Analysis
- max time kernel
25s - max time network
101s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/07/2026, 04:38
General
- Target 2026-07-15_8b2bf40ed8a45d48e9d0985233c99729_agent-tesla_cobalt-strike_cryptbot_darkgate_elex_gcleane.exe
- Size 20.7MB
- Sample260715-e9gkvsew7w
- SHA256 2c760d7ab3dd161b013eb4f48185ba2052f25e463f05000218c3e3b1b864fa71
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 31 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 30 IoCs
- UPX dump on OEP (original entry point) 30 IoCs
- Executes dropped EXE 9 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 30 IoCs
Inno Setup installer
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_8b2bf40ed8a45d48e9d0985233c99729_agent-tesla_cobalt-strike_cryptbot_darkgate_elex_gcleane.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_8b2bf40ed8a45d48e9d0985233c99729_agent-tesla_cobalt-strike_cryptbot_darkgate_elex_gcleane.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53870.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42590.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42590.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8990.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27937.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27937.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6133.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6133.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14570.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14570.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15217.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22450.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23229.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3971.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3971.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40056.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40056.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35627.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-744.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51948.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59669.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59669.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29043.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12677.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12677.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48815.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48815.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14184.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14184.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26768.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26768.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43906.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43906.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63349.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60889.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60889.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31717.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31717.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3427.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19868.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38071.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38071.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62295.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62295.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7981.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7981.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17925.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20919.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9533.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9533.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43579.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26452.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26452.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60650.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42429.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42429.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37008.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37008.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17526.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17526.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62092.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55656.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55656.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28577.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28577.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7536.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3961.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3961.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15123.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15123.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60043.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40545.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37001.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23485.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17324.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7137.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7137.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48144.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48144.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50026.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17766.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63084.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58763.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58763.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13693.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13693.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45803.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32275.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32275.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30508.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46358.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46358.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29696.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29696.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36421.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36421.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59493.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62657.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64132.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64132.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31657.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6245.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6245.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33488.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62294.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62294.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34018.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53870.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46611.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46611.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62702.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62702.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27869.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54548.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54548.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56158.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51507.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51507.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5985.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5433.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15217.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48381.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48381.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14952.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14952.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31706.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31706.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54534.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54534.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-287.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25538.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25538.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16503.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16503.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63810.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17465.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13608.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13608.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45734.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59028.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59028.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34004.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34004.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25999.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41213.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30863.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8564.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8564.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8531.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52181.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55968.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43669.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43669.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47262.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57006.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57006.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56651.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56651.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13042.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16707.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16707.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31817.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58360.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58360.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30815.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30815.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37274.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37274.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49830.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58341.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62657.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62657.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15553.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13729.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13729.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41958.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9545.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9545.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4055.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41917.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41917.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35449.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35449.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40549.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64016.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31976.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31976.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7152.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7152.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13115.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13115.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64708.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64708.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28101.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28101.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30355.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30355.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13179.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28755.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28755.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60500.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60500.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16077.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16077.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12939.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12939.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35790.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58618.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58618.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36421.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36421.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12134.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12698.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27581.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27581.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38392.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38392.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20727.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20727.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47828.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47828.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15217.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39999.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23987.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23742.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23742.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44744.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17826.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48644.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48644.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31976.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31976.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23764.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23764.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36058.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36058.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61593.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27333.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27333.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41459.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41459.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9972.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51932.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51932.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33442.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33442.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42595.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31976.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31976.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-411.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45767.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64521.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64521.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16316.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16316.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12970.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12970.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61933.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61933.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3734.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24303.exe3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-12677.exe
Unicorn-14131.exe
Unicorn-14570.exe
Unicorn-16421.exe
Unicorn-19529.exe
Unicorn-19868.exe
Unicorn-25999.exe
Unicorn-27892.exe
Unicorn-28577.exe
Unicorn-29043.exe
Unicorn-31706.exe
Unicorn-31976.exe
Unicorn-34004.exe
Unicorn-34018.exe
Unicorn-35790.exe
Unicorn-37274.exe
Unicorn-40549.exe
Unicorn-46611.exe
Unicorn-48644.exe
Unicorn-52641.exe
Unicorn-53870.exe
Unicorn-55656.exe
Unicorn-58763.exe
Unicorn-59683.exe
Unicorn-6133.exe
Unicorn-62092.exe
Unicorn-62294.exe
Unicorn-63771.exe
Unicorn-64016.exe
Unicorn-6954.exe
memory/720-313-0x0000000000400000-0x0000000000475000-memory.dmp
memory/812-177-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1676-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1776-761-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1828-652-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1856-664-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2224-93-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2412-312-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2680-648-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2740-665-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2804-854-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2856-474-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3328-654-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3452-176-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3540-364-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3556-819-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3656-760-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3756-759-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3760-666-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3784-786-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4224-549-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4456-443-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4688-649-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5320-653-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5368-651-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5372-182-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5556-422-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5776-507-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5848-650-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5956-550-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6092-365-0x0000000000400000-0x0000000000475000-memory.dmp