Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/07/2026, 19:55
General
- Target 2026-07-02_a24874041d35d84b2d3924f974967e06_agent-tesla_akira_amadey_cobalt-strike_coinminer_cryptbo.exe
- Size 35.7MB
- Sample260702-ym4xesav6k
- SHA256 96e782157a37b8df2bd8ad024b833e89848b45e6de73b8c4737bba60b1f9d745
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Custom signatureDetects executables Discord URL observed in first stage droppers 59 IoCs
- Custom signatureDetects executables containing possible sandbox analysis VM usernames 12 IoCs
- Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 12 IoCs
- Custom signatureUPX dump on OEP (original entry point) 59 IoCs
- Executes dropped EXE 8 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 59 IoCs
Inno Setup installer
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a24874041d35d84b2d3924f974967e06_agent-tesla_akira_amadey_cobalt-strike_coinminer_cryptbo.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_a24874041d35d84b2d3924f974967e06_agent-tesla_akira_amadey_cobalt-strike_coinminer_cryptbo.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40465.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53869.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25411.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44627.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19769.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19769.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42095.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37191.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8680.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8680.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32569.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32569.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63103.exe12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27550.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27550.exe11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-999.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50427.exe10⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17682.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31845.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61406.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11025.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11025.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18385.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18385.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-704.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-704.exe10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30736.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2655.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2655.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28922.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8170.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57803.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8301.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-432.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52416.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38421.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38421.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11124.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11124.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21167.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61228.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61228.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44808.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44808.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39605.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39605.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28917.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28917.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37037.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46753.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46753.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63513.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25545.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45242.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6863.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47538.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47538.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20907.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20907.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22420.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22420.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24101.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24101.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10361.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10361.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45835.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37059.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42883.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42883.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59390.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59390.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12560.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59780.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59780.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34314.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5397.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27658.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20497.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20497.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42740.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42740.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12664.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12664.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24350.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47337.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5682.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16423.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16423.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5710.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5710.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54923.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3946.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53675.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52354.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52354.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18358.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18358.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38156.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40013.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40897.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9115.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9115.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7510.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59981.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59981.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15286.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10962.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10962.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62852.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54103.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26888.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26888.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10292.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10292.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18691.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29075.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29075.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21269.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21269.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8897.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6516.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6516.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52951.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57022.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19436.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57803.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57181.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56755.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56755.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23931.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23931.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4847.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53412.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12665.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48294.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48294.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28836.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28836.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27639.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64784.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64784.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43475.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48689.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48689.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18001.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62985.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3379.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3379.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15597.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2655.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2655.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35783.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35783.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19612.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64362.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64362.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6962.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6962.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47549.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26501.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6467.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6467.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28728.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28728.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47418.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47418.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30589.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30589.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30012.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9619.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60687.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60687.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57035.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57035.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20143.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10859.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4466.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4466.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44979.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51018.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6468.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6468.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47911.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13895.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13895.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54103.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47810.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54855.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54855.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51290.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51290.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24223.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24223.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40253.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40253.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2463.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2463.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18235.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34594.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15046.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32290.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32290.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54103.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6877.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6877.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48194.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18835.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18425.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23839.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23839.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41632.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24392.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24392.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41278.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41278.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64444.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49527.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52951.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24553.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64730.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18939.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18939.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46071.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46071.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34159.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34159.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49635.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48194.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6270.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6270.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17072.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36891.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36891.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54247.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54247.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31967.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31967.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11189.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-537.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17605.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17605.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21177.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21177.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31142.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37300.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29490.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29490.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-517.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42669.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42669.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58571.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58571.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8742.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8742.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35899.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35899.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12904.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12904.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63488.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57841.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57841.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32317.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32317.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3371.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3371.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48706.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48706.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26501.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57504.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57504.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21138.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21138.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55862.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54103.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48194.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51995.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51995.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53675.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22176.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10766.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52679.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23330.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23330.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34394.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34394.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61354.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61354.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54195.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62987.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46589.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46589.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61699.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38129.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57947.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57947.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12743.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12743.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59982.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59982.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3496.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3496.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51803.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60583.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60583.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22905.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1574.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1574.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56303.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34067.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34067.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32261.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32261.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34337.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32893.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52353.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1591.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1591.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45224.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45224.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-76.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-76.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18555.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18555.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22949.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34323.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29499.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29499.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2048.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15841.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15841.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30728.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30728.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1424.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1424.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53557.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53557.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50844.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50844.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44736.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3252.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25425.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9038.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9038.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41306.exe6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 807⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51884.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51884.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59643.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5708.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5708.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55862.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35078.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35991.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35991.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43532.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20317.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20317.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60122.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42121.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16173.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19872.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26208.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28474.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52327.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52327.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33085.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11010.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11010.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10608.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10608.exe6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35774.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35774.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34458.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16359.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16359.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18641.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18641.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61809.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61809.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9760.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9760.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62733.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28281.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28281.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18235.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21627.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23219.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45243.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45243.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46921.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46921.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49595.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1172 -ip 11721⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /hc /shared Global\e773a8a57acc4b7d91d92d763738d109 /t 4764 /p 20001⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-10292.exe
Unicorn-10292.exe
Unicorn-12560.exe
Unicorn-12560.exe
Unicorn-13215.exe
Unicorn-13215.exe
Unicorn-13215.exe
Unicorn-14786.exe
Unicorn-14786.exe
Unicorn-1574.exe
Unicorn-1574.exe
Unicorn-16423.exe
Unicorn-16423.exe
Unicorn-18425.exe
Unicorn-18425.exe
Unicorn-18425.exe
Unicorn-18691.exe
Unicorn-18691.exe
Unicorn-23609.exe
Unicorn-23609.exe
Unicorn-24019.exe
Unicorn-25411.exe
Unicorn-25411.exe
Unicorn-33915.exe
Unicorn-33915.exe
Unicorn-34067.exe
Unicorn-34067.exe
Unicorn-39391.exe
Unicorn-39391.exe
Unicorn-40465.exe
Unicorn-43475.exe
Unicorn-43475.exe
Unicorn-44627.exe
Unicorn-44627.exe
Unicorn-46246.exe
Unicorn-496.exe
Unicorn-496.exe
Unicorn-53869.exe
Unicorn-54195.exe
Unicorn-54195.exe
Unicorn-56303.exe
Unicorn-56303.exe
Unicorn-58571.exe
Unicorn-58571.exe
Unicorn-60122.exe
Unicorn-60122.exe
Unicorn-60325.exe
Unicorn-60325.exe
Unicorn-60325.exe
Unicorn-60325.exe
Unicorn-62935.exe
Unicorn-62935.exe
Unicorn-64362.exe
Unicorn-64362.exe
Unicorn-64730.exe
Unicorn-6863.exe
Unicorn-6863.exe
Unicorn-9760.exe
Unicorn-9760.exe
memory/112-1399-0x0000000000400000-0x0000000000475000-memory.dmp
memory/212-705-0x0000000000400000-0x0000000000475000-memory.dmp
memory/632-754-0x0000000000400000-0x0000000000475000-memory.dmp
memory/632-89-0x0000000000400000-0x0000000000475000-memory.dmp
memory/648-1418-0x0000000000400000-0x0000000000475000-memory.dmp
memory/676-688-0x0000000000400000-0x0000000000475000-memory.dmp
memory/728-1391-0x0000000000400000-0x0000000000475000-memory.dmp
memory/872-1229-0x0000000000400000-0x0000000000475000-memory.dmp
memory/968-1398-0x0000000000400000-0x0000000000475000-memory.dmp
memory/972-1125-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1068-1422-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1076-1397-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1120-860-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1204-918-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1228-1405-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1288-1339-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1468-1402-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1472-1415-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1524-1406-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1548-1228-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1552-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1552-537-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1580-1315-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1684-1421-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1740-1408-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1888-1381-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1956-1410-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1960-1340-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2080-1393-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2084-1341-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2160-1404-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2252-1394-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2308-1371-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2328-778-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2344-1365-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2384-989-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2400-825-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2496-1414-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2512-727-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2720-1373-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2852-1401-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2884-653-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3172-1419-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3288-1409-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3380-1413-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3404-1124-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3420-1388-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3512-1227-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3536-940-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3720-1126-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3756-644-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3760-612-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3856-820-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3856-98-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3932-1226-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4076-554-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4176-1407-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4184-1416-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4268-1093-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4372-1400-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4376-19-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4376-614-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4412-851-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4440-1417-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4600-967-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4624-250-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4624-1372-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4664-1403-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4672-779-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4672-90-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4676-1412-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4732-748-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4740-1420-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4752-968-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4800-777-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4800-88-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4812-1225-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4816-1091-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4928-1395-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4936-1396-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4948-780-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4948-91-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4984-1092-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4992-1380-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5072-969-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5140-1423-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5172-1424-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5180-1411-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5188-1425-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5208-1426-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5252-375-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5500-524-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6536-687-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6704-804-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7004-850-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7056-821-0x0000000000400000-0x0000000000475000-memory.dmp