Analysis
- max time kernel
34s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
30/06/2026, 09:28
General
- Target 2026-06-29_56bdd88c4d6546edb078564c4852090e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
- Size 17.7MB
- Sample260630-lftfwsby21
- SHA256 1004a77b2df7384fcb33982bc9bf87c3aa15e2e96ea7b44b695259b5e13311e1
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 27 IoCs
- UPX dump on OEP (original entry point) 27 IoCs
- Executes dropped EXE 17 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 16 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_56bdd88c4d6546edb078564c4852090e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_56bdd88c4d6546edb078564c4852090e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12991.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12991.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64771.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7466.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7466.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54062.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54062.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42153.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42153.exe11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40154.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23013.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12101.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12101.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12822.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52593.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11222.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11222.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58042.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63741.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11918.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11918.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45991.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45991.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9713.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44291.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44291.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41446.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41446.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22240.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22240.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37483.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58765.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6902.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6902.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47378.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56698.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42361.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42361.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20443.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20443.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53175.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54909.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54909.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15635.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60860.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18436.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16028.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16028.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25604.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30285.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55427.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35893.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30745.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19958.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9745.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20933.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20933.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17833.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17833.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40627.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65442.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65442.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33782.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33782.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-419.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62941.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57026.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60221.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60221.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54129.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3346.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23881.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36021.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14914.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14914.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29890.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51950.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28301.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3547.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38189.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24872.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-850.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63937.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63937.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34073.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34073.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21463.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21463.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13356.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34849.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1336.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5660.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50554.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50554.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3709.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3709.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7808.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7808.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13408.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30134.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47679.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22217.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54394.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54394.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63927.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63927.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36455.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36455.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43397.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8649.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8649.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50034.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21149.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21149.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50767.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32028.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32028.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15921.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15921.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34934.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47783.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47783.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18531.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7305.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7305.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61234.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28736.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45464.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45464.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20451.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20451.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26065.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26065.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32810.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52410.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55887.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26626.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26626.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26574.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46854.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46854.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65136.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65136.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51825.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51825.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3299.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58738.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5394.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5394.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45230.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45230.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19199.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19199.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34234.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16538.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16538.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17531.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6537.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25090.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9511.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59853.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59853.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41139.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41139.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45043.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7201.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7201.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5660.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49293.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59475.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41446.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41446.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25318.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25318.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34265.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34265.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8660.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49757.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59839.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59839.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-284.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-284.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42734.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20730.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30496.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30496.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-345.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24810.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46968.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2351.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2351.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30959.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30959.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26516.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26516.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48264.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48264.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-284.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-284.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21271.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15001.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15717.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15717.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30587.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41950.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27555.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27555.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11208.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46657.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34208.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9859.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31229.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21738.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40128.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40128.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38435.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55679.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46650.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36029.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16050.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16050.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25801.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30591.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30591.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55136.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55136.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10933.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10933.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46351.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46351.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61155.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61805.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61805.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55017.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40205.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21219.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9942.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9942.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46470.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46470.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38691.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-601.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-601.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45833.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45833.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16538.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16538.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55162.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46304.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46304.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41939.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41939.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44721.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44721.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24260.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24260.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8705.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8705.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6501.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16241.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10056.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10056.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40082.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40082.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4986.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30330.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30330.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60342.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38863.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64326.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58406.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35416.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25334.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29315.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49757.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36404.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3356.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4674.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9568.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21941.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16604.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56562.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56562.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16163.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37093.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37093.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25682.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33610.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33610.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13673.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13673.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61047.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61047.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10673.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10673.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51078.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54457.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54457.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46844.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46844.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9698.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16972.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29074.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29225.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29225.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4486.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17457.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17457.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56963.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56963.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1336.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31695.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31695.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12878.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29278.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29278.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41747.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41747.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36139.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36139.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2865.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2865.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46226.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47036.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13906.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13906.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34528.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41524.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38934.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37950.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3172.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51571.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51571.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45645.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27253.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27253.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5167.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18853.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18853.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3568.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36289.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36289.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-10056.exe
Unicorn-12991.exe
Unicorn-14914.exe
Unicorn-16187.exe
Unicorn-16538.exe
Unicorn-17531.exe
Unicorn-20008.exe
Unicorn-21514.exe
Unicorn-22217.exe
Unicorn-2865.exe
Unicorn-36021.exe
Unicorn-36139.exe
Unicorn-36404.exe
Unicorn-39964.exe
Unicorn-40966.exe
Unicorn-46650.exe
Unicorn-47679.exe
Unicorn-49757.exe
Unicorn-52410.exe
Unicorn-54909.exe
Unicorn-55679.exe
Unicorn-55887.exe
Unicorn-59839.exe
Unicorn-61858.exe
Unicorn-64771.exe
Unicorn-6738.exe
Unicorn-8018.exe
memory/52-533-0x0000000000400000-0x0000000000475000-memory.dmp
memory/460-762-0x0000000000400000-0x0000000000475000-memory.dmp
memory/564-91-0x0000000000400000-0x0000000000475000-memory.dmp
memory/792-661-0x0000000000400000-0x0000000000475000-memory.dmp
memory/808-283-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1028-219-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1040-282-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1108-984-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1120-85-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1320-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1324-500-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1336-937-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1340-280-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1400-222-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1484-977-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1520-218-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1544-281-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1700-664-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1860-717-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1880-662-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1888-220-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2024-217-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2040-300-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2248-221-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2396-284-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2520-532-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2552-940-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2572-985-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2596-1479-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2612-761-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2648-535-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2668-285-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2700-1561-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2752-534-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2804-765-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2840-501-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3000-749-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3368-536-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3596-84-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3812-764-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4360-665-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4452-986-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4508-712-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4576-973-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4940-719-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5152-1023-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5176-939-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5244-794-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5252-938-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5256-725-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5328-666-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5336-660-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5456-279-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5468-721-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5472-23-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5772-763-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5832-981-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5872-663-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5988-1555-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6016-1425-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6088-978-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6168-987-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6180-988-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6200-1426-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6204-1022-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6216-1427-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6236-1429-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6240-1024-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6276-1556-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6320-1025-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6332-1596-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6352-1557-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6360-1558-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6368-1026-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6400-1559-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6636-1075-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6660-1027-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6672-1028-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6680-1030-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6696-1031-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6752-1417-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6888-1418-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6912-1565-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6956-1144-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6972-1278-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6988-1337-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7060-1420-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7068-1419-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7080-1421-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7100-1423-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7124-1424-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7204-1563-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7288-1567-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7312-1597-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7320-1598-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7340-1599-0x0000000000400000-0x0000000000475000-memory.dmp