Analysis
- max time kernel
35s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/08/2026, 22:57
General
- Target 2026-08-14_d29cb3dc15e023854f386c86bd51ae61_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe
- Size 8.0MB
- Sample260814-2xks3styhs
- SHA256 e590137c4d6ccc1b307a8a89c03dd492737a4d7811a5150e6ac44efdd0c0ab6b
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 30 IoCs
- UPX dump on OEP (original entry point) 30 IoCs
- Executes dropped EXE 22 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 21 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_d29cb3dc15e023854f386c86bd51ae61_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_d29cb3dc15e023854f386c86bd51ae61_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2602.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2602.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51619.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27027.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27027.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24645.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61786.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61786.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2974.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2974.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36948.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57625.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57625.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42620.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55034.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55034.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33424.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33424.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20824.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20824.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43867.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43867.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4664.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4664.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51433.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59051.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59051.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-348.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-348.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4779.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4779.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10737.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10737.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50992.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50992.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45496.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45496.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34572.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34572.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13699.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11448.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8224.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8224.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30193.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6513.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5583.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5583.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40079.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55549.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53919.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47810.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24645.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24645.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15699.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55730.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9009.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9009.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47183.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47183.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31790.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18250.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18250.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60369.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28600.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28600.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46825.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46825.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31017.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13591.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13591.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55216.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25418.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25418.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51785.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-498.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-498.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21029.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16351.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16351.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27411.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40026.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1168.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42147.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42147.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4049.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4049.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39482.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39482.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9300.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14893.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38359.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38359.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6113.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6113.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64001.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61194.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26419.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45730.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35864.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35864.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53175.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24345.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57385.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57385.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61868.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3145.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3145.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41843.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41843.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4095.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13887.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21473.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21473.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9232.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65159.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65159.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59475.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41210.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41210.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31934.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30551.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9378.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26133.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26133.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48568.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10899.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10899.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64914.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64914.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65520.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19080.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13685.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41354.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41354.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46177.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46177.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53560.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33337.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7120.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17914.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17914.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45470.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45470.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8633.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8633.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15813.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48724.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5408.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61714.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61714.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2454.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2454.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27033.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19990.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36593.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58614.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50524.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6113.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6113.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6902.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6902.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58065.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58065.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9300.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19493.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64841.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64841.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36934.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57790.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26662.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22632.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14805.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14805.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54832.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54832.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4629.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4629.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41226.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32552.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32552.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18613.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18613.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25123.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25123.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38963.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38963.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46690.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65501.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60560.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4520.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19818.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19818.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51785.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22095.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50644.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50644.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41868.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37852.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12014.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13551.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48969.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48969.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27471.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27471.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3145.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3145.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54946.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62860.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55595.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17757.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24479.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24479.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8760.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8760.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46929.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46929.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9252.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41210.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41210.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39903.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39903.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8942.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8942.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16320.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16320.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23863.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6201.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6201.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38667.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38667.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60094.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25418.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25418.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35786.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35786.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12564.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19901.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64588.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57385.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57385.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35156.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60705.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60705.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55138.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55138.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44136.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44136.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27624.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27624.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57385.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57385.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30074.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27399.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27399.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15845.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38022.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36497.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36497.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4001.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17837.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17837.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52154.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2768.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2768.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9243.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9243.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13699.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10893.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43789.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43789.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57084.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8633.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8633.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42129.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52445.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9212.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64566.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64566.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17729.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17729.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58317.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58317.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6113.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6113.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40042.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34749.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30141.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30141.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44625.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44625.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4536.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33439.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33439.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6690.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1740.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1740.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38152.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38152.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29570.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29570.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11853.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11853.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22979.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13181.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11063.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11063.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51727.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51727.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9689.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9689.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45610.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45610.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22077.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22077.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2771.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61007.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61007.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60566.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60566.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8054.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8054.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-845.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41210.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41210.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-851.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-851.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4292.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4292.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7546.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7546.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4022.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1501.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4920.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4920.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21334.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23863.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5848.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5848.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36289.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36289.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40582.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40582.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21475.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42740.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42740.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7358.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7358.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40987.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60296.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60296.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36353.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7266.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17811.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17811.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55652.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32138.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32138.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26400.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26400.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51328.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12599.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12599.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28688.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28688.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41096.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41096.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4022.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26133.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26133.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19519.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19519.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62016.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6209.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6209.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-11655.exe
Unicorn-1344.exe
Unicorn-14011.exe
Unicorn-14805.exe
Unicorn-18514.exe
Unicorn-24645.exe
Unicorn-2602.exe
Unicorn-27027.exe
Unicorn-27471.exe
Unicorn-2771.exe
Unicorn-33337.exe
Unicorn-34108.exe
Unicorn-38359.exe
Unicorn-40042.exe
Unicorn-44136.exe
Unicorn-4779.exe
Unicorn-47810.exe
Unicorn-50524.exe
Unicorn-51619.exe
Unicorn-51785.exe
Unicorn-58317.exe
Unicorn-5848.exe
Unicorn-58614.exe
Unicorn-6113.exe
Unicorn-61868.exe
Unicorn-6201.exe
Unicorn-63736.exe
Unicorn-64001.exe
Unicorn-65520.exe
Unicorn-7266.exe
memory/936-689-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1092-690-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1160-571-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1196-738-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1212-431-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1368-991-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1476-929-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1524-954-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2040-729-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2068-952-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2084-693-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2188-169-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2256-909-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2324-994-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2340-806-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2412-955-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2684-953-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2732-433-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2768-934-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2852-354-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2868-259-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2884-578-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3012-709-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3140-808-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3204-592-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3288-737-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3296-594-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3340-593-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3352-262-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3372-442-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3404-993-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3404-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3532-691-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3792-663-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3920-445-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4028-579-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4040-606-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4132-437-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4204-436-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4416-990-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4428-692-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4528-432-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4592-78-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4620-435-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4632-1014-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4636-207-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4748-777-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4808-444-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4856-805-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4920-1194-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5044-804-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5084-1165-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5192-1011-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5292-928-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5320-256-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5372-573-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5444-1135-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5464-927-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5508-572-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5540-1196-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5596-208-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5604-206-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5680-443-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5764-803-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5768-932-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5800-930-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5828-326-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5888-740-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5920-1163-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5936-933-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5960-931-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6028-112-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6112-739-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6132-209-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6180-958-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6276-935-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6284-957-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6328-1015-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6376-1164-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6396-1197-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6440-1016-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6520-1132-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6576-1195-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6580-1166-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6640-1198-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6720-992-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6744-1191-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6752-1133-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6776-1131-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6864-1192-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6872-1130-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6880-1162-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6896-1136-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6904-1134-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6968-1193-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7008-1161-0x0000000000400000-0x0000000000475000-memory.dmp