Analysis
- max time kernel
148s - max time network
91s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
03/07/2026, 12:39
General
- Target 2026-07-03_4df29eff27367e74db5c038404250fb5_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe
- Size 16.2MB
- Sample260703-pvmtfaes7l
- SHA256 15666a87c06f779ebc8c4bb1f603d3a3724605b4c6e8ec7b834dfb0f7ea471f0
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 28 IoCs
- Custom signatureUPX dump on OEP (original entry point) 28 IoCs
- Executes dropped EXE 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_4df29eff27367e74db5c038404250fb5_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_4df29eff27367e74db5c038404250fb5_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41217.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1414.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1414.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1902.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1902.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62925.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62352.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62352.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30635.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11911.exe10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65194.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61195.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22131.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29326.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60168.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6347.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6347.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18584.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64293.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40796.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40796.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11795.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13430.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31953.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63904.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63904.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3198.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3198.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57620.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27068.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27068.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11598.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11598.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59415.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59415.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33194.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21528.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26068.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26068.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7422.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7422.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34823.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34823.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2171.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8564.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13524.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58304.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58304.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17698.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57210.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57210.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28201.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28201.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60895.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60895.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-444.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55699.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45404.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50903.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50903.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42180.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50119.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50119.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63208.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5990.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21743.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21743.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7592.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17740.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17740.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63852.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14983.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60313.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16370.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16370.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48379.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48379.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22650.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31813.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6473.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6473.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47770.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60839.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60839.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1833.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1833.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49094.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1412.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4371.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4371.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42322.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31802.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31802.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23099.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23099.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13524.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42802.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42802.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2799.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58758.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33764.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33764.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37206.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44492.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35496.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35496.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3826.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38196.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38196.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23909.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23909.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48865.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48865.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19257.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63946.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49358.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49358.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40659.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65194.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13477.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4500.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4500.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16790.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22786.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22786.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1144.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1144.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11018.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20542.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20542.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17537.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22275.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22275.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44522.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36581.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15690.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7768.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7768.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28033.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27997.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27997.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48818.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48818.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55549.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58891.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58891.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37313.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55434.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55434.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57587.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8237.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55731.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55731.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39586.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51527.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21222.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21222.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5960.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5960.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13971.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13971.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28513.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48310.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48310.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9181.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28218.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28218.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7402.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65442.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65442.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20789.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20789.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54044.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54044.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24911.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27782.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27782.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23752.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23752.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31032.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14298.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14298.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23038.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23038.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4719.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59026.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48865.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48865.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44792.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60810.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35990.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28892.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28892.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14528.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21922.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30635.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26785.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43894.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43894.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17266.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54003.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54676.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16390.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16390.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26525.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42026.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1081.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1081.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42334.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42776.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42776.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61891.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61891.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51052.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5986.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27087.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27087.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61932.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61932.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65326.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45865.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45865.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26752.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26752.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30059.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45788.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10228.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10228.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39586.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1355.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1355.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51531.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3453.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3453.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10287.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3049.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3049.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46161.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46161.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21969.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21969.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38046.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54060.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54060.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46072.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61299.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47862.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16271.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23121.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16671.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16671.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32191.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27183.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27183.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11386.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11386.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2466.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2466.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9704.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9704.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1736.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24626.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24626.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26923.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8766.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32882.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46530.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39672.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39672.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20379.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20379.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62973.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62973.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18316.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18316.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8637.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58237.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8663.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48756.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48756.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47573.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47573.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42948.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19681.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27002.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27002.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6706.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6706.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55575.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21191.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36545.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33986.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49645.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49557.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49557.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42705.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42705.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21704.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21704.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60017.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48502.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48502.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31170.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9166.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48865.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48865.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33090.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53322.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48595.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39940.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39940.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62179.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30059.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55191.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39416.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36545.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58362.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58362.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16736.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7483.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28513.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63494.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22839.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22839.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4106.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52522.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34698.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21570.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21570.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1621.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1621.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24604.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36150.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33186.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44250.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5952.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5952.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50640.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50640.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38046.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2928.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2928.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13602.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13602.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58652.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63754.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63754.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20406.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17266.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20490.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20490.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65508.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43478.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43478.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63305.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63305.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49275.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49275.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5863.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57608.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57608.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24652.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4767.exe2⤵
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-1414.exe
Unicorn-14528.exe
Unicorn-14793.exe
Unicorn-1902.exe
Unicorn-20408.exe
Unicorn-20542.exe
Unicorn-22650.exe
Unicorn-24626.exe
Unicorn-27087.exe
Unicorn-28115.exe
Unicorn-33764.exe
Unicorn-34283.exe
Unicorn-37206.exe
Unicorn-38362.exe
Unicorn-3940.exe
Unicorn-41217.exe
Unicorn-444.exe
Unicorn-44492.exe
Unicorn-49557.exe
Unicorn-49645.exe
Unicorn-5863.exe
Unicorn-5986.exe
Unicorn-60465.exe
Unicorn-60895.exe
Unicorn-61897.exe
Unicorn-62925.exe
Unicorn-8663.exe
Unicorn-9416.exe
memory/552-763-0x0000000000400000-0x0000000000475000-memory.dmp
memory/720-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/984-446-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1132-255-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1148-817-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1152-722-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1220-260-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1300-816-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1328-867-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1416-893-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1716-279-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1776-1451-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1884-869-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1924-842-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1944-721-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1984-52-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2108-1443-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2160-449-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2220-379-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2252-471-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2292-813-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2300-257-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2468-779-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2504-1465-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2584-448-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2604-844-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2848-905-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2864-723-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3076-865-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3184-472-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3332-841-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3392-393-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3448-896-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3480-814-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3512-469-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3660-691-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3840-877-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3852-894-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3904-843-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3916-447-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3988-879-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4088-878-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4188-1453-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4208-259-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4220-815-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4344-866-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4376-1364-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4472-895-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4684-261-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4728-840-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4772-769-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4836-818-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4908-846-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4920-727-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4960-724-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5060-470-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5072-1441-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5136-864-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5188-726-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5436-258-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5552-765-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5596-445-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5636-845-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5772-1452-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5816-256-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5896-764-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5900-768-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5948-559-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5996-725-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6040-819-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6044-868-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6212-979-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6280-1429-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6348-1193-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6376-1152-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6524-1191-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6532-978-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6612-1192-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6644-1455-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6760-1454-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7016-1462-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7060-1464-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7180-1442-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7336-1467-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7492-1444-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7500-1461-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7508-1445-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7536-1460-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7876-1446-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7884-1450-0x0000000000400000-0x0000000000475000-memory.dmp
memory/8104-1456-0x0000000000400000-0x0000000000475000-memory.dmp
memory/8112-1457-0x0000000000400000-0x0000000000475000-memory.dmp
memory/8124-1458-0x0000000000400000-0x0000000000475000-memory.dmp
memory/8140-1466-0x0000000000400000-0x0000000000475000-memory.dmp
memory/8148-1459-0x0000000000400000-0x0000000000475000-memory.dmp
memory/8184-1463-0x0000000000400000-0x0000000000475000-memory.dmp