Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
02/08/2026, 03:05
General
- Target 2026-08-02_64d8cc76972aea7620d29ab9f1e36304_agent-tesla_cobalt-strike_cryptbot_darkgate_elex_gcleane.exe
- Size 20.7MB
- Sample260802-dle7fstakc
- SHA256 db514bbce7fa272bf9f37de76aea2f0061730fb5bde0eebe3031938008cefd17
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 33 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 31 IoCs
- UPX dump on OEP (original entry point) 31 IoCs
- Executes dropped EXE 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 31 IoCs
Inno Setup installer
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_64d8cc76972aea7620d29ab9f1e36304_agent-tesla_cobalt-strike_cryptbot_darkgate_elex_gcleane.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_64d8cc76972aea7620d29ab9f1e36304_agent-tesla_cobalt-strike_cryptbot_darkgate_elex_gcleane.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21490.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21490.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11175.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13981.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13981.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58603.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6474.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6474.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1902.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1902.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37476.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37476.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38794.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38794.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62560.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31038.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31038.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50378.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35835.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35177.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35177.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26120.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15341.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23876.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50174.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15048.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49513.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57451.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57451.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41980.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55212.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55171.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17745.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54165.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19390.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19390.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50558.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45339.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15047.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15047.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34696.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34696.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38235.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24497.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24497.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28538.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28538.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52770.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6813.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6813.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29182.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29182.exe10⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32214.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18261.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18261.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9221.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9221.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5203.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5203.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48487.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48487.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52281.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52281.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30091.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30091.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48141.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48141.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55817.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32560.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39756.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39756.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50816.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50816.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30409.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30409.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40378.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11084.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32560.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51270.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51270.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45856.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-160.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-160.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33496.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33496.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62510.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62510.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35541.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35541.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63884.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63884.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13313.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47944.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47944.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18764.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18764.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38399.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38399.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62834.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62834.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18267.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38556.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38556.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10661.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10661.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63993.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63993.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13048.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55090.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27294.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27294.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61260.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61260.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46240.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46240.exe6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9301.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8084.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4626.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4626.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15841.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15841.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34322.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34322.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16353.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19761.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13779.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13779.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55983.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11538.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11538.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51047.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51047.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56484.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56484.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37469.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37469.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59653.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59653.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31852.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8856.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20999.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65206.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59451.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59451.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40636.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40636.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55983.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11935.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5240.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5240.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54006.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54006.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32446.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32446.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64227.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64227.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41478.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41478.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60663.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55882.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59438.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39925.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64138.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64138.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60530.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25389.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28724.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44900.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44900.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41343.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41343.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34442.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34442.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32560.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20221.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20221.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33633.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33633.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11935.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35142.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19699.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19682.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8306.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-321.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30985.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44014.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53067.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53067.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34594.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34594.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50590.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50590.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49966.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49101.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49101.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14792.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36022.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36022.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17800.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17800.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43357.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29417.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29417.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6479.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6479.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20337.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62549.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55339.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55339.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11175.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42954.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42954.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59407.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59407.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60869.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5547.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7102.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7102.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17854.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17854.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49143.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20791.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20791.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40491.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42662.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17950.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38730.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45721.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45721.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60395.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60395.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48830.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41725.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41725.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3018.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3018.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11887.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-11175.exe
Unicorn-11935.exe
Unicorn-13048.exe
Unicorn-13313.exe
Unicorn-13779.exe
Unicorn-1378.exe
Unicorn-15341.exe
Unicorn-16353.exe
Unicorn-19327.exe
Unicorn-19761.exe
Unicorn-21490.exe
Unicorn-24497.exe
Unicorn-26120.exe
Unicorn-33624.exe
Unicorn-34322.exe
Unicorn-34696.exe
Unicorn-38235.exe
Unicorn-41443.exe
Unicorn-43930.exe
Unicorn-44900.exe
Unicorn-45721.exe
Unicorn-45856.exe
Unicorn-48792.exe
Unicorn-53067.exe
Unicorn-54562.exe
Unicorn-55339.exe
Unicorn-55882.exe
Unicorn-59451.exe
Unicorn-60663.exe
Unicorn-9674.exe
Unicorn-28724.exe
memory/1004-280-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1096-206-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1196-870-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1252-588-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1368-778-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1960-172-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2380-510-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2384-136-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2412-733-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2568-761-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2640-734-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2856-513-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3008-559-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3560-515-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3656-871-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3940-757-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4144-300-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4244-762-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4448-326-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4512-512-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4516-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4708-587-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4748-279-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5600-475-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5608-811-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5632-478-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5768-756-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5828-812-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5912-758-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5960-731-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5988-760-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5992-278-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6096-277-0x0000000000400000-0x0000000000475000-memory.dmp