Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    113s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19/12/2023, 15:34

General

  • Target

    5071a7315c4b800e46cdf0e65b3e65e1.exe

  • Size

    188KB

  • MD5

    5071a7315c4b800e46cdf0e65b3e65e1

  • SHA1

    402c58fd4c15aa5a80aa88cadd5cb689c386f912

  • SHA256

    cdafe3853c6d77b16b085f2a4c677d957d3046dcdb421314ee0835a1ad6bdbe7

  • SHA512

    080b476bfae38a563cfe30a26f5bac86e544dee6cc0eb7ca1f1316006dc5cd62662b5c3545c3f6042b483cd48767dbead8aceef566d2054d6deb1de984e8c7e9

  • SSDEEP

    3072:TygsoRVMgGuM+Oj4qiU/u7A0uw1JdbWfSOZfvjLp8lv1pik:TyTo7hM+bqL/u7taTx8lv1pi

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 63 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5071a7315c4b800e46cdf0e65b3e65e1.exe
    "C:\Users\Admin\AppData\Local\Temp\5071a7315c4b800e46cdf0e65b3e65e1.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Users\Admin\AppData\Local\Temp\Unicorn-28985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28985.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2232
      • C:\Users\Admin\AppData\Local\Temp\Unicorn-9799.exe
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9799.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1972
        • C:\Users\Admin\AppData\Local\Temp\Unicorn-9389.exe
          C:\Users\Admin\AppData\Local\Temp\Unicorn-9389.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2744
          • C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
            C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2160
            • C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
              C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1924
              • C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe
                C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1920
                • C:\Users\Admin\AppData\Local\Temp\Unicorn-43315.exe
                  C:\Users\Admin\AppData\Local\Temp\Unicorn-43315.exe
                  8⤵
                    PID:1764
                • C:\Users\Admin\AppData\Local\Temp\Unicorn-23449.exe
                  C:\Users\Admin\AppData\Local\Temp\Unicorn-23449.exe
                  7⤵
                    PID:840
              • C:\Users\Admin\AppData\Local\Temp\Unicorn-49711.exe
                C:\Users\Admin\AppData\Local\Temp\Unicorn-49711.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:1428
                • C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe
                  C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:1800
                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-2472.exe
                    C:\Users\Admin\AppData\Local\Temp\Unicorn-2472.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2368
                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-49016.exe
                      C:\Users\Admin\AppData\Local\Temp\Unicorn-49016.exe
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1628
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-47479.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-47479.exe
                        9⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1040
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe
                          10⤵
                            PID:2212
                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-12046.exe
                      C:\Users\Admin\AppData\Local\Temp\Unicorn-12046.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:2768
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe
                        8⤵
                          PID:2828
                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exe
                      C:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exe
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:2116
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2896
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-23449.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-23449.exe
                          8⤵
                            PID:1756
                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-15611.exe
                    C:\Users\Admin\AppData\Local\Temp\Unicorn-15611.exe
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:3036
                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-49156.exe
                      C:\Users\Admin\AppData\Local\Temp\Unicorn-49156.exe
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetWindowsHookEx
                      PID:2216
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-30018.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-30018.exe
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1528
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-44081.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-44081.exe
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:2780
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-60547.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-60547.exe
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:2732
                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-46008.exe
                              C:\Users\Admin\AppData\Local\Temp\Unicorn-46008.exe
                              9⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:832
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe
                                10⤵
                                  PID:1320
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-6537.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-6537.exe
                                9⤵
                                  PID:952
                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe
                              C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe
                              7⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:328
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-55982.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-55982.exe
                                8⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:2580
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-41732.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-41732.exe
                                  9⤵
                                    PID:2448
                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-22646.exe
                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-22646.exe
                                      10⤵
                                        PID:2500
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-65248.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-65248.exe
                                6⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:2740
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-60547.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-60547.exe
                                  7⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1880
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe
                                    8⤵
                                      PID:2728
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exe
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1320
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-15492.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-15492.exe
                                  6⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2612
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
                                    7⤵
                                      PID:1316
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exe
                                        8⤵
                                          PID:1624
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:2716
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-4594.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-4594.exe
                                  4⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1648
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1052
                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-39229.exe
                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-39229.exe
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:616
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe
                                        7⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1792
                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe
                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe
                                          8⤵
                                            PID:1168
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-29150.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-29150.exe
                                        6⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2124
                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-33756.exe
                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-33756.exe
                                          7⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:588
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe
                                            8⤵
                                              PID:2356
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-6537.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-6537.exe
                                            7⤵
                                              PID:1708
                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
                                                8⤵
                                                  PID:1548
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-7111.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-7111.exe
                                            5⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1500
                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
                                              6⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2536
                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-43016.exe
                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-43016.exe
                                                7⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2816
                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe
                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe
                                                  8⤵
                                                    PID:1532
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe
                                        2⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:2732
                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-5305.exe
                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-5305.exe
                                          3⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:2608
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-35477.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-35477.exe
                                            4⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:1432
                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-29504.exe
                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-29504.exe
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2024
                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-1429.exe
                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-1429.exe
                                                6⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:356
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 356 -s 188
                                                  7⤵
                                                  • Loads dropped DLL
                                                  • Program crash
                                                  PID:2404
                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-34080.exe
                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-34080.exe
                                              5⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:764
                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
                                                6⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2620
                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-52955.exe
                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-52955.exe
                                                  7⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1608
                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-17905.exe
                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-17905.exe
                                                6⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1624
                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-31283.exe
                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-31283.exe
                                                  7⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2648
                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
                                                    8⤵
                                                      PID:2680
                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
                                                        9⤵
                                                          PID:2764
                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
                                                4⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1296
                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exe
                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exe
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2312
                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-30869.exe
                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-30869.exe
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2060
                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
                                                      7⤵
                                                        PID:1772
                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exe
                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exe
                                                          8⤵
                                                            PID:2836
                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
                                                      5⤵
                                                      • Executes dropped EXE
                                                      PID:2796
                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe
                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Suspicious use of SetWindowsHookEx
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2920
                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-33588.exe
                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-33588.exe
                                                    4⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1984
                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe
                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1736
                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-31253.exe
                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-31253.exe
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2168
                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
                                                          7⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:2832
                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-14643.exe
                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-14643.exe
                                                            8⤵
                                                              PID:2996
                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-31712.exe
                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-31712.exe
                                                                9⤵
                                                                  PID:1736
                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-4117.exe
                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-4117.exe
                                                            6⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2616
                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
                                                              7⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:320
                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-33372.exe
                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-33372.exe
                                                                8⤵
                                                                  PID:2968
                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-48336.exe
                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-48336.exe
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1676
                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe
                                                              6⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2676
                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-21504.exe
                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-21504.exe
                                                                7⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2340
                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-14150.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-14150.exe
                                                                  8⤵
                                                                    PID:1048
                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-43485.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-43485.exe
                                                                  7⤵
                                                                    PID:672
                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-42824.exe
                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-42824.exe
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:1132
                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
                                                                5⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2720
                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1244
                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-49708.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-49708.exe
                                                                    7⤵
                                                                    • Executes dropped EXE
                                                                    PID:2984

                                                      Network

                                                      MITRE ATT&CK Matrix

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-14643.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        39853009aa2add1df370daeac4f49d93

                                                        SHA1

                                                        a0731191f3192487b6adf23a1882a18629b0ae36

                                                        SHA256

                                                        8bc91cf05bba6f2deb10afdded8a9cab84a9c57e7a8deee84c34e64035ff76f5

                                                        SHA512

                                                        0b0d6becc586352848e3fa15413bc636d4365b932b7646c1b0b52c1dc008f788a86ff5f8041d36c6c9658e2d7207bd9bae17c102842e0bbd896c2b3032642dab

                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-29504.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        4df0ce56734a1aa7a5d049c519bc55e5

                                                        SHA1

                                                        e9f59d37ceeefd2072f634d71262ff6eab06fef7

                                                        SHA256

                                                        ba2073e7f3cb560b003b112fab1bd5af4b7c0408792125c9c63d131f9416f7ac

                                                        SHA512

                                                        71b900c474c00883a9c2f5d9b3e259f5872411d1ceeabf9716b406710b73ff6cfbd9ad352f307dc6f91b600644e4b9dfa23c7aca9fe293ba605a9d4e3afe5415

                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-33588.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        11b949bda13834ff7c2ca00723c7bf00

                                                        SHA1

                                                        e298ea73f9da58bb820b0a77e87bf0d807be6a7b

                                                        SHA256

                                                        2f0a1b349ee400aa82794657bd6e3baf337687640b164956d9e313c877b82e38

                                                        SHA512

                                                        369e60ac1da749615b02acf960fd69c5f1dbf3cab273c82a24dcd953638e1ed5df9b326f53b783f117dffacb53b06017432f2aa4465298c793540a673b87cdef

                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-35477.exe

                                                        Filesize

                                                        7KB

                                                        MD5

                                                        150e4bbecf65fff41b49e891afdb6746

                                                        SHA1

                                                        932947c213dc044023006311f5dd76334280dc3e

                                                        SHA256

                                                        c5599c9cf0ea7d5c8cfc6126d0e34403513511ced6ffeabb2aeefc01781ee71f

                                                        SHA512

                                                        3ceada543f76c41a567c903c95d4a62fef26a2ea8cd55080c4b7d02993fbcd5142a26573a0e52262240cd09b34867af5073868d4034447f6245b71c66460e1d1

                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        47e2e48f02b3bb6364436dcb81fc461f

                                                        SHA1

                                                        61eb6ab5da575c5ca414db1bd1f67505233be3d6

                                                        SHA256

                                                        d3d950e023a00b705199eb44a0d2e4e18055bc4d3bf63cd1ab8763cf70f319d3

                                                        SHA512

                                                        aeee3be80a972a4756b9e4a9fec374fc49ddc3cc62e2707a684677c03a3b2ec3c945eb6a240a2b0a69e04af3c2b356029d62b2731e4c5e97479b934a0db4a57a

                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        eaec1dd096d1b3d12b777ec32dfa8b29

                                                        SHA1

                                                        f68fb0172350820cc2b688395eec7add605d66b8

                                                        SHA256

                                                        9627315d5a5e332fde0713ff50582bdaa4e19b69d7696e5b83633d2ad65d0ea4

                                                        SHA512

                                                        e6a49306d388a364bab58ab37955c69a5e4713421e52fb0134d1b49bfef3130317d90ab00246526e526a83ff282cb10ceb84fb99a10461585a89cd05ff5c6d52

                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-49156.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        e78a4004a4245807f3bed9b0cf890024

                                                        SHA1

                                                        5353c9abc301ec1d66c43caf76dd276d30481b8a

                                                        SHA256

                                                        f697ed2834f63310fc5b1c3b402f14cfc3c1a922f47fe795f80ef5cfbffcfee3

                                                        SHA512

                                                        80ebdb0dc6a5496e3aa2c75a795c8e7f63440eddeb4d9cfe3a7c3e68faf05b9f909058615f860062d4bdbffec62c419a146bb2fb8561ddce65f81a8d00ad69b4

                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-5305.exe

                                                        Filesize

                                                        125KB

                                                        MD5

                                                        720415ad30d1706cc9c8b7343993dce5

                                                        SHA1

                                                        f63e8fe72d60292a8f49fa6d3fc91d693c573756

                                                        SHA256

                                                        50ba93ac1e5812f9cdf1abfcba6e66712f9ac76af1b75bb2d0caaa91e9625927

                                                        SHA512

                                                        d7a6d6a88092abdfb7be187a74f607f18d8222cd6b264e06a4db3dd2e1bd344b4a80022803c695722701a4952c18a663ce3a79d23fdacd4dee4847113b5be7d8

                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        b6ba9c419c0338c81fd56240cc002ebf

                                                        SHA1

                                                        f1c5ce762123bd6fe34cd5c10fb8c37d35591add

                                                        SHA256

                                                        06ec84fac5414f4bfb278e4fd191dc90ed1b04c340af0da9af6e48088e603ea1

                                                        SHA512

                                                        26f088b01af47b0de600d7a5c83930b4141e6f5b977e4a10bf5788909f211612c45abce357cee04b5c2c94672ce30247cbdb6c1e2870142e412f8f8557bea7a5

                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        8a945dac0b35a9d719f4cf7df91326ec

                                                        SHA1

                                                        3da72a13bf825f6800c24898bab0ea071f6351ff

                                                        SHA256

                                                        55f8db1653282e563215fd75ce2f5a1a157043783f6bb046d90f96bda6d760fa

                                                        SHA512

                                                        71bc72ae378859b6dfd62c373fccb19652f07726c0e620662976999140640ff45e5fdcfee9c4007f9abf187a66898200d401c7d6306bd85c64908de8952632f7

                                                      • \Users\Admin\AppData\Local\Temp\Unicorn-1470.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        9890925048b8c90a863e1522a52218de

                                                        SHA1

                                                        df5a23b494d70f88cbc8877bf4beb84b78cab1e7

                                                        SHA256

                                                        31f743a416f529d009c25bc49416d89d0d1f0ee6a926cd289265dfe8c91523fa

                                                        SHA512

                                                        1da83c3fbb2ad631301029772847e359687948ad94138df6ce0a84198481620cb741361f81315d0c2662ac4cf5c5ce3b6f64bf3639f34bab5f598ddc58fbc6fb

                                                      • \Users\Admin\AppData\Local\Temp\Unicorn-15611.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        0b2a54be1bc55a4febe45c1735af85f5

                                                        SHA1

                                                        55932a150731df7465f7e70d70e981c95ef207c1

                                                        SHA256

                                                        d97b1a2b8527a5e2c2e2634b1ba02df8a8311fa0c4db8366a1461bd06b136e9d

                                                        SHA512

                                                        4bb5cdba40d88efb6d4129ffd6d27d4cefae7278370b79c3f6d4566048c784a21666fe7abd398c7122044b3c5303e0de2d28759d530583aaebe63a45621c0dc4

                                                      • \Users\Admin\AppData\Local\Temp\Unicorn-25813.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        03448e221f01240eaca8fe35307c8ac5

                                                        SHA1

                                                        2f164350047f266fb9d09476b0372dc878daee90

                                                        SHA256

                                                        095506e0edbb8d092dbbbceee017857f8f14b5c0799e66310f66c796439e8b36

                                                        SHA512

                                                        91c86a6dd384dca7b5510740a4e3024c5266cb2d27d96e7d82676d9f170cb1712fb4d8db917f2f986f68389087a351f3177e631c5aa899f0df6091cc1b42c91d

                                                      • \Users\Admin\AppData\Local\Temp\Unicorn-28985.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        84ae84522d70037b60d8b67ff4c628de

                                                        SHA1

                                                        07517ae0aa6d2d4c0eeee359fb643747b36843f2

                                                        SHA256

                                                        74d316a51ec5170855e2761d812a3355c37a3c2c5a9a5859391f601dfeb05bba

                                                        SHA512

                                                        1c900f410f7544c6759474c2268965b1404fb6541c418720330db9e710139dbdbdcf61e0969962087a9bfb15425488e6812cac66f114e1f24ee099308bbcb2da

                                                      • \Users\Admin\AppData\Local\Temp\Unicorn-35477.exe

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        de8f28de92ac2ed636f6c6f00787bbc3

                                                        SHA1

                                                        4680f28d104fb09077b8f65f6d86d3962c8d411e

                                                        SHA256

                                                        5b56ca0300192f578903de6e5342737713f3f699abec8d408e91e70870151675

                                                        SHA512

                                                        b7f5f49a173de63073353fca56050aefc5b4c9895daa32c7429ff2d68f8c729df574ffc502abb62c585592947c27062e12f8e88842c17f63081033eeda1b0bfc

                                                      • \Users\Admin\AppData\Local\Temp\Unicorn-35477.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        274b72a5f1babbf851c93507c0df2537

                                                        SHA1

                                                        491ed8c57901ee01b7bf8686feab9b443ecbba18

                                                        SHA256

                                                        f0983dc128b0fef593ab70370dd699a3d4899d7ab9a296e6cd45c60d5da85f12

                                                        SHA512

                                                        879c5ca442ecded94f7424310f230fe2c37015e222dcf8c0852bbde671ee8a2a30c9cf4fb7c1f96d7b8328ff43a461311a0ef4c9996c009c3c5c5d96c7acd15f

                                                      • \Users\Admin\AppData\Local\Temp\Unicorn-4594.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        748dbf5d925922d8c45321623a8580ce

                                                        SHA1

                                                        83d4325d1f8baa30a361a432e9becc1cd350ec0a

                                                        SHA256

                                                        a409c2acaa7c23762b42e23522d99d1c5357fb3e95db38811f73ca90a25cbe85

                                                        SHA512

                                                        c29fa00f3159040883de45fe95a66b6d696239d07068318b9536065120fcc8331cb225717369ff43f45bcc7bdddd34c462963f5b19ee8a8a700a082325f9f3c2

                                                      • \Users\Admin\AppData\Local\Temp\Unicorn-46271.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        dc09f4454557311044efe0305b8f83cc

                                                        SHA1

                                                        9da8606eacdd5e63cd56eece2363065f70b4efd8

                                                        SHA256

                                                        eba32ccacd8003499fa30e5eadf8fa343982ada9f725a02c110c18e0ffa30fa1

                                                        SHA512

                                                        12b703c44b0d43cbbae26bf10c8a0a8d8f250212c5b6ec18a3cb6c1d81818b68d8572385ac9048df7d01161606547b1b28d61becaa4f2f0c6ca91ff009052dd9

                                                      • \Users\Admin\AppData\Local\Temp\Unicorn-49711.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        41db466169a6d0c0fcccdfd33f513260

                                                        SHA1

                                                        6451fd286e7c5d046dcceea02993e7823ec01c07

                                                        SHA256

                                                        50625d4132f392dd8f1e4db7de9463635ee5eb02ca7422f0396a7efa3b26cdd0

                                                        SHA512

                                                        0876529d4064d93c4ca7558305f7e5d05711b43079b115bba4085ea24ae26e1ea67d2d303a054e61485e0ddae9cff9ede2e442c75a8e6533ac9a46ec3d2daee9

                                                      • \Users\Admin\AppData\Local\Temp\Unicorn-5305.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        cc2ba459af074227464597cbffbff6be

                                                        SHA1

                                                        e85869902ff7f3e5e8d96fd2b84bda66997299e1

                                                        SHA256

                                                        a355e110f0daf1c1c0812df4d66948151ac56f0419e63a6f4de48fe0a9b3ab33

                                                        SHA512

                                                        6ec89afddd5fb24f3389cdf0b93a4b78438aaa899fe0d103bde22a9a89d76316c5e239a6823d6bf564d924461896eb898d3a2ccc7890189470ad2c0be200ea66

                                                      • \Users\Admin\AppData\Local\Temp\Unicorn-8123.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        8bf1388e9667f0e482fdebd647527b3c

                                                        SHA1

                                                        7914bc802ddaf9593b0774cc4fb139252c592fce

                                                        SHA256

                                                        de0de4fcec08bced53c179fc409a3c23512faa1ef4ec3d6bc6bfab00fec6b4f9

                                                        SHA512

                                                        676770dda88d86429bb6cbf56ce2053138335ee500976575c9fb54466c3a41976372c1f5eef75e495a0efad220a3e9f7f4ed1677040af204c32602f3a6d340c6

                                                      • \Users\Admin\AppData\Local\Temp\Unicorn-9389.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        c92c15140863ddeb73bf6174d15a65c3

                                                        SHA1

                                                        67978e8a227aa820d6d8b93d91dc0026226975c7

                                                        SHA256

                                                        c22acd8b036f589b74a3581bc80bc8b7398fd35c0e7c7d494d995854a8e8a5cd

                                                        SHA512

                                                        f0b28334dcd383d9ce6017017a0683a8e1808857d23294fcf9a81eb70bf5edfff2c4bbfff8e6b6451b8931d9f290e6678f3c4ff92a347e240cb971a0b2133b49

                                                      • \Users\Admin\AppData\Local\Temp\Unicorn-9799.exe

                                                        Filesize

                                                        188KB

                                                        MD5

                                                        df158ae47796e6dca974e80dcdc4b333

                                                        SHA1

                                                        b38ba3fef183cd18b26e63ea04f572ba46a570a8

                                                        SHA256

                                                        6a5eb18761a73ef4f15e09efc6f2b7de5c48eeb544f9b4330bd3e2b68eda73a6

                                                        SHA512

                                                        c32d0a3f287b03c316df922f5b867757e88f4464594fae84f6627bcd8d8b7a5f849e1ded5c90862e437e230e6efaa1839a7987850c9ce7e4b4714f014cc8dd2d