Analysis
- max time kernel
122s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
16/07/2026, 14:05
General
- Target 2026-07-16_53e38e17d61ef10fba58bf763ec616bd_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe
- Size 12.8MB
- Sample260716-rd2mdae13k
- SHA256 14412646cf58505cf2c6265f72a70eb30e2288b7b2ff120c23b9abc77f0ccd93
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 32 IoCs
- UPX dump on OEP (original entry point) 32 IoCs
- Executes dropped EXE 64 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_53e38e17d61ef10fba58bf763ec616bd_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_53e38e17d61ef10fba58bf763ec616bd_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63719.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46623.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46623.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64215.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64215.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40531.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55103.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41723.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63591.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63591.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11614.exe9⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34879.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34879.exe10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49466.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49466.exe9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25853.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25853.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64129.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32433.exe7⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17752.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17752.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56518.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56518.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12459.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12459.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8069.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2226.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63923.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64512.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36969.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36969.exe8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33689.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33689.exe7⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35296.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35296.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14524.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30136.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30136.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30112.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30112.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39103.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11033.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13513.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16536.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64774.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64774.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9989.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24095.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60675.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19832.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19832.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12459.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12459.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47566.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47566.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2292.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2292.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43585.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43585.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59713.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52995.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52995.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13076.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13076.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65174.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44442.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44442.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52559.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52559.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58314.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18636.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18636.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15085.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58339.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4137.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4137.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38849.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58635.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe7⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31349.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37145.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37145.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-789.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-789.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43866.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1246.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1246.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48821.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48821.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31281.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31281.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32276.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40392.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40392.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62242.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64016.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17109.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17109.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60925.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30667.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30667.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40997.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40997.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61494.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38947.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38947.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22791.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22791.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25800.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25800.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31246.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31246.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4867.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4867.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20461.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57815.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57815.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36015.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36015.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10566.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10566.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11645.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43623.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43623.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33740.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33740.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53701.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59309.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4109.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4109.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36515.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36515.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51126.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51126.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32673.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32673.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36255.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36255.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46094.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59787.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59787.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38651.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38651.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17616.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17616.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-877.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-877.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15344.exe7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3844.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3844.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42831.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42831.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28366.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28366.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41437.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41437.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36648.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7057.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7057.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-422.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-422.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51811.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9870.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60675.exe8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7580.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7580.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36306.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28261.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28261.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13041.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13041.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37935.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32419.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1609.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22275.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22275.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1349.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49677.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49677.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41868.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19414.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19414.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38215.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38215.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44131.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55409.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50166.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62905.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64129.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28925.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29429.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29429.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42257.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32536.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7805.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7805.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48393.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48393.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15192.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15192.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13524.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15839.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15839.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27616.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27616.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6949.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4086.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4086.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47864.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47864.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13788.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63079.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37935.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43023.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43023.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10268.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10268.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36325.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26083.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26083.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58593.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56509.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56509.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48731.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48731.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22175.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29191.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12605.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12605.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31888.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31888.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4665.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62329.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62329.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65437.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65437.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33513.exe5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37094.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36881.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43769.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43769.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47480.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47480.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9721.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9721.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29471.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29471.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41199.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41199.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60483.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52260.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52260.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8085.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64353.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65439.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65439.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31346.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48821.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48821.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27795.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1194.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10249.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10249.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29423.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29423.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23058.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23058.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47760.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47760.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35501.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52539.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46094.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43187.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43023.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43023.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29849.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25415.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25415.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13077.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13077.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18680.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18680.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50187.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65278.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65278.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32257.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9063.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9063.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49206.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55926.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55926.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32419.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9777.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9777.exe6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27233.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27233.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40753.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40753.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6118.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6118.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36015.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36015.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3669.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3669.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34457.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34457.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12377.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12377.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12293.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54271.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56627.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39155.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32257.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45820.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62034.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37825.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37825.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59469.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59469.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47453.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47453.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50618.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49958.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16591.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16591.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33723.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38837.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38837.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17824.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17824.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10566.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10566.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51858.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51858.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43212.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58230.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58230.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57815.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57815.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44510.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9063.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9063.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56606.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-286.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37041.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37041.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34199.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34199.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15226.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16689.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16689.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46095.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43193.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52577.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52577.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50178.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20684.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20684.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14524.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26052.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52766.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17300.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42802.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42802.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53643.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19761.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59309.exe5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60857.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19397.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64631.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64631.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52289.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52289.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8573.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8573.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44230.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44230.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25800.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25800.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52995.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52995.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62293.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30136.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30136.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31805.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31805.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12953.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26052.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20044.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20044.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43430.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60675.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19832.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19832.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41361.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41361.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20321.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55703.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55703.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57727.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57727.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43711.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43711.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4867.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4867.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19464.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19464.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31343.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31343.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1489.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1489.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9798.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9798.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27248.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27248.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38360.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38360.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3628.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3628.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37935.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14738.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53742.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53742.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35296.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35296.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37005.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37005.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60401.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60401.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40587.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21522.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48232.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13887.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46409.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38575.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53207.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53207.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13430.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49803.exe7⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23011.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24089.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24089.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41352.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41352.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17685.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19169.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19169.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35941.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56747.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56747.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28122.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18515.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18515.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51090.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3529.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3529.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57758.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47982.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47982.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51685.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23919.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19832.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19832.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22985.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25387.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25387.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44878.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12154.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33496.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33496.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48770.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50617.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50617.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23203.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23203.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48350.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10512.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22175.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29429.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29429.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15259.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23149.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23149.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40266.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47127.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47127.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63295.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63295.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10446.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10446.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32936.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32936.exe6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10396 -s 4647⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14040.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45174.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24055.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25332.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62314.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35957.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51877.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51877.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48630.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48630.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39241.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17943.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17943.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4229.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33375.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27624.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27624.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49699.exe3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43171.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24629.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24629.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46396.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25049.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25049.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50341.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-389.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-389.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44598.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44598.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48917.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48917.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56714.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56714.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25143.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11578.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11578.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-789.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-789.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52782.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52782.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33881.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15226.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14332.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33619.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5610.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5610.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46012.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41017.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19296.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19296.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16857.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe2⤵
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-13788.exe
Unicorn-22985.exe
Unicorn-24003.exe
Unicorn-27261.exe
Unicorn-28833.exe
Unicorn-32673.exe
Unicorn-33723.exe
Unicorn-35501.exe
Unicorn-36255.exe
Unicorn-38197.exe
Unicorn-38575.exe
Unicorn-40266.exe
Unicorn-40531.exe
Unicorn-40997.exe
Unicorn-4137.exe
Unicorn-422.exe
Unicorn-4241.exe
Unicorn-4506.exe
Unicorn-46094.exe
Unicorn-46409.exe
Unicorn-46623.exe
Unicorn-47127.exe
Unicorn-48699.exe
Unicorn-52289.exe
Unicorn-52539.exe
Unicorn-54506.exe
Unicorn-55103.exe
Unicorn-59829.exe
Unicorn-63079.exe
Unicorn-63719.exe
Unicorn-64215.exe
Unicorn-9721.exe
memory/64-1644-0x0000000000400000-0x0000000000475000-memory.dmp
memory/220-84-0x0000000000400000-0x0000000000475000-memory.dmp
memory/220-869-0x0000000000400000-0x0000000000475000-memory.dmp
memory/412-1664-0x0000000000400000-0x0000000000475000-memory.dmp
memory/608-1706-0x0000000000400000-0x0000000000475000-memory.dmp
memory/676-1618-0x0000000000400000-0x0000000000475000-memory.dmp
memory/792-1533-0x0000000000400000-0x0000000000475000-memory.dmp
memory/848-1354-0x0000000000400000-0x0000000000475000-memory.dmp
memory/964-873-0x0000000000400000-0x0000000000475000-memory.dmp
memory/992-368-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1140-609-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1312-1616-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1360-875-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1368-1695-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1700-1614-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1740-344-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1740-1707-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1824-1580-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1976-1688-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2060-1685-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2076-1639-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2080-1642-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2104-301-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2104-1694-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2152-1621-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2344-1671-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2352-1619-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2364-398-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2388-661-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2448-1640-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2448-218-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2536-1532-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2636-1700-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2684-325-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2684-1697-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2764-1477-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2816-422-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2956-876-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2956-1518-0x0000000077290000-0x000000007734F000-memory.dmp
memory/3016-564-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3016-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3084-662-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3084-19-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3120-1072-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3156-870-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3332-874-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3392-1353-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3428-1696-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3436-397-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3456-1689-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3524-223-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3524-1641-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3544-396-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3628-1693-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3680-1662-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3696-85-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3696-871-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3744-1684-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3788-1663-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3956-395-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3964-1686-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3972-1620-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4024-700-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4108-849-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4192-1704-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4280-1705-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4320-1692-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4328-1670-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4428-1703-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4448-1300-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4452-722-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4464-1713-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4512-1712-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4560-1711-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4620-131-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4620-1476-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4628-1534-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4768-747-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4836-1668-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4852-1710-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4864-723-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4864-40-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4880-1615-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4960-1586-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4968-1201-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5040-1669-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5068-1617-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5080-1701-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5104-1643-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5484-481-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5568-519-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5928-623-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5972-624-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6080-628-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7160-746-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7316-836-0x0000000000400000-0x0000000000475000-memory.dmp
memory/8072-952-0x0000000000400000-0x0000000000475000-memory.dmp