Analysis

  • max time kernel
    37s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25/01/2024, 18:01

General

  • Target

    752881aa01cfaf7977f1a4290ad794ed.exe

  • Size

    184KB

  • MD5

    752881aa01cfaf7977f1a4290ad794ed

  • SHA1

    d65137958c2f71dda46f2d765b10225a7222d1e3

  • SHA256

    ee3738a35b2bd5384ee0048cc5684c35d38f16e59884cda1e3fd5aad03d88749

  • SHA512

    62853a7204f879ea4bae5430b7911427a3c9e9fa1d580db98809310361339b5899534abe028dad47b6669b779fc231065f7916d784dca3d22b73c29398f7d28c

  • SSDEEP

    3072:Jv96o01U50AUkBOHpd3RL08bbi2prXp5TH0px7kM40BlVvwFa:JvQolFjBudBL08fxw7BlVvwF

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Program crash 15 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\752881aa01cfaf7977f1a4290ad794ed.exe
    "C:\Users\Admin\AppData\Local\Temp\752881aa01cfaf7977f1a4290ad794ed.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2932
    • C:\Users\Admin\AppData\Local\Temp\Unicorn-20805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20805.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Users\Admin\AppData\Local\Temp\Unicorn-37499.exe
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37499.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2872
        • C:\Users\Admin\AppData\Local\Temp\Unicorn-27852.exe
          C:\Users\Admin\AppData\Local\Temp\Unicorn-27852.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2660
          • C:\Users\Admin\AppData\Local\Temp\Unicorn-18937.exe
            C:\Users\Admin\AppData\Local\Temp\Unicorn-18937.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2456
            • C:\Users\Admin\AppData\Local\Temp\Unicorn-14141.exe
              C:\Users\Admin\AppData\Local\Temp\Unicorn-14141.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2828
              • C:\Users\Admin\AppData\Local\Temp\Unicorn-10379.exe
                C:\Users\Admin\AppData\Local\Temp\Unicorn-10379.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1972
                • C:\Users\Admin\AppData\Local\Temp\Unicorn-9668.exe
                  C:\Users\Admin\AppData\Local\Temp\Unicorn-9668.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1724
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 240
                    9⤵
                    • Program crash
                    PID:2096
                • C:\Users\Admin\AppData\Local\Temp\Unicorn-22340.exe
                  C:\Users\Admin\AppData\Local\Temp\Unicorn-22340.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1740
                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-11749.exe
                    C:\Users\Admin\AppData\Local\Temp\Unicorn-11749.exe
                    9⤵
                      PID:2188
                • C:\Users\Admin\AppData\Local\Temp\Unicorn-30835.exe
                  C:\Users\Admin\AppData\Local\Temp\Unicorn-30835.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:924
                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-36415.exe
                    C:\Users\Admin\AppData\Local\Temp\Unicorn-36415.exe
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3064
                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-39212.exe
                      C:\Users\Admin\AppData\Local\Temp\Unicorn-39212.exe
                      9⤵
                        PID:2852
                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-57255.exe
                      C:\Users\Admin\AppData\Local\Temp\Unicorn-57255.exe
                      8⤵
                        PID:2068
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-31617.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-31617.exe
                          9⤵
                            PID:3452
                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-51967.exe
                      C:\Users\Admin\AppData\Local\Temp\Unicorn-51967.exe
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:832
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-6544.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-6544.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2644
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-48091.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-48091.exe
                          8⤵
                          • Executes dropped EXE
                          PID:1780
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 244
                            9⤵
                            • Program crash
                            PID:1048
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-36585.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-36585.exe
                        7⤵
                          PID:2460
                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-39392.exe
                      C:\Users\Admin\AppData\Local\Temp\Unicorn-39392.exe
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetWindowsHookEx
                      PID:2960
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2256
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-35133.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-35133.exe
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1812
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-30146.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-30146.exe
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:2060
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 244
                              9⤵
                              • Program crash
                              PID:2148
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 236
                            8⤵
                            • Program crash
                            PID:2360
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1912
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-7691.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-7691.exe
                            8⤵
                              PID:1032
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-64468.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-64468.exe
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:2548
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-52751.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-52751.exe
                            7⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:2876
                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-59824.exe
                              C:\Users\Admin\AppData\Local\Temp\Unicorn-59824.exe
                              8⤵
                                PID:2964
                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-49087.exe
                              C:\Users\Admin\AppData\Local\Temp\Unicorn-49087.exe
                              7⤵
                                PID:2120
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-44188.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-44188.exe
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:2752
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of SetWindowsHookEx
                            PID:1576
                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe
                              C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:944
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-18413.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-18413.exe
                                7⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:2488
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 240
                                  8⤵
                                  • Program crash
                                  PID:2344
                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-35495.exe
                              C:\Users\Admin\AppData\Local\Temp\Unicorn-35495.exe
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:2800
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
                                7⤵
                                  PID:2444
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-8432.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-8432.exe
                                    8⤵
                                      PID:3252
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-52927.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-52927.exe
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:968
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-35325.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-35325.exe
                                  6⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2476
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-42206.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-42206.exe
                                    7⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1428
                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-62621.exe
                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-62621.exe
                                      8⤵
                                        PID:1536
                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-21951.exe
                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-21951.exe
                                      7⤵
                                        PID:2176
                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-14172.exe
                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-14172.exe
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:536
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 244
                                        7⤵
                                        • Program crash
                                        PID:2688
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:2448
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-47717.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-47717.exe
                                  4⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:3028
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-14333.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-14333.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2080
                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-3171.exe
                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-3171.exe
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2900
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-2652.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-2652.exe
                                        7⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1044
                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-25870.exe
                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-25870.exe
                                          8⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:496
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-40364.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-40364.exe
                                            9⤵
                                              PID:2240
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-21951.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-21951.exe
                                            8⤵
                                              PID:1748
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-10280.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-10280.exe
                                            7⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1852
                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-6715.exe
                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-6715.exe
                                          6⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1652
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-52367.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-52367.exe
                                            7⤵
                                              PID:3044
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 224
                                                8⤵
                                                • Program crash
                                                PID:1328
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 236
                                              7⤵
                                              • Program crash
                                              PID:3052
                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1636
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
                                            6⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:796
                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-24739.exe
                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-24739.exe
                                              7⤵
                                                PID:3060
                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-54266.exe
                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-54266.exe
                                              6⤵
                                                PID:2664
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-36268.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-36268.exe
                                            4⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2320
                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-56648.exe
                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-56648.exe
                                              5⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2364
                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-56513.exe
                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-56513.exe
                                                6⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2704
                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-41817.exe
                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-41817.exe
                                                  7⤵
                                                    PID:2380
                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
                                                5⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:344
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 344 -s 240
                                                  6⤵
                                                  • Program crash
                                                  PID:2492
                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:1076
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
                                            3⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:2680
                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-31381.exe
                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-31381.exe
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2952
                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
                                                5⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1832
                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
                                                  6⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1124
                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-2268.exe
                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-2268.exe
                                                    7⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2404
                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-36223.exe
                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-36223.exe
                                                      8⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1220
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 224
                                                        9⤵
                                                        • Program crash
                                                        PID:1872
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 236
                                                      8⤵
                                                      • Program crash
                                                      PID:2144
                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-53306.exe
                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-53306.exe
                                                    7⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1844
                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-48532.exe
                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-48532.exe
                                                      8⤵
                                                        PID:1496
                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-31603.exe
                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-31603.exe
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1436
                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-3358.exe
                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-3358.exe
                                                      7⤵
                                                        PID:804
                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1696
                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-33078.exe
                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-33078.exe
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1288
                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
                                                        7⤵
                                                          PID:2496
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 244
                                                            8⤵
                                                            • Program crash
                                                            PID:2836
                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe
                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe
                                                          7⤵
                                                            PID:2080
                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-3394.exe
                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-3394.exe
                                                          6⤵
                                                            PID:2400
                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
                                                        4⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1380
                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-15039.exe
                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-15039.exe
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1224
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 244
                                                            6⤵
                                                            • Program crash
                                                            PID:3016
                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-46077.exe
                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-46077.exe
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1580
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 240
                                                            6⤵
                                                            • Program crash
                                                            PID:568
                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-3347.exe
                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-3347.exe
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2684
                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-47966.exe
                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-47966.exe
                                                        4⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2092
                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-56648.exe
                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-56648.exe
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:704
                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-51469.exe
                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-51469.exe
                                                            6⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2508
                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-28823.exe
                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-28823.exe
                                                              7⤵
                                                                PID:2152
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 224
                                                                  8⤵
                                                                  • Program crash
                                                                  PID:604
                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-42755.exe
                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-42755.exe
                                                                7⤵
                                                                  PID:2024
                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
                                                                6⤵
                                                                  PID:2588
                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
                                                                    7⤵
                                                                      PID:1508
                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:2996
                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-20446.exe
                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-20446.exe
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2352
                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:2076
                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
                                                                    6⤵
                                                                      PID:2700
                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-60073.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-60073.exe
                                                                        7⤵
                                                                          PID:1908
                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-57421.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-57421.exe
                                                                        6⤵
                                                                          PID:936

                                                              Network

                                                              MITRE ATT&CK Matrix

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-31381.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                44a8cd75325639d4aab4369e44d54214

                                                                SHA1

                                                                53e8e2ecaed943c6b1160ed4e08417aefa54e159

                                                                SHA256

                                                                4508bb57194172d74f1d7ff3fcdf0d5c674c74e4a166280d9c027cf425e4f92c

                                                                SHA512

                                                                9bca2f3ffc0b978814cbc052c6b8e3bdad13ca40122e2de615edcbcbb038a4a2a1713e8f2da23a51cd5dc6164af6df22d3efcb4737ec1c0e49213404102e8b1b

                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                858f414d6303e3989b399b85a471fdcf

                                                                SHA1

                                                                d3c4b139b6d333fcdf4191a161b7fa2f7a9ca08c

                                                                SHA256

                                                                0dbdc978adeed8274198faafe2ad550e40724fac5b451e39be34568c48658a7a

                                                                SHA512

                                                                17db40cd52cc79a655e24dbc2a00f5003dc7ad38a56b5964ebffb0a4f8952b52e8f6c4107f1c36e470466c832f3e475afa74a1dc5eabc341f72a6626bbe5f753

                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-47966.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                dee8eb9cb6a8eba56c23a40beb584cec

                                                                SHA1

                                                                3a74fa5ea2b4badee2e1bbfc57af563705f8dc73

                                                                SHA256

                                                                d5bb1f752f1272b26e9644deacfd90c57e984d6ff22c2f87a003e656e75072c2

                                                                SHA512

                                                                bb9c84c81d74cb28a697b3b636f98cb93132b1ea1c6c6a14f4894e74a5502f9fa6ab5981fc5e19a50575b833571077dc74eadc804359a91743470f5e014a5cde

                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-6544.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                6e995dd4d827517566c336b371e580d9

                                                                SHA1

                                                                0c823212ebaec291499498ff1f9cb8a79dfe530a

                                                                SHA256

                                                                d3a2feccf48136cd9af3bed01693791ff4f5e4bc95a845fa48a74b613ad996e2

                                                                SHA512

                                                                0d0b774b9288b6d2374676490253c68a861956864de9af596021d168a25ef83503704fc19de016eba5d98f6a9b5cf58a621110a37a5dd144ce53ce00f156d788

                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-8432.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                9f83bf3062e14ab57316584db5a98fa0

                                                                SHA1

                                                                67b74c1a0da184d9263640ad176f07d85416174c

                                                                SHA256

                                                                9cc6e7d93ed6d8a7c0b8b9de84723b7a5b957ab38abda3594249771383790750

                                                                SHA512

                                                                83d782a8518130ec9697f2fe095e028194b32a6f2ccd65423f9ade2cc356392c27a1ef3373bc01b9fc21e7836e2943062082f0e65c73037d97f666a5288f92ab

                                                              • \Users\Admin\AppData\Local\Temp\Unicorn-11515.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                86c861f6a78eef70f543b04e9120f78b

                                                                SHA1

                                                                fc98a7aac10d3c7f02a6c55a77df513bd4c2d6dc

                                                                SHA256

                                                                dce4ca16ea612b54e02b4bdc50b2bdd09a3b1ed219b34e0efe46d64a0edff369

                                                                SHA512

                                                                b1a7a114785d118c00cf3536a072c9f11f27f3db9781a1a7860ebed198a9636ebd6910539e86dd780ea3fe0ef2a76dc4bb4cfb815d1d6656500e72aac6e71b42

                                                              • \Users\Admin\AppData\Local\Temp\Unicorn-14141.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                690222ccfb390f86b24fc05017ead63d

                                                                SHA1

                                                                7c02207ffc36231484621cdd870e528fdd681c00

                                                                SHA256

                                                                4c3609920b0452e8a0c98b338c1aeadcfe84988e098d169f5264a9a32c77de3c

                                                                SHA512

                                                                b2bdc86914b9b1dc693b5825147891788185ef3a4fd110b8e36acc77224ed76836ee2c57f59914c8ca7ead8425093d1ac9daa0fc11d0b8daa5530c440ce3afc6

                                                              • \Users\Admin\AppData\Local\Temp\Unicorn-14333.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                b242179307a942f20f5ef23783605544

                                                                SHA1

                                                                8b9f34331bce33c3288d3749a0142e0cdde4f417

                                                                SHA256

                                                                7709466b199bf4066c44337b97a89e662c327f8429b4d2cd9de6c75b069cb47c

                                                                SHA512

                                                                750dbda09d7430da4b7ca5b1317f3d96dab1b297db29624742fbc40542f77175ba19bddea99307388d39bae048c069d7e3bde5b2e14361e9614c4f364671629e

                                                              • \Users\Admin\AppData\Local\Temp\Unicorn-18937.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                bcbcd24fc6ad912ce326fa628906f712

                                                                SHA1

                                                                f6b5f725bd9912ecd0729f68429c1aa63798d342

                                                                SHA256

                                                                9058949a326266e3b9cd7179be443467f85a21e42af6c823bf44936eb02280db

                                                                SHA512

                                                                16b2c2dda7bd50e7a5a0dc8d19f30e5037b1088e9601c216c242fc3a0f4a3904c24654bf08bdfff42cc1fe6e2ef96e6c84b4f2ec0d09faa94e85d9ec7c8fe2c7

                                                              • \Users\Admin\AppData\Local\Temp\Unicorn-20805.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                6856c8966638e1d3ad470b6c3af57f82

                                                                SHA1

                                                                374e8061e9877862800e1d8d6a71c76e9738e41e

                                                                SHA256

                                                                5bf5a66f0ae05b2af139692070d5408ffb77b8b9cb52d0f23feceac10c1d9054

                                                                SHA512

                                                                2da49fe86d69238ed0dda1142b249299a7c122b4e48ef9b04e6121df97961a9379b656d1203890ae1b6f3f3bd66e2ee9f274c4b6f4db13379f498f78e1c2b9b5

                                                              • \Users\Admin\AppData\Local\Temp\Unicorn-27852.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                317206f99734826918883ab3e5cd7ee4

                                                                SHA1

                                                                a7427cf84262cad2c0b6d78467e9871db8979775

                                                                SHA256

                                                                d8cd7a997b778d8d160d89f7ee92906c49c02788be5c02b455a17c50dd685f3c

                                                                SHA512

                                                                97fc99a84055fb22d5782c8c9fb0c3019997df8b4733513c106797ae07323584d35347e070ff84f1f2cc1b8b4f6b5c21f662587da3812f446b96eccc9be8b2f8

                                                              • \Users\Admin\AppData\Local\Temp\Unicorn-30670.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                8866bb79a06f6f6fb35679bfa7f8d939

                                                                SHA1

                                                                73b60023f4edbc43c04642d1755506b7823c4474

                                                                SHA256

                                                                7275586fa80353fe41bb00d946e838b6e2b68356bb535d57dc70c119dc117825

                                                                SHA512

                                                                f13548c6b49adbfa253312b286bed5cce349cb145170b54a31cc391ac54dd7e1595908593f78d8e2c1112e350113dda526c2fcc731076a4ad092fa56350d0acc

                                                              • \Users\Admin\AppData\Local\Temp\Unicorn-3347.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                1595d816bc734f9345e05e4c7ae3d0d2

                                                                SHA1

                                                                87c2e46868f0e02c40c12624d04f01ea2035aa0b

                                                                SHA256

                                                                22f3d4c36e580cc18b6fef334763a6252465897861f732318eb6f1efc33f0374

                                                                SHA512

                                                                d02d213e4b9d86dda705aa021db878c23e61c16d0a9b649ccf5a2df692fab683b613594379f95cf6b1365bcf5df49f3debb6912811e9c431f177ba6083e3bb68

                                                              • \Users\Admin\AppData\Local\Temp\Unicorn-36268.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                7858815221dd4a26f0dfbf36db091207

                                                                SHA1

                                                                49788a722119860bec5a7d774b939a0971b7d326

                                                                SHA256

                                                                5cdd7fe5f58d4f6158ccfca3fc2f9a1bfd0d5c53623817651a5fd262b5f0b7f7

                                                                SHA512

                                                                4d26f3ed7715dd54c30927ada63b8f543a386a67f880a8778f10254157506e05e2833ae0a6c834bcd2dcb4bdc54c3f732a1a77d29c044b3ea063df16b0cd1d93

                                                              • \Users\Admin\AppData\Local\Temp\Unicorn-37499.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                745ddaf3639a6759b7073bc2429620a5

                                                                SHA1

                                                                6f77864f6999fb346730e44df4b51084417f07df

                                                                SHA256

                                                                43e71f8b6f30835f3ce20743aa8fc36bcda2015f34039a9881cef4c41927211e

                                                                SHA512

                                                                e7290fc44aa3b71e11b298af69ed21cb8e964ecfc31fe49a9ff68972e7385e9eccd8974764ed5a8274cb1263844ab69b9d53fcd57334b0bcc4e70e75411b4e3b

                                                              • \Users\Admin\AppData\Local\Temp\Unicorn-39392.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                4af892134b9243cdc41c0329467673d3

                                                                SHA1

                                                                bf18092773877551e07839019609fbc0ace670ac

                                                                SHA256

                                                                111a5f562ca6ddc6d05648e2dfaeed7610e4adb4bafd0c3c8517097499eaf59a

                                                                SHA512

                                                                93382bc02c422810da04e7fc73821b47deda0acc2fba525d07570a25a5763e6024aa56be9be0133f64ec538d60841e1447e438c1561545db57bb8de59301e5bc

                                                              • \Users\Admin\AppData\Local\Temp\Unicorn-44188.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                8742ee7086ea35c00b9e4667352ac255

                                                                SHA1

                                                                21f53538c42cec817a630aa812961f4756968621

                                                                SHA256

                                                                de65141b77df000f999a68e8cbabfd642ef8ff961d94f608c71338aded7786d2

                                                                SHA512

                                                                f1d1aa69078082c5634c8308a27c5614de83b8233f9803c4d7584bc24427c893cf21f3c27b063829ca41e8aae8822c32c17888865f46fc05f28e82ab29dda82a

                                                              • \Users\Admin\AppData\Local\Temp\Unicorn-44951.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                3a365b92d21b5496a4cf429c3f789f67

                                                                SHA1

                                                                308f4e9972ba7bfd5f8053ce2ac499567a8b42aa

                                                                SHA256

                                                                91dc1cef86325737335f830c03c711bdbc8a6b8e368835f35e0f6dc1eadacd2b

                                                                SHA512

                                                                c3096b309cd4c2dbf41c706336ef1cbb042a86f971941994b63d35b9f4d6fe1a84a8905aff47a2dc571d9f277270f5a731bc45d24be4cd0ac6c220b33eee1efe

                                                              • \Users\Admin\AppData\Local\Temp\Unicorn-47717.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                029ad51988bc0eec0805f67d2225a2eb

                                                                SHA1

                                                                5ff94ca1df9e9614f938d25dc8096c8dbd49cfac

                                                                SHA256

                                                                6c59c3213613160df5da6635ec6f05739cc89effb43146f0998807dc295f4719

                                                                SHA512

                                                                5db3778dc9fa7336472798d0db18ce594ea933db3683cb1f65d61ad8fa1f3e5fd46f892acaa8a0233ce6b38a1359b13ce1b93b84028cdccbbddeceece921f4f1

                                                              • \Users\Admin\AppData\Local\Temp\Unicorn-65355.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                e90a54619b3266081458daaba2688e70

                                                                SHA1

                                                                ce6edc3ce2a69cb21dd1945feb8f1a7aa4611680

                                                                SHA256

                                                                d1564b430321da6977472689c74ac01a98ec3cabea5a0063aafe208180b0979f

                                                                SHA512

                                                                d80c16654d456ae5f8022951b64ec24004cb82f88ad1871046d644b733377cf00003eb9b7cc567cfa38b00dd1ec430905eeb00de977a321334d6585d86257202

                                                              • \Users\Admin\AppData\Local\Temp\Unicorn-9465.exe

                                                                Filesize

                                                                184KB

                                                                MD5

                                                                52d8fd308e2de7c8fd21acd58fa38a76

                                                                SHA1

                                                                a9d3f072eac8f290ea0fe3680ab87b96157ae619

                                                                SHA256

                                                                61096e27ecfd765ab69f381a8a3fe5174448e87030cb9d47737f5456203f5dec

                                                                SHA512

                                                                2466d2512ea503dac0b8d9528d09a314efa40efd6ed3ad2bb58e05bb7d7fe2a3ae3c39198f30a41efde637eb5d708db2918e40425173279c5df1cdd67dc09a28