Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 08:37
General
- Target 2026-08-04_043f1691d5a6130b4e1e541a81d50e54_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
- Size 15.7MB
- Sample260804-kjayaa1vfy
- SHA256 6e8dbe15fcda3fdfaf3d257b837cece5721fede3bda0af9a6b0881ff15b7e094
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 31 IoCs
- UPX dump on OEP (original entry point) 31 IoCs
- Executes dropped EXE 23 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 20 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_043f1691d5a6130b4e1e541a81d50e54_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_043f1691d5a6130b4e1e541a81d50e54_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9021.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63022.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9561.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9561.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23690.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33566.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33566.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51670.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54218.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54218.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21296.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21296.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-336.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35031.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35031.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53361.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53361.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40342.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64213.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62749.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1975.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1975.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41648.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19102.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19102.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24856.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18696.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18696.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29107.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35796.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35796.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1405.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1405.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64690.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37218.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37218.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41908.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41908.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18276.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13688.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13688.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32558.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48645.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13023.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13023.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60461.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16351.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16351.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6745.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32942.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32942.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41908.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41908.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1296.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1296.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50299.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55385.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55385.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28266.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47654.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52905.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49884.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49884.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33279.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33279.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43988.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43988.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36322.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56533.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56533.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26566.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26566.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54514.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54514.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55609.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15344.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1297.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1297.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43528.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56199.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56199.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32973.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32973.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25987.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42246.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42246.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34722.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52729.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52729.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22587.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19102.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19102.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24856.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11523.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11523.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11924.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26974.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26974.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1104.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7519.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7519.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32558.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42396.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22084.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33722.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10861.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10861.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60030.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60030.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7757.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48052.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5380.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29587.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17892.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17892.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11235.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45117.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51950.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7057.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7057.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32868.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42463.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42463.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47602.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47602.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43502.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43502.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22470.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22470.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15204.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15204.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17299.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9568.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39241.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60938.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47690.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24664.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24664.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56797.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56797.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4575.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37038.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37038.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4731.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4731.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58750.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58750.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43974.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43974.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64773.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64773.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51317.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51317.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16600.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16600.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19640.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19640.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34426.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17072.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52993.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3264.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3264.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28074.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14021.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14263.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14263.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35334.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37218.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37218.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3092.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30184.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30184.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40134.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6569.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6569.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64773.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64773.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38592.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25834.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25834.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60291.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60291.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18356.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51325.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37766.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9133.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9133.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1189.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55650.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43340.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43340.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2205.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35276.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7196.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7196.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44514.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44514.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2729.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2729.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11592.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65052.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20336.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6700.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6700.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55022.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2397.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24175.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10092.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30986.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55156.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32205.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33375.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49610.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49610.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52122.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27824.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27824.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17979.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34353.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52704.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52704.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42236.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42236.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34078.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30866.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57062.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57062.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10876.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22868.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18276.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16620.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35106.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46185.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46185.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61456.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61456.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-248.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-248.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20435.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16096.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16096.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50792.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55385.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55385.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23932.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23932.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45922.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5053.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62438.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16096.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16096.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50792.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11280.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11280.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64965.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64965.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40164.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44198.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44198.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3652.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62936.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62936.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7653.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7653.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39870.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43528.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1924.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1796.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1796.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38192.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38192.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43798.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43798.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38104.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30575.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56766.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10897.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11592.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4033.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7355.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7355.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31635.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10861.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10861.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30650.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12521.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12521.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52592.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32646.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32646.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21296.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21296.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45593.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56736.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26870.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6309.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56642.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56642.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17352.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17352.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6931.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6931.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61980.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44457.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44457.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24706.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24706.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47425.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64182.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64182.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59380.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35858.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35858.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10897.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26672.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26672.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40680.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27652.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22849.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30686.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30686.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26870.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60637.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22447.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22447.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6200.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6200.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18555.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18555.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53357.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28685.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48716.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48716.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49117.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56052.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27638.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25240.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25240.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26723.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1100.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1100.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19470.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19470.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15822.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35438.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20772.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44020.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44020.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59380.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23409.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47250.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39012.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9951.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-219.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31702.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31702.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42704.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42704.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22556.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22556.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-10861.exe
Unicorn-11416.exe
Unicorn-1189.exe
Unicorn-1796.exe
Unicorn-22368.exe
Unicorn-22849.exe
Unicorn-23690.exe
Unicorn-25987.exe
Unicorn-30650.exe
Unicorn-30686.exe
Unicorn-31635.exe
Unicorn-3264.exe
Unicorn-33566.exe
Unicorn-35796.exe
Unicorn-37766.exe
Unicorn-42236.exe
Unicorn-45117.exe
Unicorn-45922.exe
Unicorn-4731.exe
Unicorn-49201.exe
Unicorn-51325.exe
Unicorn-56052.exe
Unicorn-56533.exe
Unicorn-58750.exe
Unicorn-62102.exe
Unicorn-62936.exe
Unicorn-63022.exe
Unicorn-8183.exe
Unicorn-9021.exe
Unicorn-9133.exe
Unicorn-9561.exe
memory/360-483-0x0000000000400000-0x0000000000475000-memory.dmp
memory/800-432-0x0000000000400000-0x0000000000475000-memory.dmp
memory/868-452-0x0000000000400000-0x0000000000475000-memory.dmp
memory/992-430-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1036-431-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1080-438-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1172-482-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1188-445-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1292-485-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1436-477-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1540-459-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1620-478-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1736-453-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1936-442-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1992-436-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2112-429-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2340-480-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2348-443-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2472-439-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2588-451-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2656-718-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2664-484-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2704-495-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2720-496-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2752-156-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2772-488-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2844-444-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3172-457-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3196-440-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3336-493-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3392-450-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3488-433-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3680-13-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3772-437-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3816-441-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3828-476-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3872-497-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4168-435-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4192-434-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4196-448-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4248-102-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4340-487-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4356-458-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4500-486-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4552-494-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4644-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4684-475-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4792-481-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4804-491-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4812-460-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5060-492-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5104-479-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5136-498-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5172-499-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5216-500-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5228-501-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5252-502-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5544-720-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5592-515-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5644-717-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5660-719-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5688-516-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5716-716-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5820-742-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6192-824-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6904-791-0x0000000000400000-0x0000000000475000-memory.dmp