Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/12/2023, 15:34
Static task
static1
Behavioral task
behavioral1
Sample
5071a7315c4b800e46cdf0e65b3e65e1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5071a7315c4b800e46cdf0e65b3e65e1.exe
Resource
win10v2004-20231201-en
General
-
Target
5071a7315c4b800e46cdf0e65b3e65e1.exe
-
Size
188KB
-
MD5
5071a7315c4b800e46cdf0e65b3e65e1
-
SHA1
402c58fd4c15aa5a80aa88cadd5cb689c386f912
-
SHA256
cdafe3853c6d77b16b085f2a4c677d957d3046dcdb421314ee0835a1ad6bdbe7
-
SHA512
080b476bfae38a563cfe30a26f5bac86e544dee6cc0eb7ca1f1316006dc5cd62662b5c3545c3f6042b483cd48767dbead8aceef566d2054d6deb1de984e8c7e9
-
SSDEEP
3072:TygsoRVMgGuM+Oj4qiU/u7A0uw1JdbWfSOZfvjLp8lv1pik:TyTo7hM+bqL/u7taTx8lv1pi
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2232 Unicorn-28985.exe 1972 Unicorn-9799.exe 2732 Unicorn-25813.exe 2744 Unicorn-9389.exe 2716 Unicorn-59145.exe 2608 Unicorn-5305.exe 2160 Unicorn-39561.exe 3036 Unicorn-15611.exe 1432 Unicorn-35477.exe 2920 Unicorn-7443.exe 1648 Unicorn-4594.exe 1924 Unicorn-8123.exe 1428 Unicorn-49711.exe 2216 Unicorn-49156.exe 1984 Unicorn-33588.exe 2024 Unicorn-29504.exe 1296 Unicorn-1470.exe 1052 Unicorn-46271.exe 1800 Unicorn-4361.exe 1736 Unicorn-1237.exe 1132 Unicorn-42824.exe 2312 Unicorn-25934.exe 1320 Unicorn-55269.exe 1528 Unicorn-30018.exe 356 Unicorn-1429.exe 764 Unicorn-34080.exe 616 Unicorn-39229.exe 1500 Unicorn-7111.exe 2368 Unicorn-2472.exe 2116 Unicorn-44060.exe 2168 Unicorn-31253.exe 1676 Unicorn-48336.exe 2060 Unicorn-30869.exe 2796 Unicorn-60204.exe 2740 Unicorn-65248.exe 2780 Unicorn-44081.exe 2720 Unicorn-23661.exe 2612 Unicorn-15492.exe 2620 Unicorn-48357.exe 1628 Unicorn-49016.exe 2124 Unicorn-29150.exe 2768 Unicorn-12046.exe 2896 Unicorn-31912.exe 2676 Unicorn-23983.exe 2832 Unicorn-23983.exe 2616 Unicorn-4117.exe 328 Unicorn-40681.exe 2732 Unicorn-60547.exe 1880 Unicorn-60547.exe 2536 Unicorn-23983.exe 1624 Unicorn-17905.exe 1608 Unicorn-52955.exe 1792 Unicorn-29856.exe 1244 Unicorn-49722.exe 320 Unicorn-23882.exe 2816 Unicorn-43016.exe 2648 Unicorn-31283.exe 1040 Unicorn-47479.exe 2580 Unicorn-55982.exe 1920 Unicorn-4975.exe 832 Unicorn-46008.exe 588 Unicorn-33756.exe 2340 Unicorn-21504.exe 2984 Unicorn-49708.exe -
Loads dropped DLL 64 IoCs
pid Process 1192 5071a7315c4b800e46cdf0e65b3e65e1.exe 1192 5071a7315c4b800e46cdf0e65b3e65e1.exe 2232 Unicorn-28985.exe 2232 Unicorn-28985.exe 1192 5071a7315c4b800e46cdf0e65b3e65e1.exe 1192 5071a7315c4b800e46cdf0e65b3e65e1.exe 1972 Unicorn-9799.exe 1972 Unicorn-9799.exe 2232 Unicorn-28985.exe 2232 Unicorn-28985.exe 2732 Unicorn-25813.exe 2732 Unicorn-25813.exe 2744 Unicorn-9389.exe 2744 Unicorn-9389.exe 1972 Unicorn-9799.exe 2608 Unicorn-5305.exe 1972 Unicorn-9799.exe 2608 Unicorn-5305.exe 2732 Unicorn-25813.exe 2732 Unicorn-25813.exe 2716 Unicorn-59145.exe 2716 Unicorn-59145.exe 2160 Unicorn-39561.exe 2160 Unicorn-39561.exe 2744 Unicorn-9389.exe 2744 Unicorn-9389.exe 3036 Unicorn-15611.exe 3036 Unicorn-15611.exe 2920 Unicorn-7443.exe 2920 Unicorn-7443.exe 1432 Unicorn-35477.exe 1432 Unicorn-35477.exe 2608 Unicorn-5305.exe 2608 Unicorn-5305.exe 1648 Unicorn-4594.exe 1648 Unicorn-4594.exe 1428 Unicorn-49711.exe 1428 Unicorn-49711.exe 1984 Unicorn-33588.exe 1984 Unicorn-33588.exe 2920 Unicorn-7443.exe 2920 Unicorn-7443.exe 1296 Unicorn-1470.exe 2216 Unicorn-49156.exe 1296 Unicorn-1470.exe 2216 Unicorn-49156.exe 3036 Unicorn-15611.exe 3036 Unicorn-15611.exe 2024 Unicorn-29504.exe 2024 Unicorn-29504.exe 1432 Unicorn-35477.exe 1432 Unicorn-35477.exe 2404 WerFault.exe 2404 WerFault.exe 2404 WerFault.exe 2404 WerFault.exe 2404 WerFault.exe 1052 Unicorn-46271.exe 1052 Unicorn-46271.exe 1648 Unicorn-4594.exe 1648 Unicorn-4594.exe 1800 Unicorn-4361.exe 1800 Unicorn-4361.exe 1428 Unicorn-49711.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2404 356 WerFault.exe 51 -
Suspicious use of SetWindowsHookEx 63 IoCs
pid Process 1192 5071a7315c4b800e46cdf0e65b3e65e1.exe 2232 Unicorn-28985.exe 1972 Unicorn-9799.exe 2732 Unicorn-25813.exe 2716 Unicorn-59145.exe 2744 Unicorn-9389.exe 2608 Unicorn-5305.exe 2160 Unicorn-39561.exe 3036 Unicorn-15611.exe 1432 Unicorn-35477.exe 2920 Unicorn-7443.exe 1648 Unicorn-4594.exe 1924 Unicorn-8123.exe 1428 Unicorn-49711.exe 1984 Unicorn-33588.exe 2216 Unicorn-49156.exe 1296 Unicorn-1470.exe 2024 Unicorn-29504.exe 1052 Unicorn-46271.exe 1800 Unicorn-4361.exe 1736 Unicorn-1237.exe 2312 Unicorn-25934.exe 764 Unicorn-34080.exe 1132 Unicorn-42824.exe 1528 Unicorn-30018.exe 1320 Unicorn-55269.exe 356 Unicorn-1429.exe 616 Unicorn-39229.exe 2368 Unicorn-2472.exe 1500 Unicorn-7111.exe 2116 Unicorn-44060.exe 1676 Unicorn-48336.exe 2168 Unicorn-31253.exe 2740 Unicorn-65248.exe 2780 Unicorn-44081.exe 2720 Unicorn-23661.exe 2620 Unicorn-48357.exe 2612 Unicorn-15492.exe 2616 Unicorn-4117.exe 1244 Unicorn-49722.exe 1792 Unicorn-29856.exe 2060 Unicorn-30869.exe 1880 Unicorn-60547.exe 1624 Unicorn-17905.exe 2832 Unicorn-23983.exe 328 Unicorn-40681.exe 2768 Unicorn-12046.exe 1628 Unicorn-49016.exe 2124 Unicorn-29150.exe 2732 Unicorn-60547.exe 2536 Unicorn-23983.exe 2896 Unicorn-31912.exe 2676 Unicorn-23983.exe 1608 Unicorn-52955.exe 320 Unicorn-23882.exe 2648 Unicorn-31283.exe 2816 Unicorn-43016.exe 2580 Unicorn-55982.exe 1040 Unicorn-47479.exe 1920 Unicorn-4975.exe 832 Unicorn-46008.exe 588 Unicorn-33756.exe 2340 Unicorn-21504.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1192 wrote to memory of 2232 1192 5071a7315c4b800e46cdf0e65b3e65e1.exe 28 PID 1192 wrote to memory of 2232 1192 5071a7315c4b800e46cdf0e65b3e65e1.exe 28 PID 1192 wrote to memory of 2232 1192 5071a7315c4b800e46cdf0e65b3e65e1.exe 28 PID 1192 wrote to memory of 2232 1192 5071a7315c4b800e46cdf0e65b3e65e1.exe 28 PID 2232 wrote to memory of 1972 2232 Unicorn-28985.exe 29 PID 2232 wrote to memory of 1972 2232 Unicorn-28985.exe 29 PID 2232 wrote to memory of 1972 2232 Unicorn-28985.exe 29 PID 2232 wrote to memory of 1972 2232 Unicorn-28985.exe 29 PID 1192 wrote to memory of 2732 1192 5071a7315c4b800e46cdf0e65b3e65e1.exe 30 PID 1192 wrote to memory of 2732 1192 5071a7315c4b800e46cdf0e65b3e65e1.exe 30 PID 1192 wrote to memory of 2732 1192 5071a7315c4b800e46cdf0e65b3e65e1.exe 30 PID 1192 wrote to memory of 2732 1192 5071a7315c4b800e46cdf0e65b3e65e1.exe 30 PID 1972 wrote to memory of 2744 1972 Unicorn-9799.exe 31 PID 1972 wrote to memory of 2744 1972 Unicorn-9799.exe 31 PID 1972 wrote to memory of 2744 1972 Unicorn-9799.exe 31 PID 1972 wrote to memory of 2744 1972 Unicorn-9799.exe 31 PID 2232 wrote to memory of 2716 2232 Unicorn-28985.exe 32 PID 2232 wrote to memory of 2716 2232 Unicorn-28985.exe 32 PID 2232 wrote to memory of 2716 2232 Unicorn-28985.exe 32 PID 2232 wrote to memory of 2716 2232 Unicorn-28985.exe 32 PID 2732 wrote to memory of 2608 2732 Unicorn-25813.exe 33 PID 2732 wrote to memory of 2608 2732 Unicorn-25813.exe 33 PID 2732 wrote to memory of 2608 2732 Unicorn-25813.exe 33 PID 2732 wrote to memory of 2608 2732 Unicorn-25813.exe 33 PID 2744 wrote to memory of 2160 2744 Unicorn-9389.exe 34 PID 2744 wrote to memory of 2160 2744 Unicorn-9389.exe 34 PID 2744 wrote to memory of 2160 2744 Unicorn-9389.exe 34 PID 2744 wrote to memory of 2160 2744 Unicorn-9389.exe 34 PID 1972 wrote to memory of 3036 1972 Unicorn-9799.exe 37 PID 1972 wrote to memory of 3036 1972 Unicorn-9799.exe 37 PID 1972 wrote to memory of 3036 1972 Unicorn-9799.exe 37 PID 1972 wrote to memory of 3036 1972 Unicorn-9799.exe 37 PID 2608 wrote to memory of 1432 2608 Unicorn-5305.exe 35 PID 2608 wrote to memory of 1432 2608 Unicorn-5305.exe 35 PID 2608 wrote to memory of 1432 2608 Unicorn-5305.exe 35 PID 2608 wrote to memory of 1432 2608 Unicorn-5305.exe 35 PID 2732 wrote to memory of 2920 2732 Unicorn-25813.exe 36 PID 2732 wrote to memory of 2920 2732 Unicorn-25813.exe 36 PID 2732 wrote to memory of 2920 2732 Unicorn-25813.exe 36 PID 2732 wrote to memory of 2920 2732 Unicorn-25813.exe 36 PID 2716 wrote to memory of 1648 2716 Unicorn-59145.exe 38 PID 2716 wrote to memory of 1648 2716 Unicorn-59145.exe 38 PID 2716 wrote to memory of 1648 2716 Unicorn-59145.exe 38 PID 2716 wrote to memory of 1648 2716 Unicorn-59145.exe 38 PID 2160 wrote to memory of 1924 2160 Unicorn-39561.exe 39 PID 2160 wrote to memory of 1924 2160 Unicorn-39561.exe 39 PID 2160 wrote to memory of 1924 2160 Unicorn-39561.exe 39 PID 2160 wrote to memory of 1924 2160 Unicorn-39561.exe 39 PID 2744 wrote to memory of 1428 2744 Unicorn-9389.exe 40 PID 2744 wrote to memory of 1428 2744 Unicorn-9389.exe 40 PID 2744 wrote to memory of 1428 2744 Unicorn-9389.exe 40 PID 2744 wrote to memory of 1428 2744 Unicorn-9389.exe 40 PID 3036 wrote to memory of 2216 3036 Unicorn-15611.exe 41 PID 3036 wrote to memory of 2216 3036 Unicorn-15611.exe 41 PID 3036 wrote to memory of 2216 3036 Unicorn-15611.exe 41 PID 3036 wrote to memory of 2216 3036 Unicorn-15611.exe 41 PID 2920 wrote to memory of 1984 2920 Unicorn-7443.exe 42 PID 2920 wrote to memory of 1984 2920 Unicorn-7443.exe 42 PID 2920 wrote to memory of 1984 2920 Unicorn-7443.exe 42 PID 2920 wrote to memory of 1984 2920 Unicorn-7443.exe 42 PID 1432 wrote to memory of 2024 1432 Unicorn-35477.exe 44 PID 1432 wrote to memory of 2024 1432 Unicorn-35477.exe 44 PID 1432 wrote to memory of 2024 1432 Unicorn-35477.exe 44 PID 1432 wrote to memory of 2024 1432 Unicorn-35477.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\5071a7315c4b800e46cdf0e65b3e65e1.exe"C:\Users\Admin\AppData\Local\Temp\5071a7315c4b800e46cdf0e65b3e65e1.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-28985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28985.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-9799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9799.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-9389.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9389.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43315.exe8⤵PID:1764
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23449.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23449.exe7⤵PID:840
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49711.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49711.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4361.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-2472.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2472.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49016.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-47479.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47479.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe10⤵PID:2212
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12046.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe8⤵PID:2828
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23449.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23449.exe8⤵PID:1756
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15611.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15611.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49156.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-30018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30018.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-44081.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44081.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-60547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60547.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46008.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46008.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:832 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe10⤵PID:1320
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6537.exe9⤵PID:952
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:328 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-55982.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55982.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-41732.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41732.exe9⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22646.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22646.exe10⤵PID:2500
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65248.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65248.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-60547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60547.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe8⤵PID:2728
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-15492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15492.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe7⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exe8⤵PID:1624
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-4594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4594.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-39229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39229.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:616 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe8⤵PID:1168
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29150.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-33756.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33756.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:588 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe8⤵PID:2356
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6537.exe7⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe8⤵PID:1548
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7111.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43016.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe8⤵PID:1532
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-5305.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5305.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-35477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35477.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-29504.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29504.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-1429.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1429.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:356 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 356 -s 1887⤵
- Loads dropped DLL
- Program crash
PID:2404
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34080.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:764 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-52955.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52955.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1608
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17905.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31283.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31283.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe8⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe9⤵PID:2764
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-30869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30869.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe7⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exe8⤵PID:2836
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe5⤵
- Executes dropped EXE
PID:2796
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-33588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33588.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31253.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31253.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-14643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14643.exe8⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31712.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31712.exe9⤵PID:1736
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4117.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:320 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-33372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33372.exe8⤵PID:2968
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48336.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23983.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-21504.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21504.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-14150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14150.exe8⤵PID:1048
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43485.exe7⤵PID:672
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42824.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42824.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49708.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49708.exe7⤵
- Executes dropped EXE
PID:2984
-
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
MD539853009aa2add1df370daeac4f49d93
SHA1a0731191f3192487b6adf23a1882a18629b0ae36
SHA2568bc91cf05bba6f2deb10afdded8a9cab84a9c57e7a8deee84c34e64035ff76f5
SHA5120b0d6becc586352848e3fa15413bc636d4365b932b7646c1b0b52c1dc008f788a86ff5f8041d36c6c9658e2d7207bd9bae17c102842e0bbd896c2b3032642dab
-
Filesize
188KB
MD54df0ce56734a1aa7a5d049c519bc55e5
SHA1e9f59d37ceeefd2072f634d71262ff6eab06fef7
SHA256ba2073e7f3cb560b003b112fab1bd5af4b7c0408792125c9c63d131f9416f7ac
SHA51271b900c474c00883a9c2f5d9b3e259f5872411d1ceeabf9716b406710b73ff6cfbd9ad352f307dc6f91b600644e4b9dfa23c7aca9fe293ba605a9d4e3afe5415
-
Filesize
188KB
MD511b949bda13834ff7c2ca00723c7bf00
SHA1e298ea73f9da58bb820b0a77e87bf0d807be6a7b
SHA2562f0a1b349ee400aa82794657bd6e3baf337687640b164956d9e313c877b82e38
SHA512369e60ac1da749615b02acf960fd69c5f1dbf3cab273c82a24dcd953638e1ed5df9b326f53b783f117dffacb53b06017432f2aa4465298c793540a673b87cdef
-
Filesize
7KB
MD5150e4bbecf65fff41b49e891afdb6746
SHA1932947c213dc044023006311f5dd76334280dc3e
SHA256c5599c9cf0ea7d5c8cfc6126d0e34403513511ced6ffeabb2aeefc01781ee71f
SHA5123ceada543f76c41a567c903c95d4a62fef26a2ea8cd55080c4b7d02993fbcd5142a26573a0e52262240cd09b34867af5073868d4034447f6245b71c66460e1d1
-
Filesize
188KB
MD547e2e48f02b3bb6364436dcb81fc461f
SHA161eb6ab5da575c5ca414db1bd1f67505233be3d6
SHA256d3d950e023a00b705199eb44a0d2e4e18055bc4d3bf63cd1ab8763cf70f319d3
SHA512aeee3be80a972a4756b9e4a9fec374fc49ddc3cc62e2707a684677c03a3b2ec3c945eb6a240a2b0a69e04af3c2b356029d62b2731e4c5e97479b934a0db4a57a
-
Filesize
188KB
MD5eaec1dd096d1b3d12b777ec32dfa8b29
SHA1f68fb0172350820cc2b688395eec7add605d66b8
SHA2569627315d5a5e332fde0713ff50582bdaa4e19b69d7696e5b83633d2ad65d0ea4
SHA512e6a49306d388a364bab58ab37955c69a5e4713421e52fb0134d1b49bfef3130317d90ab00246526e526a83ff282cb10ceb84fb99a10461585a89cd05ff5c6d52
-
Filesize
188KB
MD5e78a4004a4245807f3bed9b0cf890024
SHA15353c9abc301ec1d66c43caf76dd276d30481b8a
SHA256f697ed2834f63310fc5b1c3b402f14cfc3c1a922f47fe795f80ef5cfbffcfee3
SHA51280ebdb0dc6a5496e3aa2c75a795c8e7f63440eddeb4d9cfe3a7c3e68faf05b9f909058615f860062d4bdbffec62c419a146bb2fb8561ddce65f81a8d00ad69b4
-
Filesize
125KB
MD5720415ad30d1706cc9c8b7343993dce5
SHA1f63e8fe72d60292a8f49fa6d3fc91d693c573756
SHA25650ba93ac1e5812f9cdf1abfcba6e66712f9ac76af1b75bb2d0caaa91e9625927
SHA512d7a6d6a88092abdfb7be187a74f607f18d8222cd6b264e06a4db3dd2e1bd344b4a80022803c695722701a4952c18a663ce3a79d23fdacd4dee4847113b5be7d8
-
Filesize
188KB
MD5b6ba9c419c0338c81fd56240cc002ebf
SHA1f1c5ce762123bd6fe34cd5c10fb8c37d35591add
SHA25606ec84fac5414f4bfb278e4fd191dc90ed1b04c340af0da9af6e48088e603ea1
SHA51226f088b01af47b0de600d7a5c83930b4141e6f5b977e4a10bf5788909f211612c45abce357cee04b5c2c94672ce30247cbdb6c1e2870142e412f8f8557bea7a5
-
Filesize
188KB
MD58a945dac0b35a9d719f4cf7df91326ec
SHA13da72a13bf825f6800c24898bab0ea071f6351ff
SHA25655f8db1653282e563215fd75ce2f5a1a157043783f6bb046d90f96bda6d760fa
SHA51271bc72ae378859b6dfd62c373fccb19652f07726c0e620662976999140640ff45e5fdcfee9c4007f9abf187a66898200d401c7d6306bd85c64908de8952632f7
-
Filesize
188KB
MD59890925048b8c90a863e1522a52218de
SHA1df5a23b494d70f88cbc8877bf4beb84b78cab1e7
SHA25631f743a416f529d009c25bc49416d89d0d1f0ee6a926cd289265dfe8c91523fa
SHA5121da83c3fbb2ad631301029772847e359687948ad94138df6ce0a84198481620cb741361f81315d0c2662ac4cf5c5ce3b6f64bf3639f34bab5f598ddc58fbc6fb
-
Filesize
188KB
MD50b2a54be1bc55a4febe45c1735af85f5
SHA155932a150731df7465f7e70d70e981c95ef207c1
SHA256d97b1a2b8527a5e2c2e2634b1ba02df8a8311fa0c4db8366a1461bd06b136e9d
SHA5124bb5cdba40d88efb6d4129ffd6d27d4cefae7278370b79c3f6d4566048c784a21666fe7abd398c7122044b3c5303e0de2d28759d530583aaebe63a45621c0dc4
-
Filesize
188KB
MD503448e221f01240eaca8fe35307c8ac5
SHA12f164350047f266fb9d09476b0372dc878daee90
SHA256095506e0edbb8d092dbbbceee017857f8f14b5c0799e66310f66c796439e8b36
SHA51291c86a6dd384dca7b5510740a4e3024c5266cb2d27d96e7d82676d9f170cb1712fb4d8db917f2f986f68389087a351f3177e631c5aa899f0df6091cc1b42c91d
-
Filesize
188KB
MD584ae84522d70037b60d8b67ff4c628de
SHA107517ae0aa6d2d4c0eeee359fb643747b36843f2
SHA25674d316a51ec5170855e2761d812a3355c37a3c2c5a9a5859391f601dfeb05bba
SHA5121c900f410f7544c6759474c2268965b1404fb6541c418720330db9e710139dbdbdcf61e0969962087a9bfb15425488e6812cac66f114e1f24ee099308bbcb2da
-
Filesize
1KB
MD5de8f28de92ac2ed636f6c6f00787bbc3
SHA14680f28d104fb09077b8f65f6d86d3962c8d411e
SHA2565b56ca0300192f578903de6e5342737713f3f699abec8d408e91e70870151675
SHA512b7f5f49a173de63073353fca56050aefc5b4c9895daa32c7429ff2d68f8c729df574ffc502abb62c585592947c27062e12f8e88842c17f63081033eeda1b0bfc
-
Filesize
188KB
MD5274b72a5f1babbf851c93507c0df2537
SHA1491ed8c57901ee01b7bf8686feab9b443ecbba18
SHA256f0983dc128b0fef593ab70370dd699a3d4899d7ab9a296e6cd45c60d5da85f12
SHA512879c5ca442ecded94f7424310f230fe2c37015e222dcf8c0852bbde671ee8a2a30c9cf4fb7c1f96d7b8328ff43a461311a0ef4c9996c009c3c5c5d96c7acd15f
-
Filesize
188KB
MD5748dbf5d925922d8c45321623a8580ce
SHA183d4325d1f8baa30a361a432e9becc1cd350ec0a
SHA256a409c2acaa7c23762b42e23522d99d1c5357fb3e95db38811f73ca90a25cbe85
SHA512c29fa00f3159040883de45fe95a66b6d696239d07068318b9536065120fcc8331cb225717369ff43f45bcc7bdddd34c462963f5b19ee8a8a700a082325f9f3c2
-
Filesize
188KB
MD5dc09f4454557311044efe0305b8f83cc
SHA19da8606eacdd5e63cd56eece2363065f70b4efd8
SHA256eba32ccacd8003499fa30e5eadf8fa343982ada9f725a02c110c18e0ffa30fa1
SHA51212b703c44b0d43cbbae26bf10c8a0a8d8f250212c5b6ec18a3cb6c1d81818b68d8572385ac9048df7d01161606547b1b28d61becaa4f2f0c6ca91ff009052dd9
-
Filesize
188KB
MD541db466169a6d0c0fcccdfd33f513260
SHA16451fd286e7c5d046dcceea02993e7823ec01c07
SHA25650625d4132f392dd8f1e4db7de9463635ee5eb02ca7422f0396a7efa3b26cdd0
SHA5120876529d4064d93c4ca7558305f7e5d05711b43079b115bba4085ea24ae26e1ea67d2d303a054e61485e0ddae9cff9ede2e442c75a8e6533ac9a46ec3d2daee9
-
Filesize
188KB
MD5cc2ba459af074227464597cbffbff6be
SHA1e85869902ff7f3e5e8d96fd2b84bda66997299e1
SHA256a355e110f0daf1c1c0812df4d66948151ac56f0419e63a6f4de48fe0a9b3ab33
SHA5126ec89afddd5fb24f3389cdf0b93a4b78438aaa899fe0d103bde22a9a89d76316c5e239a6823d6bf564d924461896eb898d3a2ccc7890189470ad2c0be200ea66
-
Filesize
188KB
MD58bf1388e9667f0e482fdebd647527b3c
SHA17914bc802ddaf9593b0774cc4fb139252c592fce
SHA256de0de4fcec08bced53c179fc409a3c23512faa1ef4ec3d6bc6bfab00fec6b4f9
SHA512676770dda88d86429bb6cbf56ce2053138335ee500976575c9fb54466c3a41976372c1f5eef75e495a0efad220a3e9f7f4ed1677040af204c32602f3a6d340c6
-
Filesize
188KB
MD5c92c15140863ddeb73bf6174d15a65c3
SHA167978e8a227aa820d6d8b93d91dc0026226975c7
SHA256c22acd8b036f589b74a3581bc80bc8b7398fd35c0e7c7d494d995854a8e8a5cd
SHA512f0b28334dcd383d9ce6017017a0683a8e1808857d23294fcf9a81eb70bf5edfff2c4bbfff8e6b6451b8931d9f290e6678f3c4ff92a347e240cb971a0b2133b49
-
Filesize
188KB
MD5df158ae47796e6dca974e80dcdc4b333
SHA1b38ba3fef183cd18b26e63ea04f572ba46a570a8
SHA2566a5eb18761a73ef4f15e09efc6f2b7de5c48eeb544f9b4330bd3e2b68eda73a6
SHA512c32d0a3f287b03c316df922f5b867757e88f4464594fae84f6627bcd8d8b7a5f849e1ded5c90862e437e230e6efaa1839a7987850c9ce7e4b4714f014cc8dd2d