Analysis
- max time kernel
119s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 14:52
General
- Target 2026-08-04_9745a3c73e6d09d04badb5bc137a3270_agent-tesla_cobalt-strike_coinminer_cryptbot_darkgate_el.exe
- Size 23.1MB
- Sample260804-r8vsbace57
- SHA256 04c3196bc38d7b33b79d0b0e3ee0d5ecc5c2432f48d6da7f837d5de170957bb9
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 31 IoCs
- UPX dump on OEP (original entry point) 31 IoCs
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 31 IoCs
Inno Setup installer
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_9745a3c73e6d09d04badb5bc137a3270_agent-tesla_cobalt-strike_coinminer_cryptbot_darkgate_el.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_9745a3c73e6d09d04badb5bc137a3270_agent-tesla_cobalt-strike_coinminer_cryptbot_darkgate_el.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33614.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48746.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51590.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51590.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43526.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43526.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56686.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56686.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50686.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50686.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62017.exe8⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2713.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31436.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41316.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41316.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12744.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8473.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8473.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53636.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53636.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe7⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7508.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63212.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13008.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13008.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32736.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19080.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4944.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4944.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54934.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34286.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53725.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53725.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13227.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13227.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27984.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27984.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41220.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41220.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15492.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29214.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64918.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64918.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52002.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52002.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14420.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14420.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40622.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40622.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8468.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8468.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5925.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54514.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54514.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18312.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45002.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45002.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44520.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62785.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15443.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15443.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-777.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-777.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-461.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11508.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37166.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55962.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55962.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61073.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61073.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27094.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7001.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31724.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28638.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60954.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60954.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65365.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65365.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37668.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37668.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53014.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65401.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65401.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37492.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59698.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43112.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43112.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17440.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17440.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40836.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40836.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44224.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44224.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1161.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1161.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15541.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15541.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39500.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39500.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36708.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36708.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57617.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57617.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33850.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37336.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23760.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23760.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54374.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7001.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20328.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27695.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27695.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6449.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6449.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26450.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41576.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41576.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50549.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27299.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64601.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64601.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20638.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60497.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60497.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5163.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27322.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27840.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4544.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4544.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36280.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36280.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12365.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12365.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37794.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37794.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44789.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44789.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4627.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63012.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33082.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33082.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5660.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61826.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37607.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37607.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40085.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64918.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64918.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22070.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6164.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41664.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41664.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59661.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17654.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2503.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2503.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61182.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61182.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6901.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64528.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64528.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50605.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50605.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58930.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46813.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62014.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19835.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5580.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5580.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7329.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7329.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42410.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16770.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20475.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22729.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22729.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32600.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32600.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31250.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13953.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30460.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30460.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29987.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8871.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8871.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25713.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49153.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49153.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48272.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48272.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20370.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20370.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28032.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45749.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5032.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61042.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20127.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20127.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13471.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13471.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26900.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40408.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18820.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59506.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62542.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62542.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19184.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19184.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40488.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31544.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31544.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30712.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30712.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36266.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11249.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11249.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56470.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56470.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-897.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26288.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26288.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59277.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59277.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13761.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21104.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55104.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60741.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3761.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9117.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10912.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10912.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12955.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12955.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7839.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7839.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30135.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61218.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61218.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64638.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20166.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63553.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28474.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2011.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12941.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12941.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48681.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49744.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10155.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50762.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50897.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23952.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23952.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6425.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18459.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18459.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16400.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16400.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28494.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8037.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59729.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59729.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18156.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51302.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51302.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1539.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59548.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65074.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16710.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16710.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52957.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2100.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2100.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25298.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25298.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50321.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49232.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24300.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46229.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40890.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17114.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17114.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2988.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2988.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33584.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4908.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4908.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57105.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57105.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29662.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23570.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23570.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36538.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36538.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49117.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56196.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56196.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45872.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29171.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38686.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38686.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58878.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58878.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57617.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57617.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47760.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47760.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28266.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14996.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14996.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63062.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63062.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39522.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-15443.exe
Unicorn-15492.exe
Unicorn-16400.exe
Unicorn-16770.exe
Unicorn-18459.exe
Unicorn-20328.exe
Unicorn-27695.exe
Unicorn-28638.exe
Unicorn-29171.exe
Unicorn-29214.exe
Unicorn-30135.exe
Unicorn-30712.exe
Unicorn-31724.exe
Unicorn-32736.exe
Unicorn-33614.exe
Unicorn-36266.exe
Unicorn-36280.exe
Unicorn-40085.exe
Unicorn-40890.exe
Unicorn-42410.exe
Unicorn-43526.exe
Unicorn-44224.exe
Unicorn-46229.exe
Unicorn-48746.exe
Unicorn-50189.exe
Unicorn-51590.exe
Unicorn-54506.exe
Unicorn-5580.exe
Unicorn-56686.exe
Unicorn-5792.exe
Unicorn-7329.exe
memory/8-466-0x0000000000400000-0x0000000000475000-memory.dmp
memory/112-94-0x0000000000400000-0x0000000000475000-memory.dmp
memory/112-620-0x0000000000400000-0x0000000000475000-memory.dmp
memory/560-807-0x0000000000400000-0x0000000000475000-memory.dmp
memory/624-1003-0x0000000000400000-0x0000000000475000-memory.dmp
memory/636-240-0x0000000000400000-0x0000000000475000-memory.dmp
memory/636-745-0x0000000000400000-0x0000000000475000-memory.dmp
memory/672-710-0x0000000000400000-0x0000000000475000-memory.dmp
memory/676-614-0x0000000000400000-0x0000000000475000-memory.dmp
memory/748-634-0x0000000000400000-0x0000000000475000-memory.dmp
memory/888-744-0x0000000000400000-0x0000000000475000-memory.dmp
memory/944-494-0x0000000000400000-0x0000000000475000-memory.dmp
memory/968-771-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1040-328-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1040-1015-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1084-1013-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1288-693-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1428-232-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1428-735-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1464-746-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1476-524-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1636-875-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1652-573-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1732-1004-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1900-596-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2156-769-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2192-514-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2204-950-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2256-742-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2276-523-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2664-1177-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2720-859-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2824-995-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3000-914-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3204-1014-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3256-948-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3348-766-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3364-980-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3780-747-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3812-686-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3836-743-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3852-635-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3904-678-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3956-740-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3956-238-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4000-15-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4000-493-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4008-951-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4036-619-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4156-770-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4232-1016-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4312-234-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4312-737-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4328-748-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4332-741-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4332-239-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4356-598-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4384-996-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4448-738-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4448-236-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4532-597-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4612-638-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4672-680-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4704-915-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4708-711-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4708-235-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4760-237-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4760-739-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4776-679-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4792-428-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4792-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4812-599-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4904-736-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4904-233-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4964-681-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4976-516-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5004-772-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5056-949-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5092-637-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5128-418-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5576-572-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6984-765-0x0000000000400000-0x0000000000475000-memory.dmp