Analysis
- max time kernel
27s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
28/06/2026, 21:53
General
- Target 2026-06-28_6cca6bbaa7eae2df164e4d26da976e32_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
- Size 15.7MB
- Sample260628-1rtclafx5j
- SHA256 2e3bb94d174b6126d53c00c651e863bb00e63e5b0aa5c15b1aebeab830fc59db
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 24 IoCs
- UPX dump on OEP (original entry point) 24 IoCs
- Executes dropped EXE 12 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-28_6cca6bbaa7eae2df164e4d26da976e32_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-28_6cca6bbaa7eae2df164e4d26da976e32_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28734.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9164.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40143.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24356.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14066.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14066.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53506.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31009.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31009.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34578.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34578.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1954.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1954.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9006.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9006.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64808.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64808.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2665.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16147.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25176.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25896.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25896.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19962.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19962.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48285.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20253.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20253.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39069.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4803.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30438.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35079.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53204.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53204.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39545.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33776.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33776.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9411.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1907.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1907.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52454.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52454.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40143.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27175.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62556.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62556.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15742.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15742.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39234.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58358.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58358.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19369.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18809.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18809.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62347.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62347.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18243.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18243.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24605.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24605.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58363.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58363.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6303.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25266.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31742.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31742.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33104.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23361.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23361.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49967.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49967.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39605.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39605.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46012.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43127.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43127.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44767.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52624.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52624.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42187.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25826.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18120.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25738.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27662.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8342.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39948.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28935.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10866.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40143.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3298.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3298.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64030.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64030.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7123.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7123.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39888.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39888.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20121.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2924.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64393.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64393.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24777.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24777.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32510.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15581.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34819.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58010.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58010.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47485.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23587.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46900.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20376.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20376.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16018.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5633.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5633.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51056.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51056.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45042.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26345.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18055.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16096.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16096.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23330.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23330.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46874.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46874.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43350.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41441.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45448.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45448.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46277.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34077.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34077.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9681.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63002.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63002.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2140.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19369.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17741.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31244.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31244.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60771.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24246.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24246.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46848.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46848.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39292.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39292.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26411.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58306.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40796.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40796.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56723.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45871.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45871.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53869.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47367.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47367.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51295.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51295.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5197.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5197.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39931.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39931.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39878.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45016.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35980.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50688.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50688.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13080.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30635.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56635.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7574.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7574.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17757.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-126.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-126.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53361.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53361.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34222.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34222.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62857.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37274.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37274.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60823.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60823.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64855.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64855.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42243.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42243.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53601.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53601.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45677.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45677.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46277.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58970.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58970.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29718.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29718.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2084.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6915.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6915.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60807.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60807.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33234.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60558.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61420.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61420.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21615.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21615.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59069.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26411.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-148.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-148.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8674.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5348.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5348.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57574.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57574.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29457.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29457.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64886.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64886.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38570.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38570.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38336.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37274.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37274.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48353.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41726.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41726.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50510.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29033.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27741.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48213.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63765.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5732.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5732.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5162.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46277.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3355.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3355.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52992.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52992.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12125.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2342.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27345.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44487.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44487.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64869.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25987.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40147.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65384.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65384.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37070.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15767.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47486.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3283.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3283.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29285.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61118.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61118.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16755.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16755.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31881.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16376.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16376.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4055.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40143.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16620.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52665.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35150.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45052.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56853.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56853.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60247.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60247.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37703.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37703.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13089.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13089.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4746.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30102.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30102.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39732.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39732.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47403.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3122.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51134.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63530.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5072.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5991.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5991.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42178.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34012.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18989.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54772.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22509.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22509.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17558.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14574.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14574.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42847.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53480.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53480.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33614.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11358.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11358.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41633.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41633.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14283.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14283.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5421.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5421.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40143.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46277.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44305.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44305.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13298.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13298.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43589.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43589.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37025.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37025.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13978.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13978.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46090.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50272.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50272.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47294.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47294.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42655.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42655.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39287.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12914.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12914.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1217.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29390.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29390.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48784.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48784.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30538.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30538.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26589.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26589.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36231.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36231.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55488.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26411.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64917.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64917.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4637.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59946.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34180.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35373.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35373.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64528.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40111.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41513.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56439.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56439.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19905.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43453.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43453.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20350.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22370.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22370.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3090.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51975.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51975.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26568.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26838.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1819.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10594.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6416.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46277.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22209.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30485.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9717.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9717.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47319.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19369.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26184.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26184.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7860.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24346.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51439.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51439.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19930.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37346.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8171.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26052.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1155.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41211.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41211.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13001.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22484.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3288.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3288.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58328.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-10866.exe
Unicorn-16620.exe
Unicorn-18956.exe
Unicorn-20277.exe
Unicorn-26411.exe
Unicorn-28734.exe
Unicorn-28935.exe
Unicorn-34012.exe
Unicorn-34947.exe
Unicorn-39878.exe
Unicorn-40143.exe
Unicorn-40147.exe
Unicorn-40619.exe
Unicorn-40633.exe
Unicorn-45677.exe
Unicorn-46277.exe
Unicorn-49167.exe
Unicorn-52454.exe
Unicorn-5421.exe
Unicorn-54813.exe
Unicorn-6416.exe
Unicorn-65120.exe
Unicorn-6782.exe
Unicorn-9164.exe
memory/464-252-0x0000000000400000-0x0000000000475000-memory.dmp
memory/664-881-0x0000000000400000-0x0000000000475000-memory.dmp
memory/816-1237-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1336-331-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1552-515-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1556-490-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2464-488-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2508-159-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2580-621-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2600-158-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2652-1256-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2856-79-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2888-1085-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2920-976-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2968-217-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3668-1259-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3728-157-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3824-81-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3880-514-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4176-885-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4236-1235-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4316-1260-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4600-410-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4712-1204-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4808-516-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4868-142-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4940-639-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5416-608-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5440-607-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5796-162-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5852-974-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5872-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5992-160-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6040-101-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6240-784-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6260-927-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6264-1255-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6296-928-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6300-838-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6312-1238-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6408-813-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6424-859-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6472-841-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6484-840-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6568-844-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6620-854-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6668-1257-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6724-978-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6780-1020-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6876-887-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6896-1048-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6928-1049-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6932-855-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6948-1234-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6960-856-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6972-973-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6992-1236-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7004-857-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7268-1261-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7288-1262-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7308-1263-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7616-1265-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7720-1266-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7732-1825-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7912-1278-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7920-1267-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7932-1643-0x0000000000400000-0x0000000000475000-memory.dmp
memory/8032-2056-0x0000000000400000-0x0000000000475000-memory.dmp