Analysis
- max time kernel
145s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/07/2026, 12:35
General
- Target 2026-07-14_c63fe907cbeb4cbf853e44b0c06ffa29_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
- Size 12.9MB
- Sample260714-psep2sfw3s
- SHA256 e520bcf619090aeeaa61c7ecd5762af64cf941633347699c8a324d61c4a87651
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 30 IoCs
- UPX dump on OEP (original entry point) 30 IoCs
- Executes dropped EXE 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_c63fe907cbeb4cbf853e44b0c06ffa29_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_c63fe907cbeb4cbf853e44b0c06ffa29_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57294.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57294.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62167.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45406.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38533.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38533.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18072.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2005.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2005.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36588.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50052.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63849.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33971.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33971.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35257.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55575.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35228.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35228.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9434.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9434.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53478.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53478.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33910.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13043.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46717.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46717.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16134.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13551.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17495.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17495.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1034.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54465.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26801.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7806.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7806.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46525.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14937.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14937.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30458.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5938.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56139.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56139.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55738.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2399.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2399.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38357.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34673.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34673.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8593.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47672.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47672.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45607.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45607.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11792.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1676.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1029.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12171.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33660.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53707.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53707.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35026.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53356.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5295.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5295.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-125.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38191.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17164.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2259.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33054.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33054.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44455.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44455.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7843.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7843.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21220.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21220.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16654.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55938.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5622.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5622.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36152.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36152.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43125.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22237.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33116.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33116.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57987.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24790.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27904.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27904.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50230.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50230.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60256.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60256.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-962.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-962.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18913.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18913.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64406.exe10⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29337.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30297.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30297.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8850.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46493.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55648.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43744.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37266.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48506.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30158.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51325.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14272.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14272.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32125.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25332.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37971.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37971.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53245.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53245.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63079.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1979.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18206.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11226.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8139.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8139.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52445.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16785.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21791.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21791.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16899.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16899.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50386.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50386.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28366.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28366.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27646.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27646.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39924.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30023.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30023.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17356.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57592.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60780.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60780.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20211.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20211.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60893.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59161.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59161.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36868.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6881.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49483.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46260.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46260.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49800.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49800.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25000.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25000.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23131.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65175.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1771.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27252.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13318.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13318.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14483.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27095.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10344.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50106.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39498.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39498.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64406.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16365.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16365.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4890.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7541.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7541.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64449.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64449.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-614.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50080.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33997.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33997.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47163.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18999.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35799.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-604.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39362.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39362.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56950.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8560.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2525.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15286.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29262.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55938.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8320.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8320.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63956.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55285.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35922.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32387.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32387.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22898.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22898.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12259.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30581.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34481.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34481.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6284.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6284.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53409.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2010.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2010.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37904.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37904.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14044.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14044.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39084.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24698.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64568.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16531.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51480.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51480.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3882.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44086.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44086.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15654.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18644.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18644.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21383.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21383.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9396.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19089.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19089.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8985.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41034.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15808.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15808.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63915.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63915.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51752.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51752.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1676.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55845.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19349.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40323.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50718.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50718.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27853.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27853.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54552.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54552.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21999.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40049.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40049.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42322.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2170.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65042.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44101.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44101.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22519.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22519.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34900.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51405.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51405.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52150.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24821.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24821.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35493.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17164.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60708.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60708.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60085.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14101.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14101.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20384.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20384.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5897.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25213.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6317.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6317.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37971.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37971.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18050.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18050.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13956.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46567.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46567.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48859.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18648.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57480.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57480.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57049.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57049.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2176.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44603.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32333.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32333.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50750.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50750.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59836.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59836.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34967.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34967.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23037.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24235.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18435.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63992.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63992.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21798.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21798.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13575.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3058.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3058.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5596.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5596.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46297.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46297.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52751.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52751.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3067.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3067.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58502.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58502.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27194.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44226.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37817.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53900.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28997.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28997.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46701.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27091.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27091.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4338.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4338.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25729.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25729.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54771.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32896.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32896.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8977.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8977.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43406.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47008.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47008.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56281.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56281.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25445.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65383.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65383.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41056.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41056.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62227.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62227.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9675.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4968.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-11856.exe
Unicorn-15286.exe
Unicorn-1676.exe
Unicorn-16910.exe
Unicorn-19371.exe
Unicorn-23037.exe
Unicorn-23131.exe
Unicorn-24235.exe
Unicorn-2525.exe
Unicorn-26801.exe
Unicorn-27904.exe
Unicorn-28997.exe
Unicorn-29262.exe
Unicorn-36072.exe
Unicorn-37971.exe
Unicorn-44101.exe
Unicorn-45406.exe
Unicorn-48197.exe
Unicorn-50657.exe
Unicorn-53478.exe
Unicorn-55938.exe
Unicorn-57294.exe
Unicorn-61742.exe
Unicorn-62167.exe
Unicorn-65042.exe
Unicorn-65175.exe
Unicorn-7541.exe
Unicorn-7806.exe
Unicorn-8560.exe
Unicorn-9396.exe
memory/624-1639-0x0000000000400000-0x0000000000475000-memory.dmp
memory/800-1694-0x0000000000400000-0x0000000000475000-memory.dmp
memory/916-879-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1096-719-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1120-605-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1128-721-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1300-837-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1332-653-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1356-1699-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1404-602-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1520-722-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1604-309-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1712-500-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1716-487-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1728-536-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2064-603-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2520-277-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2844-275-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3252-49-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3260-604-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3264-935-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3308-720-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3332-601-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3340-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3348-1108-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3464-1372-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3700-1609-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3772-199-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3836-836-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3840-570-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3908-501-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4012-1110-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4112-1104-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4164-1373-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4200-150-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4308-152-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4816-488-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5116-883-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5212-884-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5216-885-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5316-1638-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5464-1200-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5472-1371-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5584-1701-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5684-292-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5792-276-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5892-310-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6128-151-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6204-1102-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6216-1003-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6232-1690-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6244-1640-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6316-1100-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6400-1101-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6472-1696-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6496-1698-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6504-1684-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6516-1692-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6568-1201-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6616-1105-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6640-1695-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6644-1106-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6676-1367-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6752-1197-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6804-1198-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6824-1199-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6840-1376-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7016-1211-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7036-1322-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7056-1366-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7148-1368-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7156-1369-0x0000000000400000-0x0000000000475000-memory.dmp