Analysis
- max time kernel
47s - max time network
84s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
24/08/2026, 12:38
Errors
Reason
Machine shutdown
General
- Target 054fe3e63a3f1951ea8f5bd2b67536aec564fa60291e892e3d9cd4208bcce2b3.exe
- Size 468KB
- Sample260824-pt9ltadd68
- SHA256 054fe3e63a3f1951ea8f5bd2b67536aec564fa60291e892e3d9cd4208bcce2b3
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Executes dropped EXE 64 IoCs
- Program crash 5 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\054fe3e63a3f1951ea8f5bd2b67536aec564fa60291e892e3d9cd4208bcce2b3.exe"C:\Users\Admin\AppData\Local\Temp\054fe3e63a3f1951ea8f5bd2b67536aec564fa60291e892e3d9cd4208bcce2b3.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55785.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45609.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45609.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35957.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59257.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59257.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54893.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27369.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27369.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exe9⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49956.exe10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27366.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27366.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57143.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58100.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58100.exe8⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39048.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12130.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12130.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24175.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24175.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12739.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1188.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57527.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39739.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41907.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41907.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6439.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6439.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36497.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36497.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1572.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1572.exe8⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45464.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45464.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28332.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5525.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9182.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9182.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51555.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51555.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33425.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10925.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29987.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29987.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23055.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54893.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56149.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56149.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8396.exe8⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43568.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52727.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52727.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53930.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56372.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56372.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28192.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28192.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47910.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47910.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35675.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64872.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64872.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13824.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13824.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37490.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37490.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16241.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5098.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5098.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16090.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16269.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16269.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24733.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24733.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6235.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55955.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55955.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6790.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36080.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49462.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49462.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49079.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15237.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60371.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60371.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13531.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13531.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61876.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61876.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36670.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54378.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27718.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27718.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26248.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26248.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24067.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24067.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2952.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2952.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18573.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18573.exe7⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31258.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31258.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4330.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4330.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42551.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60736.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60736.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21648.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61855.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61855.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52082.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52082.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60843.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60843.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41939.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41939.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53796.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53796.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60791.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60791.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51419.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9947.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9947.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10319.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23090.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23090.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50870.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8066.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8066.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15986.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63061.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63061.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14924.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28192.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28192.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64315.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54016.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-122.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48678.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48678.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61331.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49775.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49775.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31258.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31258.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25467.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25467.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27438.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37844.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37844.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5306.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17978.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17978.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19041.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19041.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27912.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27912.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32586.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36110.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36110.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37842.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37842.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44784.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44784.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29007.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29007.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35957.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34945.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34945.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33321.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53497.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53497.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59221.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59221.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42068.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42068.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28834.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28834.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36722.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51224.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51224.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10319.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62414.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62414.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59115.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59115.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43461.exe7⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64402.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54491.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54978.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54978.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56972.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30525.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11206.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11206.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42194.exe6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8740 -s 4647⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35219.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35219.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60425.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20649.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20649.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64315.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6790.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53930.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3087.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3087.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47718.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47718.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26547.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9178.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13824.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13824.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56972.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23282.exe7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9960 -s 4648⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57527.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57527.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45604.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23480.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23480.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10698.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33241.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60059.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60059.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47560.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47560.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54893.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35205.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8539.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41730.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1502.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1502.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9411.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44062.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44062.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37819.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37819.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17616.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17616.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18644.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18644.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32586.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20349.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52919.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3454.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3454.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40773.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40773.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43373.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43373.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1502.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1502.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26003.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8451.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8451.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51731.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51731.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64630.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64630.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19722.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33425.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 6326⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31626.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31626.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10925.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37803.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63061.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63061.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33708.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33708.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41242.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43442.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43442.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47054.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47054.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29267.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9063.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9063.exe6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42062.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42062.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21189.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21189.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29801.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26859.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28137.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28137.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35205.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1502.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1502.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36391.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36391.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26003.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26003.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53848.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53848.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53530.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53530.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16790.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43387.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43387.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51248.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51248.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29426.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60766.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60766.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54719.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54719.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30404.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39045.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39045.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10212.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6235.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30525.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51995.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51995.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39846.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39846.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47140.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21648.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41242.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34611.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34611.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55744.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55744.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6235.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52727.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52727.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44595.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1902.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1902.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26002.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26002.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9514.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9514.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46662.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46662.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37794.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37794.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24053.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32849.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32849.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41294.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41294.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50127.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50127.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42830.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50267.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15691.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8451.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8451.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47647.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47647.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64491.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52727.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52727.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21851.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21851.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23253.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23253.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63844.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63844.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6178.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59501.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59501.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28749.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 4885⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55256.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55256.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32221.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32221.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16129.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58124.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58124.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16074.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26390.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13857.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13857.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50267.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50267.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51555.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51555.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53412.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28502.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28502.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52998.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52998.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38815.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38815.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23735.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23735.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53604.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53604.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5799.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49271.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60791.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60791.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10386.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10386.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55798.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55798.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30299.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35026.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17089.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17089.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38155.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44254.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2110.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2110.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23757.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47841.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47841.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55384.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55384.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16214.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62379.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62379.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55466.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55466.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53775.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53775.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2307.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38154.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30299.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50456.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50456.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11030.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11030.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53670.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53670.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21014.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47804.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47804.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29481.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29481.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21648.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33074.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27490.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27490.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30299.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30299.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6134.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46588.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46588.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-838.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20349.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20349.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4350.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28749.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28749.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 4924⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35027.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35027.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55765.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55765.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4312.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11663.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11663.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6790.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6790.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49462.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49462.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6874.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6874.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11803.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11803.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63983.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26282.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10925.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42047.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42047.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39438.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41297.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41297.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23757.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61385.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61385.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33376.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33376.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44476.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44476.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22950.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19758.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19758.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39166.exe5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60650.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60650.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38467.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38467.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6235.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52727.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52727.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37526.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37526.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41925.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41925.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21648.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37158.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37158.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56463.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56463.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15725.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15725.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14154.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49199.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49199.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59904.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59904.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3126.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3126.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8457.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8457.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15748.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-731.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-731.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8539.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41730.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60738.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61331.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53859.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53859.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6235.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6235.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52727.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52727.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17298.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17298.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52178.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27438.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47837.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47837.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10212.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10212.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16988.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16988.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41242.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41242.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51995.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51995.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60266.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37074.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32586.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32586.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20642.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20642.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60411.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5640 -ip 56401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2084 -ip 20841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1424 -ip 14241⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-15986.exe
Unicorn-20093.exe
Unicorn-2110.exe
Unicorn-23055.exe
Unicorn-23282.exe
Unicorn-24067.exe
Unicorn-25467.exe
Unicorn-28749.exe
Unicorn-29007.exe
Unicorn-30404.exe
Unicorn-33321.exe
Unicorn-34732.exe
Unicorn-34945.exe
Unicorn-35219.exe
Unicorn-35957.exe
Unicorn-37803.exe
Unicorn-38815.exe
Unicorn-41297.exe
Unicorn-45609.exe
Unicorn-47560.exe
Unicorn-48311.exe
Unicorn-49751.exe
Unicorn-54893.exe
Unicorn-55085.exe
Unicorn-55173.exe
Unicorn-55785.exe
Unicorn-57804.exe
Unicorn-59257.exe
Unicorn-59501.exe
Unicorn-6178.exe
Unicorn-63061.exe
Unicorn-63844.exe
memory/60-298-0x0000000000400000-0x0000000000475000-memory.dmp
memory/204-207-0x0000000000400000-0x0000000000475000-memory.dmp
memory/212-541-0x0000000000400000-0x0000000000475000-memory.dmp
memory/448-411-0x0000000000400000-0x0000000000475000-memory.dmp
memory/652-540-0x0000000000400000-0x0000000000475000-memory.dmp
memory/680-136-0x0000000000400000-0x0000000000475000-memory.dmp
memory/700-380-0x0000000000400000-0x0000000000475000-memory.dmp
memory/700-19-0x0000000000400000-0x0000000000475000-memory.dmp
memory/844-141-0x0000000000400000-0x0000000000475000-memory.dmp
memory/956-359-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1080-388-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1144-38-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1164-65-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1196-52-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1288-450-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1308-393-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1340-257-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1652-7-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1696-412-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1752-100-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1808-273-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1924-167-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1928-415-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1996-487-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2084-91-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2084-161-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2120-535-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2172-534-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2216-391-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2280-555-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2424-258-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2440-556-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2580-550-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2600-392-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2608-332-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2728-365-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2876-339-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2920-449-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2960-47-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3012-517-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3164-76-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3284-296-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3288-262-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3328-513-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3340-307-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3400-514-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3404-394-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3428-554-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3524-346-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3744-310-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3768-297-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3780-177-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3956-542-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3992-306-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4032-557-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4048-363-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4124-546-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4152-551-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4172-518-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4188-516-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4292-304-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4452-188-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4520-267-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4544-519-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4652-360-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4660-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4756-275-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4824-558-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4916-329-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4928-238-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4956-263-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4984-133-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4984-1844-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4992-101-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5072-242-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5152-117-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5164-502-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5256-274-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5352-178-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5392-373-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5436-75-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5464-144-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5568-1842-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5568-126-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5640-160-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5648-206-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5680-265-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5724-322-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5748-276-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5804-457-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5844-26-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5904-14-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5960-340-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6024-63-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6028-309-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6040-147-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6088-33-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6116-195-0x0000000000400000-0x0000000000475000-memory.dmp
memory/12044-1841-0x0000000000400000-0x0000000000475000-memory.dmp
memory/12072-1840-0x0000000000400000-0x0000000000475000-memory.dmp