn-7528.exe 1684 Unicorn-29995.exe 2952 Unicorn-38355.exe 1168 Unicorn-61442.exe 2500 Unicorn-40467.exe 2092 Unicorn-63818.exe 2288 Unicorn-31915.exe 2944 Unicorn-42313.exe 2204 Unicorn-12625.exe 916 Unicorn-35096.exe 1760 Unicorn-15230.exe 756 Unicorn-12629.exe 876 Unicorn-59600.exe 2044 Unicorn-30414.exe 1880 Unicorn-9439.exe 2504 Unicorn-41150.exe 1016 Unicorn-9247.exe 1644 Unicorn-63663.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2632 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 30 PID 3068 wrote to memory of 2632 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 30 PID 3068 wrote to memory of 2632 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 30 PID 3068 wrote to memory of 2632 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 30 PID 2632 wrote to memory of 2676 2632 Unicorn-34680.exe 31 PID 2632 wrote to memory of 2676 2632 Unicorn-34680.exe 31 PID 2632 wrote to memory of 2676 2632 Unicorn-34680.exe 31 PID 2632 wrote to memory of 2676 2632 Unicorn-34680.exe 31 PID 3068 wrote to memory of 2712 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 32 PID 3068 wrote to memory of 2712 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 32 PID 3068 wrote to memory of 2712 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 32 PID 3068 wrote to memory of 2712 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 32 PID 2676 wrote to memory of 2688 2676 Unicorn-46159.exe 33 PID 2676 wrote to memory of 2688 2676 Unicorn-46159.exe 33 PID 2676 wrote to memory of 2688 2676 Unicorn-46159.exe 33 PID 2676 wrote to memory of 2688 2676 Unicorn-46159.exe 33 PID 2632 wrote to memory of 2636 2632 Unicorn-34680.exe 34 PID 2632 wrote to memory of 2636 2632 Unicorn-34680.exe 34 PID 2632 wrote to memory of 2636 2632 Unicorn-34680.exe 34 PID 2632 wrote to memory of 2636 2632 Unicorn-34680.exe 34 PID 2712 wrote to memory of 2536 2712 Unicorn-50990.exe 35 PID 2712 wrote to memory of 2536 2712 Unicorn-50990.exe 35 PID 2712 wrote to memory of 2536 2712 Unicorn-50990.exe 35 PID 2712 wrote to memory of 2536 2712 Unicorn-50990.exe 35 PID 3068 wrote to memory of 2052 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 36 PID 3068 wrote to memory of 2052 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 36 PID 3068 wrote to memory of 2052 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 36 PID 3068 wrote to memory of 2052 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 36 PID 2636 wrote to memory of 2408 2636 Unicorn-33112.exe 37 PID 2636 wrote to memory of 2408 2636 Unicorn-33112.exe 37 PID 2636 wrote to memory of 2408 2636 Unicorn-33112.exe 37 PID 2636 wrote to memory of 2408 2636 Unicorn-33112.exe 37 PID 2632 wrote to memory of 2164 2632 Unicorn-34680.exe 38 PID 2632 wrote to memory of 2164 2632 Unicorn-34680.exe 38 PID 2632 wrote to memory of 2164 2632 Unicorn-34680.exe 38 PID 2632 wrote to memory of 2164 2632 Unicorn-34680.exe 38 PID 2052 wrote to memory of 2820 2052 Unicorn-63184.exe 39 PID 2052 wrote to memory of 2820 2052 Unicorn-63184.exe 39 PID 2052 wrote to memory of 2820 2052 Unicorn-63184.exe 39 PID 2052 wrote to memory of 2820 2052 Unicorn-63184.exe 39 PID 2688 wrote to memory of 1660 2688 Unicorn-27405.exe 41 PID 2688 wrote to memory of 1660 2688 Unicorn-27405.exe 41 PID 2688 wrote to memory of 1660 2688 Unicorn-27405.exe 41 PID 2688 wrote to memory of 1660 2688 Unicorn-27405.exe 41 PID 3068 wrote to memory of 1664 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 42 PID 3068 wrote to memory of 1664 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 42 PID 3068 wrote to memory of 1664 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 42 PID 3068 wrote to memory of 1664 3068 7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe 42 PID 2536 wrote to memory of 380 2536 Unicorn-52978.exe 40 PID 2536 wrote to memory of 380 2536 Unicorn-52978.exe 40 PID 2536 wrote to memory of 380 2536 Unicorn-52978.exe 40 PID 2536 wrote to memory of 380 2536 Unicorn-52978.exe 40 PID 2676 wrote to memory of 1308 2676 Unicorn-46159.exe 44 PID 2676 wrote to memory of 1308 2676 Unicorn-46159.exe 44 PID 2676 wrote to memory of 1308 2676 Unicorn-46159.exe 44 PID 2676 wrote to memory of 1308 2676 Unicorn-46159.exe 44 PID 2712 wrote to memory of 2940 2712 Unicorn-50990.exe 43 PID 2712 wrote to memory of 2940 2712 Unicorn-50990.exe 43 PID 2712 wrote to memory of 2940 2712 Unicorn-50990.exe 43 PID 2712 wrote to memory of 2940 2712 Unicorn-50990.exe 43 PID 2164 wrote to memory of 1784 2164 Unicorn-12909.exe 45 PID 2164 wrote to memory of 1784 2164 Unicorn-12909.exe 45 PID 2164 wrote to memory of 1784 2164 Unicorn-12909.exe 45 PID 2164 wrote to memory of 1784 2164 Unicorn-12909.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe"C:\Users\Admin\AppData\Local\Temp\7b773f78a7a3cb3f5bd6e8fe39a134f0N.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-34680.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34680.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46159.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46159.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-27405.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27405.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-2511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2511.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-15911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15911.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:552 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-29995.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29995.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exe8⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18722.exe9⤵
- System Location Discovery: System Language Discovery
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-28869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28869.exe10⤵PID:6972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 22810⤵PID:9188
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 2489⤵
- Program crash
PID:4860
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7553.exe8⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe9⤵PID:7576
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 2289⤵PID:8252
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 2448⤵
- Program crash
PID:4952
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39716.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39716.exe7⤵PID:2244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 2408⤵
- Program crash
PID:1808
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12492.exe7⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe8⤵PID:5000
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51200.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51200.exe8⤵
- System Location Discovery: System Language Discovery
PID:6688
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33503.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33503.exe8⤵PID:6756
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55926.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55926.exe8⤵PID:8348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 2248⤵PID:9100
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5073.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5073.exe7⤵PID:4396
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7148.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7148.exe7⤵PID:6208
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44022.exe7⤵PID:6712
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64620.exe7⤵PID:7856
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32088.exe7⤵PID:8700
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61442.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61442.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-35161.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35161.exe7⤵
- System Location Discovery: System Language Discovery
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe8⤵PID:3408
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 2288⤵PID:5884
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe7⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe8⤵PID:7704
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9730.exe8⤵PID:9136
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25365.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25365.exe8⤵PID:9324
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 2447⤵
- Program crash
PID:4816
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45943.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45943.exe6⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe7⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34318.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34318.exe8⤵PID:8244
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 2168⤵PID:8976
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 2487⤵
- Program crash
PID:4640
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28929.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28929.exe6⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55999.exe7⤵PID:7468
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28635.exe7⤵PID:7368
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33107.exe6⤵PID:4576
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe6⤵PID:6940
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45079.exe6⤵PID:7200
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40152.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40152.exe6⤵PID:8868
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe6⤵PID:9412
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37077.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37077.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-40467.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40467.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2500 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 2247⤵
- Program crash
PID:2340
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe6⤵PID:1716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 2207⤵
- Program crash
PID:3612
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13058.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13058.exe6⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6767.exe7⤵PID:8796
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe7⤵PID:9604
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 2486⤵
- Program crash
PID:4456
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42313.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2944 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 2246⤵
- Program crash
PID:2396
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60822.exe5⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57138.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57138.exe6⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52546.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52546.exe7⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe8⤵PID:7828
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3565.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3565.exe8⤵PID:8912
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 2487⤵
- Program crash
PID:4920
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9328.exe6⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31879.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31879.exe7⤵PID:8328
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 2287⤵PID:8408
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 2446⤵
- Program crash
PID:4732
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe5⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe6⤵
- System Location Discovery: System Language Discovery
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-9523.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9523.exe7⤵PID:9196
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30148.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30148.exe6⤵PID:5072
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28391.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28391.exe6⤵PID:7044
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60998.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60998.exe6⤵
- System Location Discovery: System Language Discovery
PID:7324
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4360.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4360.exe6⤵PID:9012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 2486⤵PID:9488
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6250.exe5⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe6⤵
- System Location Discovery: System Language Discovery
PID:8676
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe5⤵PID:5144
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24321.exe5⤵PID:6256
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26703.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26703.exe5⤵PID:7752
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51155.exe5⤵PID:8320
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61152.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61152.exe5⤵
- System Location Discovery: System Language Discovery
PID:9780
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41934.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1308 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 2405⤵
- Loads dropped DLL
- Program crash
PID:1200
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34092.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-50306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50306.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-32273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32273.exe6⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26791.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26791.exe7⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe8⤵PID:5100
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49856.exe8⤵PID:6776
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9383.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9383.exe8⤵PID:5700
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44525.exe8⤵PID:8388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 2248⤵PID:9200
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51586.exe7⤵PID:4448
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9948.exe7⤵PID:6160
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exe7⤵PID:6288
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64090.exe7⤵PID:7568
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36553.exe7⤵PID:8720
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6925.exe6⤵PID:2772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 2247⤵
- Program crash
PID:4784
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65321.exe6⤵PID:4440
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15813.exe6⤵PID:6200
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18648.exe6⤵PID:6176
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47554.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47554.exe6⤵PID:7908
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53619.exe6⤵PID:9192
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37295.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37295.exe5⤵PID:2008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 2206⤵
- Program crash
PID:1216
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33130.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33130.exe5⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exe6⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe7⤵PID:8612
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36803.exe7⤵PID:8424
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 2486⤵
- Program crash
PID:4888
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe5⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53280.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53280.exe6⤵PID:8756
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4261.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4261.exe6⤵PID:9368
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33107.exe5⤵PID:4600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 2485⤵PID:6976
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe5⤵PID:1028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 2246⤵
- Program crash
PID:2832
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48643.exe5⤵PID:1516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 2246⤵
- Program crash
PID:4472
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31174.exe5⤵PID:4108
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54412.exe5⤵PID:5848
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exe5⤵PID:6448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 2485⤵PID:2348
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50652.exe4⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51778.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51778.exe5⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23820.exe6⤵PID:7400
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11147.exe6⤵PID:8948
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 2485⤵
- Program crash
PID:4868
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31849.exe4⤵PID:4016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 2245⤵PID:7892
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe4⤵
- System Location Discovery: System Language Discovery
PID:4644
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13719.exe4⤵PID:6952
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18213.exe4⤵PID:7212
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39017.exe4⤵
- System Location Discovery: System Language Discovery
PID:8892
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38838.exe4⤵
- System Location Discovery: System Language Discovery
PID:9468
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33112.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33112.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-16679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16679.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43954.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43954.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-8536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8536.exe7⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17450.exe8⤵
- System Location Discovery: System Language Discovery
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-30611.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30611.exe9⤵PID:4656
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 2369⤵PID:6148
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22836.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22836.exe8⤵PID:3928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 2448⤵PID:6088
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4491.exe7⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe8⤵PID:3700
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe8⤵PID:5332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 2408⤵PID:6412
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe7⤵PID:3232
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4697.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4697.exe7⤵PID:6056
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63194.exe7⤵PID:7016
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27214.exe7⤵PID:7564
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43204.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43204.exe7⤵PID:8980
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52965.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52965.exe7⤵
- System Location Discovery: System Language Discovery
PID:10164
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54784.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54784.exe6⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35016.exe7⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe8⤵
- System Location Discovery: System Language Discovery
PID:3548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 2288⤵PID:5876
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11850.exe7⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe8⤵PID:8992
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64639.exe7⤵PID:4432
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53987.exe7⤵PID:5776
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53039.exe7⤵PID:7712
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56756.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56756.exe7⤵PID:8316
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46017.exe7⤵PID:9840
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5808.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5808.exe6⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe7⤵PID:3672
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34811.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34811.exe7⤵PID:5844
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 2407⤵PID:6408
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe6⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6223.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6223.exe7⤵PID:9560
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4854.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4854.exe6⤵PID:5272
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe6⤵PID:6452
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15032.exe6⤵PID:7920
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe6⤵PID:8336
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe6⤵PID:9788
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30440.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30440.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-65137.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65137.exe6⤵
- System Location Discovery: System Language Discovery
PID:596 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe7⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe8⤵PID:4356
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe8⤵PID:5740
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe8⤵PID:6908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 2288⤵PID:7640
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50958.exe7⤵PID:3780
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 2247⤵PID:6096
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63121.exe6⤵PID:2412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 2247⤵
- Program crash
PID:4272
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36572.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36572.exe6⤵PID:3768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 2486⤵PID:6064
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe5⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe6⤵
- System Location Discovery: System Language Discovery
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-1923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1923.exe7⤵PID:3524
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe7⤵PID:5868
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14873.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14873.exe7⤵PID:6836
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50303.exe7⤵PID:7436
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18169.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18169.exe7⤵PID:8784
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37887.exe7⤵PID:10100
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12701.exe6⤵PID:3116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 2446⤵PID:6080
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59691.exe5⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34285.exe6⤵PID:4960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 2166⤵PID:6584
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 2405⤵
- Program crash
PID:4100
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62158.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:408 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-19066.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19066.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-9247.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9247.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-30517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30517.exe7⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-771.exe8⤵PID:3912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 2368⤵PID:5836
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe7⤵PID:3352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 2447⤵PID:6072
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19395.exe6⤵PID:1044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 2207⤵
- Program crash
PID:4768
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5819.exe6⤵PID:3224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 2486⤵PID:5496
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63663.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-29427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29427.exe6⤵
- System Location Discovery: System Language Discovery
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-21431.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21431.exe7⤵PID:3248
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 2487⤵PID:6032
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54419.exe6⤵PID:3988
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe6⤵PID:5904
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe6⤵PID:2064
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41638.exe6⤵PID:7404
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe6⤵PID:8752
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54953.exe6⤵PID:10124
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe5⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5914.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5914.exe6⤵PID:4480
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe6⤵PID:6192
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21448.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21448.exe6⤵PID:6184
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7218.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7218.exe6⤵PID:7364
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53089.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53089.exe6⤵
- System Location Discovery: System Language Discovery
PID:8920
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5021.exe5⤵PID:3620
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61569.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61569.exe5⤵
- System Location Discovery: System Language Discovery
PID:6004
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46658.exe5⤵PID:7008
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44280.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44280.exe5⤵
- System Location Discovery: System Language Discovery
PID:7540
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21673.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21673.exe5⤵PID:8968
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe5⤵PID:10156
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4575.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exe5⤵PID:2224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 2206⤵
- Program crash
PID:2184
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10075.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10075.exe5⤵PID:2404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 2246⤵
- Program crash
PID:4800
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 2405⤵
- Program crash
PID:4056
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8271.exe4⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43843.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43843.exe5⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18665.exe6⤵PID:3800
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25792.exe6⤵PID:5328
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 2406⤵PID:6572
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29914.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29914.exe5⤵
- System Location Discovery: System Language Discovery
PID:3680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 2405⤵PID:5856
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34912.exe4⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31716.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31716.exe5⤵
- System Location Discovery: System Language Discovery
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46773.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46773.exe6⤵PID:8476
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 2285⤵PID:4372
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49586.exe4⤵PID:3252
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4346.exe4⤵PID:5892
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56609.exe4⤵PID:1160
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe4⤵PID:7420
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe4⤵PID:8724
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe4⤵PID:10092
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12909.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12909.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-10596.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10596.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1700 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 2446⤵
- Program crash
PID:2020
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15230.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15230.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-51881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51881.exe6⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32100.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32100.exe7⤵
- System Location Discovery: System Language Discovery
PID:3948
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1703.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1703.exe7⤵PID:5208
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48122.exe7⤵PID:6248
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61704.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61704.exe7⤵PID:7764
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exe7⤵
- System Location Discovery: System Language Discovery
PID:8432
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12532.exe7⤵PID:9976
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25664.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25664.exe6⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51230.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51230.exe7⤵PID:8272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 2287⤵PID:8208
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 2446⤵
- Program crash
PID:4776
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37007.exe5⤵PID:1096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 2206⤵
- Program crash
PID:3584
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20760.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20760.exe5⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36046.exe6⤵PID:8444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 2166⤵PID:8400
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33107.exe5⤵PID:4564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 2485⤵PID:6984
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31571.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31571.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:900 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-35096.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35096.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:916 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43137.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43137.exe6⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe7⤵PID:3424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 2167⤵PID:5824
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exe6⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34918.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34918.exe7⤵PID:3492
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49482.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49482.exe7⤵PID:5172
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46892.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46892.exe7⤵
- System Location Discovery: System Language Discovery
PID:5692
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe7⤵PID:7380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 2247⤵PID:9132
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe6⤵PID:3428
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45393.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45393.exe6⤵PID:5488
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exe6⤵PID:6472
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe6⤵PID:7352
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28840.exe6⤵PID:8952
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31247.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31247.exe5⤵PID:1252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 2406⤵
- Program crash
PID:3564
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13935.exe5⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28776.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28776.exe6⤵PID:8728
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53078.exe6⤵PID:9272
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 2485⤵
- Program crash
PID:4436
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 2205⤵
- Program crash
PID:644
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39437.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39437.exe4⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exe5⤵PID:5728
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49763.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49763.exe5⤵PID:6748
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44438.exe5⤵PID:7460
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe5⤵PID:8768
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54423.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54423.exe5⤵PID:10112
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5152.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5152.exe4⤵PID:4540
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56150.exe4⤵PID:5696
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61088.exe4⤵PID:2176
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43089.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43089.exe4⤵PID:7340
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26753.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26753.exe4⤵PID:8520
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16413.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16413.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-35677.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35677.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-59600.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59600.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:876 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe6⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54817.exe7⤵PID:5244
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10074.exe7⤵PID:6396
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exe7⤵PID:7876
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe7⤵PID:8384
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45487.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45487.exe7⤵PID:9828
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10553.exe6⤵PID:4688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 2406⤵PID:5484
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe5⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15502.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15502.exe6⤵PID:6416
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61465.exe6⤵PID:6736
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe6⤵PID:7832
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe6⤵PID:8256
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 2445⤵
- Program crash
PID:4740
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30414.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30414.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-11663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11663.exe5⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51347.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51347.exe6⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53801.exe7⤵PID:7684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 2487⤵PID:8260
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 2286⤵
- Program crash
PID:4924
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37449.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37449.exe5⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29489.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29489.exe6⤵PID:7868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 2286⤵PID:8368
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 2445⤵
- Program crash
PID:4672
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12357.exe4⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29941.exe5⤵PID:1696
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 2406⤵
- Program crash
PID:4900
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57621.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57621.exe5⤵PID:3244
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exe5⤵PID:5656
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52757.exe5⤵PID:6640
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28023.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28023.exe5⤵PID:7348
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11774.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11774.exe5⤵PID:9068
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2706.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2706.exe4⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2904.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2904.exe5⤵PID:3528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 2365⤵PID:5640
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28374.exe4⤵PID:4116
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29211.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29211.exe4⤵
- System Location Discovery: System Language Discovery
PID:5864
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe4⤵PID:6524
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7023.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7023.exe4⤵PID:7492
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1974.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1974.exe4⤵PID:9096
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52128.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52128.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-9439.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9439.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 2405⤵
- Program crash
PID:2476
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19836.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19836.exe4⤵
- System Location Discovery: System Language Discovery
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-2383.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2383.exe5⤵
- System Location Discovery: System Language Discovery
PID:5584
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe5⤵PID:6716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 2405⤵PID:7392
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7952.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7952.exe4⤵PID:4548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 2364⤵PID:6128
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41150.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-18623.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18623.exe4⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe5⤵
- System Location Discovery: System Language Discovery
PID:5768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 2165⤵PID:7028
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 2364⤵
- Program crash
PID:3972
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31302.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31302.exe3⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48377.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48377.exe4⤵PID:5344
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58123.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58123.exe4⤵PID:6616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 2204⤵PID:7356
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49688.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49688.exe3⤵PID:4516
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46349.exe3⤵PID:5152
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62050.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62050.exe3⤵PID:7148
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe3⤵
- System Location Discovery: System Language Discovery
PID:6996
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42386.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42386.exe3⤵PID:8480
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-52978.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52978.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-51520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51520.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:380 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-48199.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48199.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49878.exe7⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42411.exe8⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53993.exe9⤵PID:7644
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 2489⤵PID:8300
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 2488⤵
- Program crash
PID:4908
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48202.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48202.exe7⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exe8⤵
- System Location Discovery: System Language Discovery
PID:7472
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe8⤵PID:9180
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16491.exe8⤵PID:9700
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 2447⤵
- Program crash
PID:4664
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50542.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50542.exe6⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10698.exe7⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54486.exe8⤵PID:7440
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3513.exe8⤵PID:9120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 2248⤵PID:9496
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 2487⤵
- Program crash
PID:4856
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61745.exe6⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13645.exe7⤵PID:7412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 2167⤵PID:9112
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 2286⤵
- Program crash
PID:4632
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 380 -s 2365⤵
- Program crash
PID:2420
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20741.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 2205⤵
- Program crash
PID:2012
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7528.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:568 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe5⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe6⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27731.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27731.exe7⤵PID:4328
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe7⤵PID:5672
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26902.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26902.exe7⤵PID:280
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 2287⤵PID:7636
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe6⤵PID:4748
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13539.exe6⤵PID:6324
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5113.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5113.exe6⤵PID:6844
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 2406⤵PID:7796
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16567.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16567.exe5⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5243.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5243.exe6⤵PID:6528
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28263.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28263.exe6⤵PID:8000
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10554.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10554.exe6⤵PID:8292
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe6⤵PID:9812
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12010.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12010.exe5⤵PID:4876
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37360.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37360.exe5⤵
- System Location Discovery: System Language Discovery
PID:6604
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33095.exe5⤵PID:6500
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46869.exe5⤵PID:1384
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40101.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40101.exe5⤵PID:8828
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35742.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35742.exe4⤵PID:1456
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 2205⤵
- Program crash
PID:2236
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22219.exe4⤵
- System Location Discovery: System Language Discovery
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-44612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44612.exe5⤵PID:4156
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36913.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36913.exe5⤵PID:6820
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13249.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13249.exe5⤵PID:6728
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37831.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37831.exe5⤵PID:8660
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe5⤵PID:9280
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54154.exe4⤵PID:4488
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7678.exe4⤵PID:5976
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63185.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63185.exe4⤵PID:6268
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37754.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37754.exe4⤵
- System Location Discovery: System Language Discovery
PID:7848
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6641.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6641.exe4⤵
- System Location Discovery: System Language Discovery
PID:8456
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41934.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-57519.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57519.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2304 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 2405⤵
- Program crash
PID:2136
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59330.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59330.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-57470.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57470.exe5⤵PID:2388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 2246⤵
- Program crash
PID:3120
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56562.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56562.exe5⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37657.exe6⤵PID:7612
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe6⤵
- System Location Discovery: System Language Discovery
PID:8232
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48287.exe6⤵PID:9760
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 2445⤵
- Program crash
PID:4956
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53452.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53452.exe4⤵
- System Location Discovery: System Language Discovery
PID:660 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-35203.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35203.exe5⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29982.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29982.exe6⤵PID:7384
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60690.exe6⤵PID:9084
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe6⤵
- System Location Discovery: System Language Discovery
PID:9480
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 660 -s 2485⤵PID:4976
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10625.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10625.exe4⤵
- System Location Discovery: System Language Discovery
PID:3808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 2405⤵PID:7588
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 2444⤵
- Program crash
PID:4608
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9396.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:268 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-19450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19450.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-42304.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42304.exe5⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-38685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38685.exe6⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5094.exe7⤵PID:4088
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50634.exe7⤵PID:6040
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16793.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16793.exe7⤵PID:7132
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52415.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52415.exe7⤵PID:7604
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42674.exe7⤵PID:9032
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe7⤵PID:10224
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64637.exe6⤵PID:3632
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64369.exe6⤵PID:6048
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22659.exe6⤵PID:7104
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 2246⤵PID:7692
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21642.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21642.exe5⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34586.exe6⤵PID:4792
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65341.exe6⤵PID:6356
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64785.exe6⤵PID:1652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 712 -s 2166⤵PID:7748
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22923.exe5⤵PID:3992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 2485⤵PID:5592
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe4⤵PID:2788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 2205⤵
- Program crash
PID:2416
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20660.exe4⤵
- System Location Discovery: System Language Discovery
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-37635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37635.exe5⤵PID:5960
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe5⤵PID:6948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 2405⤵PID:7372
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5073.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5073.exe4⤵PID:4404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 268 -s 2404⤵PID:5140
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18992.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18992.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-9112.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9112.exe4⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50454.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50454.exe5⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11980.exe6⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe7⤵PID:8488
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25018.exe7⤵PID:8900
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 2286⤵
- Program crash
PID:4896
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12561.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12561.exe5⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23433.exe6⤵PID:7972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 2486⤵PID:8360
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 2445⤵
- Program crash
PID:4820
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe4⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4964.exe5⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19228.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19228.exe6⤵PID:9236
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61944.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61944.exe5⤵PID:5112
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52704.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52704.exe5⤵PID:7072
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60998.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60998.exe5⤵
- System Location Discovery: System Language Discovery
PID:7332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 2445⤵PID:9020
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30079.exe4⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2518.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2518.exe5⤵
- System Location Discovery: System Language Discovery
PID:5992
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31942.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31942.exe5⤵PID:6376
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30714.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30714.exe5⤵PID:7744
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 2285⤵PID:9092
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe4⤵PID:4420
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18383.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18383.exe4⤵PID:6856
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28013.exe4⤵PID:7100
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61683.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61683.exe4⤵
- System Location Discovery: System Language Discovery
PID:8856
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2172.exe4⤵PID:9404
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65527.exe3⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe4⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61041.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61041.exe5⤵PID:4192
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51532.exe5⤵PID:5984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 2205⤵PID:6496
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 2364⤵
- Program crash
PID:3976
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe3⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13231.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13231.exe4⤵PID:4240
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39746.exe4⤵PID:5324
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51023.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51023.exe4⤵PID:7140
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe4⤵PID:7624
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28309.exe4⤵PID:8996
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30903.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30903.exe3⤵PID:3636
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40568.exe3⤵PID:6020
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53194.exe3⤵
- System Location Discovery: System Language Discovery
PID:7088
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21614.exe3⤵PID:7584
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58339.exe3⤵PID:9000
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5894.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5894.exe3⤵
- System Location Discovery: System Language Discovery
PID:10192
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63184.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63184.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-48391.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48391.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exe6⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20341.exe7⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24287.exe8⤵PID:7256
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 2288⤵PID:8452
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 2487⤵
- Program crash
PID:4624
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48010.exe6⤵
- System Location Discovery: System Language Discovery
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31134.exe7⤵PID:7544
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 2287⤵PID:8280
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 2246⤵
- Program crash
PID:4712
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2365⤵
- Program crash
PID:2076
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12625.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12625.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-42338.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42338.exe5⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37544.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37544.exe6⤵PID:4280
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 2166⤵PID:5224
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26453.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26453.exe5⤵PID:4032
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 2445⤵PID:6104
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe4⤵PID:684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 2245⤵
- Program crash
PID:4808
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42437.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42437.exe4⤵PID:3204
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 2444⤵PID:6012
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28333.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28333.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46331.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-57361.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57361.exe5⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35525.exe6⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62491.exe7⤵
- System Location Discovery: System Language Discovery
PID:9036
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47022.exe7⤵PID:9620
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 2286⤵
- Program crash
PID:4612
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exe5⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2519.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2519.exe6⤵PID:7724
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57587.exe6⤵PID:8220
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1245.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1245.exe6⤵
- System Location Discovery: System Language Discovery
PID:9516
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 2245⤵
- Program crash
PID:4944
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe4⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58908.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58908.exe5⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48408.exe6⤵PID:9432
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59456.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59456.exe5⤵PID:5288
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40338.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40338.exe5⤵
- System Location Discovery: System Language Discovery
PID:6480
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23168.exe5⤵PID:7928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 2405⤵PID:8428
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45648.exe4⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe5⤵
- System Location Discovery: System Language Discovery
PID:7960
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17374.exe5⤵PID:9108
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 2284⤵
- Program crash
PID:4528
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32416.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-57745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57745.exe4⤵PID:2060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 2405⤵
- Program crash
PID:3712
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40080.exe4⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe5⤵PID:7484
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34177.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34177.exe5⤵PID:8312
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 2444⤵
- Program crash
PID:4756
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34896.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34896.exe3⤵PID:2592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 2204⤵
- Program crash
PID:3588
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42848.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42848.exe3⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46487.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46487.exe4⤵PID:7608
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe4⤵PID:8508
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16572.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16572.exe3⤵PID:4536
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18913.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18913.exe3⤵PID:6872
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23548.exe3⤵PID:6380
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34817.exe3⤵PID:8884
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe3⤵PID:9444
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59423.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59423.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1664 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 2243⤵
- Loads dropped DLL
- Program crash
PID:1532
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6404.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-38355.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38355.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe4⤵
- System Location Discovery: System Language Discovery
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-39702.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39702.exe5⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18141.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18141.exe6⤵PID:4928
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17759.exe6⤵PID:6596
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35896.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35896.exe6⤵PID:6304
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6533.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6533.exe6⤵
- System Location Discovery: System Language Discovery
PID:7252
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39571.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39571.exe6⤵PID:9176
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59754.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59754.exe5⤵PID:4500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 2405⤵PID:5724
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17143.exe4⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3395.exe5⤵PID:5164
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42030.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42030.exe5⤵PID:6696
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14954.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14954.exe5⤵PID:7864
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36975.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36975.exe5⤵PID:9028
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28455.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28455.exe4⤵PID:4724
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19404.exe4⤵PID:6340
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61985.exe4⤵PID:6740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 2364⤵PID:7572
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41221.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41221.exe3⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27616.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27616.exe4⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2468.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2468.exe5⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48781.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48781.exe6⤵PID:8680
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27535.exe6⤵
- System Location Discovery: System Language Discovery
PID:10028
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22172.exe5⤵PID:4560
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37520.exe5⤵PID:6932
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53214.exe5⤵PID:7180
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61153.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61153.exe5⤵PID:8876
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6637.exe5⤵PID:9460
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48140.exe4⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe5⤵PID:9212
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35620.exe5⤵PID:9728
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe4⤵
- System Location Discovery: System Language Discovery
PID:4580
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43385.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43385.exe4⤵PID:6960
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44549.exe4⤵PID:7228
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe4⤵PID:8924
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23702.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23702.exe4⤵PID:9504
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20717.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20717.exe3⤵PID:2776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 2204⤵
- Program crash
PID:3608
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe3⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52668.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52668.exe4⤵PID:8440
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61839.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61839.exe3⤵PID:4124
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28786.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28786.exe3⤵PID:6280
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53569.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53569.exe3⤵PID:7776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 2483⤵PID:8372
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63818.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63818.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2092 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 2403⤵
- Program crash
PID:1680
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26616.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26616.exe2⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31716.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31716.exe3⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15262.exe4⤵PID:8824
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe3⤵PID:3716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 2203⤵PID:6224
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1785.exe2⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48055.exe3⤵
- System Location Discovery: System Language Discovery
PID:9384
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35503.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35503.exe2⤵PID:5124
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23186.exe2⤵PID:6240
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3167.exe2⤵PID:7788
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5219.exe2⤵PID:8356
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58352.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58352.exe2⤵PID:9752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
468KB
MD5a2f2ca10045b5f82f0bced64345d12e2
SHA1de3653301fbb9d5b62764d71a6ba5d768d5e95ae
SHA256b0f98df6f9b1cc199e50884a76a277e85d4c700ef34823f3a2b4a8b6b2b9815f
SHA5129c00beda013706c031ea0bdcc7ed5fa4b5b0e6d776a4e3ee37834ab42dfe095a979d3014ff6a9d6bffb3d690d97dfe89486263a1babfd495dd88c30057dd9696
-
Filesize
468KB
MD53deb9fd0830d4ebed5f1d226de17def6
SHA1d5925234c9f1c4da91cf9bc0e161d051744e00c0
SHA256b382c14f9971a3d2143066ea206c1f54873d567147b8d763f06aea693d412617
SHA512cf75eb97280dfb0cf41e7056005e5e2dec1e56428c7a6e9337bd038971d734594f930aa2c19cd70fdb893279d9918629a06e24673ea3256f89c0cab876a23aaf
-
Filesize
468KB
MD5f56c04790c5e580f1b4c2186c2485c61
SHA10f0f28b4a6e9e12214fcc4687457e43eb1cd1e6c
SHA256047a6192c96592db799d462619db01b9365509663fb8fc8a8bd449976570c88d
SHA51235e71741d489d0ff67aee0a989aa1315ea89298db5ffde798fccb975c343ef21656a25519c8950b74d58d3058c2f96ed02898594a54af47f35aeac1b5d52cabf
-
Filesize
468KB
MD5bc2c7b0e8042a63632ee266015dedfe0
SHA101006419aa77d3f8a1b0d3d290c04c2144bd4207
SHA256210c8181aa605f7ceabe7ffc09aa2d8cdee90b9ecce94672beb217a2093b2f9a
SHA5123c39f3146a69a47c2fb6b4cafe450971a08f6a5d3341ef60d3ad254bb39adb90b2bf3feed752e0cf9f0cb2a7739dcb5edab8bb34a335802403bb756334678743
-
Filesize
468KB
MD57244142b205509899e1274ab0bf06386
SHA16894cbbc7763bf5ed40990e31d8e993f42588107
SHA2564e334f3110ebf0f2c08297e3957e0a4d963af382f95d33493b5c5d31ef886122
SHA5125b4004a18a42e344cc9bf2d556ce2c166fc6485e167cd666de48abbd12e8203c9577e4e0c6a96d1f95feff0190a419eb23f7ed1f6d213dd7d1826dbe0d144608
-
Filesize
468KB
MD50433be086bcb5d937227363a0aece788
SHA117c0e8aeff5a7dd49243a25013c74e33301f8761
SHA2563b51143374fdd77a5b29636139f5ba674e00375ce96137a49ca7b311e296c4c2
SHA5121728afb8ad554a9c69898a72823b6c56d075ee950219642a290f2d54ba0dba8938952bddc2cf86be626777f7967713c37288e6fab6be8bc7ee8d9009942c2ad1
-
Filesize
468KB
MD545394e7f3f8510d303898dce77353213
SHA1402277e743d886269ac1b4ed0150900a194ce480
SHA256d67a041e0e48068720812565390d14505dca00923e8a8139ec58df5af9e478dd
SHA5122d4e5f6b3d22b072c7bcfb1ddd8d13709871c01e626fc3894dc2b0b9898086f38eccd56424cedecd68b1bb80d4d6803436a7701a8012ac61e784d29796232b57
-
Filesize
468KB
MD5a402a047dc0243fa8ac015263c0b5f1f
SHA1bdfdd2f16f41d459402ee1841a7af57de33f9e37
SHA256d2c237d03d4b2018c06fe8d5f666eb083acb3d29a041818d7d1f37e23cd8e568
SHA512c85dd3c5ad5faaaaebb31cf7719e460ad77b30efd7738ca762b28acbd0fe361a0a82f42c4ae1f265084a55e42e1327be868feee111d8fc4360ada45d49fb3b65
-
Filesize
468KB
MD581d5cbf910d47513d7dd988d0359571e
SHA1bbc480d43d650db80722d13ddf4e7f105012478a
SHA256ccd0ae659259c2c8f40558ca67bdec5b427ea1d51a350eefef0c0d7f3e711bd5
SHA5120ba0f17e14ccf9ba1f557eba56c2c96eeda74df0221765eacadc2c950ee9e1069d96b2bb92dded96ba2151c75829119d1c037e890b6b07ab663aeb94d5286020
-
Filesize
468KB
MD52af665d09795f97d5800fed82a22745a
SHA15026120c15b49fb1f1dbd0b702c7052d694b0618
SHA256b46bb2cb9f1fd794e9753628e61d06f762972406167e59c91bd9b831cf79554a
SHA5129889ad0a1cb1c1e8e979c2c651dcd1a068813cfd5b6aa4af7fcce4bf5ad8adbffd2784916e3af83d1a161e3132417bf5bee1415ff84f1bef8b3eeb202ef9cab7
-
Filesize
468KB
MD5b5fcc546f1bad33b121112bdf263d8ae
SHA1c35374979327fc862c0c1b0246c2d8cec666599e
SHA25634513204f472851611491733e0674b9b13073101b641e320cd4ee65200372942
SHA5120f0afea73b085808d5d7bb31ec55852ca2a741849259d5149746fd73ef9e7e9188f6ed763eec1ace62e685ff89eb448c04b074e5bb71b58c0c5f39b2e2095179
-
Filesize
468KB
MD508c088bbe9d5031711df4370a8e31307
SHA185fc1fe16e5dd7040f956c1b9d0035a4ddbe7462
SHA2569fee29b774224ed53e53808bbc495daed43b6802c3217e123da2636b8d4f2ab5
SHA51202de6bd877c23cc43f14e17de6a7d1f947ea23ad75520089023f66980662fc363a391fc09667594dd961479b5fbc3cbb76eda77272ca7849508bfd44b0056661
-
Filesize
468KB
MD5aa510d9dfd97b801e7d3c9326192b7be
SHA1fc2175d03efba78929d1ca0149a761df6ca9ee50
SHA256802e8b5a2db6749ded8ee20990519e908b28453317fa3f8b6761ca1490c5a634
SHA5124db62a49b0dda872b69bef5231fc725d5ea8e3e830c8c338a24773c290dff74c400ee4aa271ca12eb8a6f1914420f32e514cfda96c4e07226320e983a3ff2175
-
Filesize
468KB
MD50e5d18acdd9de17bcf29c4a0c4be3cbf
SHA1019ccea09de2bb0fa9841d63e199c086c006199d
SHA256e0104055430bb4f6fcc7a422377693134ec248c8123b678bfb62aa5143f49dcf
SHA512245f7ba2f73d105a22f5a994396a029a2bc2970c6611f86e6ebe9e0d0daea6741b9a547817c0553771c08298e13a1edaedc5a870a12c01b728543319464b995a
-
Filesize
468KB
MD5ee4e08bca9eaa0cbc8a07bbd986faa5a
SHA1e19e4d19733dc7fc8b1bc4a14370202292905583
SHA2560199c4b73d162be067af8693eb927816a77e74d83395046a21e81e5d1561a1de
SHA512d77fa851e4b744fc383d2e4b99fe76cf38b82666c6266492b9254a33b1ca236f034e8f6c82bf593e3b1e3e6f1aac6eab786eab4b751169d2fbdc2f0410f80e85
-
Filesize
468KB
MD582ca62c622c4b4cc766880a358a701fc
SHA10675603ec8a6da9a2470c2cec60d585422cbc6ba
SHA256f69095cf62acf20372b2664f77ad86d872f238889820ed36b15b3fae345e5c25
SHA5126c5ec5fb832a36dbc25eb6ce70c061e595a8997dea2039604044d58179ed5e94e9a6cca9bbc0700198f98d70bff316f7b8c3d6c167f65b0f9e2365c70752bcbd
-
Filesize
468KB
MD5a67eaf14f2e71db4fe23b4fc930922a6
SHA1b059f001a333380178ed2a9446a272357b2baa73
SHA2563b97b8cd75daf36bd687a637471d01f38f05dfccbc06aa37c7b0d754ed1b7cf8
SHA512a63c9c0001edc8697c02b125ae4e1e38d9fc8039284b3b92ff99ab3f74af877214d9e3e009f39993904b5c6f7eb412c4b7cea868d009064c833954f2fc2d28f5
-
Filesize
468KB
MD59b033a13190a168f8165c072708504b4
SHA1f4899ba94430b53f65cca86ace19ad30117d6c60
SHA25666b7a9246d19b8aacba5f05ccaa254b37ecf898a37b3d2a4c7e8d732aca31ee9
SHA512d919446780f9eaef2007ff6d51078be1cf15e79e7bf814295b84537b2412ed9c734f134471cb6def55e281704efb8e54ddb4170b69c42722294e25693a06459e
-
Filesize
468KB
MD5cc176acc938a6e8c682a58cd6a27404c
SHA119133c9bb59260c7b97793630140db8c569c89c9
SHA256bbeac2ba7f5ce9a419f5c16cd1bbe01a02ce02e160c261003dab3e4ae4f64221
SHA512af5b64f87863ec84dd7af00f02121bb433920d60034c6178f769e917bb8a99055a1d799c049cd2930cff8342f767683a06a6300666ab69b5b0ac141a765cb335
-
Filesize
468KB
MD504a80edb5db7b1e7a7e732b19ef55594
SHA1453e905d9638bb1ec251466dca95bdaaa9cc6429
SHA256373405591a26b28a2ab96050ebeafec776b8a0bc7576fec508dd29672e9a78e8
SHA51213430d287333e75aa171568079f13bbe74f1f6c287ba70d5814585eef529da6e7f790a141792ca243b32a1aac3e4b6935f7d114d4875013a524919bde064bee6
-
Filesize
468KB
MD5d8f652bf5195c0930d8331e9583cc4f7
SHA1ae3c91e5ea101219d909ae05962a490c5c504466
SHA2566972cb0059fb28ad62153aaf8dae282fef255d6b93d23eb34463120b8be4984b
SHA5123e6f0e69e0e6ba02b44850ae5b2e45963237dc2389d01ef63cc0e39d890c9cf29856e90efdb2f86967b7dc2a10d23100287489bae436f75978bdb091c8f14ded
-
Filesize
468KB
MD5d625dd453b4b6230c6d6e70efd1074ac
SHA1ee07ca94d8630648896eb176466b5ec3049dbc5d
SHA256ffe5529911b4ab8cfea171709cb2367c9d97a567e2a12df0fc2a4370e98d074d
SHA5120a8f5bdf1666a4b1732599f2ae5a0a4b183df149650505cb382ecb77e2d02d8109fb56a02db9519da27017bfc4ebc627b58fbb0ea768109d7e19acc962acab1b