Analysis
- max time kernel
28s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
05/08/2026, 02:11
General
- Target 2026-08-05_18bd3d802eb498ae0cbb9209bbed5f97_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
- Size 15.7MB
- Sample260805-cmd54stwgs
- SHA256 1ff868c14b082d37511aeff5379219a971f24850ab61d676aee6454ce5ec4456
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 33 IoCs
- UPX dump on OEP (original entry point) 33 IoCs
- Executes dropped EXE 16 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 16 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_18bd3d802eb498ae0cbb9209bbed5f97_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_18bd3d802eb498ae0cbb9209bbed5f97_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25346.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28387.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28387.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29145.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29145.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3886.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3886.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4091.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4091.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64052.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59262.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62034.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4540.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39630.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39630.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60251.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60251.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10397.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53575.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11226.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5345.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24120.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63301.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46703.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46703.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28571.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28571.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1493.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10880.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10880.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59337.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22723.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54911.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54826.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46227.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46227.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-339.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6871.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6871.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-189.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28719.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33396.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8957.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21121.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38751.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38751.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46098.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46098.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25905.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49316.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49316.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33437.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33437.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55772.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39607.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39607.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54204.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54204.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50885.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56307.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8474.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58011.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37425.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8859.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4540.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35895.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35895.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29142.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31407.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31407.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9485.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18687.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18687.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42161.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42161.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10972.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51271.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15268.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15268.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41829.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41829.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7486.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40713.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36394.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36394.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31380.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20177.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20177.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41717.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41717.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3196.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3196.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5395.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13188.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45315.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4855.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4855.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38448.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38448.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64153.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64153.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11894.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11894.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12422.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12422.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40949.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17744.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24977.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24977.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15822.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42059.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20105.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20105.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33900.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22369.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45071.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45071.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11124.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11124.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2753.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2753.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8521.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8521.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51319.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37244.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37244.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29015.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29015.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48205.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32397.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32597.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4760.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4760.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2152.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2152.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29351.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29351.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54867.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54867.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49119.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49119.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62064.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62064.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2284.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2284.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65381.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65381.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1953.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52436.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20634.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63663.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51730.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65195.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54751.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54751.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55330.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55330.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29985.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51703.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51703.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-919.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64146.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16061.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16061.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64052.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58415.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58415.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20544.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20544.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24682.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31127.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31127.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60256.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60256.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23249.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23249.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25087.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25087.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14458.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42765.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3519.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3519.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8531.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25999.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55188.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58183.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58183.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53549.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61325.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31217.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49004.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49004.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32091.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32091.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6543.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12494.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61429.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61429.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19249.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19249.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49058.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49058.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54718.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54718.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7142.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4089.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4089.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9243.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9243.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41922.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23804.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28685.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42054.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42054.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2279.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2279.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46859.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42324.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62010.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62010.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56871.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56871.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31331.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30676.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39074.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34834.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34834.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39331.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57598.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57598.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4055.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49117.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27828.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27828.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40536.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19648.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15529.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15529.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21624.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21624.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8141.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8141.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17086.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17086.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5345.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45017.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20128.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20128.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26789.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26789.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6856.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3554.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3554.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39778.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39778.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33513.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24894.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24894.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5388.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5388.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61272.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61272.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33912.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33912.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48557.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48557.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63206.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4174.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2402.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41040.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1969.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1969.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9990.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56663.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63785.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28911.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33959.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33959.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24676.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42162.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7115.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7115.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51582.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51582.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61772.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21174.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43638.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59080.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62067.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62067.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59635.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59635.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52939.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52939.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31669.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31669.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61877.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61877.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48939.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48939.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1818.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1818.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12576.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12576.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7463.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7463.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55172.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3057.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3057.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4579.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44484.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20177.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20177.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14342.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60186.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48973.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48973.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19432.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3799.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64458.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64458.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46416.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46416.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18263.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18263.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48419.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62744.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58803.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2377.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2377.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21135.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27467.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27467.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58312.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63124.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63124.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35235.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26675.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60251.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60251.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49998.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49998.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44647.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59302.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59302.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59521.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59521.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17803.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31789.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31789.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55188.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24948.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19953.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-14177.exe
Unicorn-15069.exe
Unicorn-17274.exe
Unicorn-1818.exe
Unicorn-1953.exe
Unicorn-21624.exe
Unicorn-22723.exe
Unicorn-2402.exe
Unicorn-25346.exe
Unicorn-28199.exe
Unicorn-28387.exe
Unicorn-29145.exe
Unicorn-37244.exe
Unicorn-38078.exe
Unicorn-3886.exe
Unicorn-4057.exe
Unicorn-40713.exe
Unicorn-4091.exe
Unicorn-41040.exe
Unicorn-42324.exe
Unicorn-48939.exe
Unicorn-49946.exe
Unicorn-50885.exe
Unicorn-51319.exe
Unicorn-53549.exe
Unicorn-54204.exe
Unicorn-56307.exe
Unicorn-61325.exe
Unicorn-62744.exe
Unicorn-62945.exe
Unicorn-7486.exe
Unicorn-8141.exe
Unicorn-8521.exe
memory/8-1033-0x0000000000400000-0x0000000000475000-memory.dmp
memory/692-885-0x0000000000400000-0x0000000000475000-memory.dmp
memory/720-640-0x0000000000400000-0x0000000000475000-memory.dmp
memory/836-979-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1084-1246-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1092-1077-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1112-1081-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1248-157-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1320-887-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1476-1176-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1492-616-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1584-642-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1616-637-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1648-618-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1780-1079-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1788-612-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1828-639-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1960-1243-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2020-940-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2156-667-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2184-617-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2496-938-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2504-935-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2636-884-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2768-493-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2800-663-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3168-1252-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3176-1222-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3224-641-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3296-1078-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3324-303-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3384-608-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3488-936-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3516-611-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3576-158-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3744-888-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3816-738-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3968-638-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4180-159-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4304-668-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4344-992-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4404-737-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4408-615-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4524-610-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4672-939-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4864-609-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4892-886-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5004-1074-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5076-614-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5564-1224-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5652-613-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5744-1214-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5836-1076-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5988-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6028-761-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6040-643-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6148-1082-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6164-1083-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6176-1179-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6236-1084-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6264-1219-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6272-1085-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6328-1103-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6340-1250-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6348-1145-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6356-1146-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6364-1148-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6416-1178-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6420-1150-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6444-1141-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6460-1142-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6480-1143-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6488-1248-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6492-1147-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6500-1184-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6516-1217-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6524-1251-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6528-1144-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6680-1180-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6684-1181-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6696-1221-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6708-1182-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6720-1183-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6736-1223-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6748-1215-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6792-1151-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6800-1212-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6812-1153-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6968-1245-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6988-1175-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7012-1247-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7036-1154-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7044-1174-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7096-1177-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7108-1218-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7152-1220-0x0000000000400000-0x0000000000475000-memory.dmp