Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 20:12
General
- Target 2026-07-02_83cd116823095fc1c26f49948a186323_agent-tesla_cobalt-strike_coinminer_cryptbot_darkgate_el.exe
- Size 23.6MB
- Sample260702-yy8dzsd121
- SHA256 1b1939d42a01c4e66ceeb3884e3b32e9f6e160ca25a84b22397ad4141c4031c1
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 17 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 33 IoCs
- UPX dump on OEP (original entry point) 33 IoCs
- Executes dropped EXE 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 33 IoCs
Inno Setup installer
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_83cd116823095fc1c26f49948a186323_agent-tesla_cobalt-strike_coinminer_cryptbot_darkgate_el.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_83cd116823095fc1c26f49948a186323_agent-tesla_cobalt-strike_coinminer_cryptbot_darkgate_el.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25271.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58602.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58602.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24498.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24498.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30969.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30969.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33377.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33377.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11309.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11309.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32917.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32917.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49389.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49389.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27594.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16820.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16820.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6026.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39078.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39078.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24403.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63674.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23899.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23899.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40099.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40099.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8304.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8304.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46479.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46479.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64103.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36115.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36115.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17807.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17807.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48398.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48398.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42865.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42865.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46063.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46063.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51060.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51060.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9730.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38507.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44652.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44652.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43441.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11387.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11387.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26358.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26358.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27322.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42840.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54729.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54729.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13774.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13774.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5835.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61695.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61695.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37461.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54397.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57002.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57002.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53551.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60328.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18438.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2326.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2326.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19042.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29727.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29727.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61584.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63312.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59970.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59970.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17117.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48620.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48180.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61643.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61643.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-235.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35897.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35897.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35591.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35591.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8740.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8740.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53660.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53660.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54489.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54489.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30059.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63219.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49960.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27589.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27589.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39079.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32005.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32005.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11195.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62674.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5040.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49597.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35958.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39934.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34143.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23702.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23702.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58180.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58180.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26202.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26202.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30173.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10074.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23586.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45198.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45198.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18224.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18224.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54179.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50536.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14952.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14952.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21568.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-588.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9040.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59228.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59228.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27532.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9538.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9538.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35866.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35866.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58159.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58159.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60847.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60847.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22462.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22462.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46592.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58241.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3809.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3809.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29670.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23972.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2762.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58689.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58689.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19945.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19945.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3136.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3136.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52622.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52622.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14464.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14464.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15760.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15760.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56042.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24117.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8403.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32882.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60012.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27894.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27894.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48896.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48896.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14677.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14677.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20957.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51097.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51097.exe6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38368.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38368.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10505.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10505.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40592.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40592.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58371.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58371.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22670.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-13511.exe
Unicorn-18224.exe
Unicorn-22794.exe
Unicorn-235.exe
Unicorn-24498.exe
Unicorn-25271.exe
Unicorn-28508.exe
Unicorn-30969.exe
Unicorn-33377.exe
Unicorn-36115.exe
Unicorn-37461.exe
Unicorn-38368.exe
Unicorn-39934.exe
Unicorn-40099.exe
Unicorn-41822.exe
Unicorn-42244.exe
Unicorn-44652.exe
Unicorn-44874.exe
Unicorn-45198.exe
Unicorn-4632.exe
Unicorn-51060.exe
Unicorn-51498.exe
Unicorn-54397.exe
Unicorn-54489.exe
Unicorn-58602.exe
Unicorn-58689.exe
Unicorn-59228.exe
Unicorn-61643.exe
Unicorn-61695.exe
Unicorn-63312.exe
Unicorn-64103.exe
Unicorn-64474.exe
Unicorn-8403.exe
memory/268-403-0x0000000000400000-0x0000000000475000-memory.dmp
memory/692-588-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1692-358-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1728-257-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2644-614-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2852-700-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2908-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3028-356-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3184-333-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3396-550-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3744-586-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4552-404-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4560-652-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5000-357-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5080-587-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5424-701-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5608-224-0x0000000000400000-0x0000000000475000-memory.dmp