Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 05:51
Static task
static1
Behavioral task
behavioral1
Sample
607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe
Resource
win10v2004-20240802-en
General
-
Target
607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe
-
Size
468KB
-
MD5
6773f930d493abb122eb608fcee72110
-
SHA1
c87ce8330fd49d0ac0af3ce2e4a9d759803bd8fb
-
SHA256
607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68
-
SHA512
8cffc1814a4a88f3de24b11bcfa83749fa5516d20ff57fc55c11de58b7691a93a8d6b422f44b632ce8f8570b3779f4e733a01d4c45fbc5540724ed0b6326b3f3
-
SSDEEP
3072:1G3HogISIE5TtbY5HzcOcf8/zCcaP0pkJVHeTVPyB67LL9ggEslV:1G3obMTt+H4OcfVY10B6fxggE
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2720 Unicorn-62531.exe 2644 Unicorn-59044.exe 2552 Unicorn-64752.exe 2732 Unicorn-57394.exe 2560 Unicorn-53865.exe 2684 Unicorn-49226.exe 2992 Unicorn-2063.exe 2088 Unicorn-2194.exe 552 Unicorn-39313.exe 1564 Unicorn-26507.exe 2324 Unicorn-24499.exe 1624 Unicorn-40570.exe 2576 Unicorn-51041.exe 1656 Unicorn-37305.exe 2784 Unicorn-57171.exe 2176 Unicorn-8520.exe 2168 Unicorn-12282.exe 2072 Unicorn-10632.exe 2852 Unicorn-28513.exe 2780 Unicorn-18116.exe 344 Unicorn-26284.exe 1196 Unicorn-40898.exe 2228 Unicorn-8987.exe 920 Unicorn-54659.exe 2320 Unicorn-21602.exe 2492 Unicorn-49636.exe 1420 Unicorn-62635.exe 2444 Unicorn-16964.exe 2268 Unicorn-16964.exe 1160 Unicorn-17274.exe 1368 Unicorn-11409.exe 2140 Unicorn-32610.exe 1980 Unicorn-48946.exe 1964 Unicorn-20912.exe 2656 Unicorn-16658.exe 2364 Unicorn-10527.exe 2740 Unicorn-45993.exe 2672 Unicorn-32802.exe 2772 Unicorn-65401.exe 3040 Unicorn-56538.exe 2512 Unicorn-20144.exe 1620 Unicorn-47109.exe 1920 Unicorn-43964.exe 2792 Unicorn-46076.exe 2028 Unicorn-404.exe 2116 Unicorn-8572.exe 1480 Unicorn-32115.exe 1604 Unicorn-212.exe 1504 Unicorn-19354.exe 744 Unicorn-27522.exe 2796 Unicorn-57965.exe 2360 Unicorn-24530.exe 568 Unicorn-33461.exe 2344 Unicorn-26370.exe 1292 Unicorn-32501.exe 2980 Unicorn-40669.exe 3024 Unicorn-7612.exe 2488 Unicorn-55775.exe 2912 Unicorn-56040.exe 1768 Unicorn-36174.exe 1424 Unicorn-11478.exe 3048 Unicorn-30275.exe 1772 Unicorn-24253.exe 1760 Unicorn-20955.exe -
Loads dropped DLL 64 IoCs
pid Process 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 2720 Unicorn-62531.exe 2720 Unicorn-62531.exe 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 2644 Unicorn-59044.exe 2552 Unicorn-64752.exe 2552 Unicorn-64752.exe 2720 Unicorn-62531.exe 2720 Unicorn-62531.exe 2644 Unicorn-59044.exe 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 2732 Unicorn-57394.exe 2732 Unicorn-57394.exe 2552 Unicorn-64752.exe 2552 Unicorn-64752.exe 2992 Unicorn-2063.exe 2992 Unicorn-2063.exe 2560 Unicorn-53865.exe 2560 Unicorn-53865.exe 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 2720 Unicorn-62531.exe 2644 Unicorn-59044.exe 2720 Unicorn-62531.exe 2644 Unicorn-59044.exe 2684 Unicorn-49226.exe 2684 Unicorn-49226.exe 2088 Unicorn-2194.exe 2088 Unicorn-2194.exe 2732 Unicorn-57394.exe 2732 Unicorn-57394.exe 552 Unicorn-39313.exe 552 Unicorn-39313.exe 2552 Unicorn-64752.exe 2552 Unicorn-64752.exe 2784 Unicorn-57171.exe 1624 Unicorn-40570.exe 1624 Unicorn-40570.exe 2784 Unicorn-57171.exe 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 2684 Unicorn-49226.exe 1564 Unicorn-26507.exe 2684 Unicorn-49226.exe 1564 Unicorn-26507.exe 2992 Unicorn-2063.exe 2992 Unicorn-2063.exe 2324 Unicorn-24499.exe 2324 Unicorn-24499.exe 2560 Unicorn-53865.exe 2560 Unicorn-53865.exe 2576 Unicorn-51041.exe 1656 Unicorn-37305.exe 1656 Unicorn-37305.exe 2576 Unicorn-51041.exe 2720 Unicorn-62531.exe 2720 Unicorn-62531.exe 2644 Unicorn-59044.exe 2644 Unicorn-59044.exe 2176 Unicorn-8520.exe 2176 Unicorn-8520.exe -
Program crash 64 IoCs
pid pid_target Process procid_target 1608 920 WerFault.exe 52 824 2324 WerFault.exe 40 1320 1656 WerFault.exe 43 1076 2140 WerFault.exe 61 1844 1980 WerFault.exe 62 1312 2576 WerFault.exe 42 444 3024 WerFault.exe 87 2436 2756 WerFault.exe 102 2296 2488 WerFault.exe 91 1756 2912 WerFault.exe 94 3056 1612 WerFault.exe 109 2748 1092 WerFault.exe 112 3176 2656 WerFault.exe 65 3860 2828 WerFault.exe 144 4048 1692 WerFault.exe 110 3572 2028 WerFault.exe 74 3556 1772 WerFault.exe 98 3612 2444 WerFault.exe 57 3696 2980 WerFault.exe 86 3700 1768 WerFault.exe 93 3688 2556 WerFault.exe 108 3760 2256 WerFault.exe 148 3200 1424 WerFault.exe 96 3316 2016 WerFault.exe 139 4012 2624 WerFault.exe 105 3432 2532 WerFault.exe 127 4768 1824 WerFault.exe 114 4784 3020 WerFault.exe 173 4832 2776 WerFault.exe 159 4844 2640 WerFault.exe 157 5088 2448 WerFault.exe 101 5096 1196 WerFault.exe 51 4116 1524 WerFault.exe 120 4132 2024 WerFault.exe 142 4156 3068 WerFault.exe 154 4148 792 WerFault.exe 119 4180 1008 WerFault.exe 118 4164 2080 WerFault.exe 188 4120 2172 WerFault.exe 116 4212 2360 WerFault.exe 82 4240 2216 WerFault.exe 115 4252 1292 WerFault.exe 85 4776 1704 WerFault.exe 122 4888 2008 WerFault.exe 129 4916 1576 WerFault.exe 124 5064 1368 WerFault.exe 60 4932 4056 WerFault.exe 226 4316 2176 WerFault.exe 45 5124 1760 WerFault.exe 99 916 1964 WerFault.exe 63 5152 1620 WerFault.exe 71 5172 2228 WerFault.exe 53 5164 2628 WerFault.exe 103 5336 1496 WerFault.exe 132 5324 3032 WerFault.exe 135 5304 2800 WerFault.exe 145 5284 2512 WerFault.exe 70 5260 2336 WerFault.exe 146 5248 2416 WerFault.exe 130 5232 2364 WerFault.exe 64 5220 2320 WerFault.exe 54 5204 1728 WerFault.exe 128 5188 2696 WerFault.exe 143 5800 2456 WerFault.exe 100 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-23920.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-17394.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-20157.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-6437.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-46697.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-64512.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-36619.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-53463.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-34606.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-37658.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-38259.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-10970.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-8987.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-19619.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-42975.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-20407.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-42861.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-53442.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-44357.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-42540.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-11260.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-3092.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-28513.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-36619.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-15016.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-43671.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-33280.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-26277.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-26303.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-19639.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-16964.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-47869.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-2665.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-11841.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-59047.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-53082.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-30850.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-43546.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-52211.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-36174.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-20606.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-47095.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-2041.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-54193.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-18685.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-9288.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-61379.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-59778.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-16067.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-45897.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-26507.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-62423.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-18652.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-37558.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-21544.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-40669.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-57761.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-62259.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-11351.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-61486.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-51715.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-33750.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-55260.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-30210.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 2720 Unicorn-62531.exe 2644 Unicorn-59044.exe 2552 Unicorn-64752.exe 2732 Unicorn-57394.exe 2560 Unicorn-53865.exe 2992 Unicorn-2063.exe 2684 Unicorn-49226.exe 2088 Unicorn-2194.exe 552 Unicorn-39313.exe 1624 Unicorn-40570.exe 2324 Unicorn-24499.exe 2784 Unicorn-57171.exe 2576 Unicorn-51041.exe 1564 Unicorn-26507.exe 1656 Unicorn-37305.exe 2176 Unicorn-8520.exe 2168 Unicorn-12282.exe 2072 Unicorn-10632.exe 2852 Unicorn-28513.exe 2780 Unicorn-18116.exe 344 Unicorn-26284.exe 1196 Unicorn-40898.exe 2228 Unicorn-8987.exe 920 Unicorn-54659.exe 2320 Unicorn-21602.exe 2492 Unicorn-49636.exe 2444 Unicorn-16964.exe 2268 Unicorn-16964.exe 1420 Unicorn-62635.exe 1160 Unicorn-17274.exe 1368 Unicorn-11409.exe 2140 Unicorn-32610.exe 1980 Unicorn-48946.exe 1964 Unicorn-20912.exe 2364 Unicorn-10527.exe 2656 Unicorn-16658.exe 2740 Unicorn-45993.exe 2672 Unicorn-32802.exe 2772 Unicorn-65401.exe 3040 Unicorn-56538.exe 2512 Unicorn-20144.exe 1620 Unicorn-47109.exe 1920 Unicorn-43964.exe 2028 Unicorn-404.exe 2792 Unicorn-46076.exe 2116 Unicorn-8572.exe 1480 Unicorn-32115.exe 1604 Unicorn-212.exe 744 Unicorn-27522.exe 1504 Unicorn-19354.exe 2796 Unicorn-57965.exe 2360 Unicorn-24530.exe 568 Unicorn-33461.exe 2344 Unicorn-26370.exe 1292 Unicorn-32501.exe 2980 Unicorn-40669.exe 3024 Unicorn-7612.exe 2488 Unicorn-55775.exe 1768 Unicorn-36174.exe 2912 Unicorn-56040.exe 1424 Unicorn-11478.exe 3048 Unicorn-30275.exe 1760 Unicorn-20955.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2720 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 30 PID 2280 wrote to memory of 2720 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 30 PID 2280 wrote to memory of 2720 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 30 PID 2280 wrote to memory of 2720 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 30 PID 2720 wrote to memory of 2644 2720 Unicorn-62531.exe 31 PID 2720 wrote to memory of 2644 2720 Unicorn-62531.exe 31 PID 2720 wrote to memory of 2644 2720 Unicorn-62531.exe 31 PID 2720 wrote to memory of 2644 2720 Unicorn-62531.exe 31 PID 2280 wrote to memory of 2552 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 32 PID 2280 wrote to memory of 2552 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 32 PID 2280 wrote to memory of 2552 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 32 PID 2280 wrote to memory of 2552 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 32 PID 2552 wrote to memory of 2732 2552 Unicorn-64752.exe 34 PID 2552 wrote to memory of 2732 2552 Unicorn-64752.exe 34 PID 2552 wrote to memory of 2732 2552 Unicorn-64752.exe 34 PID 2552 wrote to memory of 2732 2552 Unicorn-64752.exe 34 PID 2720 wrote to memory of 2560 2720 Unicorn-62531.exe 35 PID 2720 wrote to memory of 2560 2720 Unicorn-62531.exe 35 PID 2720 wrote to memory of 2560 2720 Unicorn-62531.exe 35 PID 2720 wrote to memory of 2560 2720 Unicorn-62531.exe 35 PID 2644 wrote to memory of 2684 2644 Unicorn-59044.exe 33 PID 2644 wrote to memory of 2684 2644 Unicorn-59044.exe 33 PID 2644 wrote to memory of 2684 2644 Unicorn-59044.exe 33 PID 2644 wrote to memory of 2684 2644 Unicorn-59044.exe 33 PID 2280 wrote to memory of 2992 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 36 PID 2280 wrote to memory of 2992 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 36 PID 2280 wrote to memory of 2992 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 36 PID 2280 wrote to memory of 2992 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 36 PID 2732 wrote to memory of 2088 2732 Unicorn-57394.exe 37 PID 2732 wrote to memory of 2088 2732 Unicorn-57394.exe 37 PID 2732 wrote to memory of 2088 2732 Unicorn-57394.exe 37 PID 2732 wrote to memory of 2088 2732 Unicorn-57394.exe 37 PID 2552 wrote to memory of 552 2552 Unicorn-64752.exe 38 PID 2552 wrote to memory of 552 2552 Unicorn-64752.exe 38 PID 2552 wrote to memory of 552 2552 Unicorn-64752.exe 38 PID 2552 wrote to memory of 552 2552 Unicorn-64752.exe 38 PID 2992 wrote to memory of 1564 2992 Unicorn-2063.exe 39 PID 2992 wrote to memory of 1564 2992 Unicorn-2063.exe 39 PID 2992 wrote to memory of 1564 2992 Unicorn-2063.exe 39 PID 2992 wrote to memory of 1564 2992 Unicorn-2063.exe 39 PID 2560 wrote to memory of 2324 2560 Unicorn-53865.exe 40 PID 2560 wrote to memory of 2324 2560 Unicorn-53865.exe 40 PID 2560 wrote to memory of 2324 2560 Unicorn-53865.exe 40 PID 2560 wrote to memory of 2324 2560 Unicorn-53865.exe 40 PID 2280 wrote to memory of 1624 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 41 PID 2280 wrote to memory of 1624 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 41 PID 2280 wrote to memory of 1624 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 41 PID 2280 wrote to memory of 1624 2280 607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe 41 PID 2720 wrote to memory of 2576 2720 Unicorn-62531.exe 42 PID 2720 wrote to memory of 2576 2720 Unicorn-62531.exe 42 PID 2720 wrote to memory of 2576 2720 Unicorn-62531.exe 42 PID 2720 wrote to memory of 2576 2720 Unicorn-62531.exe 42 PID 2644 wrote to memory of 1656 2644 Unicorn-59044.exe 43 PID 2644 wrote to memory of 1656 2644 Unicorn-59044.exe 43 PID 2644 wrote to memory of 1656 2644 Unicorn-59044.exe 43 PID 2644 wrote to memory of 1656 2644 Unicorn-59044.exe 43 PID 2684 wrote to memory of 2784 2684 Unicorn-49226.exe 44 PID 2684 wrote to memory of 2784 2684 Unicorn-49226.exe 44 PID 2684 wrote to memory of 2784 2684 Unicorn-49226.exe 44 PID 2684 wrote to memory of 2784 2684 Unicorn-49226.exe 44 PID 2088 wrote to memory of 2176 2088 Unicorn-2194.exe 45 PID 2088 wrote to memory of 2176 2088 Unicorn-2194.exe 45 PID 2088 wrote to memory of 2176 2088 Unicorn-2194.exe 45 PID 2088 wrote to memory of 2176 2088 Unicorn-2194.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe"C:\Users\Admin\AppData\Local\Temp\607ea7f58ee2ede65b9f85992967c43f9d52f79e2320d2707db1cd7fe319bf68N.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-59044.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59044.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49226.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-57171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57171.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-26284.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26284.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:344 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-47109.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47109.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe8⤵PID:2756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 2409⤵
- Program crash
PID:2436
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54434.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54434.exe8⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe9⤵PID:4920
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29471.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29471.exe9⤵PID:5784
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19642.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19642.exe9⤵PID:6492
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18398.exe9⤵PID:7932
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59778.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59778.exe9⤵
- System Location Discovery: System Language Discovery
PID:8460
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39257.exe9⤵PID:9456
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19342.exe8⤵PID:3168
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 2368⤵
- Program crash
PID:5152
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11561.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11561.exe7⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21456.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21456.exe8⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46151.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46151.exe9⤵PID:6028
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26384.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26384.exe9⤵PID:6628
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe9⤵PID:8548
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54193.exe9⤵
- System Location Discovery: System Language Discovery
PID:9748
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 2488⤵
- Program crash
PID:4012
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42975.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42975.exe7⤵
- System Location Discovery: System Language Discovery
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31465.exe8⤵PID:6068
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20634.exe8⤵PID:7032
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe8⤵
- System Location Discovery: System Language Discovery
PID:7496
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exe8⤵PID:8432
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe8⤵PID:9932
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe7⤵PID:4108
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9288.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9288.exe7⤵
- System Location Discovery: System Language Discovery
PID:5912
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4645.exe7⤵PID:6236
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8945.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8945.exe7⤵PID:7992
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe7⤵PID:8804
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63801.exe7⤵PID:9040
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43964.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-4569.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4569.exe7⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55260.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55260.exe8⤵
- System Location Discovery: System Language Discovery
PID:4228
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 2288⤵PID:5972
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60096.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60096.exe7⤵PID:3104
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe7⤵PID:5460
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe7⤵PID:6872
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9681.exe7⤵PID:7668
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe7⤵
- System Location Discovery: System Language Discovery
PID:8232
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 2447⤵PID:9924
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe6⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32219.exe7⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49398.exe8⤵PID:8604
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34592.exe8⤵PID:9704
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe7⤵PID:4272
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-711.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-711.exe7⤵PID:6312
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49872.exe7⤵PID:7728
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13114.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13114.exe7⤵PID:8264
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23751.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23751.exe7⤵PID:9268
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18134.exe6⤵PID:3500
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41987.exe6⤵PID:5392
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38775.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38775.exe6⤵PID:6764
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10211.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10211.exe6⤵PID:7572
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe6⤵PID:8208
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40562.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40562.exe6⤵PID:9908
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54659.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 2406⤵
- Program crash
PID:1608
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19354.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19354.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-19497.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19497.exe6⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12597.exe7⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe8⤵PID:6400
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4719.exe8⤵PID:8416
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2770.exe8⤵PID:9576
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17792.exe7⤵PID:4808
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43207.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43207.exe7⤵PID:5812
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25508.exe7⤵PID:6352
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9733.exe7⤵PID:7300
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe7⤵PID:9124
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47963.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47963.exe7⤵PID:9444
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6437.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6437.exe6⤵
- System Location Discovery: System Language Discovery
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-3048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3048.exe7⤵PID:7844
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10923.exe7⤵PID:8388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 2287⤵PID:9424
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62337.exe6⤵PID:4196
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26981.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26981.exe6⤵PID:5992
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11855.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11855.exe6⤵PID:6196
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13919.exe6⤵PID:7356
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exe6⤵PID:9308
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61710.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61710.exe6⤵PID:10004
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11447.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11447.exe5⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19619.exe6⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65156.exe7⤵PID:4552
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe7⤵PID:5924
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15428.exe7⤵PID:6724
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe7⤵
- System Location Discovery: System Language Discovery
PID:7372
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19627.exe7⤵PID:9008
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe7⤵PID:9388
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe6⤵
- System Location Discovery: System Language Discovery
PID:3148
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exe6⤵PID:5792
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63016.exe6⤵PID:7080
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52442.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52442.exe6⤵PID:8080
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30398.exe6⤵PID:8912
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-931.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-931.exe6⤵PID:10236
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34232.exe5⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe6⤵PID:4984
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62772.exe6⤵PID:1680
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44391.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44391.exe6⤵PID:7516
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25755.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25755.exe6⤵PID:9032
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56073.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56073.exe6⤵PID:9960
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38756.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38756.exe5⤵PID:4040
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25413.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25413.exe5⤵PID:5764
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33350.exe5⤵PID:7092
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26106.exe5⤵PID:8032
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24798.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24798.exe5⤵PID:8928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 2445⤵PID:10140
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56040.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2912 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 2247⤵
- Program crash
PID:1756
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31849.exe6⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe7⤵PID:4204
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 2167⤵PID:6412
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25995.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25995.exe6⤵PID:3836
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27409.exe6⤵PID:6072
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe6⤵PID:1372
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe6⤵PID:7484
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe6⤵PID:8340
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44937.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44937.exe6⤵PID:1928
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 2365⤵
- Program crash
PID:1320
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11409.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-32501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32501.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe6⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60236.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60236.exe7⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26920.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26920.exe8⤵PID:7348
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe8⤵PID:8856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 2248⤵PID:9832
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 2487⤵
- Program crash
PID:4116
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14242.exe6⤵PID:3576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 2247⤵PID:7692
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62337.exe6⤵PID:4204
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 2366⤵
- Program crash
PID:4252
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59278.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59278.exe5⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59764.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59764.exe6⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25493.exe7⤵PID:7288
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28406.exe7⤵PID:9144
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 2207⤵PID:10168
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 2286⤵
- Program crash
PID:4916
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe5⤵PID:4064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 2246⤵PID:7984
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 2485⤵
- Program crash
PID:5064
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55775.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55775.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2488 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 2405⤵
- Program crash
PID:2296
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16168.exe4⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12769.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12769.exe5⤵PID:4960
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe5⤵PID:6124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 2405⤵PID:6420
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7.exe4⤵PID:3196
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34349.exe4⤵PID:5404
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34310.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34310.exe4⤵PID:6676
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48882.exe4⤵PID:7636
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6241.exe4⤵PID:9184
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21822.exe4⤵PID:9764
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53865.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53865.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-24499.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24499.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49636.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49636.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-40669.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40669.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-18301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18301.exe7⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe8⤵PID:4036
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14523.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14523.exe8⤵PID:5588
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 480 -s 2208⤵PID:6740
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 2487⤵
- Program crash
PID:3696
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe6⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8368.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8368.exe7⤵PID:4080
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe7⤵PID:5296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 2207⤵PID:6728
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58647.exe6⤵PID:3652
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe6⤵PID:5384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 2406⤵PID:6696
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 2365⤵
- Program crash
PID:824
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62635.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-212.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe6⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30584.exe7⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27674.exe8⤵PID:5432
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe8⤵PID:6736
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10810.exe8⤵PID:7908
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe8⤵PID:8724
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43546.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43546.exe8⤵
- System Location Discovery: System Language Discovery
PID:9608
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1845.exe7⤵PID:3188
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13048.exe7⤵PID:5488
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe7⤵PID:6688
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8010.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8010.exe7⤵PID:7892
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 2487⤵PID:8592
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33878.exe6⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64329.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64329.exe7⤵PID:5280
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36202.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36202.exe7⤵PID:7156
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 2207⤵PID:7468
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32492.exe6⤵PID:4028
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe6⤵PID:5752
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10324.exe6⤵PID:7144
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe6⤵PID:7340
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28025.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28025.exe6⤵PID:8272
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43458.exe6⤵PID:9888
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe5⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe6⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23230.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23230.exe7⤵PID:6972
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65409.exe7⤵PID:8148
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe7⤵PID:9064
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52211.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52211.exe7⤵
- System Location Discovery: System Language Discovery
PID:9596
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 2286⤵
- Program crash
PID:4180
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34993.exe5⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52052.exe6⤵PID:7864
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2833.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2833.exe6⤵PID:8444
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe6⤵PID:9856
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28488.exe5⤵PID:4864
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 2445⤵PID:5996
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27522.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:744 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20073.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20073.exe5⤵PID:1092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 2406⤵
- Program crash
PID:2748
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28663.exe5⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29099.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29099.exe6⤵PID:6568
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59685.exe6⤵PID:8052
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe6⤵PID:8668
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33405.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33405.exe6⤵PID:9540
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe5⤵PID:4460
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1158.exe5⤵PID:5240
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12628.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12628.exe5⤵PID:6516
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5009.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5009.exe5⤵PID:7316
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe5⤵
- System Location Discovery: System Language Discovery
PID:8356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 2365⤵PID:10164
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe4⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34606.exe5⤵
- System Location Discovery: System Language Discovery
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-36027.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36027.exe6⤵PID:6980
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32765.exe6⤵PID:8524
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe6⤵PID:9724
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 2365⤵
- Program crash
PID:4768
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe4⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe5⤵PID:7044
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47231.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47231.exe5⤵PID:1712
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe5⤵PID:9252
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64759.exe5⤵PID:9776
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe4⤵PID:4796
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40937.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40937.exe4⤵PID:5740
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe4⤵
- System Location Discovery: System Language Discovery
PID:6308
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe4⤵PID:8132
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37642.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37642.exe4⤵PID:8620
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe4⤵PID:10200
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51041.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51041.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 2246⤵
- Program crash
PID:444
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe5⤵PID:2016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 2206⤵
- Program crash
PID:3316
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 2405⤵
- Program crash
PID:3612
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 2284⤵
- Program crash
PID:1312
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-57965.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57965.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-62423.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62423.exe5⤵
- System Location Discovery: System Language Discovery
PID:876 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe6⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61486.exe7⤵
- System Location Discovery: System Language Discovery
PID:7924
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15931.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15931.exe7⤵PID:8500
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43087.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43087.exe7⤵PID:9368
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8887.exe6⤵PID:4764
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52003.exe6⤵PID:2596
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53463.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53463.exe6⤵
- System Location Discovery: System Language Discovery
PID:7420
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48034.exe6⤵PID:8920
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63658.exe6⤵PID:9900
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe5⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24751.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24751.exe6⤵PID:7376
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29584.exe6⤵PID:8972
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27347.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27347.exe6⤵PID:9588
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30427.exe5⤵PID:4896
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17027.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17027.exe5⤵PID:2020
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44798.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44798.exe5⤵PID:7412
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31498.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31498.exe5⤵PID:8932
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15186.exe5⤵PID:9880
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34581.exe4⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exe5⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe6⤵PID:6788
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe6⤵PID:7528
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53642.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53642.exe6⤵PID:9392
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48602.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48602.exe5⤵PID:5116
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21115.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21115.exe5⤵PID:6120
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20520.exe5⤵PID:6528
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24206.exe5⤵PID:8212
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9802.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9802.exe5⤵PID:9436
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe4⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45347.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45347.exe5⤵PID:5244
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54037.exe5⤵PID:8656
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48328.exe5⤵PID:9732
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2665.exe4⤵
- System Location Discovery: System Language Discovery
PID:5076
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18315.exe4⤵PID:6016
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60857.exe4⤵PID:6388
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe4⤵PID:7364
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13697.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13697.exe4⤵PID:9376
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56374.exe4⤵PID:10048
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24530.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-21308.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21308.exe4⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35924.exe5⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28622.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28622.exe6⤵PID:7872
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe6⤵PID:8404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 2286⤵PID:9400
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48602.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48602.exe5⤵PID:5108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 2405⤵
- Program crash
PID:4240
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe4⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43671.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43671.exe5⤵
- System Location Discovery: System Language Discovery
PID:8084
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe5⤵PID:8728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 2245⤵PID:9532
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 2444⤵
- Program crash
PID:4212
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20154.exe3⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exe4⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe5⤵PID:7684
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe5⤵PID:9212
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exe5⤵PID:10220
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 2484⤵
- Program crash
PID:4120
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17902.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17902.exe3⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe4⤵PID:7472
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53243.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53243.exe4⤵PID:8988
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe4⤵PID:9968
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38536.exe3⤵PID:4224
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40988.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40988.exe3⤵PID:5596
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe3⤵PID:6928
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe3⤵
- System Location Discovery: System Language Discovery
PID:8276
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42251.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42251.exe3⤵PID:9472
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-2194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2194.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-8520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8520.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-32610.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32610.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2140 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 2407⤵
- Program crash
PID:1076
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-26277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26277.exe7⤵
- System Location Discovery: System Language Discovery
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-40081.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40081.exe8⤵PID:3932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 2368⤵
- Program crash
PID:5324
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 2287⤵
- Program crash
PID:3700
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28890.exe6⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52463.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52463.exe7⤵PID:3984
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7808.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7808.exe7⤵PID:6088
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7395.exe7⤵PID:6368
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe7⤵PID:7464
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63654.exe7⤵PID:8412
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49402.exe7⤵PID:10088
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64512.exe6⤵
- System Location Discovery: System Language Discovery
PID:3564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 2446⤵
- Program crash
PID:4316
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20912.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20912.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-30275.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30275.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43490.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43490.exe7⤵PID:2256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 2248⤵
- Program crash
PID:3760
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe7⤵PID:3816
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe7⤵
- System Location Discovery: System Language Discovery
PID:5452
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe7⤵PID:6856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 2407⤵PID:7584
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exe6⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe7⤵PID:4140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 2167⤵PID:5840
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe6⤵PID:3120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 2366⤵
- Program crash
PID:916
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24253.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24253.exe5⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-34637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34637.exe6⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exe7⤵
- System Location Discovery: System Language Discovery
PID:3620
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5203.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5203.exe7⤵PID:5692
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 2247⤵PID:7048
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 2366⤵
- Program crash
PID:3556
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe5⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe6⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37658.exe7⤵
- System Location Discovery: System Language Discovery
PID:4880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 2487⤵PID:5760
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe6⤵PID:4360
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60830.exe6⤵PID:5368
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21293.exe6⤵PID:6632
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21544.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21544.exe6⤵
- System Location Discovery: System Language Discovery
PID:7392
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3092.exe6⤵
- System Location Discovery: System Language Discovery
PID:8472
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 2206⤵PID:9260
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58047.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58047.exe5⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45819.exe6⤵PID:6536
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18652.exe6⤵
- System Location Discovery: System Language Discovery
PID:8004
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 2246⤵PID:8680
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63619.exe5⤵PID:4516
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe5⤵PID:5140
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe5⤵PID:6616
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe5⤵PID:7320
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe5⤵PID:8368
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40265.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40265.exe5⤵PID:9220
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12282.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1980 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 2446⤵
- Program crash
PID:1844
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-19619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19619.exe6⤵
- System Location Discovery: System Language Discovery
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-16532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16532.exe7⤵PID:4424
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe7⤵PID:1876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 2207⤵PID:6496
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 2286⤵
- Program crash
PID:3200
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe5⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44918.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44918.exe6⤵PID:4324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 2286⤵PID:6256
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63957.exe5⤵PID:3988
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe5⤵PID:5776
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37815.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37815.exe5⤵PID:7100
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52972.exe5⤵PID:8040
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25933.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25933.exe5⤵PID:8884
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39602.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39602.exe5⤵PID:10132
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10527.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20955.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20955.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49987.exe6⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46215.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46215.exe7⤵PID:4188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 2287⤵PID:5980
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5332.exe6⤵PID:3920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 2406⤵
- Program crash
PID:5124
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5617.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5617.exe5⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe6⤵PID:4260
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63890.exe6⤵PID:5900
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe6⤵PID:6224
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17080.exe6⤵PID:8028
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27795.exe6⤵PID:9108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 2366⤵PID:9228
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19067.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19067.exe5⤵PID:3872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 2365⤵
- Program crash
PID:5232
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45962.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45962.exe4⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51331.exe5⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51607.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51607.exe6⤵PID:4356
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe6⤵PID:6424
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe6⤵PID:7956
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20840.exe6⤵PID:8576
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40287.exe6⤵PID:9372
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe5⤵PID:3136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 2445⤵
- Program crash
PID:5800
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42785.exe4⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10382.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10382.exe5⤵PID:5068
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe5⤵PID:6360
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44007.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44007.exe5⤵PID:7744
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe5⤵PID:8348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 2245⤵PID:9408
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6660.exe4⤵PID:3732
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19273.exe4⤵PID:6056
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49131.exe4⤵PID:6328
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47979.exe4⤵PID:7452
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41518.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41518.exe4⤵PID:8284
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16067.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16067.exe4⤵
- System Location Discovery: System Language Discovery
PID:10124
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:552 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-10632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10632.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-16658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16658.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20540.exe6⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exe7⤵
- System Location Discovery: System Language Discovery
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-17657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17657.exe8⤵PID:7488
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe8⤵
- System Location Discovery: System Language Discovery
PID:9088
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21405.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21405.exe8⤵PID:10112
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 2487⤵
- Program crash
PID:4148
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 2366⤵
- Program crash
PID:3176
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18053.exe5⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57460.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57460.exe6⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe7⤵
- System Location Discovery: System Language Discovery
PID:8116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 2287⤵PID:8780
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 2486⤵
- Program crash
PID:4776
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53442.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53442.exe5⤵
- System Location Discovery: System Language Discovery
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-59047.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59047.exe6⤵
- System Location Discovery: System Language Discovery
PID:8136
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36024.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36024.exe6⤵PID:8764
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27539.exe6⤵PID:9524
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe5⤵PID:4872
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57371.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57371.exe5⤵PID:5852
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe5⤵PID:7400
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40396.exe5⤵PID:8892
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59192.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59192.exe5⤵PID:9868
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe5⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51715.exe6⤵
- System Location Discovery: System Language Discovery
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-12021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12021.exe7⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53406.exe8⤵PID:6500
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38875.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38875.exe8⤵PID:7604
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe8⤵PID:8380
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9066.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9066.exe8⤵PID:8792
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 2367⤵
- Program crash
PID:4784
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25404.exe6⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43832.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43832.exe7⤵PID:7276
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12594.exe7⤵PID:8756
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2272.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2272.exe7⤵PID:9812
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31527.exe6⤵PID:4816
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exe6⤵PID:5820
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe6⤵PID:6380
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34230.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34230.exe6⤵PID:8100
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60308.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60308.exe6⤵PID:9112
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26432.exe6⤵PID:9304
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24558.exe5⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25069.exe6⤵PID:5680
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43415.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43415.exe6⤵PID:7124
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exe6⤵PID:8104
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6398.exe6⤵PID:8980
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-401.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-401.exe6⤵PID:10212
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29996.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29996.exe5⤵PID:3788
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 2485⤵PID:6096
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe4⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41321.exe5⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe6⤵PID:6084
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56639.exe6⤵PID:7232
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26329.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26329.exe6⤵PID:8772
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8137.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8137.exe6⤵PID:9796
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe5⤵PID:4304
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12088.exe5⤵PID:5904
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29846.exe5⤵PID:6184
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8415.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8415.exe5⤵PID:7968
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11260.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11260.exe5⤵
- System Location Discovery: System Language Discovery
PID:8640
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25130.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25130.exe5⤵PID:9324
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe4⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25556.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25556.exe5⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4890.exe6⤵PID:7008
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54037.exe6⤵PID:8648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 2206⤵PID:9696
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 2485⤵
- Program crash
PID:4164
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe4⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25052.exe5⤵PID:7444
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17057.exe5⤵PID:9044
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25292.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25292.exe5⤵PID:9668
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61450.exe4⤵PID:4296
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe4⤵PID:5828
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31119.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31119.exe4⤵PID:6996
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe4⤵PID:8320
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22650.exe4⤵PID:9480
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28513.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-32802.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32802.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-53762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53762.exe5⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe6⤵PID:3744
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 2166⤵
- Program crash
PID:5204
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44912.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44912.exe5⤵PID:3708
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe5⤵PID:5444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 2165⤵PID:6708
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26112.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26112.exe4⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe5⤵
- System Location Discovery: System Language Discovery
PID:3804
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe5⤵PID:5352
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58111.exe5⤵PID:6780
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18346.exe5⤵PID:7564
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28376.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28376.exe5⤵PID:8848
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55158.exe5⤵PID:9792
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58647.exe4⤵PID:3640
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50652.exe4⤵PID:5316
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55311.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55311.exe4⤵PID:6748
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58683.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58683.exe4⤵PID:7556
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28907.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28907.exe4⤵PID:9208
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45897.exe4⤵
- System Location Discovery: System Language Discovery
PID:9936
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65401.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65401.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23259.exe4⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe5⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55478.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55478.exe6⤵PID:3524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 2286⤵PID:6112
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe5⤵PID:3156
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45337.exe5⤵PID:5184
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20660.exe5⤵PID:6620
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48467.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48467.exe5⤵PID:7780
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe5⤵PID:8452
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44076.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44076.exe5⤵PID:9464
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18310.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18310.exe4⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1690.exe5⤵PID:5704
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64926.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64926.exe5⤵PID:7140
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62040.exe5⤵PID:7324
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36160.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36160.exe5⤵PID:8300
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64459.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64459.exe5⤵PID:9944
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48637.exe4⤵PID:3496
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51202.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51202.exe4⤵PID:5332
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11995.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11995.exe4⤵PID:6636
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31931.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31931.exe4⤵PID:7812
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe4⤵PID:8600
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe4⤵PID:9564
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46508.exe3⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59634.exe4⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39505.exe5⤵PID:3388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 2165⤵
- Program crash
PID:5188
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 2484⤵
- Program crash
PID:3688
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33976.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33976.exe3⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe4⤵PID:3584
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 2364⤵
- Program crash
PID:5304
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56377.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56377.exe3⤵PID:3660
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20986.exe3⤵PID:5344
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28975.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28975.exe3⤵PID:6804
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe3⤵
- System Location Discovery: System Language Discovery
PID:7620
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44042.exe3⤵PID:9192
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe3⤵PID:9784
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2063.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2063.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-26507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26507.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-8987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8987.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-13305.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13305.exe6⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63817.exe7⤵PID:3628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 2167⤵
- Program crash
PID:5248
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 2366⤵
- Program crash
PID:3572
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34280.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34280.exe5⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30761.exe6⤵PID:3224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 2366⤵
- Program crash
PID:5336
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58647.exe5⤵PID:3648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 2365⤵
- Program crash
PID:5172
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46076.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46076.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe5⤵PID:2640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 2406⤵
- Program crash
PID:4844
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19639.exe5⤵
- System Location Discovery: System Language Discovery
PID:3396
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe5⤵
- System Location Discovery: System Language Discovery
PID:5468
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe5⤵PID:6864
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9681.exe5⤵PID:7756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 2165⤵PID:9148
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2632.exe4⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58446.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58446.exe5⤵PID:3356
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe5⤵PID:5620
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 2245⤵PID:7108
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exe4⤵PID:3348
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33818.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33818.exe4⤵PID:4824
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 2364⤵PID:6716
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21602.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21602.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-33461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33461.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:568 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20649.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20649.exe5⤵PID:1612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 2406⤵
- Program crash
PID:3056
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe5⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8304.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8304.exe6⤵PID:6052
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5907.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5907.exe6⤵PID:6656
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12533.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12533.exe6⤵PID:7900
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2906.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2906.exe6⤵PID:8564
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe6⤵PID:9264
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe5⤵PID:3604
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1617.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1617.exe5⤵PID:5772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 2445⤵PID:6292
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24135.exe4⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50397.exe5⤵PID:2828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 2206⤵
- Program crash
PID:3860
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 2365⤵
- Program crash
PID:4048
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe4⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe5⤵PID:3936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 2365⤵
- Program crash
PID:5260
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31840.exe4⤵PID:3764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 2404⤵
- Program crash
PID:5220
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26370.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26370.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe4⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35068.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35068.exe5⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20606.exe6⤵
- System Location Discovery: System Language Discovery
PID:4284
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe6⤵PID:6212
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11910.exe6⤵PID:7612
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe6⤵
- System Location Discovery: System Language Discovery
PID:9128
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18605.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18605.exe6⤵PID:10104
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16692.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16692.exe5⤵PID:4852
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60171.exe5⤵PID:2244
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 2285⤵PID:7432
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe4⤵
- System Location Discovery: System Language Discovery
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-6277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6277.exe5⤵PID:3828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 2365⤵
- Program crash
PID:4932
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47869.exe4⤵
- System Location Discovery: System Language Discovery
PID:3868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 2284⤵PID:5920
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe3⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1025.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1025.exe4⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe5⤵PID:8044
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe5⤵PID:8968
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe5⤵PID:9516
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8332.exe4⤵PID:5032
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10970.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10970.exe4⤵
- System Location Discovery: System Language Discovery
PID:6160
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50256.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50256.exe4⤵PID:7536
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17089.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17089.exe4⤵PID:9020
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39537.exe4⤵PID:9984
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe3⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6520.exe4⤵PID:7440
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56435.exe4⤵PID:9316
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19973.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19973.exe4⤵PID:10080
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42861.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42861.exe3⤵
- System Location Discovery: System Language Discovery
PID:4320
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe3⤵PID:6300
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20206.exe3⤵PID:7736
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52315.exe3⤵PID:8256
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe3⤵PID:9288
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40570.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40570.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-18116.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18116.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56538.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56538.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe5⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe6⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13286.exe7⤵PID:5416
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11200.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11200.exe7⤵PID:6832
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8291.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8291.exe7⤵PID:8484
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53041.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53041.exe7⤵PID:9644
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 2486⤵
- Program crash
PID:3432
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe5⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48621.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48621.exe6⤵PID:6240
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5767.exe6⤵PID:7656
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10953.exe6⤵PID:9172
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42455.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42455.exe6⤵PID:10192
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe5⤵PID:4288
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe5⤵PID:5856
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21180.exe5⤵PID:6276
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe5⤵PID:8020
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe5⤵PID:8740
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3599.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3599.exe5⤵PID:8616
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42640.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42640.exe4⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe5⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9348.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9348.exe6⤵PID:7792
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe6⤵PID:8468
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe6⤵PID:9364
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 2285⤵
- Program crash
PID:4888
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe4⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe5⤵PID:7916
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11494.exe5⤵PID:8544
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3201.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3201.exe5⤵PID:10228
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe4⤵PID:5052
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8170.exe4⤵PID:1616
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25055.exe4⤵PID:7548
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exe4⤵PID:9076
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exe4⤵PID:10092
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20144.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20144.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe4⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12545.exe5⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exe6⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46032.exe7⤵PID:5420
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe7⤵PID:8716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 2247⤵PID:9824
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 2486⤵
- Program crash
PID:4156
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63806.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63806.exe5⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe6⤵
- System Location Discovery: System Language Discovery
PID:7308
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 2166⤵PID:8744
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 2205⤵
- Program crash
PID:5088
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-272.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-272.exe4⤵PID:2776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 2205⤵
- Program crash
PID:4832
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43271.exe4⤵PID:3956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 2364⤵
- Program crash
PID:5284
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50185.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50185.exe3⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe4⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41918.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41918.exe5⤵PID:3776
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38944.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38944.exe5⤵PID:5708
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 340 -s 2445⤵PID:7056
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20215.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20215.exe4⤵PID:3948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 2404⤵
- Program crash
PID:5164
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36785.exe3⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15571.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15571.exe4⤵PID:4488
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe4⤵
- System Location Discovery: System Language Discovery
PID:536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 2204⤵PID:6652
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38743.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38743.exe3⤵PID:3324
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17283.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17283.exe3⤵PID:5360
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55841.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55841.exe3⤵PID:6756
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exe3⤵PID:7596
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2041.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2041.exe3⤵
- System Location Discovery: System Language Discovery
PID:9168
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49557.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49557.exe3⤵PID:9744
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-8572.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8572.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-18685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18685.exe4⤵
- System Location Discovery: System Language Discovery
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-17938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17938.exe5⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe6⤵
- System Location Discovery: System Language Discovery
PID:7944
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19662.exe6⤵PID:8572
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 2246⤵PID:8876
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-164.exe5⤵PID:4748
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 2405⤵PID:6024
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20713.exe4⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31025.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31025.exe5⤵PID:7332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 2165⤵PID:9292
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62197.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62197.exe4⤵PID:4392
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe4⤵PID:6284
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41207.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41207.exe4⤵PID:7720
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62116.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62116.exe4⤵PID:8288
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40817.exe4⤵PID:9276
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31600.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31600.exe3⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exe4⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62259.exe5⤵
- System Location Discovery: System Language Discovery
PID:6776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 2165⤵PID:8632
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 2484⤵
- Program crash
PID:4132
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20172.exe3⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46250.exe4⤵PID:7152
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 2284⤵PID:8536
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 2483⤵
- Program crash
PID:5096
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32115.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32115.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-35322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35322.exe3⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe4⤵PID:3360
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38259.exe4⤵
- System Location Discovery: System Language Discovery
PID:5648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 288 -s 2444⤵PID:7064
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe3⤵
- System Location Discovery: System Language Discovery
PID:3808
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe3⤵PID:5372
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe3⤵PID:6848
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9681.exe3⤵PID:7708
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe3⤵PID:8220
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1891.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1891.exe3⤵PID:9896
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe2⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64222.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64222.exe3⤵PID:3320
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15016.exe3⤵
- System Location Discovery: System Language Discovery
PID:5964
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57151.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57151.exe3⤵PID:7036
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61107.exe3⤵PID:8068
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46934.exe3⤵PID:8948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 2483⤵PID:10152
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50030.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50030.exe2⤵PID:3076
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7483.exe2⤵PID:4548
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe2⤵PID:6796
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25347.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25347.exe2⤵PID:7628
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25841.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25841.exe2⤵PID:9156
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19022.exe2⤵PID:9620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
468KB
MD5f056793b1ef95ad1aa2d8400d82c1269
SHA163697c0b99e0518b266b6778f387dfed7ccc4ddb
SHA2564457fc4453c119534bb1ffce5bf9a6f0d0dfce6fb9e57daf0071635ddbbcd488
SHA5126cc0b6f06e27604a2ae4f6803dcab4b0d3a9b3de6e69676e134b4d893ddd8a9ab03390691b2f3948fe60d146254245d230ec1cb4042275496200edfb37fdf309
-
Filesize
468KB
MD584e14d9a21c6d183dae91603f813dfdb
SHA1b14e229fcff46c942e30868de8f333c6284d4fd9
SHA256ae86ee31ebacc020c1a6f39294fcbbf25e99292d3a894c7cb344c2710e19f04d
SHA512a49b13f8d211e21db14847775f415a7983634521792de26df187762a9ffe647ea415b1b1063daab60d7be1056e36fbe9368a8a030301b1a7af408b0957e127d9
-
Filesize
468KB
MD599d5b7fba58c96720cba285a890c7c8f
SHA15c9b155762d6fbfc46ec6798c274e25908a87872
SHA256c66eed95faab492ee91cb99e13aa355bdc1b452a3a0eb0c95d55d48c8de61cb9
SHA51234a145e691e6b5a0d853659000bfdcc5a61bd283fe6346a5fdf84558d23a525c93eb92a0aacfa270d9a5ae51536b58c215fbe94a4865c154d50303ad7c076596
-
Filesize
468KB
MD596312e6fa2ec27f493a1c6880715bf56
SHA190e6b11f1026846afd294f62bb4387d872939726
SHA256094822ad4d9aca4eadefcdba1b73dfbedecef934f44677162594743028eed92c
SHA5126281c6685d1bed5e702b23fea9dbd8a2bb3f02a81a49d2ca82cb0fb0e67075ca0ebf1ffee5ee0dd7da52ac9676c7f9b9af414e7ea21de4fb551b47821e05c6cb
-
Filesize
468KB
MD52644a8f26e9fed449c8c3d16d1ac03b4
SHA1d7b0897c6d626b7a1ef5d300dc5aab7b6f867942
SHA256e28c3cb3ddfbe1bb70ff1518602a12f76fc53e7dc755ec999b2c024c7460a936
SHA5123abac36fcebb83b6c82d4096d570951c687dd67c699ae6890c78ef829b7c519e1edff0e00c2e84409ae976e49e304a62a54c4d8de0649ae69abebf596be3b4be
-
Filesize
468KB
MD5839dc94f5929473bb40262d42cc5210e
SHA1b8fe0d4477ab099a2619d5e471b985ec54e7a957
SHA25626b4c63f86a375b02d637939929599ea36536813f00626c3bd9edb345f766233
SHA5121b00ad6942f3f88eaebd8db8b38e90a1938143ca89368da586867d4b744d7336d0ec6e4679197089f63d93fdf15ffd21f826a581d43b789633d91ce191f26007
-
Filesize
468KB
MD5c8c5b38c92adb694ee2016639a10c906
SHA1a298dc09427b72da1518cf57ff79e47a2530bf91
SHA256b3e58405032cf3a10408c5b86c4703d089746eff474549df6275cdb6d83cc1a7
SHA512a909c2b6e6021ed872b78b915be7b681a5d67fe05dd73aaa465a4eabc8a1808d1d3b25b1d433f007790f46f3733a5118b204ef1d43801c001b3f52a12f4643c7
-
Filesize
468KB
MD51dd5a9cc97b65c97a02e89cb424e7420
SHA1b8e1e968972e4e44c720d07140699fd264db418b
SHA25640cc298bd3696bdbca98f4042c293e3ec3187190c66ba0b45ff937435a950876
SHA512058dafd7c91173614af94ed2af9be0cbc176319f2da9ddd31d3de12db68fb6b4b7edb2f11c3737948e3c62fd53467191b84fa36f6edb391defb20cc3474c02bc
-
Filesize
468KB
MD5b16e00973ef68b2bdf1943cbe360cf59
SHA1535f0ec9b49b6a2feaf9b3443ce7e005f2efde25
SHA2565d5e2fe28ada54204fffb9f3465204918a35d838d8faf79d8b1d0b4811fe2a8d
SHA5123c4386833845b5927396ad44d8603a62ad89152dc9a410d18cd55a4a5df9c5608d02235b9359cfa8bb9eb62b60f1e2d7422b26e589dc92d8a3983aabb5a5bb5a
-
Filesize
468KB
MD5f9327e4506eb99c76c50d20ebaa8f2a0
SHA16827e7a85d81424016a2cf2a0dbfe67d1d31141b
SHA256f88b65cb66bd163082e93d1dfb9feda4704621d8468c0e9be4575d8a98f03d81
SHA51213203b10c354d5e2973924ed844b5b2899de35bee29e307a4ad8a900a4abd4da019be3cf4513310d7bcd451dec557d5e4cd75a9eedc9c01efa966303b15746a2
-
Filesize
468KB
MD5846012581aecd7bc467caa144ac6a07a
SHA14e8951f3f27a89c052d9332815b028835b128494
SHA256fed1196b26433e0b92549ff4c1c27d6e3f42470d8e3849df38a4419d077b43a6
SHA512cc63f752e9c1398966c910eb8ec922402dbeb303fc71888940dcf6dea78beb7409b23722eb01d696e4525dda516e2de04364ece86fbc730286c881867129b20a
-
Filesize
468KB
MD5237070896cc4840fe235b8f8d91d8787
SHA125f15ab824af4e2ebfcb84ca9e8a7328dc00b025
SHA2561f2f503672f1c549818868719725c064c94e217fb1608e58f531443fe3f07580
SHA51271f9a4b62e44ac4593e02f5ab057f69d000c6346ef44e97537f15d6d85e94521732f32bdafa31df64338cb1355813d7cbdf96bcef4051faeb69f5c7e334c3fbf
-
Filesize
468KB
MD5ca25a5d7a7f9af24c1fe96d2e1119208
SHA128cdbb6e7857e9545a234792f2f8ebb1af965ce7
SHA256f42b51639453eabda0db4908403f6f9bc813edeb426bb98964906aa9ca1553a7
SHA5126da515ef1e6dc07b5fea468ec14e7d1804b9cc0238c5fe1dcabb89df277fdd0d345a4c1c96d1aa77538d71183cbbe2717b6d0638b367609616e430a9d0752bcc
-
Filesize
468KB
MD58c433cb4d81aa1bcf95de9344fd91bf7
SHA17efd16c117995eba199aaac9a4c3d522a443a9f7
SHA256acde3d9fefc46d189de8ba3b4ad053034a4223852b20d10a5e806f12117a6d5c
SHA51230dffbd4cf465093782fa6807df76e329dcd54f2e80fcfa3bd8d2611d32557c4a39acd13b2fae32745cee4a5492d22a6e37b281c3718031248f6d92ffe384dc5
-
Filesize
468KB
MD5395cc991a311c63c470af1adc18b7dfc
SHA15baeaa32a9783711badf4b94bea3c3fa7c5ec7ae
SHA256182209bd9bc6e7da592d707e2d8967f020625cb829b06132c85a71abaedb49f9
SHA5122a9fa8b885de95bd4aa7b84298a55de31afb6b8554d1f6de2c5c93b65edeb87b8dd0d72e034d773f3c8ccdc85a92eb98235446c85a75ed3de0006e52e58d923b
-
Filesize
468KB
MD5844c97934fc64bf47ece104554644860
SHA1b8a26a20cf7776b73ffeb954c6bef346b22f7c3e
SHA256b5dff6b08c4f41ba3a3d34678723e751b5c67e631c6aec7c4e61d9784bd556a6
SHA51275a204e9b416861f6c93948ecf88ece3637ac1ed8c18e1921db020759362adb0c5cef9b80b777231e07e3657a40b14a4f1178d17b60548d2532075d3157b3374
-
Filesize
468KB
MD5e0735e4f2f00ab148ce9dab84b54bd14
SHA1b2ea3f68902e6d6e4abf99ce30582cc15956d627
SHA2562393fbb46e6177849ce2c920bac77aaf261c2bc52e476dab0368b6d2f9411124
SHA51243eec2799e15d0182c0cc0832d457b15ee743930da9e8ff4c9a93d475ac9c92616ebcd443a39217267bc5fb3057108e372c5dd2770ee94ccefe4778897b7774c
-
Filesize
468KB
MD53b369451e7792d6f4144863a6cef80fb
SHA142f107754e7ea9cd59032196dd26f8aa2753b039
SHA25654002f980eae72667ee4d20f46e8fdce3876c5e08092f1308630dd488daf7dec
SHA5123f260427e9a46d2ec18422914e201cfcac7558fa2b524b4cea462e3f7a1982b63745982a98899b84c16317bd74cdf986aeb0ea16e81acfbe322e43ad483b88d0
-
Filesize
468KB
MD57067879be74b8445c9e43bfcfcba34e2
SHA19717b9fb626dc6a42c44440c614b82bfd99cdcf9
SHA256fadd34c1b4352cd993a86a6f45eb96312925fc82d69e2781a0a45a9c68b115f1
SHA51289d32945a9edea8e15687a44a57a6b5e7ef786d513ef2b2aba9281c2beaed54313f4ae36d6bea727fa863b3c293f1d6cd7f42bbcce2084d28d166684cb6abb0f
-
Filesize
468KB
MD501b7dd23e2462f5ae07929dcd415d69a
SHA1d1538e51ca75a87fd81d40ced51615c53347ce1d
SHA256da0cb835ca8db192b206ed965f393930b360c13803a010993473de155931cafa
SHA5123370ffb17467497483007cc0f990936ac55f41360dae71b12fea7274185274fa639819481c3a60db54245a32e7e1e7c26a4eebc125288deca9cee9eb4116e79d
-
Filesize
468KB
MD545e5c81859b6299c288062c2ad0b96e2
SHA1c0e118d027b42977d2d4d129df9189fcc2d73996
SHA2562803271c26fba4cda7bd3c2f995c0e7c291faf38bbb0e8b832c9d8808793cd9e
SHA512639d1f655ff300920f3b4a1c2a676151caa714dbad3dab6517858c5a10dc08155a49bfe36f334bbe920f4d80dde8e235ce08786dec89cff8876a6e4e91167d09
-
Filesize
468KB
MD5e4b25a1327b9caf4a8088d85156d4b4c
SHA1ada5e81c7e1d535861961cc2c610db4f8445dbdd
SHA25649e3082c4071eccbc698c27d652ea4af8dc495c1271889c60ca3fad9fc3a589b
SHA512b626fd1a235b0a4c7ee459fec86476e70cb3d044f8796bebe164d6657c90909231ff73d81248bbf0c1c5ea465816b6a3ea9599d7ff754e1d0957b66cf97fb0a2
-
Filesize
468KB
MD55253ff207a53ae7ac81e57d18e79008f
SHA157f5566aff3e194280a1c0708e727e0f7e0183fb
SHA256404aa6d55ea4c9c9486d16ad6af646194d765d8715e41aed59f1cce7bfa3cbef
SHA512aeda72fa804c2952059bdd244f84faa6e39c11ae604f34d2b1ba3797e98639003911b612649d37e6c961db82dd016955eef512ff54dc93ed94d9466ae25ed596