Analysis
- max time kernel
80s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
23/07/2026, 09:21
General
- Target 2026-07-23_1731e13e8d2405ec676bc81fa1c01b06_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
- Size 17.7MB
- Sample260723-lbcbtaba89
- SHA256 f2e4f4afe4187bd5397ed0f7580a43986ae312bef8f248118b586542b5032f81
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 32 IoCs
- UPX dump on OEP (original entry point) 32 IoCs
- Executes dropped EXE 52 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 53 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 50 IoCs
- Suspicious use of WriteProcessMemory 52 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_1731e13e8d2405ec676bc81fa1c01b06_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_1731e13e8d2405ec676bc81fa1c01b06_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40862.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15694.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15694.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9253.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9253.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59518.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59518.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52070.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9665.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14081.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14081.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60461.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1622.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1622.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43926.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43926.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8252.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33350.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12773.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12773.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52749.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27566.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27566.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33010.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33010.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59957.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59605.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59605.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48764.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48764.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31191.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43046.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41051.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41051.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16105.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16105.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1224.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1224.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47226.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-661.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36533.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36533.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46095.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19997.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19997.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54420.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54420.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44389.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44389.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59558.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57882.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38002.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38002.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54486.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9029.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8285.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45653.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45653.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40033.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36946.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60207.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60207.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27911.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32994.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32994.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21142.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24383.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24383.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37860.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65533.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65533.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45358.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45358.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2236.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2236.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49250.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18542.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18542.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26140.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1416.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14936.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14936.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55602.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55602.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27765.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37234.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8601.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8601.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58481.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58481.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16236.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16236.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36787.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36787.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51713.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30274.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30274.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45490.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45490.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36200.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36200.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62447.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62447.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60926.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60926.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15337.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1171.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30942.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30942.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35432.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26997.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26997.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35077.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35077.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60076.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60076.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20225.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20225.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58089.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58089.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-978.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-978.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37763.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37772.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44914.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44914.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45270.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45270.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65290.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65290.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15808.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15808.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8432.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52297.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52297.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17661.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55489.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55489.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22415.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22415.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38858.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38858.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7174.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42913.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42913.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39249.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39249.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10572.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10572.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40424.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40424.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25164.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12913.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12913.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21126.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21126.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59818.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59818.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40033.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5565.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5565.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43681.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1901.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43140.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31510.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56479.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56479.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27573.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27573.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28323.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22060.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22060.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50966.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25334.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22138.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22138.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39271.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31311.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31311.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41833.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41833.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2877.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2877.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54369.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43947.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43947.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24029.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46929.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46929.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61929.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61929.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29359.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29359.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49714.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49714.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43866.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60158.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52129.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16216.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63370.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63370.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7632.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52758.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31672.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31672.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31811.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31811.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51818.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51818.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8680.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8680.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16866.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60018.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37277.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28636.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28636.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57768.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57768.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10556.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10556.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59859.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62485.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59477.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21228.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21228.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5565.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5565.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21745.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51805.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51805.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47107.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11132.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11132.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39337.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56404.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12618.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59690.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59864.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59864.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3232.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26850.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54019.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54019.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3085.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43141.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43141.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1835.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32167.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32493.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1792.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19353.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20216.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28281.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28281.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54234.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48090.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21666.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21666.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13645.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18601.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18601.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1800.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1800.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47801.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38312.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12602.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12602.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-677.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-677.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 726⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10024.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10024.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29294.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29294.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54774.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54774.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36547.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33068.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33068.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60158.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50682.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15940.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15940.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17345.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18979.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49993.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33545.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26910.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40944.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40944.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3944.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3944.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7873.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7873.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18542.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18542.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40475.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31325.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3844.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3844.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62869.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31080.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40423.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40423.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30070.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10408.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15505.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64841.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64841.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45114.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45114.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55638.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-897.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8866.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54574.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54574.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55873.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55873.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10404.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23542.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23542.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43429.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43429.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39553.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54286.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8976.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8976.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22913.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22913.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59859.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51552.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51552.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33073.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33073.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45868.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63196.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63196.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10305.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10305.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4789.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4789.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35122.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17144.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17144.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26392.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26392.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43046.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64478.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64478.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54893.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52862.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11341.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48645.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10792.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1224.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1224.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27573.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27573.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8017.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45469.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45469.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9686.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9686.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13488.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28882.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3487.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3487.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-321.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44421.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44421.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57994.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57994.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2772.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14352.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14352.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64071.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64071.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8888.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8888.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20632.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35796.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35796.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26270.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26270.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50342.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32714.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32714.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56235.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7273.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36701.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34228.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34228.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30439.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30439.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50105.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50105.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31274.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31274.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4596.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4596.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42942.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42942.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59883.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59883.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42390.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42390.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50261.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50261.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11836.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11836.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33018.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41310.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41310.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56403.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27566.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27566.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58666.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58666.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13417.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13417.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30069.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39317.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39317.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60682.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41360.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41360.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48505.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3085.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41030.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41030.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15032.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62447.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62447.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50509.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50509.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25334.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40394.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40394.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27234.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37449.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37449.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6664.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6664.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50093.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50093.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9982.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9982.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51013.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38872.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61966.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4657.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42285.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11436.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5514.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5514.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25076.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25076.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38391.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38391.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40128.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40128.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29568.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53762.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1881.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1480.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1480.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58886.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58886.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54676.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26547.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38009.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38009.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13196.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13196.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1525.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46310.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46310.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18601.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18601.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7028.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7028.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10661.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30992.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30992.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47107.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41309.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58030.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58030.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52489.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52489.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30254.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-189.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4185.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4185.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25152.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25152.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53807.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53807.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1532.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43670.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54753.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54753.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35757.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39337.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40219.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28589.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28589.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2976 -ip 29761⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-10305.exe
Unicorn-10408.exe
Unicorn-15694.exe
Unicorn-19615.exe
Unicorn-20623.exe
Unicorn-22060.exe
Unicorn-22415.exe
Unicorn-25334.exe
Unicorn-26270.exe
Unicorn-27911.exe
Unicorn-28281.exe
Unicorn-29358.exe
Unicorn-30009.exe
Unicorn-30274.exe
Unicorn-3487.exe
Unicorn-35796.exe
Unicorn-38872.exe
Unicorn-3944.exe
Unicorn-40560.exe
Unicorn-40862.exe
Unicorn-40944.exe
Unicorn-4596.exe
Unicorn-50509.exe
Unicorn-50966.exe
Unicorn-51713.exe
Unicorn-52749.exe
Unicorn-58089.exe
Unicorn-59518.exe
Unicorn-63196.exe
Unicorn-7873.exe
Unicorn-8680.exe
Unicorn-9253.exe
memory/228-161-0x0000000000400000-0x0000000000475000-memory.dmp
memory/228-694-0x0000000000400000-0x0000000000475000-memory.dmp
memory/432-1017-0x0000000000400000-0x0000000000475000-memory.dmp
memory/452-697-0x0000000000400000-0x0000000000475000-memory.dmp
memory/816-881-0x0000000000400000-0x0000000000475000-memory.dmp
memory/928-781-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1048-159-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1048-692-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1084-163-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1084-696-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1112-776-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1168-1016-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1196-879-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1248-1040-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1316-301-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1316-905-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1408-950-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1536-616-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1564-780-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1704-796-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1744-737-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1824-900-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1828-647-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1852-906-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1872-635-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1872-91-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1972-1032-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1996-899-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2056-748-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2072-1031-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2088-864-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2132-863-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2200-700-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2236-702-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2324-843-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2344-164-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2344-698-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2388-615-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2492-300-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2492-904-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2632-423-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2716-880-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2804-1010-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2816-512-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2908-782-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2940-1039-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2952-902-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2968-779-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3100-910-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3212-727-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3228-980-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3324-493-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3368-909-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3408-693-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3408-160-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3420-901-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3428-937-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3464-482-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3464-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3496-936-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3500-162-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3500-695-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3604-657-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3796-949-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3900-622-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3992-560-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4052-596-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4092-631-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4236-783-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4248-889-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4260-968-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4264-701-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4308-908-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4440-1009-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4460-967-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4508-1029-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4536-981-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4548-566-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4576-543-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4576-34-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4636-951-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4640-270-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4640-898-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4664-755-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4756-828-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4772-523-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4772-18-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4780-933-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4884-632-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4916-784-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4936-539-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4976-907-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4988-1008-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4996-862-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5012-670-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5512-524-0x0000000000400000-0x0000000000475000-memory.dmp