Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
24s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 17:28
Static task
static1
Behavioral task
behavioral1
Sample
5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe
Resource
win10v2004-20240802-en
Errors
General
-
Target
5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe
-
Size
468KB
-
MD5
33c553c020bbe7fe04cd2da84f14f360
-
SHA1
8461061457c3a13e011b709e9bedf796571cb828
-
SHA256
5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75
-
SHA512
5522d855bd5d3bf3862155581d786dea26c03f84d32a4ec70192b629a68e905720d5e76d6f6ac1cbe99c67950f686dd265f648f565f9fbdfdf59bc559cefb008
-
SSDEEP
3072:bbAh+51Pt8U1bY4PCfjSf8FECDA1SO3udH0ZVpTQg43Dq9N68lf:bb2MGU1HPMjSfDVbdQgmG9N6
Malware Config
Signatures
-
Executes dropped EXE 51 IoCs
pid Process 1036 Unicorn-11898.exe 1900 Unicorn-42215.exe 4272 Unicorn-63382.exe 680 Unicorn-52879.exe 4076 Unicorn-20761.exe 396 Unicorn-20207.exe 4556 Unicorn-14076.exe 5020 Unicorn-63507.exe 2360 Unicorn-14752.exe 4784 Unicorn-19351.exe 4956 Unicorn-40932.exe 760 Unicorn-7098.exe 3416 Unicorn-34545.exe 3856 Unicorn-56299.exe 2588 Unicorn-25739.exe 3624 Unicorn-29500.exe 5004 Unicorn-49366.exe 3952 Unicorn-30983.exe 1520 Unicorn-33715.exe 4432 Unicorn-37799.exe 4388 Unicorn-58966.exe 2236 Unicorn-60664.exe 4844 Unicorn-21463.exe 3152 Unicorn-49174.exe 3396 Unicorn-48909.exe 2584 Unicorn-17824.exe 4748 Unicorn-3694.exe 4268 Unicorn-41197.exe 1708 Unicorn-59418.exe 4488 Unicorn-56958.exe 4260 Unicorn-11286.exe 4708 Unicorn-56403.exe 3964 Unicorn-54357.exe 1576 Unicorn-38733.exe 3364 Unicorn-57150.exe 4340 Unicorn-56595.exe 4896 Unicorn-29329.exe 4732 Unicorn-24691.exe 2728 Unicorn-8032.exe 4436 Unicorn-44919.exe 2924 Unicorn-54248.exe 2804 Unicorn-12246.exe 868 Unicorn-60378.exe 928 Unicorn-28474.exe 3636 Unicorn-41033.exe 840 Unicorn-39749.exe 2028 Unicorn-28474.exe 4812 Unicorn-12245.exe 4616 Unicorn-28474.exe 1064 Unicorn-30097.exe 4916 Unicorn-34011.exe -
Program crash 5 IoCs
pid pid_target Process procid_target 4660 4272 WerFault.exe 84 3308 396 WerFault.exe 87 4720 3856 WerFault.exe 98 220 4844 WerFault.exe 109 3436 868 WerFault.exe 130 -
System Location Discovery: System Language Discovery 1 TTPs 52 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-3694.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-29329.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-54248.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-60378.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-52879.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-30983.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-58966.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-41197.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-11286.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-28474.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-28474.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-34011.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-14752.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-7098.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-56299.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-49366.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-21463.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-56958.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-20207.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-11898.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-42215.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-20761.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-59418.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-56403.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-54357.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-30097.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-63382.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-25739.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-49174.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-40932.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-34545.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-29500.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-60664.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-48909.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-14076.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-63507.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-8032.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-12246.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-39749.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-17824.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-38733.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-57150.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-56595.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-44919.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-28474.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-19351.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-33715.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-37799.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-24691.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-41033.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Unicorn-12245.exe -
Suspicious use of SetWindowsHookEx 51 IoCs
pid Process 4376 5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe 1036 Unicorn-11898.exe 1900 Unicorn-42215.exe 4272 Unicorn-63382.exe 680 Unicorn-52879.exe 4076 Unicorn-20761.exe 4556 Unicorn-14076.exe 396 Unicorn-20207.exe 5020 Unicorn-63507.exe 2360 Unicorn-14752.exe 4784 Unicorn-19351.exe 3416 Unicorn-34545.exe 4956 Unicorn-40932.exe 760 Unicorn-7098.exe 3856 Unicorn-56299.exe 2588 Unicorn-25739.exe 3624 Unicorn-29500.exe 5004 Unicorn-49366.exe 3952 Unicorn-30983.exe 1520 Unicorn-33715.exe 4432 Unicorn-37799.exe 4844 Unicorn-21463.exe 2584 Unicorn-17824.exe 2236 Unicorn-60664.exe 3396 Unicorn-48909.exe 4388 Unicorn-58966.exe 3152 Unicorn-49174.exe 4748 Unicorn-3694.exe 4268 Unicorn-41197.exe 1708 Unicorn-59418.exe 4488 Unicorn-56958.exe 4708 Unicorn-56403.exe 1576 Unicorn-38733.exe 3964 Unicorn-54357.exe 3364 Unicorn-57150.exe 4260 Unicorn-11286.exe 4896 Unicorn-29329.exe 4732 Unicorn-24691.exe 4340 Unicorn-56595.exe 2728 Unicorn-8032.exe 4436 Unicorn-44919.exe 2804 Unicorn-12246.exe 2924 Unicorn-54248.exe 868 Unicorn-60378.exe 2028 Unicorn-28474.exe 3636 Unicorn-41033.exe 4812 Unicorn-12245.exe 1064 Unicorn-30097.exe 840 Unicorn-39749.exe 928 Unicorn-28474.exe 4616 Unicorn-28474.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4376 wrote to memory of 1036 4376 5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe 82 PID 4376 wrote to memory of 1036 4376 5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe 82 PID 4376 wrote to memory of 1036 4376 5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe 82 PID 1036 wrote to memory of 1900 1036 Unicorn-11898.exe 83 PID 1036 wrote to memory of 1900 1036 Unicorn-11898.exe 83 PID 1036 wrote to memory of 1900 1036 Unicorn-11898.exe 83 PID 4376 wrote to memory of 4272 4376 5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe 84 PID 4376 wrote to memory of 4272 4376 5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe 84 PID 4376 wrote to memory of 4272 4376 5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe 84 PID 1900 wrote to memory of 680 1900 Unicorn-42215.exe 85 PID 1900 wrote to memory of 680 1900 Unicorn-42215.exe 85 PID 1900 wrote to memory of 680 1900 Unicorn-42215.exe 85 PID 1036 wrote to memory of 4076 1036 Unicorn-11898.exe 86 PID 1036 wrote to memory of 4076 1036 Unicorn-11898.exe 86 PID 1036 wrote to memory of 4076 1036 Unicorn-11898.exe 86 PID 4272 wrote to memory of 396 4272 Unicorn-63382.exe 87 PID 4272 wrote to memory of 396 4272 Unicorn-63382.exe 87 PID 4272 wrote to memory of 396 4272 Unicorn-63382.exe 87 PID 4376 wrote to memory of 4556 4376 5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe 88 PID 4376 wrote to memory of 4556 4376 5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe 88 PID 4376 wrote to memory of 4556 4376 5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe 88 PID 680 wrote to memory of 5020 680 Unicorn-52879.exe 92 PID 680 wrote to memory of 5020 680 Unicorn-52879.exe 92 PID 680 wrote to memory of 5020 680 Unicorn-52879.exe 92 PID 1900 wrote to memory of 2360 1900 Unicorn-42215.exe 93 PID 1900 wrote to memory of 2360 1900 Unicorn-42215.exe 93 PID 1900 wrote to memory of 2360 1900 Unicorn-42215.exe 93 PID 4076 wrote to memory of 4784 4076 Unicorn-20761.exe 94 PID 4076 wrote to memory of 4784 4076 Unicorn-20761.exe 94 PID 4076 wrote to memory of 4784 4076 Unicorn-20761.exe 94 PID 1036 wrote to memory of 4956 1036 Unicorn-11898.exe 95 PID 1036 wrote to memory of 4956 1036 Unicorn-11898.exe 95 PID 1036 wrote to memory of 4956 1036 Unicorn-11898.exe 95 PID 4556 wrote to memory of 760 4556 Unicorn-14076.exe 96 PID 4556 wrote to memory of 760 4556 Unicorn-14076.exe 96 PID 4556 wrote to memory of 760 4556 Unicorn-14076.exe 96 PID 4376 wrote to memory of 3416 4376 5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe 97 PID 4376 wrote to memory of 3416 4376 5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe 97 PID 4376 wrote to memory of 3416 4376 5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe 97 PID 396 wrote to memory of 3856 396 Unicorn-20207.exe 98 PID 396 wrote to memory of 3856 396 Unicorn-20207.exe 98 PID 396 wrote to memory of 3856 396 Unicorn-20207.exe 98 PID 5020 wrote to memory of 2588 5020 Unicorn-63507.exe 101 PID 5020 wrote to memory of 2588 5020 Unicorn-63507.exe 101 PID 5020 wrote to memory of 2588 5020 Unicorn-63507.exe 101 PID 680 wrote to memory of 3624 680 Unicorn-52879.exe 102 PID 680 wrote to memory of 3624 680 Unicorn-52879.exe 102 PID 680 wrote to memory of 3624 680 Unicorn-52879.exe 102 PID 2360 wrote to memory of 5004 2360 Unicorn-14752.exe 103 PID 2360 wrote to memory of 5004 2360 Unicorn-14752.exe 103 PID 2360 wrote to memory of 5004 2360 Unicorn-14752.exe 103 PID 1900 wrote to memory of 3952 1900 Unicorn-42215.exe 104 PID 1900 wrote to memory of 3952 1900 Unicorn-42215.exe 104 PID 1900 wrote to memory of 3952 1900 Unicorn-42215.exe 104 PID 4784 wrote to memory of 1520 4784 Unicorn-19351.exe 105 PID 4784 wrote to memory of 1520 4784 Unicorn-19351.exe 105 PID 4784 wrote to memory of 1520 4784 Unicorn-19351.exe 105 PID 3416 wrote to memory of 4432 3416 Unicorn-34545.exe 106 PID 3416 wrote to memory of 4432 3416 Unicorn-34545.exe 106 PID 3416 wrote to memory of 4432 3416 Unicorn-34545.exe 106 PID 4076 wrote to memory of 4388 4076 Unicorn-20761.exe 108 PID 4076 wrote to memory of 4388 4076 Unicorn-20761.exe 108 PID 4076 wrote to memory of 4388 4076 Unicorn-20761.exe 108 PID 4376 wrote to memory of 2236 4376 5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe"C:\Users\Admin\AppData\Local\Temp\5ac841f2ddae85f81c6d5a032937fc0ded2c9f54af95ff6aea8f3d7a44564a75N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-11898.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11898.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-42215.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42215.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-52879.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52879.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63507.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-25739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25739.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-3694.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3694.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-34011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34011.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-10933.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10933.exe9⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2293.exe10⤵PID:6216
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe8⤵PID:5260
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51094.exe7⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16087.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16087.exe8⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55002.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55002.exe9⤵PID:5308
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59157.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59157.exe7⤵PID:5268
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-13590.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13590.exe7⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61203.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61203.exe8⤵PID:5224
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21685.exe7⤵PID:5284
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe6⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61203.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61203.exe7⤵PID:5216
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41286.exe6⤵PID:5292
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29500.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29500.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56403.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-6574.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6574.exe7⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65370.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65370.exe8⤵PID:5408
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42489.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42489.exe7⤵PID:5432
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe6⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe7⤵PID:5708
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56573.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56573.exe6⤵PID:6040
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54357.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-6766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6766.exe6⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25947.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25947.exe7⤵PID:5756
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1805.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1805.exe6⤵PID:5988
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42381.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42381.exe5⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-373.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-373.exe6⤵PID:5744
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe5⤵PID:5996
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14752.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14752.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49366.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49366.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-59418.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59418.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe7⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62163.exe8⤵PID:5332
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24892.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24892.exe7⤵PID:5352
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14337.exe6⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe7⤵PID:5312
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38628.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38628.exe6⤵PID:5356
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56958.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-6574.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6574.exe6⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62355.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62355.exe7⤵PID:5444
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50658.exe6⤵PID:5456
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41477.exe5⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exe6⤵PID:5612
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17513.exe5⤵PID:5732
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30983.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-11286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11286.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-59475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59475.exe6⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21671.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21671.exe7⤵PID:6020
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe6⤵PID:5148
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11021.exe5⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exe6⤵PID:5884
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3864.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3864.exe5⤵PID:5304
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38733.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-39439.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39439.exe5⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exe6⤵PID:5620
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43029.exe5⤵PID:5776
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21764.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21764.exe4⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-565.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-565.exe5⤵PID:5792
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe4⤵PID:6004
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20761.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-33715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33715.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56595.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-30887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30887.exe7⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26907.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26907.exe8⤵PID:5144
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16065.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16065.exe6⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54618.exe7⤵PID:3420
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29329.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29329.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe6⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54618.exe7⤵PID:5244
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24756.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24756.exe5⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53274.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53274.exe6⤵PID:5924
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe5⤵PID:5372
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-28474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28474.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-15318.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15318.exe6⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26414.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26414.exe7⤵PID:5752
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40569.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40569.exe5⤵PID:876
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:840 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63258.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63258.exe5⤵PID:4860
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15053.exe4⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21946.exe5⤵PID:4920
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40932.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40932.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-9205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9205.exe5⤵PID:676
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe5⤵PID:5820
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24564.exe4⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exe5⤵PID:5892
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-684.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-684.exe4⤵PID:5580
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48909.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48909.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-28474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28474.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-35547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35547.exe5⤵PID:2632
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52822.exe4⤵PID:1452
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41033.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-7150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7150.exe4⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55303.exe5⤵PID:5684
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43137.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43137.exe3⤵PID:1040
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63382.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63382.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-20207.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20207.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-56299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56299.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-21463.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21463.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:868 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-27571.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27571.exe7⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe8⤵PID:5768
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 7447⤵
- Program crash
PID:3436
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 7246⤵
- Program crash
PID:220
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 6525⤵
- Program crash
PID:4720
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 7284⤵
- Program crash
PID:3308
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 7443⤵
- Program crash
PID:4660
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14076.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14076.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-7098.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7098.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:760 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-49174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49174.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-28474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28474.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:928 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-15318.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15318.exe6⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9994.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9994.exe7⤵PID:5328
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48738.exe5⤵PID:5024
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63450.exe5⤵PID:3092
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62473.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62473.exe4⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe5⤵PID:5824
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17824.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17824.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-44919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44919.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe5⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51603.exe6⤵PID:5340
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe4⤵PID:5812
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54248.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54248.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-60819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60819.exe4⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51603.exe5⤵PID:5248
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15053.exe3⤵PID:3480
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34545.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-37799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37799.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-51307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51307.exe5⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exe6⤵PID:5876
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11021.exe4⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54618.exe5⤵PID:5188
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe4⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe5⤵PID:5140
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24756.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24756.exe3⤵PID:2444
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe3⤵PID:5344
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60664.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60664.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-12246.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12246.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe4⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54618.exe5⤵PID:5196
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40953.exe3⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18739.exe4⤵PID:2484
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34372.exe3⤵PID:6060
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12245.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12245.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\Unicorn-64327.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64327.exe3⤵PID:336
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6918.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6918.exe2⤵PID:3196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4272 -ip 42721⤵PID:3876
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 396 -ip 3961⤵PID:1360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3856 -ip 38561⤵PID:3432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4844 -ip 48441⤵PID:4256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 868 -ip 8681⤵PID:5968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
468KB
MD5596c03c3c69881aa15e0c4fb73fcab1c
SHA1449127c98c4a85edf3f58cad84694d28a770a406
SHA25697b7c6e36e9019566718bbd19accd7467a54cd747c9f7b57ca74bf1326a297e0
SHA512f8dba9c6c59937a932f2866d1be7d73e6955a196c97aee89ab1b68fe7e57ca82b6390d4f6a89973b7683e83fa2e2b4d03240e543ab97865cdd5a0089a6169f87
-
Filesize
468KB
MD506fe0d0cb42c07d2e33d22c64bff491d
SHA1182ec434aee57a4a6bf7ff39a047508f012b6ff0
SHA256e9ea8795dc3317735a714228ba9afb51b087a2dde015381fbaaa7d1076c43e65
SHA5127bb06bf06cce00d60820a3b32243a7ba8f9f9bd2be4ebcea4582137e9dffd3887b2f615232a47e27c3cbd986100c73c0bf84f6eb8fea37cd88bba56f036e74f0
-
Filesize
468KB
MD5a36eefb654b9a1d626503a5e4c8498eb
SHA1f2984726d2f4a6ee3800ffc2381672748844504e
SHA2562673b9320c7b744f77d58d6a1ac3de4bbc1ea266774af0c0d6c73527f49cdff8
SHA5126562a07784a3ec521a494c570315cc855e3c1e1e1496ca02ba613d05079dadda15a1f0a4048783fea4fddfcbba1b12035201a0205ec3e2ae430d959589794df6
-
Filesize
468KB
MD5891725ddd08b86f7d8ccefcabc99c48b
SHA15c8f82fbf44d2e601407a2fab5fd6688ba0b3205
SHA256888219a3a74859911c941589e33377f3bf6014918860de811b0ec363282b66a7
SHA512f3311bf34b72a5bb965b4284812074e6903c1f5384175e52b0121ba181b86925f82a4cbe70bb7b6b2b74833989e4929ee79a00dc485c68db59720554b91a3ef5
-
Filesize
468KB
MD5c079f802292d88c38780eea0e9307e77
SHA1dd4a578bb8ea07f5092e12d2d012a00ca4534f07
SHA25644a5ac93b8bfcb5d25a680f199fdce96791d3f3604bc9fa1a0660cda399e26cb
SHA512c60bb7bba8358e75a5c80f6ab8b115c85bf9d1e943994c055c7e9563293fe1cf28bfd78d7607ea803c2a83b78ccf19bddaff49223351cacded40755142d47749
-
Filesize
468KB
MD58a4d9405d214a42c1fc0b3b4e5b046c6
SHA175235a39dda397a609e3c2174aee894dd0379b0a
SHA256bb70f7316d575eb455a88765514f6555644457015c8ce345b683509678a8e4ad
SHA512e9396a0601bbe74e8e9684de640c912d6c893c62e7a6ff1b8c20e5230d28eeba7f2bcae04389a9a609cfa31a63b330f23acba16f82187ba232b680dca7f78e24
-
Filesize
468KB
MD506ba708c56db4fbb0a237a4d8de5fa86
SHA1d790491b235be3b53ba99e93e7664a64b3968838
SHA256d84f8603e4ca895fc60e9afc5fe08105e988ce8b81bee992dc2a07e687b77a7a
SHA5120626183163a67b360706d240e8e67aca9b039c6ddbf4167c09c8327236a8ed0ca97fce5bbf75553029aeb569e71130b8114e25eb2f40c5cbace99d24496ca32a
-
Filesize
468KB
MD5b8e88f682ec72b76b7bdb35a99eebb23
SHA10c11e17001258452e456506acb7e4520d7a05c59
SHA256fd9e8be054ee4b751cc1ee720554a4f499259d465ea82d687ff139b75ec730de
SHA512af20468616ce47e9f23388e3c95a6e78bcdbe5f94d1dccaf413418378b4451f2d1ddc05e6994af61f5c8de5f889ec804b5e064ef25e67cadf003c18a693a75ce
-
Filesize
468KB
MD5568c571527cc386fefa2ca4c8ffd8fe7
SHA16f0fe6dac7936a7449aa115b35388a4dcd6c977d
SHA25669b8619a378f57c3e94ee6f2556857300d5429e960cc8e81cfec8f99014cab07
SHA512df8993ccab8c8cc29fdd2f4cb69838f980cc30b54782e9537ff5a23ac50a41477dc9d6f8f0fd44ed960a7eef943b27b8df340ad603afd6e06a657959474db75b
-
Filesize
468KB
MD5b6e1b118cc1e80ac4e9cf6f6d7934cfd
SHA1b8e006664680c12c929a91d69e4d62be7adc0ed3
SHA256089ee868be6247f53462a5e6c310d9f5de0b9c2dac1cd1695f14eed210dc35a5
SHA51256a3be5c948c6d317e78db770374363399c484246e50b702b601d004913396fce495249625487561aa0f50ae372c2bd7fad31325d13d7cedec9e87fea328620c
-
Filesize
468KB
MD5ce22354c047b9f0cb471e91092f65b04
SHA1a5b3fdd62ba7da2df5ea180d704050fce8978e73
SHA25614cfa883332381737a529770e9646fd8c04d74d7d1bc25cb85676f1cc31021b5
SHA512f9e2995907047de3f4bdd7f2deff7525f59bcac1cff32fddf3a882fe64ee4be2216520cbdb6d6aac162e60e5cd0af328fd86ac190cc2682aa437ee625db87b37
-
Filesize
468KB
MD58c5c2aa72ec11e6a0a19a5e42e77ed69
SHA1a498991168514e38b1aef506138846d25faadace
SHA256e67f94d852c7b95d331cec21b79cea3afaddcfc95cffb0621600aaab526214b0
SHA5124f7e21189e9b3c99ecb34e26d45f1139d5599397ed4d801e7123293a9863266457259b141f9f8e8904c30febdf2a18f2721d9ce736f6deb4c2345ba0c0ab3624
-
Filesize
468KB
MD5623fca4a6f566dae124202d0cddb68c0
SHA1c81c5963685ae53a726f159bbc32d462f50aeb58
SHA2560dcc6f0022366fecfca456ddb289454c75af0b30af6097c1a8bd788547a6e825
SHA512a509c6575e6fb21aac705900bd72131d1584fbf8f8ad0d06cd4b1a064842f75d1b18d27deed85eed4a368213312e1d2ecf145e31b2a228b6b1cc59582cfd4ff5
-
Filesize
468KB
MD5bd5ffdd59d2f5e6e5844320842f95ca6
SHA18e6ed9ecd303381c8cc390b7aece8a949993c079
SHA256c8a2f6771355c5b3c1c9563cccee4f00a8aca44f158c6131553891ff9ce2dba6
SHA5120c9d10f4dfd2e6b7dc93034f5044c4d0da07ea445c4bff1d65e4461142f23d9313948b891c0793b1f6ca60ec5e6f4879f9cfb45030c6d9e8fe9607064df984fb
-
Filesize
468KB
MD5bf9f53db8d5e1268088dea1b4c342e35
SHA172ecc2768ff118eaec87c775cbe252f4a84fcaaa
SHA2561013e35fda6f0a734d7672f343ff7056519b7417c9dafa68c65f4202e8296ccf
SHA512bbf06cee075d02ada8bef8a27152db45e8defc756a79b42d3b652aabb1d9ed267a03594c21ad7a0609eb9a8897b031eb0fe4198162e8fca86b723fb5d299f0cc
-
Filesize
468KB
MD55cfb4240c969313991c7f10be7011d1e
SHA16681072334ec3163282fa7bef70e407038ab84bb
SHA256b80b44cd3a811d612b1ecfdf36b30c2161c6372dc7c08c2fd47feacb8e1fbdca
SHA5129fcb4acf5c47662517f4cfa646d9c7372d0f4c3e445045ee26987317b6dd5349aa01eaedda3ee17d12650515df2fd1b833be8ac2cb48e1a52841cdcdcf0039bc
-
Filesize
468KB
MD5903fceb0eea0b4e3ae08207fe71adaa0
SHA1c33a9fe6032a34beef8a4c48cfa3e6b8387415e4
SHA256cf3fa8d6cfbb51d961b67bd2eae73344e56164d60a367480b6a68ef434205b0c
SHA5120606d3ec31b0fae770937795d74184122debf214175c850471f4e9365bd55d6f2af2a52b87933a84e26fd9f386c916e28103979cab41f9bd9b8e76eb4c18e2cd
-
Filesize
468KB
MD560b8fdfcc6716cc20499707d74d8e31b
SHA171c860531bb6bf1f6b9e255b0648951a8c796e62
SHA25625666ea0c6679ea11a2d1e390023f43ed74acb9b98ba9447232d38e3b4dcf8fc
SHA51238a02dcd5bb40cb5db32048ccdf76a2c5a31097f4437cecb2a283d9a20303b741db6699968819f30a3b6dd8ef42882c58459e6811171ed5e3592969e6850da45
-
Filesize
468KB
MD5260c91a186989deaaaf535308933717a
SHA19521f95d2c95935e6e9496ea8479abc2e3427d74
SHA256fadf063276097cbdf6bdecd11e03feb3d8663cf974edbc597e0a51c2a6316291
SHA5127458dae75c2719d022db4c64f350866a42225865c24de459f8a8269f80aecae8568cc04f9b692d21e2c276af060c8a5b291f94628d5061356254e9e8de2f90bf
-
Filesize
468KB
MD5489be9126e9057e819da79b70b3aab5a
SHA170f085790aa10bd06a938fa84a2be63a644a7da0
SHA2563999034f5cdb48618e1ce3d4bc608b89d550ffdcdbf12214a58869d99c1009f8
SHA5120e1964a5ee625c00612a80f20a68aff6489d074476ff167af2216f3c2643ed6518e1f44a430bdee7dbfb0be92c8c45d019892aba8028d6cfea56898490aca00a
-
Filesize
468KB
MD53db1d4179067407f6128f8bdeddbe74b
SHA1c7540e3fd1fcb1891d83bfca473f67687c732dca
SHA25697229f120b6ecf3b3396f08386babce8079458d8956e522227498f8afb5647bd
SHA51225810f071c2d73618b2ac8452b88f6cca444d72d65d6f0fe2405f4f1a9632de3941c0692cab496b1454b3bfe20453680a2f6051682d4df4a2b4ee4d60d300c77
-
Filesize
468KB
MD5b1393f6b9562729388b3a4c2116332fd
SHA14cc9eef842c03a0db0019ff9c156810356fa44c0
SHA256b4ddb8a3d0b4d97137a3eb27f1307111ff63a865fb9e62195ec0da50c3b7830c
SHA512511d45d09fa1ec582d6bd58d41f731460557a8b5efc7e8bd547b8ec0fce9644df969c6696fc0b611a88e1aa1b74eb1a965de608b6ab0d0c3b9db3a5ae6a5b79c
-
Filesize
468KB
MD5ef05d04fad4135929d46645e6236e635
SHA1973580b4e264b1cc17fdf6377dce9dca54cf66e4
SHA25612972b5c6e3929bdf93e9a1a726b448d3eb9f96cf13e151ac3d094514bf41631
SHA512330a112c83c84810a2903f0792305b805ed65c5ef787ac84dee04733aaeceb377f46f851e7e11f51a868472e8ee31ecb6b6dad4e6e80cfbbf472d4de53554cfb
-
Filesize
468KB
MD53ec18446dcca791e03b2afff4af1189e
SHA1e47dc08fd2c7d634400b5fb4d33692ab82cf899c
SHA25646468ca208ba104ed859ba1e4d7744e7bb317d3f36664dfb78cef2080f984bd4
SHA51273192ed3183d6297acff1aed4ef18d60cf527a21bd5d30f41ab30ee7027035e5943937f562311817dd93015c9c26a4fdf3a6db1c6d4c74b0051b0b7d59f4bdc3
-
Filesize
468KB
MD5b3a0f46263faa13690f7ce6e1dd7c621
SHA15835cb4eea796c20dfb53bc650acd7b0e0dcf51e
SHA25660655df236d1e31ea4032817b4fafb14b6b707baffbfd0882e9640a67614a592
SHA512877d5ee28044d746582baa9503aeb5e96dde4758bd617ed4ae4e847596fd73f4fc26229447323ca1703e053eb17acb68956204d21777f600f2c633d18efbddcc
-
Filesize
468KB
MD542ec1388f850af1f798db40953c11991
SHA1c9c02084426672e4026b1c62b9ecd8cb7d8971ee
SHA256f617caa9d1e2f47f3fcc238ecc73fbefefbc82377b3ace1d41fbd5abd2eb6ab4
SHA512d1c0921a684ce9a8fe0ca39293e32ff4871b66e15d5e2ad1d268b08d3828d13fd1d413d81012382929b3ec48c366144513ca1a676c04168fe4d072eb49240ef8
-
Filesize
468KB
MD544709173fa96b428b6c12208f45f30dd
SHA1b777fd8069ee015fe54f3932f23449d5693e2b0e
SHA25638e0799b2273cfcc3430ca5fd37e7513dc636ff678cde0e340070964b209c8a6
SHA512051185f4c63579b823db7ab15ee60879b17fa437b57c9647a9894cd609e7affcfd1318f53493150a407c2416eb32362322d493f99453e59d213e9b05502d0cfc
-
Filesize
468KB
MD5391ee93094cdc248d26b60073d0cb26d
SHA12552954243e7e7e5f186d3bce3839ed8d9491271
SHA25699284517d6b50d1ce7ae6dc6552b53ebeff0516c21a67ef26e6dada21c732a16
SHA512458faa5b6161af490b8cf5759db97c529bc55454761be7b74d5fceb4660c5fa3c8504581122057e463de22d2ecb28c2b161e946f7925ac8b2a5c6a3efe67b54d
-
Filesize
468KB
MD559d6f0c9d319cc685467b1357c95de9e
SHA153606711c6e43cbe1bdb327fc23a6422aa2ae026
SHA2568bc03284522b03111ee5cccaa167401b3e66fb22c407465902817cc3905fced4
SHA51271c1fd217096e979e73e7578e4e1db9e15fe19f059b9982c4883b3e843af648b645ca621965992c98783ddf206612efea43fcf7f4edbe828da253df6dce82ff2
-
Filesize
468KB
MD5a0df059e54313b1cc697129a3bdcfb68
SHA1313e591ef66749cc06da8f83cf2d96ef0ac7b221
SHA2567ee4679db5f5f143d2478458bee7471e45f7457bc504b9ac65e034275d419246
SHA512fd3f05d2d2816143531feaf6229e21a02e5a067012ce5a9cc23e02b5cb8c3208ebf0093523ac2e0b1f1e5826fa6a1346df449e9038dd0720ed0403adb6a27246
-
Filesize
468KB
MD5c0fa31d5b1fc374155e0b06dcc009e6c
SHA14574ebfb1e735e4f1d402f55535bbe9f9ecdac3d
SHA256ce360dfccad0b2305993c9847ca4558e74323c1cec6252c815cbf341a9c8fd36
SHA512f70e31a4fb82337b674773b897673b7df87cf23606a3ab16990deeef1b20d51ad995a0d6f089b8e138b21aa9624a9e6305e18fb741c85bbbe5b128703fbd742c
-
Filesize
468KB
MD5f00a37d4353d505927df9996aa246fd4
SHA13a268d29f561962dbff17f7596a81c12a0311fc3
SHA2568a82b214d4027dfa4dc23d882fc35d3b7b1925cabb5c6667df6f58f5b5172388
SHA5122558100b0101eb71ec3e2fd7af3ea635a5e2e2c4fd7cee1fd5e05e4d155d2c0f1a65947dc267f184e65ecba3200da8c7fe37a9ff016209f4a72946d042588e9b