Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 00:22
General
- Target 2026-06-30_1bd6df1af151b6966ca4c6f76f4f76c1_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
- Size 10.1MB
- Sample260701-anzr4acy21
- SHA256 1b38c2986349bb1a4d9ee64a5f178d6f418188b04225d92c0c5c3f072d9ebfc7
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 33 IoCs
- UPX dump on OEP (original entry point) 33 IoCs
- Executes dropped EXE 6 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_1bd6df1af151b6966ca4c6f76f4f76c1_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_1bd6df1af151b6966ca4c6f76f4f76c1_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20208.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17282.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5790.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21368.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21368.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1699.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65506.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61585.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61585.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-555.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-555.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33232.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16458.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4957.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51859.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12409.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37164.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61787.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61787.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14823.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14823.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63939.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63939.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45396.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29569.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29569.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65389.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65389.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31529.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31529.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53481.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53481.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60803.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11007.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11007.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31749.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46275.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46275.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13308.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13308.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40146.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5980.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29544.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29544.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4322.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11187.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9844.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9844.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24474.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35512.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27063.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27063.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40829.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40829.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38656.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38656.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29569.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29569.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5961.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5961.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51593.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53253.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53253.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46337.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60373.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60373.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24584.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3048.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18647.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42729.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42729.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10650.exe10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22752.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22752.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63416.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4820.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53058.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53058.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51350.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2671.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2671.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49241.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21008.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21008.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15543.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51859.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28251.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28251.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4592.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4517.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49241.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30660.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53859.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48302.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48302.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29265.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29265.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21103.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60849.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35174.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55636.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55636.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55652.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11259.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6855.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6855.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49126.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49126.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26256.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26256.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17147.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44439.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44439.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60380.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25624.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25624.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60290.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60290.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40411.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35229.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30849.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7026.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2295.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2295.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52395.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11216.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24293.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33224.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33224.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39165.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21318.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21318.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49871.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49871.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61408.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21826.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53853.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53853.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32066.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32066.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59730.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15272.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15272.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13170.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51596.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51596.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24354.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24354.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42657.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36859.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28537.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33921.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33921.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51884.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51884.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52501.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33118.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33118.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8324.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9810.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31488.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65080.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15142.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28558.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2153.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2153.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4965.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4965.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29414.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29414.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46071.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46071.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32212.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47909.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47909.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61117.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50181.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31129.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3260.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3260.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41212.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5771.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8741.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34267.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60565.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60565.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25312.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9434.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9434.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36517.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29156.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4276.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9752.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9752.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1502.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1502.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7862.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47456.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47456.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54410.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26945.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26945.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58722.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28135.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23288.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23288.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41212.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7426.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36325.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23215.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23215.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41262.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17751.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17751.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56689.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56689.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15744.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51332.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3031.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3031.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53591.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53591.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4492.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55200.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55200.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34436.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14476.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14476.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61898.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61898.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24684.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24684.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3048.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45733.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43707.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43707.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34744.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26400.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26400.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51838.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52804.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37402.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38397.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46266.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14449.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14449.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56322.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16269.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16269.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59869.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45330.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45330.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-303.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6724.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23233.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23233.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63125.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34567.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34567.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52203.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52203.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32964.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59325.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7711.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7711.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10547.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23459.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23459.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46783.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46783.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3627.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30033.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41537.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22787.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22787.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29533.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29533.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53803.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34223.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34223.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55895.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55895.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47929.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47929.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36859.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56479.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56479.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10360.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10360.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20814.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20814.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3107.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27066.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27066.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-555.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-555.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40606.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3434.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3434.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40281.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40281.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45593.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43770.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52275.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52275.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20853.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20853.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55605.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55605.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6155.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63881.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-649.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-649.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62199.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62199.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51818.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51818.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56825.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56825.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41536.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64346.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57851.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57851.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8500.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8500.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28977.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28977.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16734.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18258.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18258.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33350.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38912.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38912.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55605.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55605.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28585.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28585.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31345.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35958.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52601.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52601.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20174.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22477.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60843.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60843.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9717.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9717.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22400.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22400.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20977.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20977.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32211.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32211.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15486.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10452.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10452.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32899.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32899.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26083.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26083.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4592.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38676.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30397.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62459.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62459.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25755.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25755.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37295.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37295.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31069.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58257.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27419.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38125.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13660.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36562.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36562.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15545.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-13310.exe
Unicorn-14823.exe
Unicorn-17282.exe
Unicorn-20208.exe
Unicorn-20426.exe
Unicorn-2295.exe
Unicorn-24584.exe
Unicorn-24684.exe
Unicorn-27699.exe
Unicorn-28537.exe
Unicorn-30849.exe
Unicorn-31129.exe
Unicorn-3260.exe
Unicorn-33176.exe
Unicorn-33679.exe
Unicorn-338.exe
Unicorn-33921.exe
Unicorn-34567.exe
Unicorn-35174.exe
Unicorn-41212.exe
Unicorn-41536.exe
Unicorn-46275.exe
Unicorn-47666.exe
Unicorn-47741.exe
Unicorn-52395.exe
Unicorn-54433.exe
Unicorn-55734.exe
Unicorn-56479.exe
Unicorn-5790.exe
Unicorn-60373.exe
Unicorn-61898.exe
Unicorn-7026.exe
Unicorn-9717.exe
memory/1004-920-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1076-925-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1128-426-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1140-1006-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1148-862-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1164-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1516-299-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1532-557-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1564-422-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1608-859-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1688-1050-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1772-916-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1844-70-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1924-304-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1960-894-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2096-425-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2152-270-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2172-861-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2368-424-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2440-644-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2456-911-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2468-1002-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2544-915-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2564-900-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2580-863-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2688-558-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2776-266-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2784-1028-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2824-857-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2872-298-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2976-922-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3036-897-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3060-297-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3084-423-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3140-457-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3144-926-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3152-921-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3276-891-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3388-303-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3640-892-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3660-909-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3844-1042-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3920-910-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4200-923-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4220-917-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4252-814-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4392-913-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4436-645-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4456-898-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4496-893-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4516-165-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4552-152-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4716-912-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4736-1017-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4852-899-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4920-43-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5188-272-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5232-865-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5264-420-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5372-269-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5776-421-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5816-895-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5904-919-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5916-271-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5944-302-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5980-456-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6060-896-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6080-864-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6128-531-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6132-1043-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6140-556-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6164-1051-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6180-914-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6212-1018-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6224-1019-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6228-1003-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6244-1022-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6304-1053-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6332-924-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6348-918-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6408-930-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6436-952-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6484-931-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6492-951-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6524-927-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6536-928-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6548-929-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6640-1027-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6712-932-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6760-1130-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6768-1046-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6776-1044-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6792-1020-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7128-998-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7164-1052-0x0000000000400000-0x0000000000475000-memory.dmp