Analysis
- max time kernel
143s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 20:21
General
- Target 2026-08-10_609cb7cc530948e5439ac7db22ccfae4_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe
- Size 8.0MB
- Sample260810-y45v2sgp91
- SHA256 4fb81584eee18aa7dced89285d27979d60f5c1610ba9f224a6ca96bfeb1afc4b
Score
10/10
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 62 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 29 IoCs
- UPX dump on OEP (original entry point) 29 IoCs
- Executes dropped EXE 25 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 23 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_609cb7cc530948e5439ac7db22ccfae4_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_609cb7cc530948e5439ac7db22ccfae4_agent-tesla_cobalt-strike_coinminer_cryptbot_elex_glassw.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38037.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38037.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12053.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12053.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21265.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21265.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64710.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64710.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61013.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20552.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20552.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36364.exe9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4537.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4163.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65154.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65154.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17864.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17864.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45653.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45653.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13129.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59374.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44558.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60032.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29898.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29898.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33375.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33375.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32740.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32740.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12248.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12248.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38606.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32319.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32319.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27812.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27812.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64220.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64220.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23640.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23640.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53013.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53013.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28333.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28333.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18347.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18347.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53457.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53457.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12679.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26048.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26048.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32740.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32740.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64603.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29940.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29940.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37381.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37381.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-785.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59353.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23815.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23815.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7520.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2518.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2518.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49156.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13425.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13425.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7064.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7064.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-687.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-687.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14227.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14227.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5032.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62632.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62632.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7972.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7972.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61932.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61932.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48190.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48190.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49414.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49414.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16519.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16519.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45014.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10136.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10136.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44890.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44890.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28558.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61346.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41132.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41132.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3814.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3814.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40868.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40868.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64439.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64439.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3141.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3141.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21964.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46099.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46099.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64833.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64833.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16482.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16482.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33178.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33178.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41241.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41241.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28558.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41170.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41170.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63306.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63306.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8384.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8384.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35550.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35550.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37300.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37300.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33406.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58756.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58756.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58735.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58735.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24097.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24097.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27407.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27407.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63062.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63062.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17904.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17904.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34443.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34443.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28887.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19483.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19483.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17183.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17183.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1655.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1655.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45015.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45015.exe6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1568.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3083.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3083.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60722.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60722.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31169.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31169.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8230.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8230.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9285.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9285.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47739.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47739.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16793.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16793.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26145.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26145.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26125.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26125.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9830.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53370.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53370.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4767.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4767.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56986.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56986.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57303.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57303.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1199.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1199.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46099.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46099.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14734.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14734.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44262.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17832.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17832.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49330.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49330.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48315.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50138.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50138.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55768.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55768.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65011.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12108.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12108.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8040.exe8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42590.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42590.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50085.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50085.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38606.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38606.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7493.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7493.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35383.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35383.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48891.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48891.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8667.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8667.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-127.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-127.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22922.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22922.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55087.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55087.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47443.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47443.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60012.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60012.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62155.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62155.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35678.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35678.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10353.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10353.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7541.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7541.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23728.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23728.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26120.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50287.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50287.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60614.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60614.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53193.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53193.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26036.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52254.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54044.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54044.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64682.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64682.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46068.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46068.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20582.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20582.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64406.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64406.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41060.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41060.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13945.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13945.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8844.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8844.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27396.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27396.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65040.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65040.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7537.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7537.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47712.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47712.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20436.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20436.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25357.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25357.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6573.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6573.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39882.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2352.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2352.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62923.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62923.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16567.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16567.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62419.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27433.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27433.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13525.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13525.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23177.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23177.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52014.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52014.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26494.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1179.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50704.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50704.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43136.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43136.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61641.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61641.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35678.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35678.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30033.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38672.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38672.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3956.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3956.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38159.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38159.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15835.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15835.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31408.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6308.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6308.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54978.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54978.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12705.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12705.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26036.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26036.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52481.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52481.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60307.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60307.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19549.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19549.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39823.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39823.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38943.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38943.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50204.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50204.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53223.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53223.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52882.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52882.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47856.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1989.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1989.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27392.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27392.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47943.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47943.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41860.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41860.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-12053.exe
Unicorn-14095.exe
Unicorn-14227.exe
Unicorn-21265.exe
Unicorn-22438.exe
Unicorn-25357.exe
Unicorn-28333.exe
Unicorn-28887.exe
Unicorn-29.exe
Unicorn-31169.exe
Unicorn-35550.exe
Unicorn-37300.exe
Unicorn-38011.exe
Unicorn-38037.exe
Unicorn-39823.exe
Unicorn-42623.exe
Unicorn-46843.exe
Unicorn-4767.exe
Unicorn-48753.exe
Unicorn-5032.exe
Unicorn-50704.exe
Unicorn-53013.exe
Unicorn-6308.exe
Unicorn-64439.exe
Unicorn-64710.exe
Unicorn-65011.exe
Unicorn-6573.exe
Unicorn-6796.exe
Unicorn-8230.exe
memory/240-567-0x0000000000400000-0x0000000000475000-memory.dmp
memory/464-459-0x0000000000400000-0x0000000000475000-memory.dmp
memory/708-589-0x0000000000400000-0x0000000000475000-memory.dmp
memory/988-802-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1124-758-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1156-248-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1332-230-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1388-715-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1652-412-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1692-1009-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2512-561-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2788-804-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2820-1134-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2872-440-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2884-348-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2912-344-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2960-874-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2972-912-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2984-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2984-473-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3020-507-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3172-117-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3176-918-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3308-413-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3376-384-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3396-690-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3656-411-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3904-510-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3924-914-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3960-917-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4044-785-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4112-621-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4148-233-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4164-515-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4312-1122-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4472-247-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4556-293-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4568-665-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4584-559-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4588-508-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4608-530-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4688-471-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4708-843-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4888-784-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5008-806-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5024-509-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5056-713-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5280-805-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5696-633-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5744-514-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5764-594-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5852-714-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6080-85-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6084-231-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6172-1103-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6204-1131-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6404-1135-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6412-1132-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6520-1136-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6688-1168-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6952-1133-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6980-1178-0x0000000000400000-0x0000000000475000-memory.dmp