Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 15:00
Static task
static1
Behavioral task
behavioral1
Sample
d11ebb721261bee7b497463b4fca81cf.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d11ebb721261bee7b497463b4fca81cf.exe
Resource
win10v2004-20231215-en
General
-
Target
d11ebb721261bee7b497463b4fca81cf.exe
-
Size
188KB
-
MD5
d11ebb721261bee7b497463b4fca81cf
-
SHA1
dbed997d532c4f09469f6cc70a2e5d1875364c96
-
SHA256
c9536b007ecac1b88b8b045ecc90d96f8b1708d90c2c3205c517d01787723e83
-
SHA512
5f46ddb70771c19e8b0dff9cd422976666059b77b5f417ada11304521a0a5c8f13c8dd2fac87c9d7bfdec82766f0fbe76eb226c330242dcfdab1e6820d74ef05
-
SSDEEP
3072:R7tLoxqYmJwZ2OjjqBa6oJSLPTPJMoItkjx0zoYbxlv1pF2:R7poaiZ2wqo6oJVx7Zxlv1pF
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2320 Unicorn-20776.exe 2244 Unicorn-27626.exe 2784 Unicorn-43504.exe 2676 Unicorn-9704.exe 2732 Unicorn-22511.exe 2560 Unicorn-9512.exe 2600 Unicorn-1095.exe 2816 Unicorn-46575.exe 2876 Unicorn-711.exe 1732 Unicorn-16856.exe 1900 Unicorn-53119.exe 584 Unicorn-45735.exe 1108 Unicorn-42013.exe 1912 Unicorn-31895.exe 1644 Unicorn-60846.exe 1652 Unicorn-15174.exe 2380 Unicorn-30250.exe 1376 Unicorn-42864.exe 2340 Unicorn-13721.exe 2424 Unicorn-27910.exe 2444 Unicorn-39647.exe 1796 Unicorn-42985.exe 1768 Unicorn-43478.exe 932 Unicorn-6015.exe 1668 Unicorn-12040.exe 2436 Unicorn-6866.exe 2008 Unicorn-60857.exe 2912 Unicorn-60089.exe 1168 Unicorn-60089.exe 308 Unicorn-27609.exe 888 Unicorn-57987.exe 2296 Unicorn-41650.exe 1792 Unicorn-1895.exe 1744 Unicorn-31915.exe 2776 Unicorn-53016.exe 2836 Unicorn-16430.exe 2696 Unicorn-65055.exe 2420 Unicorn-35912.exe 2728 Unicorn-19000.exe 2576 Unicorn-4897.exe 2372 Unicorn-40715.exe 1864 Unicorn-56667.exe 2888 Unicorn-41374.exe 2880 Unicorn-24654.exe 1232 Unicorn-23009.exe 2004 Unicorn-4212.exe 2800 Unicorn-3143.exe 1992 Unicorn-5639.exe 820 Unicorn-25505.exe 1496 Unicorn-8592.exe 1588 Unicorn-57409.exe 1628 Unicorn-22634.exe 2016 Unicorn-14918.exe 836 Unicorn-62209.exe 1208 Unicorn-16621.exe 2676 Unicorn-6444.exe 2492 Unicorn-37664.exe 1704 Unicorn-17881.exe 1308 Unicorn-22262.exe 1008 Unicorn-52365.exe 1548 Unicorn-28121.exe 2528 Unicorn-61836.exe 1612 Unicorn-29823.exe 2332 Unicorn-46050.exe -
Loads dropped DLL 64 IoCs
pid Process 2420 d11ebb721261bee7b497463b4fca81cf.exe 2420 d11ebb721261bee7b497463b4fca81cf.exe 2320 Unicorn-20776.exe 2320 Unicorn-20776.exe 2420 d11ebb721261bee7b497463b4fca81cf.exe 2420 d11ebb721261bee7b497463b4fca81cf.exe 2244 Unicorn-27626.exe 2244 Unicorn-27626.exe 2320 Unicorn-20776.exe 2320 Unicorn-20776.exe 2784 Unicorn-43504.exe 2784 Unicorn-43504.exe 2676 Unicorn-9704.exe 2676 Unicorn-9704.exe 2244 Unicorn-27626.exe 2244 Unicorn-27626.exe 2732 Unicorn-22511.exe 2732 Unicorn-22511.exe 2560 Unicorn-9512.exe 2560 Unicorn-9512.exe 2784 Unicorn-43504.exe 2784 Unicorn-43504.exe 2600 Unicorn-1095.exe 2600 Unicorn-1095.exe 2676 Unicorn-9704.exe 2676 Unicorn-9704.exe 2876 Unicorn-711.exe 2876 Unicorn-711.exe 2816 Unicorn-46575.exe 2732 Unicorn-22511.exe 2816 Unicorn-46575.exe 2732 Unicorn-22511.exe 1732 Unicorn-16856.exe 1732 Unicorn-16856.exe 2560 Unicorn-9512.exe 2560 Unicorn-9512.exe 1900 Unicorn-53119.exe 1900 Unicorn-53119.exe 584 Unicorn-45735.exe 584 Unicorn-45735.exe 2600 Unicorn-1095.exe 2600 Unicorn-1095.exe 1108 Unicorn-42013.exe 1108 Unicorn-42013.exe 1912 Unicorn-31895.exe 1912 Unicorn-31895.exe 2876 Unicorn-711.exe 2876 Unicorn-711.exe 1644 Unicorn-60846.exe 1644 Unicorn-60846.exe 2380 Unicorn-30250.exe 2380 Unicorn-30250.exe 1732 Unicorn-16856.exe 1732 Unicorn-16856.exe 1652 Unicorn-15174.exe 1652 Unicorn-15174.exe 2340 Unicorn-13721.exe 2340 Unicorn-13721.exe 1376 Unicorn-42864.exe 1376 Unicorn-42864.exe 2816 Unicorn-46575.exe 1900 Unicorn-53119.exe 2816 Unicorn-46575.exe 1900 Unicorn-53119.exe -
Program crash 5 IoCs
pid pid_target Process procid_target 2608 1744 WerFault.exe 61 1528 1624 WerFault.exe 101 1532 3056 WerFault.exe 109 1232 1252 WerFault.exe 178 1652 1644 WerFault.exe 170 -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2420 d11ebb721261bee7b497463b4fca81cf.exe 2320 Unicorn-20776.exe 2244 Unicorn-27626.exe 2784 Unicorn-43504.exe 2676 Unicorn-9704.exe 2732 Unicorn-22511.exe 2560 Unicorn-9512.exe 2600 Unicorn-1095.exe 2816 Unicorn-46575.exe 2876 Unicorn-711.exe 1732 Unicorn-16856.exe 1900 Unicorn-53119.exe 584 Unicorn-45735.exe 1108 Unicorn-42013.exe 1912 Unicorn-31895.exe 1644 Unicorn-60846.exe 2380 Unicorn-30250.exe 1652 Unicorn-15174.exe 1376 Unicorn-42864.exe 2340 Unicorn-13721.exe 2424 Unicorn-27910.exe 2444 Unicorn-39647.exe 1796 Unicorn-42985.exe 932 Unicorn-6015.exe 1768 Unicorn-43478.exe 1668 Unicorn-12040.exe 2436 Unicorn-6866.exe 2008 Unicorn-60857.exe 1168 Unicorn-60089.exe 2912 Unicorn-60089.exe 2296 Unicorn-41650.exe 308 Unicorn-27609.exe 888 Unicorn-57987.exe 1792 Unicorn-1895.exe 1744 Unicorn-31915.exe 2696 Unicorn-65055.exe 2576 Unicorn-4897.exe 2836 Unicorn-16430.exe 2776 Unicorn-53016.exe 2728 Unicorn-19000.exe 2420 Unicorn-35912.exe 2372 Unicorn-40715.exe 1864 Unicorn-56667.exe 2888 Unicorn-41374.exe 2880 Unicorn-24654.exe 2004 Unicorn-4212.exe 820 Unicorn-25505.exe 1232 Unicorn-23009.exe 1588 Unicorn-57409.exe 1992 Unicorn-5639.exe 2800 Unicorn-3143.exe 1496 Unicorn-8592.exe 1628 Unicorn-22634.exe 2016 Unicorn-14918.exe 1208 Unicorn-16621.exe 836 Unicorn-62209.exe 2492 Unicorn-37664.exe 2676 Unicorn-6444.exe 1308 Unicorn-22262.exe 1704 Unicorn-17881.exe 1008 Unicorn-52365.exe 1548 Unicorn-28121.exe 2528 Unicorn-61836.exe 1612 Unicorn-29823.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2320 2420 d11ebb721261bee7b497463b4fca81cf.exe 28 PID 2420 wrote to memory of 2320 2420 d11ebb721261bee7b497463b4fca81cf.exe 28 PID 2420 wrote to memory of 2320 2420 d11ebb721261bee7b497463b4fca81cf.exe 28 PID 2420 wrote to memory of 2320 2420 d11ebb721261bee7b497463b4fca81cf.exe 28 PID 2320 wrote to memory of 2244 2320 Unicorn-20776.exe 29 PID 2320 wrote to memory of 2244 2320 Unicorn-20776.exe 29 PID 2320 wrote to memory of 2244 2320 Unicorn-20776.exe 29 PID 2320 wrote to memory of 2244 2320 Unicorn-20776.exe 29 PID 2420 wrote to memory of 2784 2420 d11ebb721261bee7b497463b4fca81cf.exe 30 PID 2420 wrote to memory of 2784 2420 d11ebb721261bee7b497463b4fca81cf.exe 30 PID 2420 wrote to memory of 2784 2420 d11ebb721261bee7b497463b4fca81cf.exe 30 PID 2420 wrote to memory of 2784 2420 d11ebb721261bee7b497463b4fca81cf.exe 30 PID 2244 wrote to memory of 2676 2244 Unicorn-27626.exe 31 PID 2244 wrote to memory of 2676 2244 Unicorn-27626.exe 31 PID 2244 wrote to memory of 2676 2244 Unicorn-27626.exe 31 PID 2244 wrote to memory of 2676 2244 Unicorn-27626.exe 31 PID 2320 wrote to memory of 2732 2320 Unicorn-20776.exe 32 PID 2320 wrote to memory of 2732 2320 Unicorn-20776.exe 32 PID 2320 wrote to memory of 2732 2320 Unicorn-20776.exe 32 PID 2320 wrote to memory of 2732 2320 Unicorn-20776.exe 32 PID 2784 wrote to memory of 2560 2784 Unicorn-43504.exe 33 PID 2784 wrote to memory of 2560 2784 Unicorn-43504.exe 33 PID 2784 wrote to memory of 2560 2784 Unicorn-43504.exe 33 PID 2784 wrote to memory of 2560 2784 Unicorn-43504.exe 33 PID 2676 wrote to memory of 2600 2676 Unicorn-9704.exe 34 PID 2676 wrote to memory of 2600 2676 Unicorn-9704.exe 34 PID 2676 wrote to memory of 2600 2676 Unicorn-9704.exe 34 PID 2676 wrote to memory of 2600 2676 Unicorn-9704.exe 34 PID 2244 wrote to memory of 2816 2244 Unicorn-27626.exe 35 PID 2244 wrote to memory of 2816 2244 Unicorn-27626.exe 35 PID 2244 wrote to memory of 2816 2244 Unicorn-27626.exe 35 PID 2244 wrote to memory of 2816 2244 Unicorn-27626.exe 35 PID 2732 wrote to memory of 2876 2732 Unicorn-22511.exe 36 PID 2732 wrote to memory of 2876 2732 Unicorn-22511.exe 36 PID 2732 wrote to memory of 2876 2732 Unicorn-22511.exe 36 PID 2732 wrote to memory of 2876 2732 Unicorn-22511.exe 36 PID 2560 wrote to memory of 1732 2560 Unicorn-9512.exe 37 PID 2560 wrote to memory of 1732 2560 Unicorn-9512.exe 37 PID 2560 wrote to memory of 1732 2560 Unicorn-9512.exe 37 PID 2560 wrote to memory of 1732 2560 Unicorn-9512.exe 37 PID 2784 wrote to memory of 1900 2784 Unicorn-43504.exe 38 PID 2784 wrote to memory of 1900 2784 Unicorn-43504.exe 38 PID 2784 wrote to memory of 1900 2784 Unicorn-43504.exe 38 PID 2784 wrote to memory of 1900 2784 Unicorn-43504.exe 38 PID 2600 wrote to memory of 584 2600 Unicorn-1095.exe 39 PID 2600 wrote to memory of 584 2600 Unicorn-1095.exe 39 PID 2600 wrote to memory of 584 2600 Unicorn-1095.exe 39 PID 2600 wrote to memory of 584 2600 Unicorn-1095.exe 39 PID 2676 wrote to memory of 1108 2676 Unicorn-9704.exe 40 PID 2676 wrote to memory of 1108 2676 Unicorn-9704.exe 40 PID 2676 wrote to memory of 1108 2676 Unicorn-9704.exe 40 PID 2676 wrote to memory of 1108 2676 Unicorn-9704.exe 40 PID 2876 wrote to memory of 1912 2876 Unicorn-711.exe 41 PID 2876 wrote to memory of 1912 2876 Unicorn-711.exe 41 PID 2876 wrote to memory of 1912 2876 Unicorn-711.exe 41 PID 2876 wrote to memory of 1912 2876 Unicorn-711.exe 41 PID 2816 wrote to memory of 1652 2816 Unicorn-46575.exe 46 PID 2816 wrote to memory of 1652 2816 Unicorn-46575.exe 46 PID 2816 wrote to memory of 1652 2816 Unicorn-46575.exe 46 PID 2816 wrote to memory of 1652 2816 Unicorn-46575.exe 46 PID 2732 wrote to memory of 1644 2732 Unicorn-22511.exe 42 PID 2732 wrote to memory of 1644 2732 Unicorn-22511.exe 42 PID 2732 wrote to memory of 1644 2732 Unicorn-22511.exe 42 PID 2732 wrote to memory of 1644 2732 Unicorn-22511.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\d11ebb721261bee7b497463b4fca81cf.exe"C:\Users\Admin\AppData\Local\Temp\d11ebb721261bee7b497463b4fca81cf.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20776.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20776.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-27626.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27626.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-9704.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9704.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-1095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1095.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-45735.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45735.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:584 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-1895.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1895.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-14918.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14918.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe10⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59190.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59190.exe11⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59977.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59977.exe12⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28911.exe13⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15833.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15833.exe14⤵PID:1712
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16200.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16200.exe9⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe10⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe11⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38558.exe12⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30368.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30368.exe13⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56891.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56891.exe14⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe15⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5810.exe16⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe17⤵PID:1916
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10779.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10779.exe16⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41014.exe17⤵PID:2372
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54528.exe10⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9169.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9169.exe11⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe12⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1934.exe13⤵PID:2436
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16006.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16006.exe11⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16029.exe12⤵PID:2936
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:836 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe9⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19661.exe10⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58424.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58424.exe11⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30368.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30368.exe12⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64561.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64561.exe13⤵PID:1644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 24014⤵
- Program crash
PID:1652
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1744 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 1888⤵
- Program crash
PID:2608
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39647.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2444
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-42985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42985.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-53016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53016.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-2900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2900.exe8⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10968.exe9⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45632.exe10⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe11⤵PID:3044
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe11⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51477.exe12⤵PID:924
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16430.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-16621.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16621.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-37960.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37960.exe8⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19386.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19386.exe9⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51022.exe10⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37097.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37097.exe11⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39443.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39443.exe12⤵PID:2972
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-15174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15174.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-60089.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60089.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-2023.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2023.exe8⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41192.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41192.exe9⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13248.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13248.exe10⤵PID:2880
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10656.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10656.exe10⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13521.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13521.exe11⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15754.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15754.exe12⤵PID:2392
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59204.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59204.exe11⤵PID:2964
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4212.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-29823.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29823.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe8⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37834.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37834.exe9⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50308.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50308.exe10⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62999.exe11⤵PID:1252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 18812⤵
- Program crash
PID:1232
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35894.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35894.exe7⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe8⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-93.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-93.exe9⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55737.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55737.exe10⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36478.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36478.exe11⤵PID:1376
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57987.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:888 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-25505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25505.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:820 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-35874.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35874.exe7⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35914.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35914.exe8⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60048.exe9⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30368.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30368.exe10⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29585.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29585.exe11⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3485.exe12⤵PID:2384
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28551.exe10⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11409.exe11⤵PID:3044
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22511.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-711.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-711.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31895.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31895.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43478.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43478.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-19237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19237.exe8⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44134.exe9⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe10⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16840.exe11⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40481.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40481.exe12⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8906.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8906.exe13⤵PID:584
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-2817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2817.exe7⤵PID:2440
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6015.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6015.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:932 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56667.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56667.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-37664.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37664.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe8⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8799.exe9⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38558.exe10⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30353.exe11⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25307.exe12⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13532.exe13⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe14⤵PID:2452
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44267.exe13⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35752.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35752.exe14⤵PID:1124
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61700.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61700.exe12⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5663.exe13⤵PID:1932
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65292.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65292.exe7⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6049.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6049.exe8⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30680.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30680.exe9⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37248.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37248.exe10⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20848.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20848.exe11⤵PID:944
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe7⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23273.exe8⤵PID:1000
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60846.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-12040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12040.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-19000.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19000.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe7⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24041.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24041.exe8⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60048.exe9⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47784.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47784.exe10⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36723.exe11⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47687.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47687.exe12⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32684.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32684.exe13⤵PID:2748
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe10⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46324.exe11⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31405.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31405.exe12⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64132.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64132.exe13⤵PID:2432
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe12⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3847.exe13⤵PID:2440
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29987.exe11⤵PID:1780
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-6444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6444.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe7⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38203.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38203.exe8⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51022.exe9⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31991.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31991.exe10⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe11⤵PID:2364
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe10⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe11⤵PID:2752
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-9512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9512.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-16856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16856.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-30250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30250.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-60857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60857.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-24654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24654.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-35957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35957.exe8⤵PID:1648
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3143.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-28121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28121.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-64727.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64727.exe8⤵PID:3056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 2409⤵
- Program crash
PID:1532
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6866.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-22262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22262.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-16980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16980.exe8⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10143.exe9⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exe10⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34535.exe11⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30711.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30711.exe12⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61461.exe13⤵PID:2560
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52365.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52365.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-12306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12306.exe7⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41088.exe8⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31998.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31998.exe9⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exe10⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15014.exe11⤵PID:832
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6135.exe10⤵PID:3068
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42864.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42864.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:308 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23009.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23009.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe7⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44518.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44518.exe8⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57768.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57768.exe9⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe10⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61570.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61570.exe11⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12686.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12686.exe12⤵PID:1616
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe10⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe11⤵PID:1076
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33769.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33769.exe9⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58654.exe10⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63618.exe11⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe12⤵PID:3024
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1992
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53119.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53119.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13721.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-60089.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60089.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-57409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57409.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exe7⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe8⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe9⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-93.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-93.exe10⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30647.exe11⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8906.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8906.exe12⤵PID:688
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22634.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-61836.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61836.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe7⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8415.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8415.exe8⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55355.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55355.exe9⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe10⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51477.exe11⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11643.exe12⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13670.exe13⤵PID:1788
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe12⤵PID:1796
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26754.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26754.exe11⤵PID:2016
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16006.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16006.exe9⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5514.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5514.exe10⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe11⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe12⤵PID:1012
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41650.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-8592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8592.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exe6⤵PID:1624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 2007⤵
- Program crash
PID:1528
-
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
MD5b0dad351acf7739f52d2dfa0d6ea7d90
SHA183dde2b770dce050667246d224b9fa04658105fe
SHA256c8c848aa44eaf7bfb13ac26e5e82c09e060251627f017ea1a4b24d163ffa3e08
SHA5120dfd6b19e4abeaa346e0abe53cb692bbe24109f6f1172e0d29e288ab1a91b294eda011efca18687e1c097aef097e918b68b4d5aecbd0f56c2421eb262aad16c4
-
Filesize
188KB
MD58a471f2016a7b3386d4f5611fa4fddae
SHA1ab7af042a66b47eb9cdd3726433968a45956357f
SHA256c17b589033aadc17402502d081b8036abac58f441da1ea40b3aa4d5506239690
SHA512a1b9a73ec634d7b0d123f2fa5747b3d02467c248d56ca922203affb407644df6dcf6077ddf3c745c2fb0137215c659984804d8b9b70e64e106a7c3f00ff24c6a
-
Filesize
188KB
MD54dc080fff00baac24f9d099d40e2f445
SHA1d51f0c72e0d59dcdffb0fbeddb6c726e1af731bc
SHA256f2aa6740786919711e3c20e32b302cd8df4a7e08e1c6e597f322fe744b3cdd85
SHA512cbd59d30b8139e7ad3e284e0dd7bfb507f76944de056b83fffe4edefeb2303732bfac825262f6e7b92e721f32bce909caaeded681b1968b780ff642232afec3b
-
Filesize
188KB
MD57a24c7e01646400d52408e27131ace66
SHA1af4800d20be6961823e225a9d1c7c69b315ed079
SHA256e25de2454372680a62dc9e4a3f488cda3ca46776fd7a0e5e11382c16942cff29
SHA512e01b7214f615aaedfd1d8b024b82c0eea645e24d161be4ff6b8b7f009d995d3f0549bb95dcce58c2e9fed2d959830eec16eefc911cee2732fc044bb4cdd08ea0
-
Filesize
188KB
MD583b84c84ba2cef3c6f972bdae50d9da5
SHA19d34a5c9ee71799f2b40feb5e16b98bb1166d310
SHA256dccc2d926760aa048a3fafbe9427c79353a84eb7c107b5d3770c0a0e8ce107de
SHA512b73011f0bdb34ab29e50e3601e2c223257219a7a354a6591af46739950dd79e24243ae31c01c033a1fa69cfd990a9efcb444a8c5b3e5bafe95f1e60c65077cbc
-
Filesize
188KB
MD54d9f9bbb4b79ddb3d71d3ae1428ade55
SHA137e55f314896e98b821c377e8de9ca76fa318fe2
SHA25697ee5701f276e0d71a692b49ba2d636e11d6b6dbb99fb2cfffe1bc382a4c7de2
SHA512b40adaae96338b6b7a74562fde560dfb7812d42d7541c259882a5548b6b1c2429ad0a4bfbad6eed402e8d72c33a70dace12e3dd3e368e5f5ece75026ece80b2e
-
Filesize
188KB
MD583b10fc5ec8756c1f6d5f5e41ccfcd79
SHA1dd177d41e7d6f73c0077b670262705cc595e9777
SHA256de5f825d5bd1b2458943172c0524121d0bec452ef8bc9ae7d62b921ed31949ab
SHA5123c8917892a92be46dab4230237a9c781821b0f9261d95fea308569b7e18f285cba0c4e00eb1db54262eb470ee5ed1a823cbc6c52143b2cecb73e9a3bc46d36e8
-
Filesize
188KB
MD5073f7ee06e473f44c9d5b875d6703c09
SHA1e88508ceb4ab50e3be54d287677d24e08963efcb
SHA256448c38c1064d043f035436f89cd92453fa6a94d3d9dc8f57aa10186df34f49a4
SHA51227d97c76dbb4922cae3c20ff0b4326ff6ff9a4ed96abd7e950aa0ae615833d18595694b497673570c21195a4e93ba401a74edd76359e9f3f6681f210df7f873a
-
Filesize
188KB
MD54d7d2ff3549aeb304432fc356a7b374b
SHA144b9a5e00ee834c9c4af676f675bbddedec3a28b
SHA256f9d1fb1faf48edace81350b86c73af99eb3ad58d162a7f4d259423e76b97c4cd
SHA512f746687e871ba1c055a3acbeaebb23f9cbd7aac020b8f29748b12b8950c4e88f453dae49582a5d397308ab8dce9510281b717c02e41b93acf19726bf16463a56
-
Filesize
188KB
MD56cee5c6e8f177965ce5fc1eabf8d845f
SHA181e53e02fd562fb6fc22c46a428fd9b0145a0f5a
SHA256e223bc96ed9053a87a2ff1e6a274397516141e831e0b14d27c78c86678d01616
SHA51220d6d27d4b2018ce399f129ccddc64a5d363b245dedbb2a9130907aa67d0e2182d5c3e72688ed6274b1db16af9ca913f54e33bbd14ad74e058398e327ef41b83
-
Filesize
188KB
MD5becb27bce63fedf5950dbdad1ade25b4
SHA1f29e8f749d44e11346d2eabc65e691ecc64f4bd6
SHA2567e0d892f1b154c2c24779ed3936dded796b89b3dcedf299a7a44278478499aa7
SHA51260a42fda09c155603fedf111f246d0d2625783537b735f39b34774e3db738c2823fd165dc406c10a3899b06f30b85e79d0b3bc1c160fe3502d17c0e1ca0ca69a
-
Filesize
188KB
MD5b0f1d9d6ac941f1dea3ba6da766188b9
SHA1727e03a75545e026dcd6b82d418211a155702491
SHA256b2dfb71a628180fbe707e1e097e8f0790ad978325da52099b45be37dfc6bde5f
SHA5127989ff90178ba7a1b5d63b8e8f05cc2fe38d23c309156f3b2f6872aa08cf60f4de8b7e7d4290803013f275812e6ad7534e4cfe20b11341d77fbdcd8669e31ff0
-
Filesize
188KB
MD589ca2b258437657d9154feb0a2ba58b3
SHA1d99cc39322abb852bf28b7557995f0c3387b1e7a
SHA2566127d017c6f6705388c942436bce52e111331ed863b44f8625995a9cd21ab5e2
SHA512dc52d7bc1cbb27c6512788fbaf762eb840bf441f8350b6da8936ec0cf3548712ff90c56774541566622815674df322182665836720475ff351b8865a292b3848
-
Filesize
188KB
MD5dd44e06ff686a186ddfb2b29323b8e96
SHA1c4436f4f8a42e29c71ad7cc360fbbf5dfbb30487
SHA256874a658ddea6f72df054bbba75deafc70158fac8f772c9245c8562532100995f
SHA5123dca42e2f6aa70a9a474a56202253a79cdbeac2df93f2b826e9cf4498536aefa7b878b7885930c4dec175e0c54be4fcb45f79d50c2e58adc3333d6cdf1504c05
-
Filesize
188KB
MD53c40dba67d52635fb907f014ae0bb6b4
SHA16075057bf1948bc90ace126f206ba31d1a2efa09
SHA256421762cb0e61e3ce4f23b919f2a6245c11723910744f4b513104c857a55a96a2
SHA512d7eb424170323829ceaecc9ccd3a7f23d4b0606fa152607a4f186967230e3c4019aca411c27c1ac044a4bbee4a1d7d7d10341e6f39eaabf09daee99d1c5a3ff5
-
Filesize
188KB
MD524fe961a95e3b5a044b96a3e413467f9
SHA1958215a07dd094df6d188f9b2b29e136d656372e
SHA256f41f2575ab9fbbf8c7de531ca0c11d9c6119a46b09dce64610c8643e3c999a2d
SHA5127a4dfe7a210477fb16845f2745f6c65b17c76a851291fd5a6da82e7578f92a29ad473a95ca5cec83463cc1f7da389cf48629616bf03bced2cec5154f525d38ee
-
Filesize
188KB
MD573476337a31b68fc9ca6cf152df88e36
SHA1719fb583114c3683e44a1c9df0d89bca4d52ce35
SHA2563a8a5d83e075b13fcb957c91a397caa34355fc217f272c6bf351d5e128626b72
SHA51294755d22702f7980dc3af20752c5747cfa9329718edf597192795e43cabcc3af8f0fc400bc62130d0a9ba3b255c84ffc2deb3e68da5f89ceea0aa1cd69d3eafd
-
Filesize
188KB
MD509183f6e48c38ef8f2c634a0e46b44b2
SHA1d17dea254cb251adec1eb5070695f9ed51f5ddd6
SHA256ff3f2814a31f7b4c4c57606654f35eea73b86083652d8cfaf830fc2ee6d0f2aa
SHA51214b38b86ae04a4675139d0b2a5fd1cf90bdc071c49790eabb03c3bdd1406cd25c770c251b418178e58361ab8e53d10ddd84d2aea1ab333e7737fc3f78d260c8a
-
Filesize
188KB
MD538d58a025ee1960d7a618fb29b2392b8
SHA154a74f17daa774e7785eb9b52e8c02fff1b2080c
SHA2561ac2e38952f5fcb3972791adef1b054f9cfe43b5e57987bc6eb0a5941b35d3b5
SHA51273baeaa10be927ca2978fb56bac33be07485ee28840e32c7bd2e7a6de0656268da65cd413f32385fa46590885f68f3672e29df666c55f8385c8a4698a7abd242
-
Filesize
188KB
MD5b42eb0fce17adb7be62144f170916f6e
SHA11736e9edaf023dbe4bb8b7b0806f45b9b12ba3df
SHA256519b912a52d1f02d790ad06a8843bcbc553db71d64f145aa1dc387731087d7b0
SHA5123f568051159063e4e000392bf19871e93c52b74e7503d149b8aae83524dbea32ba7317a42810d72e8d7ff8e9bd27c1198cfc4b6c3f88893837ead445a92d5571
-
Filesize
188KB
MD504a7a8c230462ecf8918bd0582fc7605
SHA13719e591d459cd2d050a698f7d3a8ddba6260ca4
SHA2566560aea060727ad5a67faf189092931eaa5d03cca07b6198aac74cdf64857fd5
SHA51267d4b2c7f29526cb474c74530fda7a022b2bf3b434727dbe94598b07aff9c8a9760a0dbd319ca9390c08072a7c9b9a512260e7840e1cee53cb45c383e2ed14e1
-
Filesize
188KB
MD5f41125b9998c5352002cbe12ebcf0fb7
SHA1ea31d157168aec484882489c04a6a058abb58209
SHA256f8fe8b646e1410a1095af4a255ada8b906c188fc4d5cb1d3bfed669f47ab5b1e
SHA512ad6ecb609e5ca3dac58e7f9922c6b95fb5819582600ec29409be7fc96570a31780fe6ad41ea20a391da5c3af8870f8565cfe1a82434e9a5d3418ecf4bf4efedc
-
Filesize
188KB
MD52c54db07187957fbd217c4b656ba111b
SHA1e9d5181b91bcdf7efe90399801b47aa726273b7c
SHA256f38d9f448a7f2c5586365a38a2ab88b7696b8d6484a74ee604f12936e30f8440
SHA512869738a33ecdf727f2034413eca446c0e72b3cf3b4a28fe19df1f0a6ac2a3c8ee6f2bf039e24e8ea02ca27e32fe0629e3b2fbef49e9f2b97bc77e1f257423e56
-
Filesize
188KB
MD50e84dba94e769a83b4332beede459cc2
SHA15bf6a2bf7d273c7db3020257676bb2643fae6efe
SHA256a33382c8e56e5ae6cb895d3c62d93b0652527e36f3bcbf736cc8d1268e22c0c0
SHA51206707deee668f1f6a960ff706e21c0365013b70f00c5cb3636e593629d0783a5cf665a9ec8eae154246aee8702abef6be9b2ba8e8d229cf4e48e5175fe55b239