Analysis
- max time kernel
150s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
21/07/2026, 13:21
General
- Target 2026-07-21_95c4f3205c001bffb5d54f1d0a516394_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe
- Size 10.8MB
- Sample260721-qlpgcacj9x
- SHA256 5646835c3358e0d988cb95be3749c546ddf46b0e044b26fe6f163317c73d9771
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 31 IoCs
- UPX dump on OEP (original entry point) 31 IoCs
- Executes dropped EXE 12 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_95c4f3205c001bffb5d54f1d0a516394_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_95c4f3205c001bffb5d54f1d0a516394_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51287.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3285.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39798.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39798.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3311.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3311.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50307.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38081.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38081.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56148.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56148.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15193.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37830.exe12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49734.exe11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19147.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27161.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27161.exe11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56703.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56703.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10836.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10836.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51872.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1597.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57949.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exe12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42505.exe11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2012.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11115.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11115.exe11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49505.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39074.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60762.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24398.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18414.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18414.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35620.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2009.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2009.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55507.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44773.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44773.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30129.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9470.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9470.exe12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3532.exe11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32759.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65058.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65058.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44519.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44519.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10575.exe11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35120.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64509.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64509.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65121.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45027.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45027.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48603.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51426.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41134.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61919.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32189.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36518.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36518.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23772.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39610.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39610.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10985.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47311.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47311.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43454.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43454.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55042.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42504.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42504.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61831.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61831.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8759.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25858.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25858.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20152.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20152.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45323.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37856.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30207.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30207.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42494.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51224.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51224.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33225.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33225.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54046.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22646.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22646.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23901.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23368.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23368.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60523.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60523.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3866.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2175.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64723.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64251.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64251.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54306.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48494.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7534.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7534.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9120.exe11⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5951.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16615.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16615.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65250.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54270.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54270.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52968.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19579.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21494.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16523.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16523.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54887.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56070.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34488.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52314.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30554.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30554.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64691.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17534.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17534.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55507.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4801.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59137.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59137.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22350.exe10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58385.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58385.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63216.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6465.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13915.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13915.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25106.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23202.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23202.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47458.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21743.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21743.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20606.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3168.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50165.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-627.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60923.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18038.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18038.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15859.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33503.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33503.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56444.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42407.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42407.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3004.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3004.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41880.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41880.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26128.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26128.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43575.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31000.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31000.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44576.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44576.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20410.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1365.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1365.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46828.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46828.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4991.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4991.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62521.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62521.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41650.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58831.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58831.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53973.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53973.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56620.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60539.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41880.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41880.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37222.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37222.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65278.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65278.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55080.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4093.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4093.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22235.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42188.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58312.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57779.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57779.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62718.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62718.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24760.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24760.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36268.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36268.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37245.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37245.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59762.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63652.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45266.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19670.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12661.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37954.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37954.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55164.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15522.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40831.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40831.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55517.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58644.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58644.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15612.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65360.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65360.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22381.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22381.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41189.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22781.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22781.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8625.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8625.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15756.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15756.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18598.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18598.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59023.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59023.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27595.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23357.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60876.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9490.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9490.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3495.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3495.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45132.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45132.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33196.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33196.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17058.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17058.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14980.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19657.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20201.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20201.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12510.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64841.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64841.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15239.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15239.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58975.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58975.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13730.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60399.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60399.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37077.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37077.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25692.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25692.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14104.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25340.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25340.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6840.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40005.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40005.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59625.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59625.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55167.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37825.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37825.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40559.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40559.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30700.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30700.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7847.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11900.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30788.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6517.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23984.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23984.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55826.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38441.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30129.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3580.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3580.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22182.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22182.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39034.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48287.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54650.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13104.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41442.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41442.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25468.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25468.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21276.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53383.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53383.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35148.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35148.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2007.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2007.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44410.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64550.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64550.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25032.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62758.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26922.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34892.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34892.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28778.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28778.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65250.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35360.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35360.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8962.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8962.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34551.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49233.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49233.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56076.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56076.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21165.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30658.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39999.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33335.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33335.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23865.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23865.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34099.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34099.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14862.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32896.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32896.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42195.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36216.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8193.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60217.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32676.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53756.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53756.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61572.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61572.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37076.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37076.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6216.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39947.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39947.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62455.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62455.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50640.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50640.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-1365.exe
Unicorn-14131.exe
Unicorn-15756.exe
Unicorn-16851.exe
Unicorn-17534.exe
Unicorn-2009.exe
Unicorn-2175.exe
Unicorn-22781.exe
Unicorn-24760.exe
Unicorn-2495.exe
Unicorn-30700.exe
Unicorn-3285.exe
Unicorn-32896.exe
Unicorn-3311.exe
Unicorn-36268.exe
Unicorn-37245.exe
Unicorn-38081.exe
Unicorn-3866.exe
Unicorn-39798.exe
Unicorn-47847.exe
Unicorn-48287.exe
Unicorn-48520.exe
Unicorn-50307.exe
Unicorn-51287.exe
Unicorn-54650.exe
Unicorn-56555.exe
Unicorn-62522.exe
Unicorn-62718.exe
Unicorn-64723.exe
Unicorn-8625.exe
Unicorn-28844.exe
memory/240-1287-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1272-633-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1532-1176-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1660-729-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1696-1392-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1780-1029-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1824-825-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1880-426-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1896-826-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1928-632-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1944-1030-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2156-1399-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2656-465-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2660-284-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2976-870-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3412-686-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3684-567-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3732-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3780-285-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3984-143-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3988-728-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4104-585-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4244-498-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4280-449-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4380-824-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4464-730-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4540-685-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4564-286-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4664-1395-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4720-635-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4908-144-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4928-1077-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4976-238-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5128-142-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5248-1466-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5300-653-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5436-687-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5596-763-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5640-636-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6164-1115-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6192-1035-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6232-827-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6280-829-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6376-1391-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6384-1448-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6404-1444-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6492-1034-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6512-828-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6580-1173-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6584-1286-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6676-1174-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6716-1076-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6736-1175-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6768-1032-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6812-1393-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6832-1031-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6988-954-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7032-1251-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7060-1033-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7068-1114-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7124-1036-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7140-1468-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7152-1250-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7188-1401-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7248-1289-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7288-1290-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7308-1291-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7408-1292-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7500-1293-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7604-1339-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7624-1350-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7636-1340-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7716-1341-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7752-1471-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7780-1469-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7788-1342-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7804-1345-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7812-1346-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7836-1398-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7844-1348-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7852-1347-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7864-1470-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7876-1349-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7920-1443-0x0000000000400000-0x0000000000475000-memory.dmp
memory/8012-1396-0x0000000000400000-0x0000000000475000-memory.dmp
memory/8132-1397-0x0000000000400000-0x0000000000475000-memory.dmp
memory/8172-1351-0x0000000000400000-0x0000000000475000-memory.dmp