Analysis
- max time kernel
94s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
11/08/2026, 02:46
General
- Target 2026-08-11_8ff55972d4a8831bc388b1d871d57076_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
- Size 12.9MB
- Sample260811-c9qsestfnc
- SHA256 856a1ff891f8bb85c9ac52cddd3eb797a8815f6edd564df98f327970bf8bad30
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 33 IoCs
- UPX dump on OEP (original entry point) 33 IoCs
- Executes dropped EXE 64 IoCs
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_8ff55972d4a8831bc388b1d871d57076_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_8ff55972d4a8831bc388b1d871d57076_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27918.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27918.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55811.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55811.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31088.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37905.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8943.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8943.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe9⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44045.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44045.exe10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63316.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63316.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34323.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61003.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48759.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51115.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51115.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37937.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37937.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10332.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56958.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4431.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4431.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50749.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34443.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34443.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3.exe8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7240.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7240.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1270.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1270.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-922.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56535.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57728.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57728.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2172.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64356.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44667.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44667.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58547.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11981.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11981.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26247.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26247.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51885.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18915.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18915.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48779.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48779.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13939.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13939.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36295.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36295.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16640.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16640.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe7⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14995.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14995.exe8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49140.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11507.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35350.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5978.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5978.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45966.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44813.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17034.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58527.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65121.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48407.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48407.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48231.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48231.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24135.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58274.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20819.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14930.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41613.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41613.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4658.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27750.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27750.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31168.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44091.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44091.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35815.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35815.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56973.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56973.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17193.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58107.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17324.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4542.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4542.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43694.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43694.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5344.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54372.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18090.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22022.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45515.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45515.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7203.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7203.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54077.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54077.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45603.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48718.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48718.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28513.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1135.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27549.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59170.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65227.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65227.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53767.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14882.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-827.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-827.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48615.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48615.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3859.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51885.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58804.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45924.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36826.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15990.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11519.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11519.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38522.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60516.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60516.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16172.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28989.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51373.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51373.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25699.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39970.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39970.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61223.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61223.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12524.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11468.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11468.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2329.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2329.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52961.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52961.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19568.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42513.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13183.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13183.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34960.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34960.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37149.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37149.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44706.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44706.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8435.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48443.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48443.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39290.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39290.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19018.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12717.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12717.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33021.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19603.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45099.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45099.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44192.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44192.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13068.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13068.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46020.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46020.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39483.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65508.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27555.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27555.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40254.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25171.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20886.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20886.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41683.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41683.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11895.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11895.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33664.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33664.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26512.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1532.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46020.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46020.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38336.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3338.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3338.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43474.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3462.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3462.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59837.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59837.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20323.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59422.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59422.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7094.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20099.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20099.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29261.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29261.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54960.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54960.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40445.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34579.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56724.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39399.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39399.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45930.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56247.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56247.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18989.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46779.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46779.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12706.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12706.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46999.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3219.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33610.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33610.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35214.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45172.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12244 -s 727⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14223.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14223.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50062.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50062.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37860.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29306.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12054.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12054.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10938.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23165.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7999.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2095.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61963.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61963.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62850.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12791.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12791.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38867.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38867.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25174.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60574.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60574.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34788.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34788.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59623.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59623.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65121.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59220.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59220.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1779.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1779.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41486.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50148.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50148.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14682.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27738.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26653.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26653.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39378.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24957.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42897.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31168.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37860.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50558.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44589.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44589.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57318.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57318.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57300.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62807.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62807.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52077.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52077.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33610.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33610.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53028.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53028.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3338.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3338.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62724.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11677.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11677.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17197.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17197.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37860.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9747.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9747.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6294.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6294.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35930.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31880.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31880.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61728.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61728.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44020.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44020.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63911.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27949.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20029.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31614.exe3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23908.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23908.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34579.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3338.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3338.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48790.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27165.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7866.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59522.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59522.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34473.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34473.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59707.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59707.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49781.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49781.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12402.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52193.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8175.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44064.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44064.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60352.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60352.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4385.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4385.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29348.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29348.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17193.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47207.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47207.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34413.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34413.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45060.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45060.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3914.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3914.exe7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62631.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62631.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1167.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20579.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20819.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16157.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16157.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25108.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25108.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54615.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54615.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18065.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18065.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29984.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29984.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44875.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44875.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15217.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24724.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8449.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8449.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42286.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15228.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15228.exe7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17193.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4787.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4787.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48587.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52388.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52388.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17549.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32688.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32688.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22963.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22963.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20579.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53159.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53159.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64043.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49272.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49272.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32219.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13820.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13654.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24512.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2172.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59540.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39587.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39587.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49172.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2131.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39307.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13814.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13814.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64043.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51326.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56973.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56973.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56004.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56004.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24515.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24515.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64979.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-931.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-931.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51246.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51246.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29440.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29440.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29984.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29984.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9585.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9585.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36330.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36330.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48535.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17949.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16218.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16218.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21949.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58244.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58244.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47255.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47255.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1555.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1555.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61435.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17914.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17914.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56964.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46222.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46222.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17770.exe4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43136.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43136.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40080.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5439.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5439.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45316.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45316.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19018.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24490.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24490.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53764.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53764.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39483.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47519.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47519.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2172.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5139.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5139.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19018.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38183.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38183.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25689.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25689.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41683.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41683.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21382.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21382.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60144.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60144.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27091.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27091.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45930.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10250.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23340.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23340.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39486.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17427.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42376.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42376.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14252.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41683.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41683.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44713.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12184 -s 4645⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40131.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44655.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44655.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59504.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59504.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8255.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8255.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21901.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30634.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33956.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28630.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28630.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16172.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33789.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33789.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19827.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19827.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16486.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44539.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11770.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32077.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32077.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64043.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9306.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64887.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54676.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38098.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38098.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47232.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8719.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26109.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26109.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39307.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42019.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42019.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62997.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62997.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63783.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63783.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62820.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28259.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50045.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50045.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47732.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47732.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24300.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60178.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6814.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6814.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30452.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30452.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53767.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25654.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45259.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51879.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51879.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5007.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5007.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51060.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51060.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33332.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33585.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33585.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27299.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35853.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35853.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7402.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37554.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37554.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32486.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32486.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23552.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23552.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43696.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43696.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-515.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-515.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45474.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12060.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12060.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26634.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2803.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32278.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32278.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62125.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4385.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4385.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38654.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8817.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52932.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52932.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45924.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7053.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8719.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-978.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-978.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28582.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28582.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28922.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41763.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41763.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16172.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37340.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37340.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9917.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9917.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45965.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45965.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37827.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37827.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31005.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31005.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11019.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11019.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17347.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17347.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26512.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26512.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24724.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54372.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3338.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3338.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32880.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32880.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59012.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57547.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33677.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33677.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22539.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13441.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7926.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7926.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54960.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54960.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56957.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35699.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30634.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27555.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27555.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44286.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44286.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62125.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53181.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51032.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61180.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29005.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29005.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55664.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55664.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53159.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53159.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8817.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52072.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52072.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26518.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26518.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43812.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43812.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-429.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-429.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40765.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22539.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34038.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34038.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49024.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49024.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31139.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31139.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7432.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45633.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45633.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59170.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8325.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31075.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31075.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47778.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47778.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64364.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 12244 -ip 122441⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-11895.exe
Unicorn-12402.exe
Unicorn-13654.exe
Unicorn-18119.exe
Unicorn-18679.exe
Unicorn-19568.exe
Unicorn-22003.exe
Unicorn-2329.exe
Unicorn-24957.exe
Unicorn-27750.exe
Unicorn-27918.exe
Unicorn-29005.exe
Unicorn-31088.exe
Unicorn-31880.exe
Unicorn-32486.exe
Unicorn-33127.exe
Unicorn-36295.exe
Unicorn-37905.exe
Unicorn-40865.exe
Unicorn-4111.exe
Unicorn-42513.exe
Unicorn-42897.exe
Unicorn-44655.exe
Unicorn-45316.exe
Unicorn-47232.exe
Unicorn-48097.exe
Unicorn-48718.exe
Unicorn-49781.exe
Unicorn-52193.exe
Unicorn-52961.exe
Unicorn-55040.exe
Unicorn-55811.exe
Unicorn-59936.exe
memory/372-2138-0x0000000000400000-0x0000000000475000-memory.dmp
memory/388-973-0x0000000000400000-0x0000000000475000-memory.dmp
memory/464-476-0x0000000000400000-0x0000000000475000-memory.dmp
memory/688-450-0x0000000000400000-0x0000000000475000-memory.dmp
memory/888-1836-0x0000000000400000-0x0000000000475000-memory.dmp
memory/980-682-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1028-372-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1040-981-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1060-650-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1152-2097-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1388-1725-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1400-1363-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1404-947-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1520-1950-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1532-1176-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1568-1121-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1624-406-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1652-671-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1996-680-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2076-2096-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2092-1662-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2180-802-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2252-428-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2396-895-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2756-649-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2832-1874-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2836-972-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2872-427-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2876-679-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2900-893-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2920-1254-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2952-463-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3020-501-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3044-974-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3104-1139-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3272-1025-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3292-629-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3372-630-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3444-462-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3596-555-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3784-1550-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4004-2226-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4048-1919-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4088-2216-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4152-826-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4152-162-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4232-897-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4304-2228-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4312-477-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4332-2258-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4352-2144-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4376-1456-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4420-1496-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4456-553-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4464-1426-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4516-509-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4632-512-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4708-1837-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4732-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4732-344-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4784-407-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4792-379-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4812-323-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4812-1875-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4856-1412-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4920-896-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4928-1551-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4952-361-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4952-7-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4984-508-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5084-683-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5104-1120-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5156-971-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5204-1800-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5248-584-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5336-1873-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5392-1876-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5424-2227-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5488-2195-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5516-827-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5576-894-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5580-899-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5592-378-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5592-2229-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5628-898-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5796-873-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5808-430-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5916-1726-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5928-2071-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5972-237-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5972-1072-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6204-845-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6212-855-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6664-796-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6864-801-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7732-970-0x0000000000400000-0x0000000000475000-memory.dmp