Analysis
- max time kernel
17s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 15:04
General
- Target 2026-07-31_059f500274af864291702530ee0adecd_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
- Size 12.9MB
- Sample260731-sfvsaacd44
- SHA256 3ee7f10109f6c063a2f1f120cfd33237609a7ebdf3702e75f75e7b16afcbe318
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 58 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 31 IoCs
- UPX dump on OEP (original entry point) 31 IoCs
- Executes dropped EXE 12 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_059f500274af864291702530ee0adecd_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_059f500274af864291702530ee0adecd_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3880.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3880.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50816.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50816.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37552.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37552.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16380.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14044.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14044.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25306.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42893.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53840.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62751.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62751.exe11⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16356.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52192.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52192.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43327.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43327.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6053.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29061.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29061.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14852.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28520.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56814.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56814.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57094.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45423.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45423.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4618.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2377.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2377.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28812.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28812.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39487.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39487.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53116.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53116.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19850.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3705.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3705.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36143.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33436.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33116.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33116.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24889.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24889.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28771.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13700.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13700.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30587.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12444.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24758.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8445.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6314.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6814.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6814.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61603.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52776.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52776.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47681.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40487.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40487.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13380.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2911.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64214.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42640.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42640.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37132.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7791.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7791.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21103.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43711.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43711.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36019.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36019.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44873.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44873.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13728.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13728.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20504.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20504.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46705.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46705.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39257.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16996.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16996.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39948.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20821.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20821.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55923.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58077.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58077.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55916.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33057.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33057.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58421.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58421.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31044.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31044.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28314.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63114.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63114.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27242.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34489.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34489.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2472.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2472.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50161.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50161.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31609.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22291.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22291.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62524.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26238.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26238.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63247.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63247.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27863.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41828.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41828.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6694.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6694.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42210.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42210.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2209.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64382.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64382.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3845.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56228.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56228.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46118.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46118.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10911.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36565.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36565.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16118.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16118.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56306.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48356.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6722.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36326.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29444.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57236.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26145.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26145.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37503.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37503.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58879.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58879.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55221.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55221.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51079.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19705.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19705.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61236.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61236.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8943.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8943.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30810.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28214.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25252.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54133.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54133.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40348.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40348.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40902.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40902.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13659.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54816.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54816.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48718.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48718.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31450.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43780.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43780.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1263.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1263.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31308.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31308.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32699.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58878.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58095.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36612.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1818.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1818.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51043.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7348.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7348.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21416.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49379.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49379.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41941.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15132.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15132.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60353.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31468.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31468.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47924.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20343.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20343.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26129.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-181.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44506.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42711.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42711.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42976.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42976.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32430.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24583.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24583.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47102.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47102.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30696.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30696.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59647.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15844.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15844.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31813.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46732.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46732.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41636.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41636.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21195.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13785.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7644.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7644.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21987.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42007.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42007.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-178.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7013.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2528.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25771.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30587.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4859.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24069.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18614.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56581.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4364.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60817.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40964.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35856.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18589.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18589.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14063.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14063.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22377.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22377.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9668.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9668.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-539.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39175.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11558.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53977.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53977.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37055.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-301.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12039.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2822.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10967.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10967.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26267.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12430.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31492.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10830.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16459.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16459.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29466.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29466.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4859.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20281.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20281.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38655.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38655.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24627.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48900.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6279.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6279.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20347.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20347.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24443.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24443.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41104.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42788.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15643.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1569.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1569.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51495.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51495.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58287.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15790.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56795.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28511.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40037.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-498.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-498.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29178.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3456.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3456.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43156.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52322.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53788.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29938.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14779.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14779.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65269.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65269.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13261.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13261.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4707.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4707.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35303.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5085.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35196.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35196.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57509.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57509.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15821.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15821.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13913.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13913.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28202.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28202.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8557.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8557.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31547.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20269.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20269.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56347.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56347.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21189.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21651.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21651.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31450.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8450.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54133.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54133.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20643.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30851.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30851.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50483.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20800.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20800.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53463.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53463.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36287.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29601.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29601.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-140.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2118.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2118.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13461.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2335.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2335.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35840.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2519.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2519.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6725.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6725.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48080.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57409.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42767.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63430.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37032.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56423.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56423.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33379.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33379.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41225.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41225.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18114.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18114.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11821.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11821.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60166.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39838.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44432.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6634.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-11558.exe
Unicorn-1176.exe
Unicorn-14044.exe
Unicorn-15643.exe
Unicorn-16380.exe
Unicorn-18749.exe
Unicorn-20821.exe
Unicorn-20949.exe
Unicorn-21651.exe
Unicorn-25191.exe
Unicorn-30587.exe
Unicorn-31450.exe
Unicorn-35840.exe
Unicorn-37132.exe
Unicorn-37552.exe
Unicorn-3880.exe
Unicorn-39175.exe
Unicorn-41636.exe
Unicorn-42788.exe
Unicorn-44506.exe
Unicorn-46732.exe
Unicorn-47427.exe
Unicorn-48356.exe
Unicorn-48561.exe
Unicorn-48718.exe
Unicorn-50453.exe
Unicorn-50816.exe
Unicorn-53146.exe
Unicorn-54537.exe
Unicorn-6083.exe
Unicorn-9960.exe
memory/244-831-0x0000000000400000-0x0000000000475000-memory.dmp
memory/248-772-0x0000000000400000-0x0000000000475000-memory.dmp
memory/460-414-0x0000000000400000-0x0000000000475000-memory.dmp
memory/568-425-0x0000000000400000-0x0000000000475000-memory.dmp
memory/852-830-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1096-732-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1152-728-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1296-527-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1312-408-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1348-580-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1356-136-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1360-407-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1564-834-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1620-410-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1860-405-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2000-415-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2012-870-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2072-413-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2080-419-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2244-835-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2440-411-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2616-420-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2664-1001-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2876-137-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2984-731-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3076-1000-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3092-833-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3180-730-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3288-837-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3336-836-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3432-832-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3592-426-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4200-421-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4204-644-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4272-412-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4392-406-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4416-418-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4512-424-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4608-733-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4740-417-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4756-427-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4888-101-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4892-422-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4932-939-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5240-941-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5500-792-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5520-526-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5548-869-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5924-428-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5976-729-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5996-423-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6052-416-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6056-581-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6080-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6236-890-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6464-1011-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6500-1012-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6748-1002-0x0000000000400000-0x0000000000475000-memory.dmp