Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
03/07/2026, 04:29
General
- Target 2026-07-03_1f9b638a94706380b88c1930f6900458_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
- Size 20.5MB
- Sample260703-e4lmmabv2z
- SHA256 bc536e042d11a9a35e4cc4aec5bada9d1abe82f7607f8dc0394dd4c978222404
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 31 IoCs
- UPX dump on OEP (original entry point) 31 IoCs
- Executes dropped EXE 64 IoCs
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f9b638a94706380b88c1930f6900458_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_1f9b638a94706380b88c1930f6900458_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47188.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43732.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43732.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6171.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38706.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38706.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5934.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64383.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64383.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27927.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27927.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25455.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25455.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12860.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29118.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29118.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27901.exe7⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64335.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64335.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35173.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12896.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12896.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8325.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48959.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48959.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2805.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2805.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11726.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11726.exe7⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21064.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21064.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7644.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7644.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30725.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30725.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30039.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22508.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62015.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62015.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57262.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26582.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26582.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20620.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51885.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56895.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56895.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39791.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39791.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28311.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28311.exe8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exe7⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47743.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47743.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31692.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31692.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51830.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15549.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57526.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57526.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58943.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58943.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42181.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24814.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24814.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44319.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41959.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41959.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43109.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43109.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13829.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13829.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4953.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21164.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61792.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38661.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45567.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45567.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60822.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9728 -s 4726⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44274.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44274.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46334.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45551.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62830.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52749.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17765.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45149.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45149.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31060.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31060.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39135.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60934.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18621.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18621.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16237.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55974.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55974.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62037.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29436.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33054.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33054.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39087.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39087.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54512.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1989.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47846.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26951.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2165.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7031.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7031.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32548.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7980.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62183.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62183.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26007.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26007.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19757.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39669.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39669.exe5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29893.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25766.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30647.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53109.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53109.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6309.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51843.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51843.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41191.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14502.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14502.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58343.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58343.exe7⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15134.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49590.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49590.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48767.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9477.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11900.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63750.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63750.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44662.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55397.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18429.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18429.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58221.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58221.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17412.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44119.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44119.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56414.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56414.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42461.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10614.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36133.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36133.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27321.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21564.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31309.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18646.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18646.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42090.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49879.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49879.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65326.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37941.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10989.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15430.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22575.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16540.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36615.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36615.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48103.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64758.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30919.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60462.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60462.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16341.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18655.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18655.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50870.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7646.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7646.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17916.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2933.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2933.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5353.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20175.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3174.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40821.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40821.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43149.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43149.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41293.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27862.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19357.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23061.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23061.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3741.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15405.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15405.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-749.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51998.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51998.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59166.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4953.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24068.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24068.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17759.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8517.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49173.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61691.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15478.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15478.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21151.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21151.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42239.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42239.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53233.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53233.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2268.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2268.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62077.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62077.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57510.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45503.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45503.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17301.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40998.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40998.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16309.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13740.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13740.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51135.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47039.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22485.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33062.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33062.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42237.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35925.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32877.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32877.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33997.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33997.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55445.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45256.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45256.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29111.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55999.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14778.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14778.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29711.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29711.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6966.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8045.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8045.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12485.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12929.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12929.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3597.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3430.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46773.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46773.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10660.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18197.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18197.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11382.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11382.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3741.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30919.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62637.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11076.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11076.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7646.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7646.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58444.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58015.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58015.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35183.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35183.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54271.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28999.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32471.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32471.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16286.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6957.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29743.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29743.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43237.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23788.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18341.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26797.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26797.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5213.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38063.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38063.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6950.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26125.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15356.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21620.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11334.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63094.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30237.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55826.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41503.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41503.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28255.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28255.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36287.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6981.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6981.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61381.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61381.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1349.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12964.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8773.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8773.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61878.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20716.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20716.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50437.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50437.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19909.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19909.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2982.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2982.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41055.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15366.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15366.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52830.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10076.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10076.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58397.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37615.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37615.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34700.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34700.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36637.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50857.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-782.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-782.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-952.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-952.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60018.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11483.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65223.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65223.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25271.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62183.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62183.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2078.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7405.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7405.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51470.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51470.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21620.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3589.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3589.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42469.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42469.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33492.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21221.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21221.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28724.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44710.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44710.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20191.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11790.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4920.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4920.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48029.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7236.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7236.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18783.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18783.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36325.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3396.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55926.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55926.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17487.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17487.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20759.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65205.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14484.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63192.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63192.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51647.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19901.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32916.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50733.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14044.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14044.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3174.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54319.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48319.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20759.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54454.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54454.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17005.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17005.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-374.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56669.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56669.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49919.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48959.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48959.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18477.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13421.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13421.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8222.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8222.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51893.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60349.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10333.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10333.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11218.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11218.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6422.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6422.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30703.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30703.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35068.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35068.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53624.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53624.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6108.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6108.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17765.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45149.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45149.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8684 -s 4365⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-989.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64127.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64127.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48902.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48902.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52957.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55973.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55973.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57734.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53026.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41991.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41991.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28359.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28359.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10157.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10157.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21911.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12341.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26415.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26415.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55989.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58191.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31228.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31228.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49173.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62742.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62742.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53911.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49767.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42237.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28428.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60695.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60695.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22919.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53624.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53624.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28301.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 8684 -ip 86841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 9728 -ip 97281⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-10660.exe
Unicorn-11218.exe
Unicorn-11483.exe
Unicorn-14044.exe
Unicorn-14778.exe
Unicorn-19909.exe
Unicorn-20175.exe
Unicorn-33054.exe
Unicorn-33180.exe
Unicorn-38706.exe
Unicorn-41191.exe
Unicorn-42090.exe
Unicorn-43732.exe
Unicorn-44274.exe
Unicorn-46363.exe
Unicorn-47188.exe
Unicorn-50259.exe
Unicorn-51843.exe
Unicorn-51885.exe
Unicorn-53026.exe
Unicorn-5353.exe
Unicorn-55826.exe
Unicorn-57155.exe
Unicorn-58015.exe
Unicorn-5934.exe
Unicorn-60018.exe
Unicorn-61691.exe
Unicorn-6171.exe
Unicorn-63268.exe
Unicorn-6422.exe
Unicorn-65223.exe
memory/544-928-0x0000000000400000-0x0000000000475000-memory.dmp
memory/608-564-0x0000000000400000-0x0000000000475000-memory.dmp
memory/696-1499-0x0000000000400000-0x0000000000475000-memory.dmp
memory/764-847-0x0000000000400000-0x0000000000475000-memory.dmp
memory/832-1131-0x0000000000400000-0x0000000000475000-memory.dmp
memory/984-613-0x0000000000400000-0x0000000000475000-memory.dmp
memory/996-1504-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1176-892-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1372-558-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1420-1472-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1452-576-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1624-741-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1644-1420-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1652-953-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1744-180-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1744-845-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1748-1503-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1756-895-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1772-559-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1808-1501-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1864-879-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1888-727-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1924-1502-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1964-513-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1984-497-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1984-19-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2096-1293-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2140-934-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2284-637-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2332-124-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2332-618-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2336-1053-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2336-283-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2480-1583-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2512-877-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2560-1419-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2576-424-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2576-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2696-458-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2712-1584-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2820-172-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2820-708-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2896-878-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2956-1498-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3020-742-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3028-579-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3048-619-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3056-565-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3056-77-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3184-1421-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3184-339-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3280-1418-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3328-1130-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3336-920-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3372-927-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3488-880-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3492-1505-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3556-539-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3624-1500-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3672-596-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3688-512-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3688-30-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3760-1242-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3796-942-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3824-1671-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3936-941-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3960-1346-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4128-1533-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4244-1294-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4264-876-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4268-785-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4268-173-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4320-944-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4340-566-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4368-1375-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4404-493-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4428-855-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4600-1473-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4620-707-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4628-998-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4652-141-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4652-651-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4728-125-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4728-635-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4780-943-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4780-265-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4788-916-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4808-915-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4828-1422-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4912-527-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4952-617-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4968-1560-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4984-856-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5116-340-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5116-1423-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5724-634-0x0000000000400000-0x0000000000475000-memory.dmp