Analysis
- max time kernel
107s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 14:20
General
- Target 2026-07-02_ff307a7e4c60355d8244b060afb7714b_agent-tesla_akira_cobalt-strike_coinminer_cryptbot_darkg.exe
- Size 33.4MB
- Sample260702-rnqb4afx71
- SHA256 77d26187ec82b9b10cdeab625853691ff9903a9bda1706da645affc49dec400f
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 37 IoCs
- Detects executables Discord URL observed in first stage droppers 31 IoCs
- Detects executables containing possible sandbox analysis VM usernames 31 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 31 IoCs
- UPX dump on OEP (original entry point) 31 IoCs
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 31 IoCs
Inno Setup installer
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_ff307a7e4c60355d8244b060afb7714b_agent-tesla_akira_cobalt-strike_coinminer_cryptbot_darkg.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_ff307a7e4c60355d8244b060afb7714b_agent-tesla_akira_cobalt-strike_coinminer_cryptbot_darkg.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-964.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30451.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30451.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38121.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63495.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63495.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11118.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11118.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52053.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44350.exe10⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47154.exe8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33276.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49992.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49992.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46433.exe8⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37575.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37575.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64331.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63520.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37983.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4735.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4735.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24295.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24295.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51861.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51861.exe8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37698.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37698.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41875.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41875.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65452.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65452.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47801.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47801.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12945.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12945.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5069.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5069.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14185.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14185.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63506.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63506.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59598.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59598.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47792.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33138.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33138.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42166.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57365.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57365.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15213.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15213.exe7⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49088.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35885.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26541.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26541.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36153.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36153.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26423.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26423.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29019.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63495.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63495.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2950.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1762.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1762.exe8⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17757.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17757.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46926.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46926.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3536.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3536.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48778.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48778.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20637.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20637.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31584.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30308.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30308.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15725.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15725.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16475.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59451.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59451.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57699.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57699.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59411.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9411.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9411.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13324.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13324.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10371.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10371.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8513.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8513.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34124.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34124.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25336.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28461.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28461.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31761.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31761.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30128.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30128.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7890.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52245.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52245.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38121.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39676.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39676.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25015.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25015.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4070.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1030.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1030.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18883.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18883.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53157.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53157.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42084.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31929.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31929.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42929.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42929.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48031.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48031.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7403.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7403.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37143.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27956.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9795.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2160.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2160.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55524.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55524.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23922.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30320.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30320.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19738.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19738.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36853.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36853.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32079.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64840.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64840.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47107.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47107.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11679.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64838.exe5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19016.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24543.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24543.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9230.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9230.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45119.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45119.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53058.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53058.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40626.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40626.exe5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9764.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9764.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41006.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41006.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2042.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2042.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25015.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25015.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62056.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62056.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27922.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59489.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59489.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24285.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28430.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28430.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59405.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59405.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4746.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4746.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65220.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65220.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12960.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12960.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2442.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2442.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50226.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50226.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56073.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56073.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60413.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60413.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40422.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40055.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21208.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21208.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27553.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27553.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44314.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exe5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52229.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52229.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56775.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56775.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55001.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55001.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6713.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6713.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44350.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44350.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2867.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2867.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45499.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45499.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7080.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46950.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46950.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26276.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26276.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2342.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2342.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30320.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30320.exe3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10885.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18028.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18028.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62426.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62426.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-345.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26636.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26636.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50464.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50464.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65119.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65119.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51129.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11975.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11975.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60911.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60911.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6126.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6126.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45353.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62146.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62146.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3475.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3475.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15337.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40336.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40336.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19130.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19130.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28933.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28933.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24534.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24534.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42197.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42197.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9448.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9448.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52245.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52245.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45097.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45097.exe2⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63314.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63314.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-10885.exe
Unicorn-14185.exe
Unicorn-18028.exe
Unicorn-18125.exe
Unicorn-18390.exe
Unicorn-19738.exe
Unicorn-2042.exe
Unicorn-20851.exe
Unicorn-21930.exe
Unicorn-23423.exe
Unicorn-23989.exe
Unicorn-26423.exe
Unicorn-29019.exe
Unicorn-30451.exe
Unicorn-36853.exe
Unicorn-37991.exe
Unicorn-38121.exe
Unicorn-39517.exe
Unicorn-39676.exe
Unicorn-41006.exe
Unicorn-41271.exe
Unicorn-46294.exe
Unicorn-5069.exe
Unicorn-52573.exe
Unicorn-57699.exe
Unicorn-59411.exe
Unicorn-6126.exe
Unicorn-622.exe
Unicorn-62426.exe
Unicorn-63495.exe
Unicorn-964.exe
memory/556-895-0x0000000000400000-0x0000000000475000-memory.dmp
memory/600-877-0x0000000000400000-0x0000000000475000-memory.dmp
memory/992-521-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1100-933-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1244-930-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1552-921-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1904-1259-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2028-161-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2548-113-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2800-903-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3084-879-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3356-800-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3408-956-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3704-928-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3812-902-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3940-910-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4356-897-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4364-899-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4404-522-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4492-786-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4764-896-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4772-900-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4840-898-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4856-425-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5024-878-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5084-901-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5532-799-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5596-923-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5788-894-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5996-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6140-804-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6152-420-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6472-920-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6524-801-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6708-436-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6724-803-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6828-802-0x0000000000400000-0x0000000000475000-memory.dmp