Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
83s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 03:44
Static task
static1
Behavioral task
behavioral1
Sample
c79aa71206bcd73752bd584838dfb267.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
c79aa71206bcd73752bd584838dfb267.exe
Resource
win10v2004-20231215-en
General
-
Target
c79aa71206bcd73752bd584838dfb267.exe
-
Size
184KB
-
MD5
c79aa71206bcd73752bd584838dfb267
-
SHA1
2f19df970a59c1c6a95d19786238a59e8b301f54
-
SHA256
64377f087940fc5cbedf0b9245e19ade68af3c210f647f5c7d5269ca9da68428
-
SHA512
b9006ddc003e381649181f02bef2806ba6a240093aa0c7bbe1360b15b8c2547942f6a8736e7e01574e09a91e2f556f45e478499d17b82abf5853c59d9b17ee70
-
SSDEEP
3072:xCRromHxcIAEAmj4Mhc4c8AM5XYMgxXldk7xKDP7yylPvpFo:xChoFpEAHM64c8Y1BCylPvpF
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2800 Unicorn-9232.exe 2544 Unicorn-29980.exe 2700 Unicorn-59123.exe 2436 Unicorn-11962.exe 2540 Unicorn-24769.exe 2412 Unicorn-28491.exe 272 Unicorn-7437.exe 2668 Unicorn-20244.exe 2764 Unicorn-56830.exe 2224 Unicorn-7053.exe 2892 Unicorn-52725.exe 888 Unicorn-52749.exe 1508 Unicorn-19.exe 1984 Unicorn-19501.exe 2092 Unicorn-13963.exe 2504 Unicorn-13122.exe 312 Unicorn-37949.exe 576 Unicorn-16652.exe 2832 Unicorn-45411.exe 2272 Unicorn-55131.exe 2176 Unicorn-23528.exe 3012 Unicorn-3662.exe 292 Unicorn-56008.exe 2160 Unicorn-45147.exe 764 Unicorn-41617.exe 2252 Unicorn-8561.exe 2000 Unicorn-28235.exe 1236 Unicorn-28235.exe 2856 Unicorn-27659.exe 1900 Unicorn-44571.exe 1564 Unicorn-57186.exe 2084 Unicorn-59682.exe 1952 Unicorn-18967.exe 3004 Unicorn-2116.exe 2816 Unicorn-56382.exe 2408 Unicorn-24369.exe 2488 Unicorn-53896.exe 2516 Unicorn-24177.exe 2480 Unicorn-47441.exe 2200 Unicorn-26999.exe 2396 Unicorn-30529.exe 2212 Unicorn-30721.exe 2640 Unicorn-10279.exe 2788 Unicorn-21270.exe 2756 Unicorn-46289.exe 2884 Unicorn-46289.exe 860 Unicorn-60160.exe 2220 Unicorn-26912.exe 1128 Unicorn-40294.exe 1288 Unicorn-23382.exe 2544 Unicorn-10191.exe 1336 Unicorn-6662.exe 2292 Unicorn-52781.exe 2236 Unicorn-32339.exe 588 Unicorn-3196.exe 1012 Unicorn-38173.exe 2844 Unicorn-50596.exe 2360 Unicorn-48588.exe 1648 Unicorn-64275.exe 2568 Unicorn-51468.exe 3036 Unicorn-32911.exe 1500 Unicorn-32261.exe 1692 Unicorn-11525.exe 2140 Unicorn-23564.exe -
Loads dropped DLL 64 IoCs
pid Process 2488 c79aa71206bcd73752bd584838dfb267.exe 2488 c79aa71206bcd73752bd584838dfb267.exe 2800 Unicorn-9232.exe 2800 Unicorn-9232.exe 2488 c79aa71206bcd73752bd584838dfb267.exe 2488 c79aa71206bcd73752bd584838dfb267.exe 2544 Unicorn-29980.exe 2544 Unicorn-29980.exe 2800 Unicorn-9232.exe 2800 Unicorn-9232.exe 2700 Unicorn-59123.exe 2700 Unicorn-59123.exe 2436 Unicorn-11962.exe 2436 Unicorn-11962.exe 2544 Unicorn-29980.exe 2544 Unicorn-29980.exe 2412 Unicorn-28491.exe 2412 Unicorn-28491.exe 2700 Unicorn-59123.exe 2700 Unicorn-59123.exe 2540 Unicorn-24769.exe 2540 Unicorn-24769.exe 272 Unicorn-7437.exe 272 Unicorn-7437.exe 2436 Unicorn-11962.exe 2436 Unicorn-11962.exe 2668 Unicorn-20244.exe 2668 Unicorn-20244.exe 2764 Unicorn-56830.exe 2764 Unicorn-56830.exe 2412 Unicorn-28491.exe 2412 Unicorn-28491.exe 2892 Unicorn-52725.exe 2892 Unicorn-52725.exe 2224 Unicorn-7053.exe 2224 Unicorn-7053.exe 2540 Unicorn-24769.exe 2540 Unicorn-24769.exe 888 Unicorn-52749.exe 888 Unicorn-52749.exe 272 Unicorn-7437.exe 1508 Unicorn-19.exe 272 Unicorn-7437.exe 1508 Unicorn-19.exe 1984 Unicorn-19501.exe 1984 Unicorn-19501.exe 2668 Unicorn-20244.exe 2668 Unicorn-20244.exe 2092 Unicorn-13963.exe 2092 Unicorn-13963.exe 2764 Unicorn-56830.exe 2764 Unicorn-56830.exe 2504 Unicorn-13122.exe 2832 Unicorn-45411.exe 2504 Unicorn-13122.exe 2832 Unicorn-45411.exe 576 Unicorn-16652.exe 312 Unicorn-37949.exe 576 Unicorn-16652.exe 312 Unicorn-37949.exe 2224 Unicorn-7053.exe 2224 Unicorn-7053.exe 2892 Unicorn-52725.exe 2892 Unicorn-52725.exe -
Program crash 3 IoCs
pid pid_target Process procid_target 2640 2440 WerFault.exe 117 1944 2664 WerFault.exe 127 1540 2672 WerFault.exe 152 -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2488 c79aa71206bcd73752bd584838dfb267.exe 2800 Unicorn-9232.exe 2544 Unicorn-29980.exe 2700 Unicorn-59123.exe 2436 Unicorn-11962.exe 2412 Unicorn-28491.exe 2540 Unicorn-24769.exe 272 Unicorn-7437.exe 2668 Unicorn-20244.exe 2764 Unicorn-56830.exe 2224 Unicorn-7053.exe 2892 Unicorn-52725.exe 888 Unicorn-52749.exe 1508 Unicorn-19.exe 1984 Unicorn-19501.exe 2092 Unicorn-13963.exe 312 Unicorn-37949.exe 2504 Unicorn-13122.exe 576 Unicorn-16652.exe 2832 Unicorn-45411.exe 2272 Unicorn-55131.exe 2176 Unicorn-23528.exe 292 Unicorn-56008.exe 764 Unicorn-41617.exe 2252 Unicorn-8561.exe 2160 Unicorn-45147.exe 2856 Unicorn-27659.exe 1236 Unicorn-28235.exe 1564 Unicorn-57186.exe 1900 Unicorn-44571.exe 2000 Unicorn-28235.exe 2084 Unicorn-59682.exe 3004 Unicorn-2116.exe 1952 Unicorn-18967.exe 2816 Unicorn-56382.exe 2408 Unicorn-24369.exe 2488 Unicorn-53896.exe 2516 Unicorn-24177.exe 2200 Unicorn-26999.exe 2396 Unicorn-30529.exe 2756 Unicorn-46289.exe 2640 Unicorn-10279.exe 2212 Unicorn-30721.exe 860 Unicorn-60160.exe 1128 Unicorn-40294.exe 2480 Unicorn-47441.exe 2884 Unicorn-46289.exe 2544 Unicorn-10191.exe 2220 Unicorn-26912.exe 2788 Unicorn-21270.exe 1288 Unicorn-23382.exe 1336 Unicorn-6662.exe 2292 Unicorn-52781.exe 2236 Unicorn-32339.exe 588 Unicorn-3196.exe 2844 Unicorn-50596.exe 1012 Unicorn-38173.exe 1648 Unicorn-64275.exe 2360 Unicorn-48588.exe 2568 Unicorn-51468.exe 3036 Unicorn-32911.exe 1692 Unicorn-11525.exe 1500 Unicorn-32261.exe 2140 Unicorn-23564.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2800 2488 c79aa71206bcd73752bd584838dfb267.exe 28 PID 2488 wrote to memory of 2800 2488 c79aa71206bcd73752bd584838dfb267.exe 28 PID 2488 wrote to memory of 2800 2488 c79aa71206bcd73752bd584838dfb267.exe 28 PID 2488 wrote to memory of 2800 2488 c79aa71206bcd73752bd584838dfb267.exe 28 PID 2800 wrote to memory of 2544 2800 Unicorn-9232.exe 29 PID 2800 wrote to memory of 2544 2800 Unicorn-9232.exe 29 PID 2800 wrote to memory of 2544 2800 Unicorn-9232.exe 29 PID 2800 wrote to memory of 2544 2800 Unicorn-9232.exe 29 PID 2488 wrote to memory of 2700 2488 c79aa71206bcd73752bd584838dfb267.exe 30 PID 2488 wrote to memory of 2700 2488 c79aa71206bcd73752bd584838dfb267.exe 30 PID 2488 wrote to memory of 2700 2488 c79aa71206bcd73752bd584838dfb267.exe 30 PID 2488 wrote to memory of 2700 2488 c79aa71206bcd73752bd584838dfb267.exe 30 PID 2544 wrote to memory of 2436 2544 Unicorn-29980.exe 31 PID 2544 wrote to memory of 2436 2544 Unicorn-29980.exe 31 PID 2544 wrote to memory of 2436 2544 Unicorn-29980.exe 31 PID 2544 wrote to memory of 2436 2544 Unicorn-29980.exe 31 PID 2800 wrote to memory of 2540 2800 Unicorn-9232.exe 32 PID 2800 wrote to memory of 2540 2800 Unicorn-9232.exe 32 PID 2800 wrote to memory of 2540 2800 Unicorn-9232.exe 32 PID 2800 wrote to memory of 2540 2800 Unicorn-9232.exe 32 PID 2700 wrote to memory of 2412 2700 Unicorn-59123.exe 33 PID 2700 wrote to memory of 2412 2700 Unicorn-59123.exe 33 PID 2700 wrote to memory of 2412 2700 Unicorn-59123.exe 33 PID 2700 wrote to memory of 2412 2700 Unicorn-59123.exe 33 PID 2436 wrote to memory of 272 2436 Unicorn-11962.exe 34 PID 2436 wrote to memory of 272 2436 Unicorn-11962.exe 34 PID 2436 wrote to memory of 272 2436 Unicorn-11962.exe 34 PID 2436 wrote to memory of 272 2436 Unicorn-11962.exe 34 PID 2544 wrote to memory of 2668 2544 Unicorn-29980.exe 35 PID 2544 wrote to memory of 2668 2544 Unicorn-29980.exe 35 PID 2544 wrote to memory of 2668 2544 Unicorn-29980.exe 35 PID 2544 wrote to memory of 2668 2544 Unicorn-29980.exe 35 PID 2412 wrote to memory of 2764 2412 Unicorn-28491.exe 36 PID 2412 wrote to memory of 2764 2412 Unicorn-28491.exe 36 PID 2412 wrote to memory of 2764 2412 Unicorn-28491.exe 36 PID 2412 wrote to memory of 2764 2412 Unicorn-28491.exe 36 PID 2700 wrote to memory of 2892 2700 Unicorn-59123.exe 37 PID 2700 wrote to memory of 2892 2700 Unicorn-59123.exe 37 PID 2700 wrote to memory of 2892 2700 Unicorn-59123.exe 37 PID 2700 wrote to memory of 2892 2700 Unicorn-59123.exe 37 PID 2540 wrote to memory of 2224 2540 Unicorn-24769.exe 38 PID 2540 wrote to memory of 2224 2540 Unicorn-24769.exe 38 PID 2540 wrote to memory of 2224 2540 Unicorn-24769.exe 38 PID 2540 wrote to memory of 2224 2540 Unicorn-24769.exe 38 PID 272 wrote to memory of 888 272 Unicorn-7437.exe 39 PID 272 wrote to memory of 888 272 Unicorn-7437.exe 39 PID 272 wrote to memory of 888 272 Unicorn-7437.exe 39 PID 272 wrote to memory of 888 272 Unicorn-7437.exe 39 PID 2436 wrote to memory of 1508 2436 Unicorn-11962.exe 40 PID 2436 wrote to memory of 1508 2436 Unicorn-11962.exe 40 PID 2436 wrote to memory of 1508 2436 Unicorn-11962.exe 40 PID 2436 wrote to memory of 1508 2436 Unicorn-11962.exe 40 PID 2668 wrote to memory of 1984 2668 Unicorn-20244.exe 41 PID 2668 wrote to memory of 1984 2668 Unicorn-20244.exe 41 PID 2668 wrote to memory of 1984 2668 Unicorn-20244.exe 41 PID 2668 wrote to memory of 1984 2668 Unicorn-20244.exe 41 PID 2764 wrote to memory of 2092 2764 Unicorn-56830.exe 42 PID 2764 wrote to memory of 2092 2764 Unicorn-56830.exe 42 PID 2764 wrote to memory of 2092 2764 Unicorn-56830.exe 42 PID 2764 wrote to memory of 2092 2764 Unicorn-56830.exe 42 PID 2412 wrote to memory of 2504 2412 Unicorn-28491.exe 43 PID 2412 wrote to memory of 2504 2412 Unicorn-28491.exe 43 PID 2412 wrote to memory of 2504 2412 Unicorn-28491.exe 43 PID 2412 wrote to memory of 2504 2412 Unicorn-28491.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\c79aa71206bcd73752bd584838dfb267.exe"C:\Users\Admin\AppData\Local\Temp\c79aa71206bcd73752bd584838dfb267.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-9232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9232.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-29980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29980.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-11962.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11962.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-7437.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7437.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-52749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52749.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:888 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-55131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55131.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-52781.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52781.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-26163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26163.exe10⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39090.exe11⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3662.exe12⤵PID:2868
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49526.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49526.exe11⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14895.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14895.exe12⤵PID:1960
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31588.exe9⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55898.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55898.exe10⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3854.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3854.exe11⤵PID:640
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5280.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5280.exe9⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42825.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42825.exe10⤵PID:2320
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-3196.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3196.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:588 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31780.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31780.exe9⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe10⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe11⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46328.exe12⤵PID:1688
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62628.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62628.exe9⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39988.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39988.exe10⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exe11⤵PID:1552
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17402.exe8⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe9⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59121.exe10⤵PID:2672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 22011⤵
- Program crash
PID:1540
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3662.exe6⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-31040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31040.exe7⤵PID:324
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-24369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24369.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48588.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-58865.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58865.exe9⤵PID:2748
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64275.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64275.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-25649.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25649.exe8⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3355.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3355.exe9⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36594.exe10⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44259.exe11⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8296.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8296.exe12⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe13⤵PID:2540
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43695.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43695.exe11⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46328.exe12⤵PID:3020
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43526.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43526.exe10⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19037.exe11⤵PID:1284
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35560.exe9⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46328.exe10⤵PID:2380
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-51468.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51468.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-47924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47924.exe8⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49738.exe9⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe10⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe11⤵PID:412
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52369.exe8⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14694.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14694.exe9⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33334.exe10⤵PID:2576
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17402.exe7⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe8⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20511.exe9⤵PID:2992
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20244.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20244.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56008.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56008.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:292 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-30721.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30721.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe8⤵PID:1820
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10279.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10279.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe7⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44056.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44056.exe8⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29630.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29630.exe9⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe10⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52991.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52991.exe11⤵PID:2792
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38399.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38399.exe9⤵PID:2308
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe8⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62856.exe9⤵PID:1868
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41617.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41617.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:764 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56382.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56382.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49415.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49415.exe8⤵PID:2912
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50596.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50596.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-8736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8736.exe7⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exe8⤵PID:1808
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-7053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7053.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-16652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16652.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:576 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-44571.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44571.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-26912.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26912.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-7415.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7415.exe8⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33838.exe9⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33325.exe10⤵PID:2432
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6681.exe8⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54314.exe9⤵PID:1336
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60290.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60290.exe7⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28467.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28467.exe8⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe9⤵PID:2328
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6662.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-29526.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29526.exe7⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52991.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52991.exe8⤵PID:2292
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-24177.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24177.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe7⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35951.exe8⤵PID:1380
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-242.exe7⤵PID:2512
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45411.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46289.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46289.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-9001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9001.exe7⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11565.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11565.exe8⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22796.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22796.exe9⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-671.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-671.exe10⤵PID:1720
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe8⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe9⤵PID:2764
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21270.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21270.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-2449.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2449.exe6⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17694.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17694.exe7⤵PID:2440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 2408⤵
- Program crash
PID:2640
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6489.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6489.exe6⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50164.exe7⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12665.exe8⤵PID:3476
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59123.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-28491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28491.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-45147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45147.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-60160.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60160.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:860 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-11608.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11608.exe8⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10765.exe9⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6931.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6931.exe10⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41898.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41898.exe11⤵PID:1616
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49334.exe10⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27257.exe11⤵PID:1260
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe8⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe9⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43785.exe10⤵PID:2552
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23647.exe7⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59520.exe8⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44259.exe9⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46328.exe10⤵PID:2756
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23382.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23382.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43513.exe7⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12130.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12130.exe8⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5649.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5649.exe9⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe10⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe11⤵PID:3508
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8561.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8561.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-30529.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30529.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-32911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32911.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-52639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52639.exe8⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe9⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46328.exe10⤵PID:2644
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32261.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32261.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe7⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe8⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33463.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33463.exe9⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe10⤵PID:2612
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13122.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-35589.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35589.exe7⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19037.exe8⤵PID:2172
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26999.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49154.exe6⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34989.exe7⤵PID:1460
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-37949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37949.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:312 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-46289.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46289.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-11525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11525.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20789.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20789.exe8⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49738.exe9⤵PID:2664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 24010⤵
- Program crash
PID:1944
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36224.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36224.exe8⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54698.exe9⤵PID:2556
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45163.exe7⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54698.exe8⤵PID:800
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-57403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57403.exe7⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50943.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50943.exe8⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30376.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30376.exe9⤵PID:2696
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40294.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40294.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43513.exe6⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28192.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28192.exe7⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44835.exe8⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe9⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46328.exe10⤵PID:1320
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59682.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-10191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10191.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-43513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43513.exe6⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55898.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55898.exe7⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19935.exe8⤵PID:1528
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38670.exe5⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54698.exe6⤵PID:2356
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD5b8348ead77ad64f74df1c56220b37581
SHA1ae2d14b3f090179342f4af92987aac181ec85f40
SHA256b7942d11600603b9029906ee3715efd0bdbb791c324ad37c1bc83213fe24942b
SHA512e906a98250f409294c9b66a957bacf8fbeae3b4bcafe935bd3c6e909733509e9ae96d47419e3a8cbc3faab943386ce3d172a0978d15f4026264ff16db17195f1
-
Filesize
184KB
MD53f58943bc5f7f1600b014c16440308e2
SHA1a1b6f5eb79d09d76104e6aa46d3a7584d69789cb
SHA256555c81624aeb07b9180aceaab85d4f345ebc8e96e7caa298d64fd42b96869923
SHA512518dd17a087aaf182f952974f2798776d11e4c32e93b8d5320155d7107556675b6986163d3af43e2e64cc9470525232cb13d76d9b4ece683774264728c74a0a4
-
Filesize
184KB
MD5528e1fb1664294e98ddfd7fe30a2f356
SHA199fdc6a3b5d14006295f400fd5bfd2cac4aa80bc
SHA2561e61d9da01f8c1bf5e4a1b1ff1f1ba8300fa614f780a645e1f8ebfd2b5ee396b
SHA51276b9512340323eac96040bf00d9acd6301a32201ac33b54eb8d911e2a8eb6405e21074cec86beeab89570ff2b9a8ce58567c758b9723949491f16c3aeda0158a
-
Filesize
184KB
MD5e251dcfe29b7804a88a9e10267ee1c0f
SHA183d360ae6c957c427f6af2e185e8cd42e1237af9
SHA256897f42f50f6d80712cce369b63065e9a474c889a388bddce530f3e0e4501c33b
SHA512f804522cbe18d86438843e72b7580c2b4f9d20a3dd6cb2874a5becf5a97c331d4125fbdac27ca47ff56ea1afa0c5c39cde399facac230b1e747f3ddad79f9fb9
-
Filesize
184KB
MD5706431b2571295192a2318341428115d
SHA1d052db041b0889fb68f67333668f5a83b97faa7e
SHA256b3cd54741965fedd4a13351c52e62177abcdc6ef28b807553eca1f90f7012e81
SHA51239d0a90f6544c274e9642f2b97a193f819b5e170d33a05fa3ab607bb1faf9bca9cee85b3817b6e25b1c1d24f7dde1ef4e8323e1e9ae00627150ea923979395ba
-
Filesize
184KB
MD59eba840ecc3c10291504f93c4d572dfe
SHA1a61308e7803f60506215b9e64504e2e21af7572e
SHA256b6d9ebda87d0b979b210d6a3fafe87fcc2d94527d6f17fcb8ca37c4fa12d8ccf
SHA512b17c9c7dcf2c7e2130614ff11a7fca72e13833219ecb86b0ccfd543a20c93cdfe44caf1bdcb6a221afc86a6326dbe6afdb96244bcd4244facc9a2ede1f045177
-
Filesize
184KB
MD5527ddb63724976c734c4d6e7f06c773f
SHA17bae264d904d5022ec5b2fac88855a40352b0898
SHA256ae681844712d156e4de81d7267403d2deb3bc8e410c81b7cf667ecfb2e8406e8
SHA512f81ce4d5113e8c771eb42361c16a0572159aef7a12788a6b54eb9996875ce741c42fcca512d6d90497e30fdb564a77b8a08182b876edbfbb8f55d74fb71597ac
-
Filesize
184KB
MD5fbaec9d4149abfd69aebc0fadaa72989
SHA13e307874f085107cf2befd49892fa25508aca03b
SHA256b2ace9d3936ed519616b7fed3534afea10c682bfc7cf4c6de7e3ef475f5bd36d
SHA512e83cde048753c7638d962cb1ac9ca0077c8503ccc9b7c468b3e18fa068b9a8fea8a24e39be13796d956c95c92449242df8c2aa6bed9eeedb45997c2455d7fa3b
-
Filesize
184KB
MD58d4c50fe8f5d1517b46e6a865edc19af
SHA17f4f0b3fcf6fde99d859126e0734cec08c521635
SHA25668c2fb6307ae9862b53a06bf528610ba9ef58ea3c57f5786535305ecf68ec009
SHA5124025f0d601b9713d67000ad3e660889cc1452403134afb1e0a2c6cb600f7ce97bce8907b9fd7c89e1aa8ad2e7c8e802f948d733c6f3495a7f94e3921fb09fed5
-
Filesize
184KB
MD5b720679761120dca90127fd90efb21ac
SHA11bcc5f3e04392116c8b613c5be6ab0eb3caa282d
SHA256fba6e21412f7678f7cddfdc35d5bc5d9133bb6da5304a36463cd3e12b9c8b2f9
SHA512a1e3eb7cac0c0eebd13ce9805c8a5497261d2a9caa198bb22d75f85a902292f8bab1761b00f74b6b9764b5f1b216d234008a492990f639a6ea20dbd6ff4cbdf3
-
Filesize
184KB
MD5ce6331bd10b0d0cfeca9e5ecf9e84ef2
SHA17e4bdfd3a6150abc94ba84e8908c493002f05e00
SHA25692fae72fbe342e4c10e513a5bfe6f3cd1e26f52ecc46fc497de4b3d2f462c83a
SHA5127feaa5b3f63c32367bcd430ecb0e8edf4ef36d208c562153757c43a7c13b0fad7091e956e793bafee9df827d9bb7a20a52ca8914c76012b50436fb89fccd7da7
-
Filesize
184KB
MD5099b7a94ff20362cba13009ce9a46af1
SHA1247ca72d0ea65a87073031a472cf76a9b3be29c4
SHA2566787645ac6010e63a9d77b24fa6d414173c0c752598fbbf3ffc461ace18ad9c5
SHA51215f1abf9d80a772c8fcf9711650b77afcdb3b794faca07cd616f2e902433dfcdf255c1d73421b0e39377c279c80dc717224843b1c2177986d5b06eab30b298f9
-
Filesize
184KB
MD55180ee685704a9cd0b5436196e1a60cc
SHA1fd88ab71af004d2256774fe102b2b00c41a052d7
SHA256ed9023d8befea68a71a467aa5c145d56993dc9cee9171cd6d616ac4b7126c45f
SHA5124c7bb985ba88fca709e7b19724fd1e2f2b0c6adb75c9a0d2b5812532b5898e14f743d5204608945d00ceba51c8669073e73de154b31a77fdfdaa81dc2340ab04
-
Filesize
162KB
MD5fa2b2b116e16bc2ff8cf7a93d30d47f9
SHA17c2b8d36ceeded3e4c79de5c47e52f3212f4ac1a
SHA256d4e14212ebffb11b2bbf70f62ac204d8af94235d2f8fcc32781a6351e4a84239
SHA512b75ae2e0ca31cfdc418ac0019953ccfe410575868b06b7c0bbb22b9ab991b349efb49c56982c654d4a3c31840123eff4d8aa0cf0316a406fec25311028b89b07
-
Filesize
184KB
MD58fb566bb1427a37f900b39695fc6d020
SHA12584bc513400c2276a6dcab29c01e5622cfed4ce
SHA25695487236d481c2c9e96fb8793d54047ed27c49a5ac263057c95ff94bc4ec11ba
SHA512055fe7d8b708602d1ed8af3e6921278b152fbb0b4b7ed60747cc9919b6b69d3ceb0238e94a088506b734da464d4ac8142f6dd68f6e8088cc5c22102d5ca33ce0
-
Filesize
184KB
MD5ad43b6a2fd84fda64799928c3f2e6dd9
SHA1bc474013b92681d0187e76ce3022ee65f7f88811
SHA2560b2a0b2aa8f8012dc19adba8c77c623ac77bf663d1e1a42d71703147f73d8ed5
SHA512c4fc7b50e5e7f4feb08cb72766524ccb46248275d412f0afab4dc67eb84751a1e19a811c262b67ac147e922f4db492bf9fcf1d1f6f0a3ecb64ca98d454c6da3a
-
Filesize
184KB
MD539d6d7e5b95d5586344a7ddf3c81e809
SHA15fca459aba8c63cf9337f5eb459c45242e9127fc
SHA256ac4ba2bf041677e0388d47e6b0961117d671250a682e835dc190fb253bc54b24
SHA512f4a70f545e051c3047bb3538e5740db6b77ba84ee0fce5fe82286244bf77d05d23a61af793eaf1f8c3098e51ab817f427c8a553b43a82853c94bc3f0a247f4e8
-
Filesize
184KB
MD53716472edc3313ce0318c0b1b8d0ea45
SHA1801fd5c47b1f697c368ab28ba489082f9d07d78b
SHA256c9887b30b74a3481d1a19a37fe08e392e081db884e9d0ee72cbc4860e42bde83
SHA512e2e2782452703cc08cc6d978d47ff6ec5fc58f7049ead916cce3d85c0c87ac34ee44a3c29d6ba99985a4b3b6e7d8a7c9b7b551ec2ba55bb7439f6df7ef0ad70f
-
Filesize
184KB
MD5a1b5c8d466f0bfd8af017cfb7fc17acb
SHA16e0820a954daeca9b888166b63da94df4c551645
SHA2562e31bef05325afd22efa80b8e256d01ecedc4eccee071f9352a4d52c7cecf5eb
SHA512a8a7a85cfbdd71612e3de08cd1f26d807db4d157d808de55dd813d1c663b8e0f1aa5b3906c27211683947338df26c9d61ad6e5057f62f943f8037afbf19015da
-
Filesize
184KB
MD5bbf2c822f311a58487fd7a3d1930ce07
SHA19b7279426e6904f89e0b303a65eae489a50216cc
SHA256bd7e7f42f960369a37f364e8fe650fad59c5a57986c2d0673e31f54c6d43e7d3
SHA51295504369bed540b415cea16ee79b0b2f81a81ee8222f7a7831a72af667cc3816cba8fbcc67c0ce9ea1ae736c5e22914c3a8a6204dbd9692ea9c7470d5744a3ab
-
Filesize
184KB
MD5be5043cb2a23083b315c962035493ee5
SHA161811c1c6c25a36c7aee687ed4d94f0a1ad184e3
SHA2560d59ab9c64f2e59e75c029d843326756e366193efdda946e741d4611e1ada9fe
SHA5124522f7e0d5d0dc87e6257dc89544f1a30e0f986403d2025b22a0adb59c1c250c82a4d118335ab59112a4139d39236ae35b09b75b49512a1c5ec3e56b5e5f4ec1
-
Filesize
184KB
MD5d95984e0229ffbd1c47eee4a324cc90c
SHA180e8b5bf87a4c2e9c1739788823a22acfcdfc9a4
SHA256b0c2156b7ae541ef61411976e407ee2e9c1b0c969b3d3b52996ec9fcfd2eeefc
SHA5129660c7b1e819dec3d3d26e329ba11b0d96ac2222269442a48b8ab41d3c2cf812db14d441c73cbc6ab4ab246ac9cc1c23ad86d0885ac8b00064f18a344d52bb4e
-
Filesize
184KB
MD55022c1e34b60bab4658b7cb695ea473f
SHA1b557a6b4c403f697a4198a8bb673f69ad21c4410
SHA256bfa5b45531e7dc5b596038e679b8c5d0a5bf6462883e680eb96bb876821c0231
SHA5124f6f54e59bd346caa9c710fab8050cf7671a275791127f1ff1d03a1b75f777814d80325971cc3a551fb7b9a20b5110a9974178351c100de2c2ff66b3cf912e55
-
Filesize
184KB
MD55add29c8f167f3346723c652ae4291fb
SHA1e19e76aa6d254bb7ce6928622aac5e1b7affc836
SHA2560d185d80d67b4c155d2c92456d74653d412be27bade23ca135030f99d66bc1e0
SHA51262d128a015f53f14e0df941008e76a5fc961ad9448c05bc2dc06ca46c053d1ae03b9e987c52acd12a3c8af50f237f5980a43931aa899420c5931a3b973cf0bdf