Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 03:39
Static task
static1
Behavioral task
behavioral1
Sample
962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe
Resource
win10v2004-20240802-en
General
-
Target
962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe
-
Size
468KB
-
MD5
20e7377e75b787588c878f2f9a6b7f00
-
SHA1
42acbc4a6fc4d93ea28c3e177afe5941e6758070
-
SHA256
962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160
-
SHA512
f820f184c70b2a95e82796f1d1e5b10674d05a5e270b19faaa5674adf47ba9315e1d5c1b69633f2cd06c71090f28add9ed19bc97c528a4b7b015a28c86b6ca28
-
SSDEEP
3072:mrz7ogKxjO8U3bYWPz3yqf8/6ptj/PpgPmHx+lOvElK0Ac71SDlk:mrfot/U31PDyqf1BtlEljJ71S
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2500 Unicorn-58209.exe 224 Unicorn-18743.exe 4420 Unicorn-38609.exe 1692 Unicorn-56868.exe 2076 Unicorn-1537.exe 1364 Unicorn-53339.exe 1448 Unicorn-26708.exe 3096 Unicorn-19587.exe 1908 Unicorn-58804.exe 1356 Unicorn-23309.exe 3348 Unicorn-36530.exe 3976 Unicorn-42395.exe 2892 Unicorn-55924.exe 1580 Unicorn-58171.exe 2904 Unicorn-30564.exe 1836 Unicorn-40962.exe 2316 Unicorn-27165.exe 4264 Unicorn-30180.exe 4972 Unicorn-14035.exe 4988 Unicorn-5105.exe 2528 Unicorn-13770.exe 4860 Unicorn-45867.exe 2592 Unicorn-9987.exe 4256 Unicorn-26340.exe 2448 Unicorn-6666.exe 4392 Unicorn-44788.exe 2568 Unicorn-38082.exe 2836 Unicorn-43636.exe 744 Unicorn-27107.exe 4000 Unicorn-35380.exe 4980 Unicorn-18852.exe 3264 Unicorn-14746.exe 3620 Unicorn-39187.exe 4924 Unicorn-64269.exe 3836 Unicorn-64269.exe 3240 Unicorn-30785.exe 5080 Unicorn-20772.exe 3156 Unicorn-27985.exe 2708 Unicorn-36916.exe 5052 Unicorn-20196.exe 4244 Unicorn-3786.exe 4732 Unicorn-330.exe 2368 Unicorn-60443.exe 780 Unicorn-59604.exe 3884 Unicorn-58571.exe 4248 Unicorn-12899.exe 2548 Unicorn-56162.exe 3512 Unicorn-12131.exe 2484 Unicorn-61140.exe 4060 Unicorn-57419.exe 1340 Unicorn-11674.exe 1956 Unicorn-11036.exe 2748 Unicorn-10522.exe 1588 Unicorn-10268.exe 1560 Unicorn-23489.exe 2400 Unicorn-15780.exe 4804 Unicorn-12250.exe 1876 Unicorn-41331.exe 2292 Unicorn-11804.exe 5072 Unicorn-33821.exe 2060 Unicorn-20692.exe 3152 Unicorn-55860.exe 1856 Unicorn-22996.exe 4200 Unicorn-62475.exe -
Program crash 29 IoCs
pid pid_target Process procid_target 5080 224 WerFault.exe 83 2944 1356 WerFault.exe 94 3060 3348 WerFault.exe 95 4932 4264 WerFault.exe 106 2012 1560 WerFault.exe 151 1004 4000 WerFault.exe 121 7040 4980 WerFault.exe 122 4776 2548 WerFault.exe 142 6068 1836 WerFault.exe 104 7308 5828 WerFault.exe 201 7788 1956 WerFault.exe 148 8200 7152 WerFault.exe 266 9792 6344 WerFault.exe 281 9784 5564 WerFault.exe 197 8812 5128 WerFault.exe 184 4456 1936 WerFault.exe 162 9660 5244 WerFault.exe 233 11288 7164 WerFault.exe 267 5564 6356 WerFault.exe 274 12800 6564 WerFault.exe 254 12788 6432 WerFault.exe 248 8736 4924 WerFault.exe 125 14692 3836 WerFault.exe 126 14356 7812 WerFault.exe 356 14400 8176 WerFault.exe 407 16348 5956 WerFault.exe 208 5692 9184 Process not Found 464 7832 7032 Process not Found 343 17832 8704 Process not Found 371 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-12232.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-62018.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-19587.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-38324.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-27779.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-18445.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-18673.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-2344.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-56770.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-27956.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-25316.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-46733.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-10723.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-46212.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-27956.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-1411.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-36611.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-4156.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-62913.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-63556.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-13891.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-8588.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-59940.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-11329.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-14131.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-3313.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-9356.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-19156.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-26948.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-15427.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-28426.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-52027.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-6826.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-20922.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-54233.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-35380.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-44557.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-65252.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-8972.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-21517.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-54590.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-18845.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-11804.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-25284.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-58916.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-8307.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-53714.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-41015.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-42297.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-29297.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-32771.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-63332.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-35204.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-64269.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-10739.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-43034.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-16436.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-45490.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-39908.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-40962.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-41770.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-46733.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-2232.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeCreateGlobalPrivilege 1016 dwm.exe Token: SeChangeNotifyPrivilege 1016 dwm.exe Token: 33 1016 dwm.exe Token: SeIncBasePriorityPrivilege 1016 dwm.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4300 962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe 2500 Unicorn-58209.exe 224 Unicorn-18743.exe 4420 Unicorn-38609.exe 1692 Unicorn-56868.exe 1364 Unicorn-53339.exe 2076 Unicorn-1537.exe 1448 Unicorn-26708.exe 3096 Unicorn-19587.exe 1356 Unicorn-23309.exe 3348 Unicorn-36530.exe 1908 Unicorn-58804.exe 3976 Unicorn-42395.exe 2892 Unicorn-55924.exe 1580 Unicorn-58171.exe 2904 Unicorn-30564.exe 1836 Unicorn-40962.exe 4988 Unicorn-5105.exe 4264 Unicorn-30180.exe 2316 Unicorn-27165.exe 4860 Unicorn-45867.exe 2528 Unicorn-13770.exe 4972 Unicorn-14035.exe 2592 Unicorn-9987.exe 4256 Unicorn-26340.exe 2448 Unicorn-6666.exe 4392 Unicorn-44788.exe 2568 Unicorn-38082.exe 2836 Unicorn-43636.exe 744 Unicorn-27107.exe 4000 Unicorn-35380.exe 4980 Unicorn-18852.exe 3264 Unicorn-14746.exe 3620 Unicorn-39187.exe 4924 Unicorn-64269.exe 3836 Unicorn-64269.exe 3156 Unicorn-27985.exe 2708 Unicorn-36916.exe 5080 Unicorn-20772.exe 4732 Unicorn-330.exe 4244 Unicorn-3786.exe 5052 Unicorn-20196.exe 2368 Unicorn-60443.exe 3240 Unicorn-30785.exe 780 Unicorn-59604.exe 3884 Unicorn-58571.exe 4248 Unicorn-12899.exe 2548 Unicorn-56162.exe 3512 Unicorn-12131.exe 2484 Unicorn-61140.exe 4060 Unicorn-57419.exe 1956 Unicorn-11036.exe 1340 Unicorn-11674.exe 2748 Unicorn-10522.exe 1560 Unicorn-23489.exe 1588 Unicorn-10268.exe 1876 Unicorn-41331.exe 2400 Unicorn-15780.exe 2292 Unicorn-11804.exe 4804 Unicorn-12250.exe 5072 Unicorn-33821.exe 3152 Unicorn-55860.exe 2060 Unicorn-20692.exe 1856 Unicorn-22996.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4300 wrote to memory of 2500 4300 962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe 82 PID 4300 wrote to memory of 2500 4300 962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe 82 PID 4300 wrote to memory of 2500 4300 962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe 82 PID 4300 wrote to memory of 224 4300 962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe 83 PID 4300 wrote to memory of 224 4300 962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe 83 PID 4300 wrote to memory of 224 4300 962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe 83 PID 2500 wrote to memory of 4420 2500 Unicorn-58209.exe 84 PID 2500 wrote to memory of 4420 2500 Unicorn-58209.exe 84 PID 2500 wrote to memory of 4420 2500 Unicorn-58209.exe 84 PID 4420 wrote to memory of 1692 4420 Unicorn-38609.exe 86 PID 4420 wrote to memory of 1692 4420 Unicorn-38609.exe 86 PID 4420 wrote to memory of 1692 4420 Unicorn-38609.exe 86 PID 2500 wrote to memory of 1364 2500 Unicorn-58209.exe 88 PID 2500 wrote to memory of 1364 2500 Unicorn-58209.exe 88 PID 2500 wrote to memory of 1364 2500 Unicorn-58209.exe 88 PID 4300 wrote to memory of 2076 4300 962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe 87 PID 4300 wrote to memory of 2076 4300 962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe 87 PID 4300 wrote to memory of 2076 4300 962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe 87 PID 1692 wrote to memory of 1448 1692 Unicorn-56868.exe 91 PID 1692 wrote to memory of 1448 1692 Unicorn-56868.exe 91 PID 1692 wrote to memory of 1448 1692 Unicorn-56868.exe 91 PID 4420 wrote to memory of 3096 4420 Unicorn-38609.exe 92 PID 4420 wrote to memory of 3096 4420 Unicorn-38609.exe 92 PID 4420 wrote to memory of 3096 4420 Unicorn-38609.exe 92 PID 1364 wrote to memory of 1908 1364 Unicorn-53339.exe 93 PID 1364 wrote to memory of 1908 1364 Unicorn-53339.exe 93 PID 1364 wrote to memory of 1908 1364 Unicorn-53339.exe 93 PID 2076 wrote to memory of 1356 2076 Unicorn-1537.exe 94 PID 2076 wrote to memory of 1356 2076 Unicorn-1537.exe 94 PID 2076 wrote to memory of 1356 2076 Unicorn-1537.exe 94 PID 2500 wrote to memory of 3348 2500 Unicorn-58209.exe 95 PID 2500 wrote to memory of 3348 2500 Unicorn-58209.exe 95 PID 2500 wrote to memory of 3348 2500 Unicorn-58209.exe 95 PID 4300 wrote to memory of 3976 4300 962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe 96 PID 4300 wrote to memory of 3976 4300 962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe 96 PID 4300 wrote to memory of 3976 4300 962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe 96 PID 1448 wrote to memory of 2892 1448 Unicorn-26708.exe 99 PID 1448 wrote to memory of 2892 1448 Unicorn-26708.exe 99 PID 1448 wrote to memory of 2892 1448 Unicorn-26708.exe 99 PID 1692 wrote to memory of 1580 1692 Unicorn-56868.exe 100 PID 1692 wrote to memory of 1580 1692 Unicorn-56868.exe 100 PID 1692 wrote to memory of 1580 1692 Unicorn-56868.exe 100 PID 3096 wrote to memory of 2904 3096 Unicorn-19587.exe 103 PID 3096 wrote to memory of 2904 3096 Unicorn-19587.exe 103 PID 3096 wrote to memory of 2904 3096 Unicorn-19587.exe 103 PID 4420 wrote to memory of 1836 4420 Unicorn-38609.exe 104 PID 4420 wrote to memory of 1836 4420 Unicorn-38609.exe 104 PID 4420 wrote to memory of 1836 4420 Unicorn-38609.exe 104 PID 3976 wrote to memory of 2316 3976 Unicorn-42395.exe 105 PID 3976 wrote to memory of 2316 3976 Unicorn-42395.exe 105 PID 3976 wrote to memory of 2316 3976 Unicorn-42395.exe 105 PID 3348 wrote to memory of 4264 3348 Unicorn-36530.exe 106 PID 3348 wrote to memory of 4264 3348 Unicorn-36530.exe 106 PID 3348 wrote to memory of 4264 3348 Unicorn-36530.exe 106 PID 1908 wrote to memory of 4972 1908 Unicorn-58804.exe 107 PID 1908 wrote to memory of 4972 1908 Unicorn-58804.exe 107 PID 1908 wrote to memory of 4972 1908 Unicorn-58804.exe 107 PID 4300 wrote to memory of 4988 4300 962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe 108 PID 4300 wrote to memory of 4988 4300 962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe 108 PID 4300 wrote to memory of 4988 4300 962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe 108 PID 2500 wrote to memory of 2528 2500 Unicorn-58209.exe 109 PID 2500 wrote to memory of 2528 2500 Unicorn-58209.exe 109 PID 2500 wrote to memory of 2528 2500 Unicorn-58209.exe 109 PID 2076 wrote to memory of 4860 2076 Unicorn-1537.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe"C:\Users\Admin\AppData\Local\Temp\962e98446dfb348a19e1fc2ea44a4446928484adc468a5a0aa830c0f08d39160N.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-58209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58209.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56868.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-26708.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26708.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-55924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55924.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-26340.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26340.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-59604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59604.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:780 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-22669.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22669.exe9⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exe10⤵PID:7144
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63524.exe11⤵PID:9132
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37066.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37066.exe11⤵PID:10056
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52648.exe11⤵PID:15292
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60290.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60290.exe11⤵PID:7488
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53467.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53467.exe10⤵PID:9344
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe11⤵
- System Location Discovery: System Language Discovery
PID:3044
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe10⤵PID:12848
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe10⤵PID:15724
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56411.exe9⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62237.exe10⤵PID:9172
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20922.exe10⤵
- System Location Discovery: System Language Discovery
PID:11904
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36805.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36805.exe10⤵PID:15316
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29154.exe10⤵PID:15712
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45490.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45490.exe9⤵
- System Location Discovery: System Language Discovery
PID:9804
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exe9⤵PID:13324
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57865.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57865.exe9⤵PID:7592
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58356.exe8⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exe9⤵PID:6352
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19581.exe10⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe11⤵PID:14640
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe9⤵PID:10008
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59842.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59842.exe9⤵PID:12772
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe9⤵PID:15708
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe9⤵PID:14360
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53426.exe8⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe9⤵PID:12716
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe9⤵PID:15028
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4072.exe9⤵PID:16648
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54427.exe8⤵PID:10396
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58571.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58571.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-12684.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12684.exe8⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe9⤵PID:6228
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26948.exe10⤵
- System Location Discovery: System Language Discovery
PID:11416
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46209.exe10⤵PID:14408
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18104.exe10⤵PID:6632
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55963.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55963.exe9⤵PID:9424
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23876.exe10⤵PID:12300
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exe10⤵PID:15304
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6760.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6760.exe10⤵PID:5460
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe9⤵PID:12228
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28654.exe9⤵PID:15908
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26072.exe9⤵PID:16696
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43722.exe8⤵PID:7276
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20733.exe9⤵PID:8604
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exe9⤵PID:13060
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe9⤵PID:15460
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39922.exe9⤵PID:6272
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14161.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14161.exe8⤵PID:9680
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6170.exe7⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-780.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-780.exe8⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe9⤵PID:7348
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31885.exe10⤵PID:10060
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20554.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20554.exe10⤵PID:13316
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25112.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25112.exe10⤵PID:15880
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe9⤵PID:10688
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39106.exe9⤵PID:6380
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exe8⤵PID:8968
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43163.exe8⤵PID:10928
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe8⤵PID:1656
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25768.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25768.exe8⤵PID:5752
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12819.exe7⤵PID:6496
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe8⤵PID:6304
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22356.exe9⤵PID:13372
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe9⤵PID:4652
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38659.exe8⤵PID:11572
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27956.exe8⤵PID:5564
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe7⤵PID:8316
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55239.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55239.exe8⤵PID:15436
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47618.exe8⤵PID:16732
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52027.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52027.exe7⤵
- System Location Discovery: System Language Discovery
PID:11612
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25687.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25687.exe7⤵PID:3392
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20640.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20640.exe7⤵PID:16912
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6666.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6666.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-12899.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12899.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe8⤵
- System Location Discovery: System Language Discovery
PID:5264 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe9⤵PID:6284
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe10⤵PID:8576
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exe10⤵PID:13180
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe10⤵PID:15640
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65186.exe10⤵PID:1228
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe9⤵PID:9364
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe9⤵PID:12652
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe9⤵PID:15756
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe9⤵PID:2864
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36483.exe8⤵PID:7104
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exe9⤵PID:6644
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23876.exe10⤵PID:12316
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exe10⤵PID:15324
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exe9⤵PID:11772
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe9⤵PID:15016
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48850.exe9⤵PID:6104
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe8⤵PID:9960
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10115.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10115.exe7⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe8⤵PID:6444
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65252.exe9⤵
- System Location Discovery: System Language Discovery
PID:8768
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55963.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55963.exe8⤵PID:9392
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe8⤵PID:12864
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe8⤵PID:15780
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40185.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40185.exe8⤵PID:5468
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe7⤵PID:7236
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33533.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33533.exe8⤵PID:10780
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe8⤵
- System Location Discovery: System Language Discovery
PID:3484
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61353.exe8⤵PID:16664
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35076.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35076.exe7⤵PID:10340
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56162.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-15700.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15700.exe7⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exe8⤵PID:6168
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38324.exe9⤵
- System Location Discovery: System Language Discovery
PID:7032 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe10⤵PID:14628
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe9⤵PID:10804
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe9⤵PID:13648
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe9⤵PID:17112
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6362.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6362.exe8⤵PID:9096
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57597.exe9⤵PID:3472
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58923.exe8⤵PID:7156
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64958.exe8⤵PID:4264
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe8⤵PID:16444
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 7287⤵
- Program crash
PID:4776
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61428.exe6⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe7⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe8⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe9⤵PID:10456
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe9⤵PID:4688
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe8⤵PID:10292
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36210.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36210.exe8⤵PID:13472
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31170.exe8⤵PID:15668
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5128 -s 6407⤵
- Program crash
PID:8812
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56562.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56562.exe6⤵PID:6564
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe7⤵PID:7624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6564 -s 6367⤵
- Program crash
PID:12800
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48042.exe6⤵PID:1768
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe6⤵PID:11684
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4156.exe6⤵
- System Location Discovery: System Language Discovery
PID:1816
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47097.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47097.exe6⤵PID:7880
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58171.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-12131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12131.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe8⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10531.exe9⤵PID:7096
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exe10⤵
- System Location Discovery: System Language Discovery
PID:9708 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe11⤵PID:11816
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exe11⤵PID:14864
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22136.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22136.exe11⤵PID:16684
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30730.exe10⤵PID:12452
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe10⤵PID:15832
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33.exe10⤵PID:4660
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe9⤵PID:316
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21274.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21274.exe9⤵PID:1464
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38529.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38529.exe9⤵PID:5008
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe9⤵PID:17016
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40842.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40842.exe8⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe9⤵PID:9044
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7539.exe9⤵PID:6260
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe9⤵PID:4376
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53746.exe8⤵PID:10108
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-746.exe8⤵PID:6656
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19412.exe8⤵PID:15808
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exe8⤵PID:3252
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63291.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63291.exe7⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe8⤵PID:6356
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe9⤵PID:7532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6356 -s 6249⤵
- Program crash
PID:5564
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32771.exe8⤵PID:7772
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe8⤵PID:13124
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6733.exe8⤵PID:14672
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51433.exe8⤵PID:5068
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53426.exe7⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26980.exe8⤵PID:2008
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54427.exe7⤵PID:10448
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52050.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52050.exe7⤵PID:13844
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24609.exe7⤵PID:15652
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-29981.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29981.exe7⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exe8⤵PID:6452
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe9⤵
- System Location Discovery: System Language Discovery
PID:1872
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe9⤵PID:13228
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exe9⤵PID:7756
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16177.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16177.exe9⤵PID:4272
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55963.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55963.exe8⤵PID:9408
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe8⤵PID:12044
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe8⤵PID:15716
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe8⤵PID:1296
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12257.exe6⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61268.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61268.exe7⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe8⤵PID:7804
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32771.exe7⤵PID:8900
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe6⤵PID:7248
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe7⤵PID:9536
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30922.exe7⤵PID:12468
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exe7⤵PID:15864
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31170.exe7⤵PID:14700
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15274.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15274.exe6⤵PID:10536
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12266.exe6⤵PID:9612
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe6⤵PID:7876
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38082.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38082.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-61140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61140.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-33188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33188.exe7⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exe8⤵PID:6380
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exe9⤵
- System Location Discovery: System Language Discovery
PID:3152
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe8⤵PID:10000
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60418.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60418.exe8⤵PID:12692
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe8⤵PID:15772
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18376.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18376.exe8⤵PID:5064
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe6⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe7⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe8⤵PID:8096
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exe8⤵PID:13164
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe8⤵PID:14648
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43378.exe8⤵PID:15716
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55963.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55963.exe7⤵PID:9400
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe7⤵PID:12232
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28654.exe7⤵PID:15892
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16840.exe7⤵PID:4436
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4609.exe6⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42397.exe7⤵PID:12840
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18845.exe7⤵PID:2312
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20216.exe7⤵PID:3136
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe6⤵PID:10308
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11674.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-34724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34724.exe6⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe7⤵PID:6248
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exe8⤵PID:8844
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55963.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55963.exe7⤵PID:9416
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe8⤵PID:14388
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exe8⤵PID:5452
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe7⤵PID:12252
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28654.exe7⤵PID:15684
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34520.exe7⤵PID:16396
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe6⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe7⤵PID:9068
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47986.exe6⤵PID:10480
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe6⤵PID:13660
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8280.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8280.exe6⤵PID:4548
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64683.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64683.exe5⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18973.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18973.exe6⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe7⤵
- System Location Discovery: System Language Discovery
PID:13268
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52670.exe7⤵PID:15612
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe7⤵PID:6868
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe6⤵PID:10588
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53714.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53714.exe6⤵
- System Location Discovery: System Language Discovery
PID:13504
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25162.exe5⤵PID:8644
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe6⤵PID:3180
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56066.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56066.exe6⤵PID:6080
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe5⤵PID:9792
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16460.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16460.exe5⤵PID:2568
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43636.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43636.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-18388.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18388.exe8⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exe9⤵PID:6536
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe10⤵PID:8344
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6297.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6297.exe11⤵PID:10428
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe11⤵PID:15016
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57627.exe10⤵PID:11648
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27956.exe10⤵
- System Location Discovery: System Language Discovery
PID:2684
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32771.exe9⤵
- System Location Discovery: System Language Discovery
PID:8700
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe9⤵PID:13108
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6733.exe9⤵PID:14872
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8776.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8776.exe9⤵PID:16864
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 6688⤵
- Program crash
PID:7788
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe7⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43988.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43988.exe8⤵PID:6320
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8588.exe9⤵
- System Location Discovery: System Language Discovery
PID:13560
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe9⤵PID:15100
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62123.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62123.exe8⤵PID:9332
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16282.exe8⤵PID:13224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5956 -s 6808⤵
- Program crash
PID:16348
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe7⤵PID:7948
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe8⤵PID:12824
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64782.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64782.exe8⤵PID:15344
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2344.exe8⤵
- System Location Discovery: System Language Discovery
PID:1568
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe7⤵PID:10732
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe7⤵PID:13428
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3953.exe7⤵PID:7812
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10522.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-15372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15372.exe7⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe8⤵PID:5604
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exe9⤵PID:7788
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exe9⤵PID:13216
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exe9⤵PID:15144
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29154.exe9⤵PID:16428
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53467.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53467.exe8⤵PID:9336
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe8⤵PID:12808
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe8⤵PID:15740
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42297.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42297.exe8⤵
- System Location Discovery: System Language Discovery
PID:1180
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe7⤵
- System Location Discovery: System Language Discovery
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exe8⤵PID:8692
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exe8⤵PID:12196
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exe8⤵PID:15668
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60674.exe8⤵PID:8068
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26522.exe7⤵PID:9644
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22147.exe7⤵PID:13152
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4228.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4228.exe7⤵PID:7752
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36817.exe7⤵PID:15284
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2273.exe6⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exe7⤵PID:6544
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe8⤵PID:7852
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32771.exe7⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8972.exe8⤵
- System Location Discovery: System Language Discovery
PID:12416
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe7⤵PID:13100
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6733.exe7⤵PID:15000
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3384.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3384.exe7⤵PID:16176
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10090.exe6⤵PID:7028
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17588.exe7⤵PID:4736
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8307.exe7⤵
- System Location Discovery: System Language Discovery
PID:12960
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exe7⤵PID:15444
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1681.exe7⤵PID:16924
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42690.exe6⤵PID:9700
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50247.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50247.exe7⤵PID:14928
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14954.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14954.exe6⤵PID:13340
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24955.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24955.exe6⤵PID:1636
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:744 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-10268.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10268.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-34724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34724.exe7⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60116.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60116.exe8⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe9⤵PID:8628
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 7448⤵
- Program crash
PID:9784
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57755.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57755.exe7⤵PID:7216
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41540.exe8⤵PID:10836
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51502.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51502.exe8⤵PID:6276
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5032.exe8⤵PID:17008
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe7⤵PID:10416
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe6⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10723.exe7⤵
- System Location Discovery: System Language Discovery
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe8⤵
- System Location Discovery: System Language Discovery
PID:9080
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe7⤵PID:9816
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe7⤵PID:12732
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe7⤵PID:15748
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57074.exe6⤵PID:7320
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exe7⤵PID:12152
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23940.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23940.exe6⤵PID:10552
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57058.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57058.exe6⤵PID:13908
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe6⤵PID:224
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23489.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23489.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1560 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 6326⤵
- Program crash
PID:2012
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8138.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8138.exe5⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exe6⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exe7⤵PID:5360
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe7⤵PID:13292
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe7⤵PID:14736
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exe7⤵PID:8364
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe6⤵PID:9808
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe6⤵PID:12552
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe6⤵PID:15764
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14920.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14920.exe6⤵PID:6992
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe5⤵PID:7176
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exe6⤵PID:9744
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60388.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60388.exe6⤵PID:12620
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29226.exe5⤵PID:10376
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe5⤵PID:13572
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35904.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35904.exe5⤵PID:4324
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40962.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40962.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20196.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20196.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-37277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37277.exe6⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18980.exe7⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe8⤵PID:7160
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe9⤵PID:8780
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19843.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19843.exe9⤵PID:13420
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe9⤵PID:15600
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe8⤵PID:10500
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe8⤵PID:13668
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe8⤵PID:15728
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exe7⤵PID:7816
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55239.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55239.exe8⤵PID:15372
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39921.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39921.exe8⤵PID:6776
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8401.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8401.exe7⤵PID:10744
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe7⤵PID:10956
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe7⤵PID:6996
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45627.exe6⤵PID:6548
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55636.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55636.exe7⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe8⤵PID:11608
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe8⤵PID:14716
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exe8⤵
- System Location Discovery: System Language Discovery
PID:8388
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38659.exe7⤵PID:11580
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27956.exe7⤵PID:8188
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8593.exe7⤵PID:2128
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52267.exe6⤵PID:8744
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51099.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51099.exe6⤵PID:11292
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14103.exe6⤵PID:14564
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 7125⤵
- Program crash
PID:6068
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3786.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3786.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe5⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18404.exe6⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe7⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe8⤵PID:12852
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18845.exe8⤵
- System Location Discovery: System Language Discovery
PID:15240
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe8⤵PID:7764
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe7⤵PID:10492
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exe6⤵PID:7560
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe7⤵PID:14676
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe7⤵PID:10088
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe6⤵PID:10980
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35057.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35057.exe6⤵PID:14328
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51241.exe6⤵PID:8460
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58756.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58756.exe5⤵PID:6504
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe6⤵PID:8176
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe7⤵PID:11052
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8176 -s 5967⤵
- Program crash
PID:14400
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43402.exe6⤵PID:11908
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43141.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43141.exe6⤵PID:4972
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10897.exe6⤵PID:7932
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31825.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31825.exe5⤵PID:7800
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54938.exe6⤵PID:656
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57986.exe6⤵PID:6732
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11690.exe5⤵PID:11880
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe5⤵PID:3980
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13738.exe4⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52804.exe5⤵PID:6112
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe6⤵PID:6784
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15427.exe7⤵
- System Location Discovery: System Language Discovery
PID:12348
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe7⤵PID:15660
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61433.exe7⤵PID:5096
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe6⤵PID:10796
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe6⤵PID:12780
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51972.exe5⤵PID:8876
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe6⤵PID:12284
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40365.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40365.exe6⤵PID:15048
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exe6⤵PID:8432
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58923.exe5⤵PID:10524
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64958.exe5⤵PID:6360
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exe5⤵PID:14592
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14666.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14666.exe4⤵PID:6680
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38324.exe5⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15411.exe6⤵PID:8732
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe6⤵PID:12204
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe6⤵PID:16408
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37620.exe4⤵PID:8036
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exe4⤵PID:11348
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe4⤵PID:12908
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29297.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29297.exe4⤵
- System Location Discovery: System Language Discovery
PID:5496
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-58804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58804.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20772.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23764.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23764.exe7⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8476.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8476.exe8⤵PID:6572
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe9⤵PID:6800
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43402.exe9⤵PID:11896
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43141.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43141.exe9⤵PID:14456
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16369.exe9⤵PID:3580
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-867.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-867.exe8⤵PID:8756
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21274.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21274.exe8⤵PID:10812
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38529.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38529.exe8⤵PID:15056
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2803.exe6⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe7⤵PID:6260
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe8⤵PID:8340
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35255.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35255.exe9⤵PID:1188
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56258.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56258.exe9⤵PID:5788
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35786.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35786.exe7⤵PID:8840
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe7⤵PID:13068
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38529.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38529.exe7⤵PID:14424
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe6⤵PID:7120
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe7⤵PID:10372
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe7⤵PID:11336
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exe7⤵PID:8384
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54427.exe6⤵PID:10432
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-330.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-330.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-37277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37277.exe6⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28580.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28580.exe7⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe8⤵PID:8704
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe9⤵PID:12292
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exe9⤵PID:4084
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe8⤵PID:764
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59093.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59093.exe8⤵PID:13596
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28386.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28386.exe8⤵PID:16612
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51972.exe7⤵PID:8940
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe8⤵PID:14600
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58923.exe7⤵PID:5676
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64958.exe7⤵PID:10580
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exe7⤵PID:2352
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1994.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1994.exe6⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe7⤵PID:8180
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61597.exe8⤵PID:10348
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe8⤵PID:11288
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55961.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55961.exe8⤵PID:7176
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60203.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60203.exe7⤵PID:10752
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe7⤵PID:11560
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27042.exe7⤵PID:7344
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe6⤵PID:9160
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe7⤵PID:12164
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64788.exe6⤵PID:9788
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe6⤵PID:13540
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50658.exe6⤵PID:4976
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16538.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16538.exe5⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe6⤵PID:5136
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3603.exe5⤵PID:6720
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63524.exe6⤵PID:9104
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51003.exe5⤵PID:8936
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62167.exe6⤵PID:15412
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe5⤵PID:12192
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16854.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16854.exe5⤵PID:14876
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe5⤵PID:17024
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-36916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36916.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe6⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59389.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59389.exe7⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exe8⤵
- System Location Discovery: System Language Discovery
PID:6580 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe9⤵PID:7260
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27779.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27779.exe8⤵
- System Location Discovery: System Language Discovery
PID:10040
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37674.exe7⤵PID:7184
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35371.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35371.exe7⤵PID:10624
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25620.exe7⤵PID:5876
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64516.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64516.exe6⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe7⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17588.exe8⤵PID:208
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8307.exe8⤵PID:12952
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe8⤵PID:15348
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exe8⤵PID:7680
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31754.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31754.exe7⤵PID:9940
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34289.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34289.exe7⤵PID:13380
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47314.exe7⤵PID:15772
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe6⤵PID:7396
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5827.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5827.exe7⤵PID:12428
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe7⤵PID:6660
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48475.exe6⤵PID:10916
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26391.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26391.exe6⤵PID:12144
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21578.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21578.exe5⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe6⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26692.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26692.exe7⤵PID:6332
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11443.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11443.exe8⤵PID:9944
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60388.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60388.exe8⤵PID:12724
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe8⤵PID:16048
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26082.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26082.exe8⤵PID:388
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15475.exe7⤵PID:10324
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54850.exe7⤵PID:13564
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63842.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63842.exe7⤵PID:5044
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exe6⤵
- System Location Discovery: System Language Discovery
PID:7812 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-33165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33165.exe7⤵PID:12256
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7812 -s 6367⤵
- Program crash
PID:14356
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3313.exe6⤵
- System Location Discovery: System Language Discovery
PID:10428
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22900.exe6⤵PID:11548
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25156.exe6⤵PID:1752
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34897.exe6⤵PID:7672
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59362.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59362.exe5⤵PID:6556
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe6⤵PID:2660
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12330.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12330.exe5⤵PID:8240
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10337.exe5⤵PID:3020
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8813.exe5⤵PID:14364
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51963.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51963.exe5⤵PID:7448
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60443.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60443.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe5⤵
- System Location Discovery: System Language Discovery
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exe6⤵PID:6160
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8531.exe7⤵PID:7540
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe8⤵PID:11080
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10573.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10573.exe8⤵PID:10564
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe7⤵PID:10284
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32180.exe7⤵PID:14332
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1873.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1873.exe7⤵PID:16956
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe6⤵PID:8920
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32548.exe7⤵PID:13676
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58923.exe6⤵PID:396
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64958.exe6⤵PID:3476
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exe6⤵PID:4084
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe5⤵PID:7008
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30660.exe6⤵PID:8908
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15603.exe6⤵PID:12244
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53416.exe6⤵PID:14908
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37659.exe5⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29325.exe6⤵PID:12200
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe6⤵PID:15884
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37897.exe6⤵PID:8984
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe5⤵
- System Location Discovery: System Language Discovery
PID:11308
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe5⤵PID:14920
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34897.exe5⤵PID:7940
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe4⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe5⤵PID:6296
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe6⤵PID:7596
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38659.exe6⤵PID:11564
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27956.exe6⤵
- System Location Discovery: System Language Discovery
PID:2576
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50306.exe6⤵PID:16892
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46212.exe5⤵
- System Location Discovery: System Language Discovery
PID:1832
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53682.exe5⤵PID:11460
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30833.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30833.exe5⤵PID:6124
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64258.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64258.exe4⤵PID:6972
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exe5⤵
- System Location Discovery: System Language Discovery
PID:2484
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18323.exe4⤵PID:1356
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27069.exe4⤵PID:5076
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62480.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62480.exe4⤵PID:15060
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58345.exe4⤵PID:7896
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-30180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30180.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4264 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 6365⤵
- Program crash
PID:4932
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 7164⤵
- Program crash
PID:3060
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13770.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20692.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20692.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-26468.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26468.exe6⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exe7⤵PID:7092
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54628.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54628.exe8⤵PID:12072
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exe7⤵
- System Location Discovery: System Language Discovery
PID:9652
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36594.exe7⤵PID:13452
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31170.exe7⤵PID:7316
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37290.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37290.exe6⤵PID:7604
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3699.exe7⤵PID:12212
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exe7⤵PID:14856
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12232.exe7⤵
- System Location Discovery: System Language Discovery
PID:5680
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38386.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38386.exe6⤵PID:10640
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11395.exe6⤵PID:6940
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe6⤵PID:5756
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59083.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59083.exe5⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe6⤵PID:8156
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31101.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31101.exe7⤵PID:7264
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43418.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43418.exe7⤵PID:13012
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exe7⤵PID:15244
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34738.exe7⤵PID:16712
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47515.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47515.exe6⤵PID:9868
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19521.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19521.exe5⤵PID:8928
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exe6⤵PID:13832
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56450.exe6⤵PID:8456
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64788.exe5⤵PID:4320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 7445⤵
- Program crash
PID:8736
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51371.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51371.exe4⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe5⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exe6⤵PID:7164
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe7⤵PID:8400
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7164 -s 6007⤵
- Program crash
PID:11288
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32771.exe6⤵PID:1432
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56411.exe5⤵PID:7060
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15411.exe6⤵PID:11040
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe6⤵PID:2884
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21176.exe6⤵PID:7856
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 6365⤵
- Program crash
PID:4456
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12849.exe4⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe5⤵PID:8168
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe6⤵PID:11796
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exe6⤵
- System Location Discovery: System Language Discovery
PID:14832
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6035.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6035.exe4⤵PID:8884
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40363.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40363.exe4⤵PID:10660
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe4⤵PID:5920
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27985.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-41252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41252.exe4⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exe5⤵PID:6188
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe6⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57159.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57159.exe7⤵PID:14432
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe6⤵PID:9456
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54101.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54101.exe6⤵PID:15020
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46212.exe5⤵PID:6944
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe6⤵PID:11320
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53682.exe5⤵PID:11452
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30833.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30833.exe5⤵PID:13300
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe5⤵
- System Location Discovery: System Language Discovery
PID:16624
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17322.exe3⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18404.exe4⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exe5⤵PID:6240
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe6⤵PID:12000
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exe6⤵PID:14848
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53849.exe6⤵PID:7548
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34826.exe5⤵PID:10404
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54850.exe5⤵PID:13548
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe5⤵PID:16132
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exe4⤵PID:7568
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe4⤵PID:10388
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38046.exe4⤵PID:12560
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe3⤵PID:6584
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32964.exe4⤵PID:9088
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34570.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34570.exe4⤵PID:4456
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54101.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54101.exe4⤵PID:15176
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe4⤵PID:17120
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe3⤵PID:8976
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe3⤵PID:11660
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57505.exe3⤵PID:14556
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe3⤵PID:17100
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18743.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18743.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:224 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 7203⤵
- Program crash
PID:5080
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1356 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 7204⤵
- Program crash
PID:2944
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45867.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45867.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-22996.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22996.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exe6⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe7⤵PID:6236
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exe8⤵PID:8784
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exe8⤵
- System Location Discovery: System Language Discovery
PID:13144
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe8⤵PID:14708
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60866.exe8⤵PID:15644
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe7⤵
- System Location Discovery: System Language Discovery
PID:9372 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-41015.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41015.exe8⤵
- System Location Discovery: System Language Discovery
PID:14536
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25313.exe8⤵PID:9052
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe7⤵PID:12688
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe7⤵PID:15732
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65465.exe7⤵PID:7628
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55835.exe6⤵PID:6428
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38525.exe7⤵PID:10208
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe7⤵PID:11812
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe7⤵PID:16420
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64898.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64898.exe6⤵PID:10440
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60715.exe6⤵PID:13580
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6168.exe6⤵PID:16052
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64651.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64651.exe5⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe6⤵PID:6840
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1622.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1622.exe7⤵PID:13524
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31089.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31089.exe7⤵PID:16976
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe6⤵PID:10696
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6241.exe6⤵PID:7452
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3185.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3185.exe5⤵PID:8952
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57597.exe6⤵PID:13852
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64788.exe5⤵PID:4588
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 6805⤵
- Program crash
PID:14692
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe4⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18404.exe5⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe6⤵
- System Location Discovery: System Language Discovery
PID:7140 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-19581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19581.exe7⤵PID:1956
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7539.exe7⤵PID:13188
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exe7⤵PID:15396
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe6⤵PID:10464
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe6⤵PID:6900
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe6⤵
- System Location Discovery: System Language Discovery
PID:14276
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exe5⤵PID:6628
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64669.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64669.exe6⤵PID:3628
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17485.exe6⤵PID:3996
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53657.exe6⤵PID:5472
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe5⤵PID:10664
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61115.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61115.exe5⤵PID:5324
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exe4⤵PID:6512
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2787.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2787.exe5⤵PID:7976
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44468.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44468.exe6⤵PID:6988
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4451.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4451.exe5⤵PID:11404
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23732.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23732.exe5⤵PID:13992
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37691.exe4⤵PID:8020
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe4⤵PID:11624
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exe4⤵PID:6152
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30785.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56628.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56628.exe4⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe5⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe6⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51556.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51556.exe7⤵PID:6344
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6541.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6541.exe7⤵PID:14652
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51545.exe7⤵PID:6204
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 6566⤵
- Program crash
PID:9660
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exe5⤵PID:6820
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe6⤵PID:2936
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31361.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31361.exe6⤵PID:5124
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe5⤵PID:10828
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8707.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8707.exe5⤵PID:6740
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51241.exe5⤵PID:7424
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe4⤵PID:6432
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exe5⤵PID:5080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6432 -s 6485⤵
- Program crash
PID:12788
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27658.exe4⤵PID:7508
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24052.exe4⤵PID:11396
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4596.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4596.exe4⤵PID:10268
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22404.exe3⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exe4⤵PID:7152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7152 -s 6045⤵
- Program crash
PID:8200
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-867.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-867.exe4⤵PID:5832
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1809.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1809.exe3⤵PID:6808
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe4⤵PID:9528
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28234.exe4⤵PID:2912
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exe4⤵PID:15856
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12890.exe3⤵PID:10356
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe3⤵PID:13588
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe3⤵PID:1328
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-27165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27165.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-18852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18852.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-11804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11804.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-24221.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24221.exe6⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10931.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10931.exe7⤵PID:6600
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe8⤵PID:7956
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exe8⤵PID:13196
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe8⤵PID:15600
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45106.exe8⤵PID:9164
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe7⤵PID:10148
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14362.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14362.exe7⤵PID:7048
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe7⤵PID:15696
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50857.exe7⤵PID:14456
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe6⤵PID:7384
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe7⤵PID:10180
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe7⤵
- System Location Discovery: System Language Discovery
PID:11540
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe7⤵PID:5492
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe6⤵PID:10672
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36983.exe7⤵PID:15416
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41649.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41649.exe7⤵PID:16236
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45163.exe6⤵PID:6196
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19144.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19144.exe6⤵PID:9028
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 7245⤵
- Program crash
PID:7040
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41331.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe5⤵PID:5828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5828 -s 7206⤵
- Program crash
PID:7308
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23795.exe5⤵PID:7364
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50955.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50955.exe4⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe5⤵PID:6948
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19268.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19268.exe6⤵PID:3752
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe6⤵PID:14372
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61545.exe6⤵PID:16948
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe5⤵PID:10948
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe5⤵PID:13440
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60866.exe5⤵PID:9116
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21011.exe4⤵PID:7420
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe5⤵PID:9444
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28234.exe5⤵PID:11432
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exe5⤵PID:15876
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exe5⤵PID:8372
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31802.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31802.exe4⤵PID:10516
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32131.exe4⤵PID:14008
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-25316.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25316.exe5⤵
- System Location Discovery: System Language Discovery
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46733.exe6⤵
- System Location Discovery: System Language Discovery
PID:6484 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe7⤵PID:7108
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38659.exe7⤵PID:11588
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27956.exe7⤵PID:4576
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18673.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18673.exe7⤵
- System Location Discovery: System Language Discovery
PID:5476
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-867.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-867.exe6⤵PID:9184
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe7⤵PID:14608
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21274.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21274.exe6⤵PID:13252
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38529.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38529.exe6⤵PID:15388
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe6⤵PID:14944
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe4⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe5⤵PID:7608
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3107.exe6⤵PID:11276
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45358.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45358.exe6⤵PID:6700
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exe6⤵PID:8280
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe5⤵PID:10680
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55250.exe5⤵PID:14292
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe4⤵PID:8668
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe5⤵
- System Location Discovery: System Language Discovery
PID:6604
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62306.exe5⤵PID:5448
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64788.exe4⤵PID:10512
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe4⤵PID:14296
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe4⤵PID:5704
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62475.exe3⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-24221.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24221.exe4⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46733.exe5⤵
- System Location Discovery: System Language Discovery
PID:5204 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe6⤵PID:8104
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57627.exe6⤵PID:11864
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43141.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43141.exe6⤵PID:5980
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32771.exe5⤵PID:8816
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe5⤵PID:13080
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38529.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38529.exe5⤵PID:1312
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25688.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25688.exe5⤵PID:17000
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exe3⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21661.exe4⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30349.exe5⤵PID:9032
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2547.exe5⤵PID:13204
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe4⤵PID:10872
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31028.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31028.exe4⤵PID:13996
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27042.exe4⤵PID:7632
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe3⤵
- System Location Discovery: System Language Discovery
PID:8792
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39587.exe3⤵PID:8140
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56823.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56823.exe3⤵PID:13836
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62913.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62913.exe3⤵
- System Location Discovery: System Language Discovery
PID:7920
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5105.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5105.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-19156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19156.exe5⤵
- System Location Discovery: System Language Discovery
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-12067.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12067.exe6⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exe7⤵PID:8596
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exe7⤵PID:13240
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exe7⤵PID:7092
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65186.exe7⤵PID:5228
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18163.exe6⤵PID:9036
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe6⤵
- System Location Discovery: System Language Discovery
PID:13116
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6733.exe6⤵PID:14620
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51433.exe6⤵PID:7428
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56027.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56027.exe5⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exe6⤵PID:7376
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exe6⤵PID:13208
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exe6⤵PID:15404
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11857.exe6⤵PID:16964
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe5⤵PID:8964
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 7524⤵
- Program crash
PID:1004
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12250.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-41652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41652.exe4⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe5⤵PID:6344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6344 -s 6046⤵
- Program crash
PID:9792
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57691.exe5⤵PID:9896
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe5⤵PID:12384
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe5⤵PID:15788
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51433.exe5⤵PID:644
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39690.exe4⤵PID:6292
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exe5⤵PID:8652
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60314.exe6⤵PID:3228
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14561.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14561.exe6⤵PID:17076
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exe5⤵PID:11640
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exe5⤵PID:14824
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe4⤵PID:10224
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39444.exe4⤵PID:13432
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9240.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9240.exe4⤵PID:5972
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe3⤵PID:6028
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25387.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25387.exe3⤵PID:8912
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe4⤵PID:8056
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14257.exe4⤵PID:2044
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56123.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56123.exe3⤵PID:10216
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39757.exe3⤵PID:12324
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51963.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51963.exe3⤵PID:7936
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39187.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-55860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55860.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-21533.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21533.exe4⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20532.exe5⤵PID:6792
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe6⤵PID:6708
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe6⤵PID:10912
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16903.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16903.exe6⤵PID:14576
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38474.exe5⤵PID:9724
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe6⤵PID:14012
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23585.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23585.exe6⤵PID:1644
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe5⤵PID:3972
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe5⤵PID:15796
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe5⤵PID:16344
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41770.exe3⤵
- System Location Discovery: System Language Discovery
PID:372 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-61268.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61268.exe4⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16820.exe5⤵PID:8828
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18163.exe4⤵PID:6216
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe4⤵PID:13092
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6733.exe4⤵PID:15584
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24424.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24424.exe4⤵PID:1440
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55922.exe3⤵PID:7192
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe4⤵PID:10192
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-627.exe4⤵PID:13024
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51355.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51355.exe3⤵PID:9720
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31489.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31489.exe3⤵PID:13332
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57282.exe3⤵PID:5260
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34388.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34388.exe2⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exe3⤵PID:6148
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe4⤵PID:6956
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe5⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe6⤵PID:11992
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe7⤵PID:16144
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47810.exe7⤵PID:16740
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exe6⤵PID:14840
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exe6⤵PID:7440
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27779.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27779.exe4⤵PID:10172
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exe3⤵PID:7268
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe4⤵PID:12756
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15088.exe4⤵PID:14884
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58946.exe3⤵PID:10936
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35057.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35057.exe3⤵PID:12388
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2808.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2808.exe3⤵PID:6116
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59593.exe2⤵PID:7000
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exe3⤵PID:4980
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe3⤵PID:11780
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18823.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18823.exe3⤵PID:14724
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50306.exe3⤵PID:16900
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8523.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8523.exe2⤵PID:8712
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe2⤵PID:9784
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33609.exe2⤵PID:15008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 224 -ip 2241⤵PID:5064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1356 -ip 13561⤵PID:1420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4264 -ip 42641⤵PID:5044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3348 -ip 33481⤵PID:2012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1836 -ip 18361⤵PID:5156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1560 -ip 15601⤵PID:5712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4000 -ip 40001⤵PID:5136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4980 -ip 49801⤵PID:5824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3156 -ip 31561⤵PID:7088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2548 -ip 25481⤵PID:7104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5828 -ip 58281⤵PID:6608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1956 -ip 19561⤵PID:7408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2484 -ip 24841⤵PID:7512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5080 -ip 50801⤵PID:7592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4060 -ip 40601⤵PID:7620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5072 -ip 50721⤵PID:7848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4200 -ip 42001⤵PID:8132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3152 -ip 31521⤵PID:7772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5128 -ip 51281⤵PID:7780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 6028 -ip 60281⤵PID:8424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5136 -ip 51361⤵PID:8568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4736 -ip 47361⤵PID:9032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 7152 -ip 71521⤵PID:4724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6344 -ip 63441⤵PID:9232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5564 -ip 55641⤵PID:9304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1936 -ip 19361⤵PID:9916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5244 -ip 52441⤵PID:9980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1876 -ip 18761⤵PID:11180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 6076 -ip 60761⤵PID:10160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 6680 -ip 66801⤵PID:10544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 6544 -ip 65441⤵PID:12068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 7164 -ip 71641⤵PID:12152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6260 -ip 62601⤵PID:12164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 6356 -ip 63561⤵PID:12200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5684 -ip 56841⤵PID:12284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5432 -ip 54321⤵PID:12184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 6432 -ip 64321⤵PID:6904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 6564 -ip 65641⤵PID:12384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 6972 -ip 69721⤵PID:12424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6248 -ip 62481⤵PID:12512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6556 -ip 65561⤵PID:12608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 6720 -ip 67201⤵PID:12652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6380 -ip 63801⤵PID:12672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6444 -ip 64441⤵PID:12816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 6580 -ip 65801⤵PID:10956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5876 -ip 58761⤵PID:11980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 6956 -ip 69561⤵PID:12512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5792 -ip 57921⤵PID:13500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5804 -ip 58041⤵PID:13968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5532 -ip 55321⤵PID:14188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6352 -ip 63521⤵PID:14244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5980 -ip 59801⤵PID:14268
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 4688 -ip 46881⤵PID:14292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 6148 -ip 61481⤵PID:6604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5184 -ip 51841⤵PID:12708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5732 -ip 57321⤵PID:12208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2400 -ip 24001⤵PID:3996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4248 -ip 42481⤵PID:6364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3884 -ip 38841⤵PID:12868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1588 -ip 15881⤵PID:12332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5920 -ip 59201⤵PID:12204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2568 -ip 25681⤵PID:10156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 2448 -ip 24481⤵PID:13996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4972 -ip 49721⤵PID:13508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4256 -ip 42561⤵PID:14332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 3836 -ip 38361⤵PID:10488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4924 -ip 49241⤵PID:4256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 7812 -ip 78121⤵PID:14700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 8176 -ip 81761⤵PID:15236
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 9160 -ip 91601⤵PID:14348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 7092 -ip 70921⤵PID:4864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5956 -ip 59561⤵PID:16228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4264 -ip 42641⤵PID:16312
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 9184 -ip 91841⤵PID:16488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 7032 -ip 70321⤵PID:17032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
468KB
MD5719a481bb19a58433e61e12e4434a7ba
SHA12df75dc7610aac1fb08536a978494e25800ced3e
SHA2564693e856356db48574bdae325abcb1b33a85e27bf5e485ef4e50421107aea290
SHA5128690a3610c46386ec4c08453c9cab7a36560602969a2dddf6321ff04f8b70199f7d44fddad1ba8bec827b658eea975a81cd44a4c6dffc7ea9c4cde69a3521b49
-
Filesize
468KB
MD5c2316acc60a1347e8d44f5103bce84b9
SHA116f35b556f8c1935e88027a2d609be41a3a270b9
SHA256d06d96e48c97cccdaebd879d549f347856847229a386242e30850f03fb0c3ad3
SHA5125672ced332726b1cbff2d07c220cc0206ff535123eea8b0acf99b9707ac18fb27f2f2d66dea570c3748e8770fa09bac5fa0b50601974c6510ecbeddd3d3f339e
-
Filesize
468KB
MD539bc843113636a1368911f8f742fd365
SHA18d2638a5b7c487d94584e57130d003617a0fde96
SHA256f1af4416b7791e040bca1f005085afd6faefe1356d479e50b5b89b88f6e2ec34
SHA512d5bfd8f323aab7f9e41184a45669a4ba47316dc32b96992b92211218a99d8231eed3ba416f0e6231ea7c0199a46b3dddce1dbd4af4491a38b6f3a94f1aa18a33
-
Filesize
468KB
MD58a20b32d41039abc4d1101fd2659eecf
SHA15e245bde23e8fc7aba26dc0e258b9ac3d265000f
SHA256b2ae19b7c2339126091e5a4534591f17026f658f37e224fdbf539500d95e049a
SHA512825b3217df6280c04eb3311caf2a163269e64094a7f02d0bac223d611c9aa17cef0353e340894cee92a66d6ba71cc2e4129afd46d286dd162eb26770d7a989bc
-
Filesize
468KB
MD54641fa3ff489798c6a24f1ea3099bec1
SHA1ddf2b50d3ea50117f8afceceb3fdc846a193c0e9
SHA2568c37131a35c0903128558830334cdbe2c9bc4a9caf2d32279a72fd3662b22585
SHA512e0b208b694f29a39008a4d644e57cb7bfd7973fe26a65d19d1651e1b8c8c090f0291cd988b31795ee3f9f5411ac820e4b325d8a9ccc8e02a6b0850c77d014987
-
Filesize
468KB
MD50e8c3254676ad4aeb666761f59bf6e27
SHA1279800b05cf9a833eaa50ab27858f4c1c5d82c83
SHA256dd697ab6ee7341c3f47b9f4f8424d2f20efccf7bc863c5aa767481cf1d3c3013
SHA512a983ddaaaf064847551e501a08b42acb6cbd680a0f77d1db76951757033059e7a0f981d3623a57ca64b59ff07d07e4cc537bd953b30fea67c2201f9a5a3bcfba
-
Filesize
468KB
MD5cb2da573bd288aec7c9766f936d143a0
SHA1302a8b7b24e53d00d648a7edbabec2fa97c96497
SHA256df50166613ecfba76220ced51ffa0d0354fbe1d754047256f7ef5585f4aa82e0
SHA512e7bcdcfa23efc99b2cfc43ebac5b4fe8515d3142e92750da51f424bda80ef4e5cd693afa15c92fcc3794fc6029cae16fb5e1a354d951ab0f3ab147247b6a89a8
-
Filesize
468KB
MD50e00f4445ac84688612fb850e620ebea
SHA109cc70da19068a2d7aacb500c70669f8cdb03636
SHA256b882da26ff231d3813546a5bfb9e2d409ca615c61a515cdf5af6dcb5af35061f
SHA512a7747f0011f4e61a20031f4bb5979687a0957688f1949135b06c59062f85fc7b9c3334acf8be5a9940bb908f45460172576405726fd1a477e6a1150b00258861
-
Filesize
468KB
MD5442d145aa8a70a57639db0d4001f11e6
SHA19e8853ca24008d7daa7c604f4baaf205047855b9
SHA256ad93024261cde51c6cefcfd19ca9935410c47242300bb56f19c35f861d74d648
SHA51205f9fb1add2dcfd2b4ac2a1fd1ad453ece32e8064524d762837c6c075f18f31a551cfa33a64a11866f6bb59e7acdde9a5b8e680ea97f7f670d917c33035d57ec
-
Filesize
468KB
MD5790ac57c64d1ff737cbb2ecaaba995d9
SHA1f42df7ecb7378842fa87a6a12e733f3ac0c8fe3d
SHA2565e6dcadc026d190fea9d47d736cabb162d722851d20efc76111618e7f0a39a78
SHA51251b7492b2be612b4179bcd9991cbcb0c5d5eb91a1f4fcba38b4ee14a278f5388d629f0b32142fe0d870e8b1626c012a3add3ab1b2eb570483c6a228640e772ab
-
Filesize
468KB
MD55db1f9e18e64145e4d1937d0fc50c68b
SHA1673c9d059b248acbd6a94077f56e9cf56324d3cc
SHA256e4a54605c483a3357bde4a1459ca651c67c0d58c0dda57ef4e86a6a89d9b27bd
SHA512fd8a74f730f3d07719e3ecc75a9649f20db9cef111937492e0d72482173167669e2ff928316b6e4fc7dfb2aaf6c063b8629108c63542306418ccadd471d491b9
-
Filesize
468KB
MD5b39d75233d5c03727d2df1780730a0a2
SHA1d626e44730322fe57550a7f1cb8c79f3b274b2af
SHA256cbdb4973fa32471b6920906b885aeb64fef9cbab967bcc9dad98c37f6a8aedf0
SHA5122ccc5fe89a8df34e27b62c38d771708efb6df820065c167f655d390d2900582dd8141316ab919b72feaf54bbd8c58c2bb48843527b48e903027f7e6dc93c6a40
-
Filesize
468KB
MD53c6970a88cb91ae0b5e192d6f167346c
SHA1ed8590dd31adddd6876b30ff56ba383bd4b96808
SHA25665d26fb915dcd0005c60e9fe062f4daa8c200b42145f124b4c44131fc6005d55
SHA5120470534c4b44433b3878992f9e1424a4df2b2ce0a13c15850f35e187127ef430dbc6632d4f2bc791e8ef5fc69ec36d63b0b2b5f03f767543aaa75c51cc93208c
-
Filesize
468KB
MD52e500c4b6e1b34ebe5c122e8d18b43d8
SHA108ceb12f7beb31bba227b04725f7302edaa09af2
SHA25695f772b499e89cd07ba0a8e83a630d32568fab45f057b2abec9434a491353f74
SHA5124e9371de8904323e9e61f86a403c76be304365afaf3737dd152a0ef308c757f6d742febd6cde6ea51cd022a36376540294d80c3335babea248fa5210eeeb0ae8
-
Filesize
468KB
MD5827b53c5ab677492392f8dd6ea96f235
SHA1b74e71b7e4340a45d96510b1a1df0a6ba8ec58a6
SHA25653564b344aa3a0d382e333cea6bec3283fcd5c6539f0ea98d5df178025f73cac
SHA51248e00cd923ac2873df616d44ca981bcc001f96df41dfcc8c6e70c3f124c4a7c2a8100b0a1477f1880fd43ed96729cb84c8283238b7d7b27d4d4f5bf350b7b512
-
Filesize
468KB
MD506ebcb3f2c534a9cb478fdb3211d2346
SHA15d6bc11ca141a0840443c6d9161709e413cab07f
SHA2560be6bf21a9fb82f2419d8f5e8b7596d4ffa3f35242e0deec342901bd75339324
SHA5126d2532fd672ad7546bf5734f9da6ef3d89e708137828d0d33b74fb4215e9980da293bb842a7a51a387690be83fb722362b0d672025f56899955ac8d07286ee92
-
Filesize
468KB
MD5b761c71387584ff4a5b0262a6725028f
SHA1f47863dd44ca4c906d6c074fc58f7e746b84b562
SHA256a35153587bc13d5d9f6089a767bbfe6b47f4061747a417b53088736d7b1f205f
SHA512b7a57a71bbd6514cd010b0a66db8f8466d1433445b98c1607e13f5dc4ead8d7082f561ae539081c5ff9561a67958a7c12da2d9f63327b9221060bb323bbd7f77
-
Filesize
468KB
MD5f38a15e86022c8dbf09b0a29479840bd
SHA1212421dad73f700729bfe24a11c4b99002c6773d
SHA256e8e93c7b03da7c54e35460b470a1038f6191691668bdab8d5a257797d1dd7356
SHA512dcd9f8bcc26b6fd500eb3e73ff7203649cbe7c7a3e0d7f9c68df940b6e7ce5835d656c9979d97a9a7653f25aed76df3d2d97a53eddfd99388eb92fa70bd41763
-
Filesize
468KB
MD5d0743c5a6c3a361899580fcedf049e8d
SHA1cc40ae5001d259f5d49ee2e98a5d726d3d5c0197
SHA256c8b3a820be6f6d083fe46c45bff6f996014abb5e3ab1d9dd419ad46bca04f516
SHA512f3f56ad22d1d2f8aad41b68d1bcf3a76f9b5014068bc91e5eaa7965a63aafe5a9e058123712735de4ab87d119c630958d948a6b60e38d682668ef5efb50e6a1d
-
Filesize
468KB
MD58bbb4f8235104e19b259197595c89dfa
SHA1eb860478e0cbb7487cb7aff592efc013ee5fd1d8
SHA256ad1996fa3c3ee88bdca6f11403a80720aa5a59658a24edb2a5c4b0bb1f8c8be7
SHA51283985b167d207b318157de6f88a820d4eb62842b235fe01afed3f72710f4e99443dfaa80b2be706df32f3d8fff0874d3ccce60df4dac2979cdbdada0b7f90c9f
-
Filesize
468KB
MD5b49e08f403fbc3402bff56f514dfb47c
SHA10d42058206b752995fe10548e3f6cbaa0a784438
SHA2560faac7a05311e988987083ff6cc3b86bda804c9291fc056a9fe78f95c3472468
SHA512ec7ba09a2342d6dd9f8b0be28d27e5d8d83c55cc7d5046a6c6e6d34ae44280bcfae8bf855bbf0de77670fb3b8bc08e7ae5490b715fad1c81d2233deaad61c79e
-
Filesize
468KB
MD51ffe1fcf6826b384b851a4d4dedfd8d4
SHA1914c8cd7ccf2bf7c8b8f583bb575ea6bac43120e
SHA25624e0721275500835b14c30f83f5e8dd69c80f49328a6d3b52fe44983943461a5
SHA51293b982303c1df552145ff74a0f9979655d630797a1795018d72d7ead3fa8b7e39764e6a16a57d90e73f2b4417dd27a85070dafcaca937652a73a4119e94f484c
-
Filesize
468KB
MD5a0eab106f22b73a7fad4e2ae92db21d4
SHA1163bff05d80821f2a22ca656deaceedcb0e12ecd
SHA2561b2e50fb009599876b40ead29f83eb67ae2c56d62edf8136b8709a6f2bb194d6
SHA512c4ce13c971d817bf8fb7672726e5af4812a6f0156556e337bee1cca2ae381e1697b4ff21f3153a101bf196e191a79369b05e88b5d32792525ef2f0c8bee81eef
-
Filesize
468KB
MD59bfe9dd07457d10ce9f1bfbc5f2967f7
SHA1b059d0c9675c945eff4f83393aecdab1ad74a1c4
SHA256c319e337cd58ff721ac1aa369c821b2daa2054a335ff6fdf468a8674a236b98b
SHA512db2b2ea0e708d594869fe843842a34982da43f45e22e06c74b660724e033db9815d50e4c03c303ebcb9b58aadef6bee6db92302a82b387539ecc504d3fb6f214
-
Filesize
468KB
MD5a8d4d9a4efca5b6fbf53420f54950ce3
SHA1323c45740553024501d974ae75dd890a6a964f17
SHA2564858f3c81ef4295084b579c4e7e7ee9c5722fdfeb083e743414c0e573e6f8e34
SHA512e8353ac7d731471a70f3f2504bf9cf5d59894812a7a431306d8fe6720f547b2e0f7b1b7fc79c987f89314e05388835f3a0b37df973e31e79465300bb653e3269
-
Filesize
468KB
MD590462bfe14f839852fa93b718c826b37
SHA1f5265a62013520b67ab7426f1f0fbc56ca58532f
SHA25615dead11e7d5371efa5761666e083d6a884c9d24e4d6af3848a54bac8753d097
SHA512aa7c92eaa2f3c7dfe6699863ddeac66c89e88a7c15eff5dec1e6f8717c3f841b6bda563f3f0e52bb69bf7b1ac381c76f612167ed30d21d0bf3dbcd6355bb0606
-
Filesize
468KB
MD595e860c94372b523a0c2ed06cc3d182c
SHA1be0cd6717b7f74b4a3b7ee760227f9af8a4fb637
SHA256bf50b6cc1cc48ad81557d54f1d6b8cedb5c8933395e67ff7d117051e9d4cb745
SHA512451d03c9e4eace6ff95d01218cb27deef593baaddd79cfc70382bcd1557765118386c0e9d7ff5567f0cbc6a88f036a98552f06169a31d9c8de1adb384cbd2e31
-
Filesize
468KB
MD577a6f8eee279cb48f5385b3e0f5e0b79
SHA10907d6bd1c6b2004f26df97f7a82c24b3d5e9548
SHA2569015817a56b83d269988da570342c9f92315f05adb7b410b66941915e6d8cd09
SHA512e41f51c704349b055143cf90a302f83b7cd3c4357d6f4514a86314804b76459f7c50f7eb337d7d4660aa37a87dea143e23213613cca32ecac7034958d2b368c0
-
Filesize
468KB
MD5cc3773ef18b6a58567f5464e1cfb1868
SHA1fe28d827caeafc707bca05d2898f354919ec9312
SHA256c51391b7e9c3bf0704cd2e86b619e6eee3ce4fedbd186cd2912b02b6af719aa7
SHA51240461538d4fadad259ac96377410473ece686f9b897f746cfbff4a059dad250ace4783d00c928dd4760e8bf878b9e9f93d1cd87cb5dda2ac7ae6633c103781a6
-
Filesize
468KB
MD51f47934a9c08819f050511ab8917fc50
SHA11b76b9e391456e79b7631f452944ba03fc471854
SHA2568e4bc7ed31464b432c7a75fadc1bb918a81184eb2da975ee111bfdb6e54c8c80
SHA512750231a7dff49e59f4a1604690a1987b840cf16efff23d18e045178e8217bf0b5bb34758ce2a31dfb3a2e94a0b21bfb5ac4e5683e034682a83f03eba5ee99122
-
Filesize
468KB
MD5f416b7978552d231a90c1306354fb40f
SHA1f9cbb53f5e83844693c23ebc1ac8db724c1a2cbd
SHA256690422ab5836218112e52f32ada1fc526934b093e697c123acedceb0f8a988b3
SHA5128bbec71108d383797d70460e4ab855e1ef417d1d257ab14cd739fe4b85ae52e8e6a8ec5f147829621bc77fe46e15bcf0dc0e4103214de1cd69a66f0f3c197dda
-
Filesize
468KB
MD53f7d4023e50d85e4445c1730a21af0ba
SHA1795c00b1319ec5d86cc6f1070773ad2d86d90f96
SHA2566bd5610b0f50a8a6b9d39b0e257b849410cca8c2a5c1045dc19a2253b410315d
SHA512eceeca96254d5998a30afa63f3a2a9d9236895ef65c486021f9fb60b00f41ffc984421732847ecb943247a484329fd2bb89d72db08bdd945b555e265e7cfd37e