Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/07/2026, 00:28
General
- Target 2026-07-23_03d03550d1ea441771a44f936db70d39_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe
- Size 25.7MB
- Sample260724-asqpzsysdz
- SHA256 353596b06829dbe30fa1cf5c3170b55a00d9db1c97d488c6f3fdca6444e1e52d
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Detects executables containing possible sandbox analysis VM usernames 31 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 32 IoCs
- UPX dump on OEP (original entry point) 32 IoCs
- Executes dropped EXE 8 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 32 IoCs
Inno Setup installer
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_03d03550d1ea441771a44f936db70d39_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_03d03550d1ea441771a44f936db70d39_agent-tesla_amadey_cobalt-strike_coinminer_cryptbot_dark.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17073.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17073.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21700.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21700.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34456.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34456.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54097.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54097.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7177.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7177.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5494.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5494.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42115.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42115.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49312.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49312.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64195.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64195.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44259.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44259.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61086.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61086.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8856.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8856.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43836.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43836.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63166.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63166.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63595.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63595.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62011.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62011.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46064.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46064.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39830.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39830.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56509.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56509.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64345.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64345.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65052.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2827.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2827.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20593.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20593.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3185.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3185.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48136.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48136.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55498.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55498.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28852.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28852.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25679.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52245.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52245.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17912.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17912.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47452.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47452.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40188.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40188.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45929.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45929.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60130.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60130.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20228.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20228.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29216.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29216.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7382.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7382.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17795.exe7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13799.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35838.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35838.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33310.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33310.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40075.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40075.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17526.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17526.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63675.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63675.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31787.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31787.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-62867.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-62867.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31827.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31827.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1297.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1297.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2408.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64887.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3973.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3973.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53121.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53121.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17600.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17600.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31122.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26926.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26926.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58769.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58769.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2143.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54477.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54477.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2935.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2935.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55916.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3207.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3207.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12421.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12421.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29030.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29030.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-55957.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-55957.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19480.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19480.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41232.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16424.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16424.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27140.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27140.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63282.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63282.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65067.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65067.exe8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22408.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22408.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64086.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64086.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6323.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6323.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36197.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36197.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48988.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48988.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27520.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29289.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29289.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15707.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15707.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29265.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29265.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36913.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36913.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31088.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31088.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11520.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11520.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24047.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24047.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58382.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58382.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-10052.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-10052.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6266.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6266.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22333.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22333.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49109.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49109.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38237.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38237.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36268.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36268.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61447.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61447.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29444.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29444.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40055.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40055.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7224.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7224.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22445.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22445.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-28162.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-28162.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-15612.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-15612.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20163.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41232.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41232.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-17016.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-17016.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44654.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44654.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33075.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33075.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1404.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1404.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22173.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22173.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12928.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12928.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46797.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46797.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46033.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46033.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-52148.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-52148.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42983.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42983.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27478.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27478.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9410.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9410.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-41495.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-41495.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-22887.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-22887.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54392.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54392.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64829.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64829.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56607.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56607.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54955.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54955.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9737.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9737.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5129.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5129.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16074.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16074.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24976.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5806.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5806.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23366.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23366.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-56924.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-56924.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44793.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44793.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20584.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20584.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-33827.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-33827.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-60554.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-60554.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-29679.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-29679.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-39065.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-39065.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5359.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5359.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-37364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-37364.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18412.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18412.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-59551.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-59551.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46745.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46745.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1585.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1585.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-44255.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-44255.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63143.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63143.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49262.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49262.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23331.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23331.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36532.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36532.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18358.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18358.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11169.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11169.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-31352.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-31352.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45664.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45664.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-48402.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-48402.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20435.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20435.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38997.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38997.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30978.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30978.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46806.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46806.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54160.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54160.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57464.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57464.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-12627.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-12627.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8124.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8124.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46467.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46467.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-50691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-50691.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30234.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30234.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34602.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34602.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8715.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8715.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-8168.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-8168.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45478.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45478.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53909.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53909.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-54113.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-54113.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42580.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42580.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-10052.exe
Unicorn-14434.exe
Unicorn-17073.exe
Unicorn-18412.exe
Unicorn-19021.exe
Unicorn-19544.exe
Unicorn-2143.exe
Unicorn-2143.exe
Unicorn-21700.exe
Unicorn-22445.exe
Unicorn-22887.exe
Unicorn-2408.exe
Unicorn-26063.exe
Unicorn-34456.exe
Unicorn-36268.exe
Unicorn-39799.exe
Unicorn-4122.exe
Unicorn-41232.exe
Unicorn-45664.exe
Unicorn-45929.exe
Unicorn-48402.exe
Unicorn-54097.exe
Unicorn-54392.exe
Unicorn-55179.exe
Unicorn-59551.exe
Unicorn-60554.exe
Unicorn-6266.exe
Unicorn-6266.exe
Unicorn-7177.exe
Unicorn-9254.exe
Unicorn-9315.exe
Unicorn-9960.exe
memory/264-1217-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1124-248-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1248-1121-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1252-1230-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1368-1184-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1396-1122-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1416-990-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1480-1159-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1572-1220-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1740-383-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2032-1240-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2356-1235-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2412-357-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2636-377-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2672-107-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2704-1125-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2784-1185-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2808-1008-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2996-1092-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3020-1231-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3036-475-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3092-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3172-1119-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3236-1218-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3396-1041-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3416-1219-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3448-249-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3532-1216-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3680-1237-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3760-1179-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3764-988-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3776-1182-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3828-1094-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3916-1156-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3944-474-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3972-545-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4088-1188-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4268-1214-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4280-1259-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4352-1152-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4556-376-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4632-987-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4640-1257-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4848-989-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5092-1124-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5268-986-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5480-250-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5524-1161-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5632-1091-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5772-284-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5808-1234-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6196-1239-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6320-1238-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6348-1256-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6364-1149-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6420-1148-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6424-1215-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6448-1187-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6480-1093-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6504-1255-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6512-1150-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6540-1095-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6684-1180-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6688-1096-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6704-1114-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6732-1181-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6760-1258-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6776-1213-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6788-1160-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6832-1113-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6840-1157-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6920-1155-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6944-1158-0x0000000000400000-0x0000000000475000-memory.dmp
memory/6996-1115-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7004-1221-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7032-1120-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7048-1178-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7072-1186-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7080-1232-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7084-1177-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7092-1117-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7100-1116-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7132-1233-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7144-1236-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7152-1183-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7176-1260-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7184-1261-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7216-1262-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7236-1263-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7268-1264-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7280-1273-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7288-1275-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7316-1276-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7336-1278-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7432-1279-0x0000000000400000-0x0000000000475000-memory.dmp
memory/7440-1282-0x0000000000400000-0x0000000000475000-memory.dmp