Analysis
- max time kernel
50s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 17:47
General
- Target 2026-07-08_657b7c5373fef44226dc572abc72b78a_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe
- Size 16.2MB
- Sample260708-wddb1aez8x
- SHA256 c5597d061a119fc8aab2a5bcf46c33c47df360c7d8882bbcb37a4e6818b7cff9
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 27 IoCs
- UPX dump on OEP (original entry point) 27 IoCs
- Executes dropped EXE 24 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 25 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_657b7c5373fef44226dc572abc72b78a_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_657b7c5373fef44226dc572abc72b78a_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22417.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22417.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24109.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24109.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47627.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55743.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55743.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6550.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6550.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39410.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20786.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20786.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35050.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35050.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2659.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30301.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55829.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55829.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45300.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35216.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3716.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3716.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48544.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48544.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28388.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28388.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27262.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21014.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63338.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63338.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45638.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14048.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31180.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46416.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe10⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3835.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54833.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54833.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11894.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11894.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47324.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1377.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1377.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38932.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38932.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43812.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43812.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45881.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53110.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53110.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5284.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5284.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61180.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51106.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47142.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10057.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10057.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65336.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26280.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26280.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38719.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23806.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23806.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28139.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28139.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12352.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12352.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7360.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7360.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11771.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11832.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11832.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24403.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30312.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25000.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25000.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53036.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63167.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18387.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18387.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56867.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56867.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27048.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63401.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63401.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62989.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38155.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46177.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46177.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44245.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44245.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53219.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15643.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34333.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34333.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57717.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57717.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57121.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19509.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19509.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30976.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30976.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35877.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35877.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64983.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42612.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54485.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8895.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8895.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25268.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25268.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3873.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3873.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35336.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19019.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19019.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60002.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60002.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52477.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48616.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48616.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61906.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61906.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37754.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37754.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1200.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1200.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51490.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51490.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17680.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17680.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41325.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32210.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32210.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42290.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42290.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18492.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54485.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51106.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13655.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13655.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50370.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50370.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5362.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5362.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25550.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25550.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45248.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45248.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20635.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64775.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64775.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52126.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52126.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40013.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62523.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62523.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31128.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31128.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2098.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2098.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4672.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4672.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6353.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24354.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24354.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33002.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33002.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48952.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48952.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55217.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43764.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43764.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55845.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41163.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34333.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34333.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27335.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27335.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26821.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26821.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12672.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12672.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58839.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58839.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51320.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51320.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40376.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30312.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59234.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5117.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29156.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-313.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62730.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30892.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30892.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36857.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50110.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50110.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52265.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52265.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25257.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56459.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56459.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62593.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55743.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55743.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19872.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61496.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61496.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25181.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27946.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33412.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17613.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17613.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22522.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35408.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36992.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36992.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51216.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58288.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58288.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61588.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-759.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3607.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3607.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33427.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49882.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32062.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32062.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14453.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14453.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19072.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39841.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39841.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22914.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3603.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48786.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48786.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44245.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44245.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5580.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5580.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60868.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28809.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28809.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29285.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52622.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52622.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8485.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31656.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31656.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35979.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36919.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38881.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30634.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8736.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33332.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34808.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34808.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48647.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18435.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46707.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46707.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44553.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54515.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54515.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62098.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62098.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28256.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28256.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45762.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39175.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12077.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12077.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7303.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24526.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24526.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4401.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4401.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19487.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19487.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62488.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51397.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45532.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52103.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33951.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5284.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5284.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4728.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4728.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51911.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44475.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41194.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24273.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6721.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6721.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22275.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22275.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30023.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30023.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1200.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1200.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49243.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49243.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4984.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4984.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34297.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34297.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1481.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1481.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35326.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31128.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31128.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50588.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63862.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40312.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30205.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33147.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42887.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23364.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46612.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12636.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12636.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5373.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5373.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35061.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35061.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22664.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22664.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46805.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46805.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11553.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55554.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55554.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30070.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25870.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40106.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51692.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51692.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62757.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59471.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59471.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51647.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28137.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28137.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21710.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21710.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1213.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-12672.exe
Unicorn-13327.exe
Unicorn-1481.exe
Unicorn-19544.exe
Unicorn-19872.exe
Unicorn-22417.exe
Unicorn-24109.exe
Unicorn-30509.exe
Unicorn-32210.exe
Unicorn-34808.exe
Unicorn-35061.exe
Unicorn-35326.exe
Unicorn-35877.exe
Unicorn-39410.exe
Unicorn-40013.exe
Unicorn-44245.exe
Unicorn-45532.exe
Unicorn-47627.exe
Unicorn-48647.exe
Unicorn-50375.exe
Unicorn-55743.exe
Unicorn-56459.exe
Unicorn-6.exe
Unicorn-62523.exe
Unicorn-62593.exe
Unicorn-64983.exe
Unicorn-6550.exe
memory/124-406-0x0000000000400000-0x0000000000475000-memory.dmp
memory/428-512-0x0000000000400000-0x0000000000475000-memory.dmp
memory/596-515-0x0000000000400000-0x0000000000475000-memory.dmp
memory/612-315-0x0000000000400000-0x0000000000475000-memory.dmp
memory/720-1062-0x0000000000400000-0x0000000000475000-memory.dmp
memory/888-644-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1144-79-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1188-1220-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1268-1066-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1364-1038-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1408-544-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1692-330-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1912-616-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2032-683-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2312-564-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2348-80-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2604-708-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2648-960-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3160-347-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3452-682-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3528-113-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3552-1037-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3556-563-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3588-871-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3712-1000-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3908-873-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4064-331-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4508-346-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4664-493-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4752-408-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4812-35-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4824-561-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4864-345-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4872-513-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4892-1138-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4892-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4992-645-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5152-1006-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5360-681-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5480-740-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5628-1167-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5700-495-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5772-214-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5836-562-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5896-204-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5964-494-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6016-999-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6020-492-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6156-1003-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6220-872-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6484-905-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6504-1001-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6544-906-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6628-1005-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6760-888-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6824-1064-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6944-907-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7008-1065-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7064-889-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7116-870-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7196-1004-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7216-1072-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7344-1192-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7348-1135-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7364-1039-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7372-1134-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7396-1049-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7408-1040-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7444-1136-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7540-1168-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7556-1157-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7564-1169-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7688-1275-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7784-1170-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7792-1195-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7840-1200-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7920-1196-0x0000000000400000-0x0000000000475000-memory.dmp