Analysis
- max time kernel
25s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 17:46
General
- Target 2026-07-02_4d0740c8c31b2a0ef8fa26618e3716f8_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe
- Size 15.7MB
- Sample260702-wccn3sa15x
- SHA256 7c3fadd3308e8a1ebb8ab58e477427b5c459642fd7aaaae79854a22206d0ae08
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 33 IoCs
- Custom signatureUPX dump on OEP (original entry point) 33 IoCs
- Executes dropped EXE 17 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 18 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_4d0740c8c31b2a0ef8fa26618e3716f8_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_4d0740c8c31b2a0ef8fa26618e3716f8_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_elex.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21425.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10708.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10708.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29624.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29624.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49380.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29557.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29557.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32758.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27134.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44170.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4969.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4969.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10790.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1675.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54938.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19760.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19760.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12514.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12514.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14985.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14985.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48414.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48414.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3687.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3687.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27117.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42126.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42126.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47262.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35982.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35982.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26010.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26010.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23875.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23875.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59915.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59915.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39203.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39203.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6905.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6905.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48073.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48073.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54939.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54939.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25181.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25181.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9758.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34497.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34497.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26869.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26869.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8825.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8825.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14663.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36656.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36656.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62442.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62442.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55914.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55914.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5602.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5602.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23377.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23377.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44517.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16135.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18281.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18281.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35051.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35051.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28239.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28239.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60584.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2170.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54040.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25188.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58450.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56568.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15597.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15597.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3634.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3634.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30434.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30434.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50595.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4475.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64642.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64642.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6111.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49506.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45305.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45305.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40527.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53506.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6412.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39177.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39177.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29267.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22353.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59152.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59152.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65488.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65488.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17356.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17356.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43785.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2639.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36001.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1461.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46781.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46781.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55715.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54871.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54871.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52359.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52359.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4081.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4081.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7735.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7735.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18473.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18473.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26017.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26017.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47237.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6220.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6220.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44906.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44906.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42114.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42114.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36755.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36755.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35229.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29531.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34030.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34030.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-262.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51155.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20917.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20917.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41192.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41192.exe9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41301.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41301.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56863.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9531.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46494.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1191.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2255.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2255.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23465.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8067.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8067.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62795.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40173.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29111.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29111.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55800.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55800.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37108.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37108.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54102.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54102.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55649.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55649.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23875.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23875.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47357.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43422.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43422.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10506.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57687.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57687.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15213.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51638.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51638.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21850.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21850.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39879.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39879.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62827.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62827.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39157.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39157.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59925.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38658.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44517.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51046.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51046.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17770.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17770.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27231.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27231.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48483.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52271.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55228.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55228.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31550.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31550.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13729.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13729.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21165.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25079.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49104.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49104.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64186.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64186.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17938.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17938.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54575.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39272.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39272.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24182.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24182.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7366.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7366.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64756.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64756.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30413.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30413.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53656.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53656.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10823.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10823.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15254.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21410.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60335.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60335.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60972.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19293.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32318.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32318.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47189.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30974.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30974.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40569.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40569.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16994.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16994.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55182.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55182.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2229.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57158.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4066.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4066.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32785.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49442.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49442.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54772.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54772.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38950.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36755.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36755.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26536.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45717.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45717.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20811.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20811.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40967.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40967.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45255.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45255.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53200.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53200.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50823.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50823.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39475.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18248.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18248.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59577.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59577.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3651.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3651.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21389.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21389.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51752.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51752.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64077.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64077.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20392.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20392.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10397.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10397.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44434.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44434.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16946.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26065.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26065.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26267.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30756.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30756.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4449.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4449.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28679.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39546.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39546.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34334.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34334.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11518.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11518.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-162.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2146.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46402.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7663.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10231.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10231.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2354.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2354.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12021.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64907.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64907.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51892.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51892.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55977.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55977.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46566.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46566.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25740.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25740.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16023.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16023.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38462.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38462.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34928.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34928.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32811.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32811.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22173.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28949.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28949.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1565.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1565.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10382.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10382.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51119.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51119.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8647.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3921.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3921.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10999.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10999.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19106.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38317.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38317.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40569.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40569.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23159.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23159.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17273.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17273.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43219.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11964.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30974.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30974.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29817.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42981.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42981.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14537.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9448.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9448.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41067.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41067.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32331.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60392.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60392.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53122.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3355.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3355.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63381.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63381.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60190.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60190.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60990.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55493.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63049.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63049.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44056.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44056.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8846.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33631.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33631.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20106.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20106.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57958.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1290.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1290.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14663.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11134.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18102.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18102.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14658.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14658.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35281.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35281.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54731.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54731.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18919.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64284.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64284.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8882.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50439.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50439.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-91.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-91.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63013.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8275.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8275.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59706.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59706.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6857.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26158.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10221.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10221.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15165.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15165.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1863.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1863.exe2⤵
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-10708.exe
Unicorn-16023.exe
Unicorn-162.exe
Unicorn-18248.exe
Unicorn-20709.exe
Unicorn-21425.exe
Unicorn-25627.exe
Unicorn-25740.exe
Unicorn-262.exe
Unicorn-29624.exe
Unicorn-30413.exe
Unicorn-34030.exe
Unicorn-34497.exe
Unicorn-35051.exe
Unicorn-40527.exe
Unicorn-4081.exe
Unicorn-41766.exe
Unicorn-43219.exe
Unicorn-45305.exe
Unicorn-49380.exe
Unicorn-49442.exe
Unicorn-51170.exe
Unicorn-51435.exe
Unicorn-52208.exe
Unicorn-54731.exe
Unicorn-55228.exe
Unicorn-55493.exe
Unicorn-58626.exe
Unicorn-59577.exe
Unicorn-64756.exe
Unicorn-7366.exe
Unicorn-7755.exe
Unicorn-9758.exe
memory/356-619-0x0000000000400000-0x0000000000475000-memory.dmp
memory/480-233-0x0000000000400000-0x0000000000475000-memory.dmp
memory/672-207-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1696-301-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1788-753-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2000-40-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2352-1034-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2456-618-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2464-462-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2596-964-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2820-717-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2896-303-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2988-300-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3216-232-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3268-464-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3284-574-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3624-531-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3804-1041-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3832-110-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4000-1035-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4004-756-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4144-714-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4352-942-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4484-713-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4496-572-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4572-463-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4708-838-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4712-302-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4776-573-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4844-1109-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4844-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4944-715-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5012-718-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5084-348-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5176-575-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5260-985-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5536-231-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5692-481-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5844-716-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5956-304-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5992-569-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6008-589-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6276-986-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6308-872-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6316-837-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6328-839-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6436-874-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6540-1004-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6596-931-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6608-934-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6748-940-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6768-905-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6784-1011-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6836-937-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6844-932-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7040-941-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7064-944-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7072-936-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7124-943-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7136-987-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7160-965-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7180-1044-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7820-1130-0x0000000000400000-0x0000000000475000-memory.dmp
memory/8168-1494-0x0000000000400000-0x0000000000475000-memory.dmp