Analysis
- max time kernel
27s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 04:17
General
- Target 2026-07-17_370e6b288038da411dcedb5c39fc2b9e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
- Size 17.7MB
- Sample260718-ewjs3af16r
- SHA256 e8abdadc4852e7a2cb8b565ab67cb41a89914cecc2fe5d05c02d9b4b9bf4d5a2
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 31 IoCs
- UPX dump on OEP (original entry point) 31 IoCs
- Executes dropped EXE 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_370e6b288038da411dcedb5c39fc2b9e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_370e6b288038da411dcedb5c39fc2b9e_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9999.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62542.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62542.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21718.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21718.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62016.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48426.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25078.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15325.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12507.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37125.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10941.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62365.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62365.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62941.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24476.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24476.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25078.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59871.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59871.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27582.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27582.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55371.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55371.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37374.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38890.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2061.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2061.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20021.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56580.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56580.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20103.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7721.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7721.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24745.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12354.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12354.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42483.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11007.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11007.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25110.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25110.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51225.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51225.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24924.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35180.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23906.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23906.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63746.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52851.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52851.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3778.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3778.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57840.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8921.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8921.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-244.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-244.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62026.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44790.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3939.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3939.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55380.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26936.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26936.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6513.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18950.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45002.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45002.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61761.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47535.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14920.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14920.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27093.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27093.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11760.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11760.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14697.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14697.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40326.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32578.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32578.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4647.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2845.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42206.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21935.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53291.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53291.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18681.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13143.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14146.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2502.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2502.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56113.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56113.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57409.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64021.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9481.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9481.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55039.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14176.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14364.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14260.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14260.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42507.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31581.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57677.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57677.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57037.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17681.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49856.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7998.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7998.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34489.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34489.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15678.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15678.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40030.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40030.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11280.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11280.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18103.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44077.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44077.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27643.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25486.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38536.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45692.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45692.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53638.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21356.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48288.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48288.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12476.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12476.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41710.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41710.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27206.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62674.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34894.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34894.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9533.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9533.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53306.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42826.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40601.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40601.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50779.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50779.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55448.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55448.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48727.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48727.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39101.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39101.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25261.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25261.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20250.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31300.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31656.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31656.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33869.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34688.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34688.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40608.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40608.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31016.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8641.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8641.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23514.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23514.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20617.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20617.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11961.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11961.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58590.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58590.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2937.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2937.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22393.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22393.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34468.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34468.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60431.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60431.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35661.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15104.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16192.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16192.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36315.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5085.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35543.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-362.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-362.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14930.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58325.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22289.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22289.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22507.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25372.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11858.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11858.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27384.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27384.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8911.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31606.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11733.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10623.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10623.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15494.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15262.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22534.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22534.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17949.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4312.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54917.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54917.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9531.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52991.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52991.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14136.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14136.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17581.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54866.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65296.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65296.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59957.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20159.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20159.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63787.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63787.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43637.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4719.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5070.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22344.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37576.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37576.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27227.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27227.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20014.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22974.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22974.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29437.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29437.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25078.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47250.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14951.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35691.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51386.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51386.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34662.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15439.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15439.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46409.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63965.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63965.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16449.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16449.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42184.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42184.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50062.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50062.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28195.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36563.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36563.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-211.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-211.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25078.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34785.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43757.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7758.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26652.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21506.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40264.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40264.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6108.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6108.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60187.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60187.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43340.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43340.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1235.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50146.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23378.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13243.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13243.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1941.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52334.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3672.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3672.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55709.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55709.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62638.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42212.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53343.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53343.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21629.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21629.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63719.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31021.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25078.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49030.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49030.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23719.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13705.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13705.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12159.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12159.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9537.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18533.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18533.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56767.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48454.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48454.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52334.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-851.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-851.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9100.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9100.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21363.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21363.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65102.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65102.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10893.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32403.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14120.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53638.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24023.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24023.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51705.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51705.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22588.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1028.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1028.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56954.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56954.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23777.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23777.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50996.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50996.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-12354.exe
Unicorn-17949.exe
Unicorn-20250.exe
Unicorn-211.exe
Unicorn-21718.exe
Unicorn-23378.exe
Unicorn-244.exe
Unicorn-24476.exe
Unicorn-24745.exe
Unicorn-27206.exe
Unicorn-27217.exe
Unicorn-2845.exe
Unicorn-29437.exe
Unicorn-31021.exe
Unicorn-32578.exe
Unicorn-4312.exe
Unicorn-44077.exe
Unicorn-4647.exe
Unicorn-48426.exe
Unicorn-49856.exe
Unicorn-51802.exe
Unicorn-53258.exe
Unicorn-53526.exe
Unicorn-54917.exe
Unicorn-58325.exe
Unicorn-58897.exe
Unicorn-62016.exe
Unicorn-62542.exe
Unicorn-63719.exe
Unicorn-9531.exe
Unicorn-9999.exe
memory/844-365-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1256-429-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1364-1515-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1476-841-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1612-1236-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1724-1451-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1916-1432-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1964-1518-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2404-788-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2476-569-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2536-695-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2680-1234-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2700-1426-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2724-496-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3004-640-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3020-1409-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3328-1237-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3340-1456-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3352-181-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3392-403-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3720-656-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4064-1517-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4092-843-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4104-402-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4236-842-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4244-641-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4372-1452-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4500-1235-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4744-1260-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4768-115-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4812-364-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4852-1425-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5300-118-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5328-309-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5400-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5444-1455-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5712-697-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5736-338-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5872-366-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5880-240-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5920-117-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5972-218-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6080-600-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6104-1256-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6148-1261-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6180-1516-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6188-1290-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6192-844-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6200-1405-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6212-1449-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6272-1450-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6436-1407-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6448-1458-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6528-1429-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6552-1483-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6568-1037-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6584-1038-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6600-1039-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6620-1041-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6640-1042-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6656-1043-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6672-1227-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6688-1085-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6696-1453-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6720-1199-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6740-1484-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6744-1431-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6752-1427-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6792-1428-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6812-1511-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6844-1430-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6864-1454-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6880-1457-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6948-1228-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6960-1229-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6972-1230-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7052-1231-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7064-1433-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7072-1232-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7088-1434-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7156-1233-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7224-1519-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7244-1533-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7264-1534-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7396-1535-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7404-1536-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7420-1537-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7432-1539-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7496-1538-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7544-1540-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7556-1544-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7564-1541-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7592-1542-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7632-1543-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7876-1574-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7900-1606-0x0000000000400000-0x0000000000475000-memory.dmp