Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14/02/2024, 04:07
Static task
static1
Behavioral task
behavioral1
Sample
9ab6da0d16bcd9ecf04c3e9e98267bdc.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
9ab6da0d16bcd9ecf04c3e9e98267bdc.exe
Resource
win10v2004-20231222-en
General
-
Target
9ab6da0d16bcd9ecf04c3e9e98267bdc.exe
-
Size
184KB
-
MD5
9ab6da0d16bcd9ecf04c3e9e98267bdc
-
SHA1
dfa22e8bcd844190a885354cabf6259eae4e1be7
-
SHA256
1c6e5ed2422a228808e14e2879dc93fe2dc4076723790b3fed00e1e57cef80af
-
SHA512
1b02793a7dbb3aeb89bc3bc7c3825e34627c8c61d7b8d722457b34d7831cb4daa97c0cec73b87f327984bf479b71d8d469ce1216a1d30ca09ea5b7181c333556
-
SSDEEP
3072:v0CYomu+Nsr3tOjRo3yK6J+LQrTMC2ZPZxxvLFvg9lvvpFB:v0poyW3tGoiK6J3Kl69lvvpF
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1824 Unicorn-49181.exe 772 Unicorn-54529.exe 2092 Unicorn-51000.exe 2648 Unicorn-26434.exe 2336 Unicorn-58530.exe 2700 Unicorn-7061.exe 2516 Unicorn-64851.exe 3024 Unicorn-61514.exe 1396 Unicorn-31795.exe 1632 Unicorn-65536.exe 2444 Unicorn-45671.exe 2180 Unicorn-18801.exe 1988 Unicorn-63595.exe 1652 Unicorn-34753.exe 2156 Unicorn-50705.exe 2320 Unicorn-31031.exe 1268 Unicorn-57441.exe 1168 Unicorn-54104.exe 696 Unicorn-24769.exe 2008 Unicorn-43186.exe 2060 Unicorn-10513.exe 1552 Unicorn-39848.exe 764 Unicorn-22936.exe 1324 Unicorn-25506.exe 1076 Unicorn-41301.exe 240 Unicorn-41301.exe 2332 Unicorn-61167.exe 2976 Unicorn-61167.exe 2160 Unicorn-22686.exe 1344 Unicorn-2820.exe 2364 Unicorn-22686.exe 2380 Unicorn-2820.exe 1732 Unicorn-54766.exe 1776 Unicorn-9094.exe 3060 Unicorn-44082.exe 940 Unicorn-3642.exe 2788 Unicorn-3642.exe 2804 Unicorn-20280.exe 772 Unicorn-36507.exe 2892 Unicorn-41598.exe 3044 Unicorn-6759.exe 1504 Unicorn-17980.exe 1496 Unicorn-17980.exe 2336 Unicorn-55051.exe 2004 Unicorn-58601.exe 1232 Unicorn-4657.exe 1768 Unicorn-25408.exe 2128 Unicorn-64982.exe 2704 Unicorn-31215.exe 2832 Unicorn-55138.exe 2272 Unicorn-42523.exe 2020 Unicorn-57873.exe 2980 Unicorn-63768.exe 2360 Unicorn-47432.exe 2588 Unicorn-27505.exe 3000 Unicorn-10592.exe 2180 Unicorn-59793.exe 2736 Unicorn-59409.exe 2920 Unicorn-23207.exe 2828 Unicorn-26737.exe 944 Unicorn-18974.exe 2516 Unicorn-11853.exe 2592 Unicorn-32845.exe 2656 Unicorn-16186.exe -
Loads dropped DLL 64 IoCs
pid Process 2392 9ab6da0d16bcd9ecf04c3e9e98267bdc.exe 2392 9ab6da0d16bcd9ecf04c3e9e98267bdc.exe 1824 Unicorn-49181.exe 1824 Unicorn-49181.exe 2392 9ab6da0d16bcd9ecf04c3e9e98267bdc.exe 2392 9ab6da0d16bcd9ecf04c3e9e98267bdc.exe 2092 Unicorn-51000.exe 2092 Unicorn-51000.exe 772 Unicorn-54529.exe 772 Unicorn-54529.exe 1824 Unicorn-49181.exe 1824 Unicorn-49181.exe 2648 Unicorn-26434.exe 2648 Unicorn-26434.exe 2092 Unicorn-51000.exe 2092 Unicorn-51000.exe 2336 Unicorn-58530.exe 2336 Unicorn-58530.exe 2700 Unicorn-7061.exe 772 Unicorn-54529.exe 2700 Unicorn-7061.exe 772 Unicorn-54529.exe 2516 Unicorn-64851.exe 2516 Unicorn-64851.exe 2648 Unicorn-26434.exe 2648 Unicorn-26434.exe 3024 Unicorn-61514.exe 3024 Unicorn-61514.exe 1396 Unicorn-31795.exe 1396 Unicorn-31795.exe 2336 Unicorn-58530.exe 2336 Unicorn-58530.exe 2444 Unicorn-45671.exe 2444 Unicorn-45671.exe 1632 Unicorn-65536.exe 1632 Unicorn-65536.exe 2700 Unicorn-7061.exe 2700 Unicorn-7061.exe 1804 WerFault.exe 1804 WerFault.exe 1804 WerFault.exe 1804 WerFault.exe 1804 WerFault.exe 2180 Unicorn-18801.exe 2180 Unicorn-18801.exe 1652 Unicorn-34753.exe 1652 Unicorn-34753.exe 3024 Unicorn-61514.exe 3024 Unicorn-61514.exe 2516 Unicorn-64851.exe 2516 Unicorn-64851.exe 2320 Unicorn-31031.exe 2320 Unicorn-31031.exe 1396 Unicorn-31795.exe 2444 Unicorn-45671.exe 1396 Unicorn-31795.exe 2444 Unicorn-45671.exe 1268 Unicorn-57441.exe 2156 Unicorn-50705.exe 2156 Unicorn-50705.exe 1268 Unicorn-57441.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe -
Program crash 4 IoCs
pid pid_target Process procid_target 1804 1632 WerFault.exe 38 2216 696 WerFault.exe 43 1608 240 WerFault.exe 53 2824 1076 WerFault.exe 54 -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2392 9ab6da0d16bcd9ecf04c3e9e98267bdc.exe 1824 Unicorn-49181.exe 2092 Unicorn-51000.exe 772 Unicorn-54529.exe 2648 Unicorn-26434.exe 2336 Unicorn-58530.exe 2700 Unicorn-7061.exe 2516 Unicorn-64851.exe 3024 Unicorn-61514.exe 1396 Unicorn-31795.exe 2444 Unicorn-45671.exe 1632 Unicorn-65536.exe 1988 Unicorn-63595.exe 2180 Unicorn-18801.exe 1652 Unicorn-34753.exe 2156 Unicorn-50705.exe 2320 Unicorn-31031.exe 1268 Unicorn-57441.exe 696 Unicorn-24769.exe 1168 Unicorn-54104.exe 2008 Unicorn-43186.exe 2060 Unicorn-10513.exe 764 Unicorn-22936.exe 240 Unicorn-41301.exe 1324 Unicorn-25506.exe 2976 Unicorn-61167.exe 2364 Unicorn-22686.exe 2380 Unicorn-2820.exe 1732 Unicorn-54766.exe 1076 Unicorn-41301.exe 3060 Unicorn-44082.exe 2332 Unicorn-61167.exe 2160 Unicorn-22686.exe 1344 Unicorn-2820.exe 1776 Unicorn-9094.exe 940 Unicorn-3642.exe 2804 Unicorn-20280.exe 2892 Unicorn-41598.exe 2788 Unicorn-3642.exe 1504 Unicorn-17980.exe 3044 Unicorn-6759.exe 2336 Unicorn-55051.exe 772 Unicorn-36507.exe 1232 Unicorn-4657.exe 1496 Unicorn-17980.exe 2004 Unicorn-58601.exe 1768 Unicorn-25408.exe 2128 Unicorn-64982.exe 2704 Unicorn-31215.exe 2832 Unicorn-55138.exe 2272 Unicorn-42523.exe 2020 Unicorn-57873.exe 2980 Unicorn-63768.exe 2360 Unicorn-47432.exe 2920 Unicorn-23207.exe 2180 Unicorn-59793.exe 3000 Unicorn-10592.exe 2736 Unicorn-59409.exe 2828 Unicorn-26737.exe 2588 Unicorn-27505.exe 944 Unicorn-18974.exe 2516 Unicorn-11853.exe 2592 Unicorn-32845.exe 2656 Unicorn-16186.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2392 wrote to memory of 1824 2392 9ab6da0d16bcd9ecf04c3e9e98267bdc.exe 28 PID 2392 wrote to memory of 1824 2392 9ab6da0d16bcd9ecf04c3e9e98267bdc.exe 28 PID 2392 wrote to memory of 1824 2392 9ab6da0d16bcd9ecf04c3e9e98267bdc.exe 28 PID 2392 wrote to memory of 1824 2392 9ab6da0d16bcd9ecf04c3e9e98267bdc.exe 28 PID 1824 wrote to memory of 772 1824 Unicorn-49181.exe 29 PID 1824 wrote to memory of 772 1824 Unicorn-49181.exe 29 PID 1824 wrote to memory of 772 1824 Unicorn-49181.exe 29 PID 1824 wrote to memory of 772 1824 Unicorn-49181.exe 29 PID 2392 wrote to memory of 2092 2392 9ab6da0d16bcd9ecf04c3e9e98267bdc.exe 30 PID 2392 wrote to memory of 2092 2392 9ab6da0d16bcd9ecf04c3e9e98267bdc.exe 30 PID 2392 wrote to memory of 2092 2392 9ab6da0d16bcd9ecf04c3e9e98267bdc.exe 30 PID 2392 wrote to memory of 2092 2392 9ab6da0d16bcd9ecf04c3e9e98267bdc.exe 30 PID 2092 wrote to memory of 2648 2092 Unicorn-51000.exe 31 PID 2092 wrote to memory of 2648 2092 Unicorn-51000.exe 31 PID 2092 wrote to memory of 2648 2092 Unicorn-51000.exe 31 PID 2092 wrote to memory of 2648 2092 Unicorn-51000.exe 31 PID 772 wrote to memory of 2336 772 Unicorn-54529.exe 32 PID 772 wrote to memory of 2336 772 Unicorn-54529.exe 32 PID 772 wrote to memory of 2336 772 Unicorn-54529.exe 32 PID 772 wrote to memory of 2336 772 Unicorn-54529.exe 32 PID 1824 wrote to memory of 2700 1824 Unicorn-49181.exe 33 PID 1824 wrote to memory of 2700 1824 Unicorn-49181.exe 33 PID 1824 wrote to memory of 2700 1824 Unicorn-49181.exe 33 PID 1824 wrote to memory of 2700 1824 Unicorn-49181.exe 33 PID 2648 wrote to memory of 2516 2648 Unicorn-26434.exe 34 PID 2648 wrote to memory of 2516 2648 Unicorn-26434.exe 34 PID 2648 wrote to memory of 2516 2648 Unicorn-26434.exe 34 PID 2648 wrote to memory of 2516 2648 Unicorn-26434.exe 34 PID 2092 wrote to memory of 3024 2092 Unicorn-51000.exe 35 PID 2092 wrote to memory of 3024 2092 Unicorn-51000.exe 35 PID 2092 wrote to memory of 3024 2092 Unicorn-51000.exe 35 PID 2092 wrote to memory of 3024 2092 Unicorn-51000.exe 35 PID 2336 wrote to memory of 1396 2336 Unicorn-58530.exe 36 PID 2336 wrote to memory of 1396 2336 Unicorn-58530.exe 36 PID 2336 wrote to memory of 1396 2336 Unicorn-58530.exe 36 PID 2336 wrote to memory of 1396 2336 Unicorn-58530.exe 36 PID 2700 wrote to memory of 1632 2700 Unicorn-7061.exe 38 PID 2700 wrote to memory of 1632 2700 Unicorn-7061.exe 38 PID 2700 wrote to memory of 1632 2700 Unicorn-7061.exe 38 PID 2700 wrote to memory of 1632 2700 Unicorn-7061.exe 38 PID 772 wrote to memory of 2444 772 Unicorn-54529.exe 37 PID 772 wrote to memory of 2444 772 Unicorn-54529.exe 37 PID 772 wrote to memory of 2444 772 Unicorn-54529.exe 37 PID 772 wrote to memory of 2444 772 Unicorn-54529.exe 37 PID 2516 wrote to memory of 2180 2516 Unicorn-64851.exe 39 PID 2516 wrote to memory of 2180 2516 Unicorn-64851.exe 39 PID 2516 wrote to memory of 2180 2516 Unicorn-64851.exe 39 PID 2516 wrote to memory of 2180 2516 Unicorn-64851.exe 39 PID 2648 wrote to memory of 1988 2648 Unicorn-26434.exe 40 PID 2648 wrote to memory of 1988 2648 Unicorn-26434.exe 40 PID 2648 wrote to memory of 1988 2648 Unicorn-26434.exe 40 PID 2648 wrote to memory of 1988 2648 Unicorn-26434.exe 40 PID 3024 wrote to memory of 1652 3024 Unicorn-61514.exe 41 PID 3024 wrote to memory of 1652 3024 Unicorn-61514.exe 41 PID 3024 wrote to memory of 1652 3024 Unicorn-61514.exe 41 PID 3024 wrote to memory of 1652 3024 Unicorn-61514.exe 41 PID 1396 wrote to memory of 2156 1396 Unicorn-31795.exe 42 PID 1396 wrote to memory of 2156 1396 Unicorn-31795.exe 42 PID 1396 wrote to memory of 2156 1396 Unicorn-31795.exe 42 PID 1396 wrote to memory of 2156 1396 Unicorn-31795.exe 42 PID 2336 wrote to memory of 2320 2336 Unicorn-58530.exe 46 PID 2336 wrote to memory of 2320 2336 Unicorn-58530.exe 46 PID 2336 wrote to memory of 2320 2336 Unicorn-58530.exe 46 PID 2336 wrote to memory of 2320 2336 Unicorn-58530.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ab6da0d16bcd9ecf04c3e9e98267bdc.exe"C:\Users\Admin\AppData\Local\Temp\9ab6da0d16bcd9ecf04c3e9e98267bdc.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49181.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-54529.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54529.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-58530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58530.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31795.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-50705.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50705.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-61167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61167.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-25408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25408.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe10⤵PID:2112
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe9⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44016.exe10⤵PID:2752
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41301.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1076 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 2007⤵
- Program crash
PID:2824
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-25506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25506.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-44082.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44082.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:772 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-8252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8252.exe10⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47871.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47871.exe11⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31820.exe12⤵PID:1724
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe10⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe11⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7117.exe12⤵PID:1540
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5984.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5984.exe9⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe10⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe11⤵PID:2848
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45671.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45671.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-57441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57441.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-61167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61167.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-41598.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41598.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-55051.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55051.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-58601.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58601.exe10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-24179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24179.exe12⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17036.exe13⤵PID:1628
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe12⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4633.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4633.exe13⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58946.exe14⤵PID:2504
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5121.exe13⤵PID:3044
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe11⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23004.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23004.exe12⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65526.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65526.exe13⤵PID:948
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41301.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:240 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 2006⤵
- Program crash
PID:1608
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7061.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7061.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-65536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65536.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:696 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 2406⤵
- Loads dropped DLL
- Program crash
PID:2216
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 2365⤵
- Loads dropped DLL
- Program crash
PID:1804
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54104.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-54766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54766.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:940 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe9⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12038.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12038.exe10⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe11⤵PID:692
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55344.exe10⤵PID:2452
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exe8⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29169.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29169.exe9⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49273.exe10⤵PID:1348
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46045.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46045.exe9⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62999.exe10⤵PID:1528
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51000.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51000.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-26434.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26434.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-64851.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64851.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-18801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18801.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43186.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe9⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50860.exe10⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12111.exe11⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63025.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63025.exe12⤵PID:2828
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43351.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43351.exe11⤵PID:2572
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30610.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30610.exe9⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17815.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17815.exe10⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe11⤵PID:2580
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54417.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54417.exe8⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe9⤵PID:1548
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2820.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-59409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59409.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe8⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe9⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45962.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45962.exe10⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe11⤵PID:2148
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exe10⤵PID:1956
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22614.exe9⤵PID:1968
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53657.exe8⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe9⤵PID:2376
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exe7⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46216.exe8⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7970.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7970.exe9⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19263.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19263.exe10⤵PID:2864
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65043.exe9⤵PID:2212
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe8⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7633.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7633.exe9⤵PID:1116
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22936.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22936.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:764 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-9094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9094.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31215.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31215.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-26737.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26737.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-25139.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25139.exe9⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40850.exe10⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43689.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43689.exe11⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe12⤵PID:840
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59112.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59112.exe11⤵PID:1780
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exe9⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29242.exe10⤵PID:1772
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41126.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41126.exe8⤵PID:1096
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63595.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-42523.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42523.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-32845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32845.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-33398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33398.exe7⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20311.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20311.exe8⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25480.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25480.exe9⤵PID:2852
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13148.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13148.exe6⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe7⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe8⤵PID:1176
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30149.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30149.exe7⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31998.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31998.exe8⤵PID:2160
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-533.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-533.exe6⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48878.exe7⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8930.exe8⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29201.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29201.exe9⤵PID:600
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe7⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe8⤵PID:2816
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57710.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57710.exe6⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17343.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17343.exe7⤵PID:1104
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61514.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61514.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-34753.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34753.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-10513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10513.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22686.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-4657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4657.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-64982.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64982.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-59793.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59793.exe10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-26208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26208.exe11⤵PID:2716
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24790.exe10⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39179.exe11⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11369.exe12⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25890.exe13⤵PID:108
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39080.exe12⤵PID:2472
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exe11⤵PID:1728
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23207.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23207.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe10⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44929.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44929.exe11⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe12⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15854.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15854.exe13⤵PID:2880
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60949.exe12⤵PID:2896
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7767.exe10⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31759.exe11⤵PID:3036
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2820.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20280.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20280.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-55138.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55138.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-18974.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18974.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:944 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-11599.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11599.exe10⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe11⤵PID:2356
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57079.exe9⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4524.exe10⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe11⤵PID:2856
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53305.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53305.exe10⤵PID:1504
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11853.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11853.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe9⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15854.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15854.exe10⤵PID:1004
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39848.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39848.exe4⤵
- Executes dropped EXE
PID:1552
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD5e79a676f8b89c606c9af5e2a97414cd1
SHA13e988a973b8854e2a140c0bc61e34c5841370d67
SHA256cb203bf14483b03b3b2aa1f55684c41cca0d22a49163680ef26ed7d94d0fc587
SHA5121e8fb822f326e1ca6695b997169ae568c6b0abd6444097260123d485914fe599fae93b342a4e39651f2ccd47741dc840a12152ec598969fa6506337c7d71f02f
-
Filesize
184KB
MD5efb23a76a53478df6e6381a340252440
SHA1341c60b6a6cf56eaba67414e49c889deb5cd7f1f
SHA256cba068ddbf8423edf4c06ec1484243272a7da7f333b550a4b87945d2349751c0
SHA51243740af2fcef599ff5332f7cedffa6b2e1c2c2656e383d9d5b2b7dc81f03e8aa8db5c2f7c9d3d5b80ddb8add31a53a2e405912e46230e616bc39741c39cbaf2b
-
Filesize
184KB
MD5cb880e6da9c9fd4ba3f09af96af489ed
SHA15963e30442d8c22378eff59fd51c2bcfe93d9737
SHA256875f5b1de2b125bc64ce639495eb04cda2acbd2dd9561339ac01d1d3208060e3
SHA51258d121aafb81b6a0e2fff075eef7175dfa70d31f8707b850effe55c50c0bcce880b6606e3c7da1de57287c133d8bd198f6e07cd1b84c2baf84c6d5ab077f7ab3
-
Filesize
128KB
MD56fbd3ecc99bf4bd8d6151bfd4b393543
SHA10d4adcf847d140c42fbeedf91415ba6ba1b3cefc
SHA25696ed8351170c80acb89b78a6dd3862f7c284ee989d6252c7dfc6e2500f2a4d2c
SHA5129b530a8bacc6e2cdaff5724bf201a02e5c375b5a8c9e71e24eb25d1d7cb411aca2ab4c411372746974e763ef1cca0e8aac9775e548dddd8a136ba04f1a8fcf12
-
Filesize
184KB
MD57c06c92e4f6b4651e46c649f5cd237f1
SHA14f54595dc69674ba2d7f01783a3ae9444eccda23
SHA2565d94313d80f9f0e44dafbe75917e8848aecb79230562f0b49e4a98c029463fb3
SHA5129366b09b5d57305138bdb3ff733abb67cb17b349c8efaae63ee86faf1cd06ec5cf9da9721f5c78274502b0a450dfd4d0ca75ef943c7dfca951392c56a11181ec
-
Filesize
184KB
MD59e8a2a19d97425784297d23de4a91498
SHA1fe6772943ad7af9355bebeeff970dd320e162bcc
SHA2565f3aca691e9b6670676216574daf3ed550b5d5306314f1f84daee8b2e653920e
SHA5125f6cbc7779d6b7c6cd8cea552acafdad52f270fb84150035c74584c7fcb472f30434704175940e75d4a92921f28ff12142769e3a4448508e06e0f610871cde21
-
Filesize
184KB
MD5bea9966915423d7f15862f0eec189c9d
SHA1d7d1cce935b72000b001f1dcbcd7b9f37d54e6a1
SHA2569be8d5217cc4ddfb3988913c5cd4c1098027ca597b9ee429989692ddeafb3925
SHA512874826218c605f4775b322dfde23e1ffc9c53e17a29d89a24de5c6366a0d6cde58f357ff3ffc12299d9157b0dd00bff6b84eb438a511a98eb108a57829b2d5ce
-
Filesize
184KB
MD5b77cc1513c8157e1d2e471e75034b653
SHA1fa8461754ffca02cf1199758f68881dec47cf5df
SHA25659bcd92ae114d957389b4da807132356435c9e4081024e19a363ab82c3c8e1e8
SHA5129b8560fbd2de49095e7f34a53b2e5b3bd166563d18439ec18ecdf40258e88c0a2e6ca612ec58e5338d7282991abec08908d2b4ce4355ec4db1974a97635b3b87
-
Filesize
184KB
MD54d3c9f32d09ab7aacf2b0cd675e7caa0
SHA19edb8a158b9a06bc2c2094ae58fd198d32a1276d
SHA256b98435c8812a304209ba732d125a6e69588ff8561bef717935b84f5ebc780c39
SHA5129a8ac99fbe6af83e7bee41d0fa2364e0247fb36c0f92ceff27c1156e03680e05ada22451f829a76af30f7641684a8b76793dcd9a7e3c150d5d85a6d37fdde082
-
Filesize
184KB
MD535423021141c11ba3ec1697768d07bb6
SHA1bc829bb11e573e3e2455b5f81db221745d23a49a
SHA2563a5e24c6e0bbea829dd1ea678d69f5b8469d497916d40293ab19b2c5f1130396
SHA512231e1bf1b9ad6b0148f2145ef7bdc8e22dabd252754803c8364ef320fbfc0dcc433877ddb244d52d6ebbc6ae3cd9f1358901ba56cc6ce3277b5798b7c7a132b4
-
Filesize
184KB
MD58bf7916b1100c2df80bfa7e941454229
SHA101ce44a8525660a82099d89a65e127378e5514fd
SHA256b6bc7e2f6f7a065be71ec7df8abd9ac37a6f25cc047f2a378c4a15c6869f2e43
SHA5123ca72edcf893891d4e9cbfe1fe016d1b1dbf41b214b1afc702cb5716a21011206906ed7e7d98b4516f3171b5960000dcc216f4736ab9a76004934d243917b55f
-
Filesize
184KB
MD5795b0078e83a7e1de1b00386e9f55dc7
SHA1bc44eb7ca3790d861bc8202e314da64068566c81
SHA256eb7fe1e4f36d3ed0e6e00517f34fc82016fe430cdfe0ef1a9707de6a074af95b
SHA5122f176b12ee4c6fe2d30c174bf409b9dcb525a6c007428700da8f1e8c351f64add599d2217f905839b2e569c38735ade72f8ebb091969dff2357ed892b54c4c21
-
Filesize
184KB
MD5c0539097574f7fb88a347a87e3ff4895
SHA186ee9fdc0bda21a663ebbb3a0d20f79aa0629e0d
SHA256aea5995339c68f17b60d0589a9a0688f0f7c3e38fb2b9bb0b1dd4b03953c0b19
SHA512cc8129788fa2c50103281d85232eafe1ce95f7a49da69a9e516e96229967dc103c22759d02c069c683015c22af5ecd0a2c361cd02956225d263c05ba4534c742
-
Filesize
184KB
MD59b96157b6ea9f1369dd10ab60e6af452
SHA176b78f23748d8fd1365300af7ec7daac74ceb210
SHA25616c63b3b0e0c3e26d2b8a71bfc4d4f7a3beff9b222846068f2cfea973a2bf5db
SHA5121fa4e8c79c63c64bdb554a1f4b6ea95496640b2e5cd390362761bea06e3cc31df3cf392d1566e45d75ca99e8cf45f1e69633d4a2727d4df6d740a145653672b7
-
Filesize
184KB
MD5c847c2460157c5ea6630143598bcaa9a
SHA17a9603409c0c347669a829706e8b4b89567af528
SHA25694beee12550a0a3432c1ce49c491c789632154440df49df9d9daac0ef9142b86
SHA5126a4d311d3ca25d67903ab0ab74c0fa07f7aea3f263f902aea9af38b76b2d54552eadbe50248a1bd143b7d172f15d1a0dda3eb6039536cd2b1352452219fa7b1d
-
Filesize
184KB
MD5977a2bd1ba21de53e8e7eeb1171fc59b
SHA1c892d11060545e3e6a5df2040b8a47138b9dad65
SHA256f595276d76de4b11b0d11535f0dee53293150b25c6ac17f55c0b918861444dfe
SHA512d60217bbede97aa1f44ecea4226d982ab7fb2b754e73357c8cc0aedefd99e8c1423beeab89fc34a1bb7ea763eeb1cda791e4d097eed44cc2c1c62350a28d31bc
-
Filesize
184KB
MD5a2feb8598ad6046db1d5c64f8f4d592a
SHA199e4a974dbe49dc6e68089e7658f25bcfdffbb62
SHA256644b3b8d1fab767a9d4de4fa97db9cd7c84668cce484836e5fc8e8d7be5b1baa
SHA512d38461d6bb19a0e1b486efa5b11f5b53a09469270aa7ada474922094132269071e974f34e8752e2178ea5d717c9610b3291af8f30b9bb9047e56855b7086e813
-
Filesize
184KB
MD569a27c7f4a696aab8fb060ba7589ff25
SHA11dc9a5723359f872a044af05f9e51eb90eb7a323
SHA25673c179e27d578b538c24bc06766d2e8121a0864069d69b1e4e2e5568c9422fcf
SHA51284e5bfe6dc15898f5cc3a026c0c87476f6315df292dee22b882be5b8c61c15d90968dca3e6980fbe0a657c028179df8e8334833107b13969f180fe2d5718168f
-
Filesize
184KB
MD52ec616c7d5ff471f157dd1dca0b274ca
SHA12952d01eebd9f9782b6ff43c88288fb0d879acfb
SHA2562f7a0557442e57284a7876cbea1dd7ec51fecdb33e4736dd7fd98e12d9a84d45
SHA5121aa460cfb08b0be7301ed094129524c020d90eaa81dab0ceac95d64a5d79edc34e81bb7e3c5cc3daf10a5c1a401dc93f89abc9b44ccd7d302d3e321a8493350e
-
Filesize
184KB
MD5b31fa9a2fd87255bb7a9f0c3f0a6a650
SHA1a83df1411699c271e3ad176a36467d6cafa9ddd6
SHA256437c749bd04546c3ddf149f84891a16033bfd9bfaae6f2a3b0cc07d3cc342b2c
SHA5122974cdb397c32f9b00a83a323b724f75adf52afc5b3884f73f4f6c35586700867e837a59728c2baf576f93783928827110d28a1cd84dd3f9b2320cb08a38319a
-
Filesize
184KB
MD5ee02b9960b5641e6ca3b0f06eec9d546
SHA12c759e5cd19d266bdc47c647c29078da761dc20b
SHA25618ee986843d8189aaa2eff0ffb5e77b8c2a60f2fd96de679558f57d5bf3549b8
SHA51297a8f1d97f9aca63325e3df5220e0541a7116ad7e6b8d606dc8b8f3ade85cc477967568c5b8fd0862cbdffcddc8a1f2db5e83af883ac9062c97e5704ce682480