| File name: | 1 (1229) |
| Full analysis: | https://app.any.run/tasks/5ff70116-ccb8-45ce-8bc7-399008546fd4 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 10:50:21 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | AA4620314A92E3B2C02C565B44532410 |
| SHA1: | A51688DA5AC15C7A7ED2D956249B2C7EB1A2D1FE |
| SHA256: | 16DA862806B58513E6B20A736BBDB982039FD907D405DB2A1831804C202E6BFE |
| SSDEEP: | 6144:2wKjt/OPvDroA5lAtdeZRZfr/5B6lvJGBV/Wye5SZk/8SwjwpyAvEhaIYcq09lUa:2952foA5KtUbBchaVOye5S8x4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- 1 (1229).exe (PID: 2284)
- Unicorn-55555.exe (PID: 5204)
- Unicorn-11673.exe (PID: 7384)
- Unicorn-9701.exe (PID: 7436)
- Unicorn-47205.exe (PID: 7464)
- Unicorn-49177.exe (PID: 7392)
- Unicorn-60940.exe (PID: 7456)
- Unicorn-51043.exe (PID: 7500)
- Unicorn-9701.exe (PID: 7444)
- Unicorn-58697.exe (PID: 7516)
- Unicorn-30108.exe (PID: 7540)
- Unicorn-10979.exe (PID: 7556)
- Unicorn-49974.exe (PID: 7532)
- Unicorn-20928.exe (PID: 7572)
- Unicorn-7908.exe (PID: 7628)
- Unicorn-52278.exe (PID: 7644)
- Unicorn-7716.exe (PID: 7660)
- Unicorn-60254.exe (PID: 7684)
- Unicorn-27390.exe (PID: 7708)
- Unicorn-65298.exe (PID: 7796)
- Unicorn-17175.exe (PID: 7716)
- Unicorn-51702.exe (PID: 7760)
- Unicorn-21259.exe (PID: 7700)
- Unicorn-17110.exe (PID: 7564)
- Unicorn-48697.exe (PID: 7768)
- Unicorn-28542.exe (PID: 7780)
- Unicorn-24820.exe (PID: 7812)
- Unicorn-53601.exe (PID: 7788)
- Unicorn-48200.exe (PID: 7804)
- Unicorn-58438.exe (PID: 7928)
- Unicorn-26320.exe (PID: 7940)
- Unicorn-45994.exe (PID: 7980)
- Unicorn-39864.exe (PID: 7988)
- Unicorn-62714.exe (PID: 7892)
- Unicorn-9600.exe (PID: 7996)
- Unicorn-23196.exe (PID: 8048)
- Unicorn-26077.exe (PID: 8108)
- Unicorn-45802.exe (PID: 8016)
- Unicorn-5921.exe (PID: 8076)
- Unicorn-63482.exe (PID: 8040)
- Unicorn-31172.exe (PID: 8084)
- Unicorn-9932.exe (PID: 8068)
- Unicorn-18920.exe (PID: 8060)
- Unicorn-51236.exe (PID: 8180)
- Unicorn-48469.exe (PID: 8164)
- Unicorn-46243.exe (PID: 6272)
- Unicorn-46060.exe (PID: 5772)
- Unicorn-64634.exe (PID: 4696)
- Unicorn-6689.exe (PID: 6972)
- Unicorn-51998.exe (PID: 8188)
- Unicorn-37700.exe (PID: 5256)
- Unicorn-38594.exe (PID: 8100)
- Unicorn-27494.exe (PID: 8144)
- Unicorn-2797.exe (PID: 8172)
- Unicorn-41666.exe (PID: 2552)
- Unicorn-62470.exe (PID: 2240)
- Unicorn-38592.exe (PID: 7224)
- Unicorn-56658.exe (PID: 904)
- Unicorn-38402.exe (PID: 8124)
- Unicorn-20264.exe (PID: 3676)
- Unicorn-15049.exe (PID: 7212)
- Unicorn-3736.exe (PID: 6036)
- Unicorn-40004.exe (PID: 7420)
- Unicorn-54473.exe (PID: 1240)
- Unicorn-63238.exe (PID: 5800)
- Unicorn-44193.exe (PID: 4448)
- Unicorn-45204.exe (PID: 2908)
- Unicorn-37669.exe (PID: 728)
- Unicorn-9377.exe (PID: 7612)
- Unicorn-51012.exe (PID: 7416)
- Unicorn-26844.exe (PID: 616)
- Unicorn-37560.exe (PID: 3240)
- Unicorn-49485.exe (PID: 7904)
- Unicorn-64369.exe (PID: 6184)
- Unicorn-29776.exe (PID: 7236)
- Unicorn-24391.exe (PID: 5436)
- Unicorn-61053.exe (PID: 3884)
- Unicorn-14769.exe (PID: 6724)
- Unicorn-23249.exe (PID: 7372)
- Unicorn-41770.exe (PID: 8448)
- Unicorn-524.exe (PID: 7240)
- Unicorn-3409.exe (PID: 7380)
- Unicorn-37110.exe (PID: 8932)
- Unicorn-26895.exe (PID: 8920)
- Unicorn-40042.exe (PID: 6108)
- Unicorn-51090.exe (PID: 8844)
- Unicorn-26010.exe (PID: 8904)
- Unicorn-14007.exe (PID: 7012)
- Unicorn-13808.exe (PID: 6228)
- Unicorn-61038.exe (PID: 8476)
- Unicorn-20483.exe (PID: 4464)
- Unicorn-32751.exe (PID: 5304)
- Unicorn-20176.exe (PID: 1568)
- Unicorn-52714.exe (PID: 8816)
- Unicorn-32411.exe (PID: 7084)
- Unicorn-18610.exe (PID: 8712)
- Unicorn-54769.exe (PID: 9012)
- Unicorn-15485.exe (PID: 8888)
- Unicorn-24208.exe (PID: 8984)
- Unicorn-13160.exe (PID: 8536)
- Unicorn-18239.exe (PID: 1128)
- Unicorn-37878.exe (PID: 8588)
- Unicorn-44236.exe (PID: 8812)
- Unicorn-19954.exe (PID: 9180)
- Unicorn-63394.exe (PID: 1300)
- Unicorn-34754.exe (PID: 8784)
- Unicorn-37716.exe (PID: 9764)
- Unicorn-25394.exe (PID: 8572)
- Unicorn-24526.exe (PID: 9816)
- Unicorn-21361.exe (PID: 9884)
- Unicorn-20255.exe (PID: 9024)
- Unicorn-3425.exe (PID: 9204)
- Unicorn-49289.exe (PID: 9140)
- Unicorn-13233.exe (PID: 9976)
- Unicorn-45278.exe (PID: 8484)
- Unicorn-31158.exe (PID: 9544)
- Unicorn-44297.exe (PID: 9620)
- Unicorn-32761.exe (PID: 8524)
- Unicorn-22999.exe (PID: 7976)
- Unicorn-6777.exe (PID: 8832)
- Unicorn-39990.exe (PID: 8968)
- Unicorn-61526.exe (PID: 8864)
- Unicorn-57442.exe (PID: 8632)
- Unicorn-51666.exe (PID: 9088)
- Unicorn-26394.exe (PID: 8856)
- Unicorn-29745.exe (PID: 9164)
- Unicorn-58329.exe (PID: 7352)
- Unicorn-61318.exe (PID: 5776)
- Unicorn-25900.exe (PID: 9328)
- Unicorn-13160.exe (PID: 8912)
- Unicorn-7229.exe (PID: 9688)
- Unicorn-45470.exe (PID: 8896)
- Unicorn-16254.exe (PID: 9108)
- Unicorn-51474.exe (PID: 8652)
- Unicorn-64738.exe (PID: 672)
- Unicorn-8801.exe (PID: 736)
- Unicorn-33423.exe (PID: 2096)
- Unicorn-20390.exe (PID: 4188)
- Unicorn-3534.exe (PID: 9072)
- Unicorn-15694.exe (PID: 10516)
- Unicorn-31348.exe (PID: 9604)
- Unicorn-50898.exe (PID: 8872)
- Unicorn-15834.exe (PID: 11520)
- Unicorn-30840.exe (PID: 8772)
- Unicorn-29652.exe (PID: 10864)
- Unicorn-10907.exe (PID: 10820)
- Unicorn-7312.exe (PID: 10376)
- Unicorn-47354.exe (PID: 11036)
- Unicorn-23239.exe (PID: 11588)
- Unicorn-34946.exe (PID: 8696)
- Unicorn-42760.exe (PID: 10276)
- Unicorn-60632.exe (PID: 9292)
- Unicorn-60950.exe (PID: 11536)
- Unicorn-29513.exe (PID: 12408)
- Unicorn-46097.exe (PID: 12516)
- Unicorn-26284.exe (PID: 9280)
- Unicorn-1763.exe (PID: 9132)
- Unicorn-9912.exe (PID: 12368)
- Unicorn-21802.exe (PID: 12356)
- Unicorn-14120.exe (PID: 8560)
- Unicorn-32361.exe (PID: 12008)
- Unicorn-58329.exe (PID: 4152)
- Unicorn-54915.exe (PID: 12972)
- Unicorn-2626.exe (PID: 10188)
- Unicorn-22392.exe (PID: 4164)
- Unicorn-37540.exe (PID: 11768)
- Unicorn-40020.exe (PID: 9272)
- Unicorn-38034.exe (PID: 10972)
- Unicorn-56098.exe (PID: 11228)
- Unicorn-13316.exe (PID: 13164)
- Unicorn-43965.exe (PID: 9584)
- Unicorn-10488.exe (PID: 12112)
- Unicorn-24417.exe (PID: 12812)
- Unicorn-15589.exe (PID: 9644)
- Unicorn-57582.exe (PID: 9756)
- Unicorn-3773.exe (PID: 12348)
- Unicorn-32361.exe (PID: 11976)
- Unicorn-912.exe (PID: 8824)
- Unicorn-23239.exe (PID: 10156)
- Unicorn-45937.exe (PID: 8616)
- Unicorn-28522.exe (PID: 10692)
- Unicorn-50286.exe (PID: 10948)
- Unicorn-57473.exe (PID: 10740)
- Unicorn-61438.exe (PID: 12828)
- Unicorn-55942.exe (PID: 9300)
- Unicorn-63565.exe (PID: 9576)
- Unicorn-9912.exe (PID: 12400)
- Unicorn-31978.exe (PID: 11628)
- Unicorn-1340.exe (PID: 10212)
- Unicorn-32952.exe (PID: 9152)
- Unicorn-45484.exe (PID: 13196)
- Unicorn-61521.exe (PID: 13908)
- Unicorn-16130.exe (PID: 12848)
- Unicorn-44806.exe (PID: 11468)
- Unicorn-37176.exe (PID: 8680)
- Unicorn-64820.exe (PID: 13236)
- Unicorn-9719.exe (PID: 13900)
- Unicorn-61548.exe (PID: 13924)
- Unicorn-45449.exe (PID: 5360)
- Unicorn-30315.exe (PID: 11496)
- Unicorn-40395.exe (PID: 9512)
- Unicorn-27435.exe (PID: 10804)
- Unicorn-44296.exe (PID: 7208)
- Unicorn-24417.exe (PID: 12796)
- Unicorn-48646.exe (PID: 9612)
- Unicorn-25131.exe (PID: 10356)
- Unicorn-55574.exe (PID: 10480)
- Unicorn-17806.exe (PID: 10924)
- Unicorn-46337.exe (PID: 14024)
- Unicorn-12673.exe (PID: 11692)
- Unicorn-45184.exe (PID: 15616)
- Unicorn-36248.exe (PID: 15652)
- Unicorn-53789.exe (PID: 15544)
- Unicorn-31122.exe (PID: 12212)
- Unicorn-26566.exe (PID: 13604)
- Unicorn-48668.exe (PID: 11732)
- Unicorn-37390.exe (PID: 7252)
- Unicorn-52340.exe (PID: 16840)
- Unicorn-11535.exe (PID: 13220)
- Unicorn-50322.exe (PID: 11476)
- Unicorn-52340.exe (PID: 16832)
- Unicorn-16742.exe (PID: 9740)
- Unicorn-53773.exe (PID: 12956)
- Unicorn-11535.exe (PID: 13228)
- Unicorn-1557.exe (PID: 1748)
Starts itself from another location
- Unicorn-55555.exe (PID: 5204)
- Unicorn-49177.exe (PID: 7392)
- 1 (1229).exe (PID: 2284)
- Unicorn-11673.exe (PID: 7384)
- Unicorn-9701.exe (PID: 7444)
- Unicorn-47205.exe (PID: 7464)
- Unicorn-60940.exe (PID: 7456)
- Unicorn-9701.exe (PID: 7436)
- Unicorn-58697.exe (PID: 7516)
- Unicorn-51043.exe (PID: 7500)
- Unicorn-10979.exe (PID: 7556)
- Unicorn-17110.exe (PID: 7564)
- Unicorn-30108.exe (PID: 7540)
- Unicorn-49974.exe (PID: 7532)
- Unicorn-7908.exe (PID: 7628)
- Unicorn-52278.exe (PID: 7644)
- Unicorn-7716.exe (PID: 7660)
- Unicorn-60254.exe (PID: 7684)
- Unicorn-27390.exe (PID: 7708)
- Unicorn-17175.exe (PID: 7716)
- Unicorn-21259.exe (PID: 7700)
- Unicorn-20928.exe (PID: 7572)
- Unicorn-53601.exe (PID: 7788)
- Unicorn-48697.exe (PID: 7768)
- Unicorn-24820.exe (PID: 7812)
- Unicorn-28542.exe (PID: 7780)
- Unicorn-65298.exe (PID: 7796)
- Unicorn-26320.exe (PID: 7940)
- Unicorn-58438.exe (PID: 7928)
- Unicorn-45994.exe (PID: 7980)
- Unicorn-49485.exe (PID: 7904)
- Unicorn-45802.exe (PID: 8016)
- Unicorn-9600.exe (PID: 7996)
- Unicorn-23196.exe (PID: 8048)
- Unicorn-39864.exe (PID: 7988)
- Unicorn-5921.exe (PID: 8076)
- Unicorn-31172.exe (PID: 8084)
- Unicorn-51702.exe (PID: 7760)
- Unicorn-9932.exe (PID: 8068)
- Unicorn-62714.exe (PID: 7892)
- Unicorn-26077.exe (PID: 8108)
- Unicorn-63482.exe (PID: 8040)
- Unicorn-48469.exe (PID: 8164)
- Unicorn-18920.exe (PID: 8060)
- Unicorn-51236.exe (PID: 8180)
- Unicorn-46243.exe (PID: 6272)
- Unicorn-64634.exe (PID: 4696)
- Unicorn-46060.exe (PID: 5772)
- Unicorn-6689.exe (PID: 6972)
- Unicorn-48200.exe (PID: 7804)
- Unicorn-51998.exe (PID: 8188)
- Unicorn-2797.exe (PID: 8172)
- Unicorn-41666.exe (PID: 2552)
- Unicorn-37700.exe (PID: 5256)
- Unicorn-27494.exe (PID: 8144)
- Unicorn-38402.exe (PID: 8124)
- Unicorn-38594.exe (PID: 8100)
- Unicorn-20264.exe (PID: 3676)
- Unicorn-63238.exe (PID: 5800)
- Unicorn-61318.exe (PID: 5776)
- Unicorn-15049.exe (PID: 7212)
- Unicorn-40004.exe (PID: 7420)
- Unicorn-54473.exe (PID: 1240)
- Unicorn-56658.exe (PID: 904)
- Unicorn-45204.exe (PID: 2908)
- Unicorn-44193.exe (PID: 4448)
- Unicorn-38592.exe (PID: 7224)
- Unicorn-37669.exe (PID: 728)
- Unicorn-62470.exe (PID: 2240)
- Unicorn-33423.exe (PID: 2096)
- Unicorn-51012.exe (PID: 7416)
- Unicorn-37390.exe (PID: 7252)
- Unicorn-9377.exe (PID: 7612)
- Unicorn-64369.exe (PID: 6184)
- Unicorn-29776.exe (PID: 7236)
- Unicorn-24391.exe (PID: 5436)
- Unicorn-8801.exe (PID: 736)
- Unicorn-37560.exe (PID: 3240)
- Unicorn-14769.exe (PID: 6724)
- Unicorn-23249.exe (PID: 7372)
- Unicorn-3736.exe (PID: 6036)
- Unicorn-3409.exe (PID: 7380)
- Unicorn-41770.exe (PID: 8448)
- Unicorn-524.exe (PID: 7240)
- Unicorn-13160.exe (PID: 8912)
- Unicorn-37110.exe (PID: 8932)
- Unicorn-26895.exe (PID: 8920)
- Unicorn-40042.exe (PID: 6108)
- Unicorn-26844.exe (PID: 616)
- Unicorn-51090.exe (PID: 8844)
- Unicorn-14007.exe (PID: 7012)
- Unicorn-26010.exe (PID: 8904)
- Unicorn-13808.exe (PID: 6228)
- Unicorn-20483.exe (PID: 4464)
- Unicorn-32751.exe (PID: 5304)
- Unicorn-52714.exe (PID: 8816)
- Unicorn-20176.exe (PID: 1568)
- Unicorn-54769.exe (PID: 9012)
- Unicorn-18610.exe (PID: 8712)
- Unicorn-32411.exe (PID: 7084)
- Unicorn-15485.exe (PID: 8888)
- Unicorn-44236.exe (PID: 8812)
- Unicorn-13160.exe (PID: 8536)
- Unicorn-37878.exe (PID: 8588)
- Unicorn-18239.exe (PID: 1128)
- Unicorn-19954.exe (PID: 9180)
- Unicorn-63394.exe (PID: 1300)
- Unicorn-34754.exe (PID: 8784)
- Unicorn-25394.exe (PID: 8572)
- Unicorn-37716.exe (PID: 9764)
- Unicorn-24526.exe (PID: 9816)
- Unicorn-21361.exe (PID: 9884)
- Unicorn-20255.exe (PID: 9024)
- Unicorn-31158.exe (PID: 9544)
- Unicorn-3425.exe (PID: 9204)
- Unicorn-49289.exe (PID: 9140)
- Unicorn-45278.exe (PID: 8484)
- Unicorn-13233.exe (PID: 9976)
- Unicorn-22999.exe (PID: 7976)
- Unicorn-44297.exe (PID: 9620)
- Unicorn-61526.exe (PID: 8864)
- Unicorn-37944.exe (PID: 8976)
- Unicorn-6777.exe (PID: 8832)
- Unicorn-57442.exe (PID: 8632)
- Unicorn-39990.exe (PID: 8968)
- Unicorn-51666.exe (PID: 9088)
- Unicorn-26394.exe (PID: 8856)
- Unicorn-29745.exe (PID: 9164)
- Unicorn-25900.exe (PID: 9328)
- Unicorn-7229.exe (PID: 9688)
- Unicorn-58329.exe (PID: 7352)
- Unicorn-32761.exe (PID: 8524)
- Unicorn-45470.exe (PID: 8896)
- Unicorn-51474.exe (PID: 8652)
- Unicorn-16254.exe (PID: 9108)
- Unicorn-20390.exe (PID: 4188)
- Unicorn-61053.exe (PID: 3884)
- Unicorn-3534.exe (PID: 9072)
- Unicorn-61038.exe (PID: 8476)
- Unicorn-64738.exe (PID: 672)
- Unicorn-15694.exe (PID: 10516)
- Unicorn-50898.exe (PID: 8872)
- Unicorn-31348.exe (PID: 9604)
- Unicorn-15834.exe (PID: 11520)
- Unicorn-50322.exe (PID: 11476)
- Unicorn-30840.exe (PID: 8772)
- Unicorn-7312.exe (PID: 10376)
- Unicorn-29652.exe (PID: 10864)
- Unicorn-37176.exe (PID: 8680)
- Unicorn-30315.exe (PID: 11496)
- Unicorn-47354.exe (PID: 11036)
- Unicorn-23239.exe (PID: 11588)
- Unicorn-10907.exe (PID: 10820)
- Unicorn-42760.exe (PID: 10276)
- Unicorn-60632.exe (PID: 9292)
- Unicorn-44806.exe (PID: 11468)
- Unicorn-9912.exe (PID: 12400)
- Unicorn-46097.exe (PID: 12516)
- Unicorn-29513.exe (PID: 12408)
- Unicorn-26284.exe (PID: 9280)
- Unicorn-1763.exe (PID: 9132)
- Unicorn-14120.exe (PID: 8560)
- Unicorn-32361.exe (PID: 12008)
- Unicorn-58329.exe (PID: 4152)
- Unicorn-9912.exe (PID: 12368)
- Unicorn-21802.exe (PID: 12356)
- Unicorn-60950.exe (PID: 11536)
- Unicorn-54915.exe (PID: 12972)
- Unicorn-2626.exe (PID: 10188)
- Unicorn-64820.exe (PID: 13236)
- Unicorn-37540.exe (PID: 11768)
- Unicorn-40020.exe (PID: 9272)
- Unicorn-22392.exe (PID: 4164)
- Unicorn-38034.exe (PID: 10972)
- Unicorn-61521.exe (PID: 13908)
- Unicorn-9719.exe (PID: 13900)
- Unicorn-61548.exe (PID: 13924)
- Unicorn-13316.exe (PID: 13164)
- Unicorn-24208.exe (PID: 8984)
- Unicorn-56098.exe (PID: 11228)
- Unicorn-43965.exe (PID: 9584)
- Unicorn-10488.exe (PID: 12112)
- Unicorn-24417.exe (PID: 12812)
- Unicorn-15589.exe (PID: 9644)
- Unicorn-57582.exe (PID: 9756)
- Unicorn-3773.exe (PID: 12348)
- Unicorn-32361.exe (PID: 11976)
- Unicorn-23239.exe (PID: 10156)
- Unicorn-28522.exe (PID: 10692)
- Unicorn-45937.exe (PID: 8616)
- Unicorn-50286.exe (PID: 10948)
- Unicorn-912.exe (PID: 8824)
- Unicorn-55942.exe (PID: 9300)
- Unicorn-61438.exe (PID: 12828)
- Unicorn-63565.exe (PID: 9576)
- Unicorn-46337.exe (PID: 14024)
- Unicorn-31978.exe (PID: 11628)
- Unicorn-1340.exe (PID: 10212)
- Unicorn-53789.exe (PID: 15544)
- Unicorn-32952.exe (PID: 9152)
- Unicorn-45184.exe (PID: 15616)
- Unicorn-36248.exe (PID: 15652)
- Unicorn-24417.exe (PID: 12796)
- Unicorn-45484.exe (PID: 13196)
- Unicorn-48646.exe (PID: 9612)
- Unicorn-16130.exe (PID: 12848)
Executes application which crashes
- Unicorn-28646.exe (PID: 7352)
INFO
The sample compiled with chinese language support
- 1 (1229).exe (PID: 2284)
Checks supported languages
- 1 (1229).exe (PID: 2284)
- Unicorn-55555.exe (PID: 5204)
- Unicorn-11673.exe (PID: 7384)
- Unicorn-49177.exe (PID: 7392)
- Unicorn-9701.exe (PID: 7444)
- Unicorn-9701.exe (PID: 7436)
- Unicorn-47205.exe (PID: 7464)
- Unicorn-51043.exe (PID: 7500)
- Unicorn-30108.exe (PID: 7540)
- Unicorn-49974.exe (PID: 7532)
- Unicorn-60940.exe (PID: 7456)
- Unicorn-17110.exe (PID: 7564)
- Unicorn-20928.exe (PID: 7572)
- Unicorn-52278.exe (PID: 7644)
- Unicorn-60254.exe (PID: 7684)
- Unicorn-21259.exe (PID: 7700)
- Unicorn-27390.exe (PID: 7708)
- Unicorn-17175.exe (PID: 7716)
- Unicorn-48697.exe (PID: 7768)
- Unicorn-28542.exe (PID: 7780)
- Unicorn-48200.exe (PID: 7804)
- Unicorn-62714.exe (PID: 7892)
- Unicorn-49485.exe (PID: 7904)
- Unicorn-53601.exe (PID: 7788)
- Unicorn-24820.exe (PID: 7812)
- Unicorn-26320.exe (PID: 7940)
- Unicorn-39864.exe (PID: 7988)
- Unicorn-9600.exe (PID: 7996)
- Unicorn-23196.exe (PID: 8048)
- Unicorn-9932.exe (PID: 8068)
- Unicorn-45802.exe (PID: 8016)
- Unicorn-63482.exe (PID: 8040)
- Unicorn-26077.exe (PID: 8108)
- Unicorn-31172.exe (PID: 8084)
- Unicorn-38594.exe (PID: 8100)
- Unicorn-38402.exe (PID: 8124)
- Unicorn-37700.exe (PID: 5256)
- Unicorn-51236.exe (PID: 8180)
- Unicorn-27494.exe (PID: 8144)
- Unicorn-51998.exe (PID: 8188)
- Unicorn-2797.exe (PID: 8172)
- Unicorn-48469.exe (PID: 8164)
- Unicorn-18920.exe (PID: 8060)
- Unicorn-15049.exe (PID: 7212)
- Unicorn-33423.exe (PID: 2096)
- Unicorn-6689.exe (PID: 6972)
- Unicorn-38592.exe (PID: 7224)
- Unicorn-46060.exe (PID: 5772)
- Unicorn-20264.exe (PID: 3676)
- Unicorn-56658.exe (PID: 904)
- Unicorn-46243.exe (PID: 6272)
- Unicorn-64369.exe (PID: 6184)
- Unicorn-64634.exe (PID: 4696)
- Unicorn-28646.exe (PID: 7352)
- Unicorn-37560.exe (PID: 3240)
- Unicorn-18239.exe (PID: 1128)
- Unicorn-61053.exe (PID: 3884)
- Unicorn-62470.exe (PID: 2240)
- Unicorn-61318.exe (PID: 5776)
- Unicorn-40004.exe (PID: 7420)
- Unicorn-41666.exe (PID: 2552)
- Unicorn-20483.exe (PID: 4464)
- Unicorn-54473.exe (PID: 1240)
- Unicorn-8801.exe (PID: 736)
- Unicorn-29222.exe (PID: 3132)
- Unicorn-37390.exe (PID: 7252)
- Unicorn-3409.exe (PID: 7380)
- Unicorn-63238.exe (PID: 5800)
- Unicorn-26844.exe (PID: 616)
- Unicorn-14007.exe (PID: 7012)
- Unicorn-14769.exe (PID: 6724)
- Unicorn-13808.exe (PID: 6228)
- Unicorn-64738.exe (PID: 672)
- Unicorn-20176.exe (PID: 1568)
- Unicorn-40042.exe (PID: 6108)
- Unicorn-45204.exe (PID: 2908)
- Unicorn-20390.exe (PID: 4188)
- Unicorn-32751.exe (PID: 5304)
- Unicorn-23249.exe (PID: 7372)
- Unicorn-524.exe (PID: 7240)
- Unicorn-41770.exe (PID: 8448)
- Unicorn-61038.exe (PID: 8476)
- Unicorn-45278.exe (PID: 8484)
- Unicorn-28174.exe (PID: 8504)
- Unicorn-26895.exe (PID: 8920)
- Unicorn-13160.exe (PID: 8912)
- Unicorn-37110.exe (PID: 8932)
- Unicorn-13160.exe (PID: 8536)
- Unicorn-18610.exe (PID: 8712)
- Unicorn-14120.exe (PID: 8560)
- Unicorn-25394.exe (PID: 8572)
- Unicorn-37878.exe (PID: 8588)
- Unicorn-51474.exe (PID: 8652)
- Unicorn-30840.exe (PID: 8772)
- Unicorn-34754.exe (PID: 8784)
- Unicorn-912.exe (PID: 8824)
- Unicorn-51090.exe (PID: 8844)
- Unicorn-34946.exe (PID: 8696)
- Unicorn-6777.exe (PID: 8832)
- Unicorn-44702.exe (PID: 8496)
- Unicorn-15485.exe (PID: 8888)
- Unicorn-39990.exe (PID: 8968)
- Unicorn-24208.exe (PID: 8984)
- Unicorn-26394.exe (PID: 8856)
- Unicorn-26010.exe (PID: 8904)
- Unicorn-37944.exe (PID: 8976)
- Unicorn-51666.exe (PID: 9088)
- Unicorn-3534.exe (PID: 9072)
- Unicorn-16254.exe (PID: 9108)
- Unicorn-1763.exe (PID: 9132)
- Unicorn-20255.exe (PID: 9024)
- Unicorn-50898.exe (PID: 8872)
- Unicorn-57442.exe (PID: 8632)
- Unicorn-29745.exe (PID: 9164)
- Unicorn-19954.exe (PID: 9180)
- Unicorn-61526.exe (PID: 8864)
- Unicorn-44236.exe (PID: 8812)
- Unicorn-52464.exe (PID: 9224)
- Unicorn-60632.exe (PID: 9292)
- Unicorn-26284.exe (PID: 9280)
- Unicorn-58329.exe (PID: 7352)
- Unicorn-58329.exe (PID: 4152)
- Unicorn-30560.exe (PID: 7180)
- Unicorn-46897.exe (PID: 9256)
- Unicorn-64131.exe (PID: 9392)
- Unicorn-37716.exe (PID: 9764)
- Unicorn-38344.exe (PID: 9312)
- Unicorn-25900.exe (PID: 9328)
- Unicorn-64925.exe (PID: 8424)
- Unicorn-28012.exe (PID: 9464)
- Unicorn-44671.exe (PID: 9492)
- Unicorn-40395.exe (PID: 9512)
- Unicorn-55942.exe (PID: 9300)
- Unicorn-31158.exe (PID: 9544)
- Unicorn-331.exe (PID: 9552)
- Unicorn-63565.exe (PID: 9576)
- Unicorn-43965.exe (PID: 9584)
- Unicorn-31348.exe (PID: 9604)
- Unicorn-44297.exe (PID: 9620)
- Unicorn-15589.exe (PID: 9644)
- Unicorn-7229.exe (PID: 9688)
- Unicorn-47172.exe (PID: 9516)
- Unicorn-57700.exe (PID: 9568)
- Unicorn-57582.exe (PID: 9756)
- Unicorn-16742.exe (PID: 9740)
- Unicorn-35984.exe (PID: 9908)
- Unicorn-17510.exe (PID: 9920)
- Unicorn-54900.exe (PID: 9560)
- Unicorn-25848.exe (PID: 10008)
- Unicorn-2626.exe (PID: 10188)
- Unicorn-42760.exe (PID: 10276)
- Unicorn-44244.exe (PID: 10296)
- Unicorn-1557.exe (PID: 1748)
- Unicorn-7312.exe (PID: 10384)
- Unicorn-30997.exe (PID: 10364)
- Unicorn-7312.exe (PID: 10376)
- Unicorn-21940.exe (PID: 10420)
- Unicorn-15694.exe (PID: 10516)
- Unicorn-32030.exe (PID: 10536)
- Unicorn-30751.exe (PID: 10656)
- Unicorn-32776.exe (PID: 10752)
- Unicorn-57473.exe (PID: 10740)
- Unicorn-46512.exe (PID: 10760)
- Unicorn-31957.exe (PID: 10768)
- Unicorn-10907.exe (PID: 10820)
- Unicorn-13913.exe (PID: 10904)
- Unicorn-7888.exe (PID: 10568)
- Unicorn-64510.exe (PID: 10588)
- Unicorn-17806.exe (PID: 10924)
- Unicorn-30508.exe (PID: 10288)
- Unicorn-24246.exe (PID: 10720)
- Unicorn-57302.exe (PID: 10684)
- Unicorn-15834.exe (PID: 11520)
- Unicorn-50322.exe (PID: 11476)
- Unicorn-59201.exe (PID: 10940)
- Unicorn-18744.exe (PID: 10308)
- Unicorn-53969.exe (PID: 11148)
- Unicorn-10021.exe (PID: 11104)
- Unicorn-35539.exe (PID: 10676)
- Unicorn-32471.exe (PID: 11244)
- Unicorn-31263.exe (PID: 10704)
- Unicorn-28522.exe (PID: 10692)
- Unicorn-47354.exe (PID: 11036)
- Unicorn-39378.exe (PID: 11444)
- Unicorn-38034.exe (PID: 10972)
- Unicorn-8604.exe (PID: 10828)
- Unicorn-1085.exe (PID: 10992)
- Unicorn-50286.exe (PID: 10948)
- Unicorn-27435.exe (PID: 10804)
- Unicorn-37540.exe (PID: 11768)
- Unicorn-31978.exe (PID: 11628)
- Unicorn-15376.exe (PID: 11608)
- Unicorn-44806.exe (PID: 11468)
- Unicorn-63114.exe (PID: 11760)
- Unicorn-60950.exe (PID: 11536)
- Unicorn-52206.exe (PID: 11168)
- Unicorn-48485.exe (PID: 11260)
- Unicorn-48536.exe (PID: 11804)
- Unicorn-23239.exe (PID: 11588)
- Unicorn-56098.exe (PID: 11228)
- Unicorn-32361.exe (PID: 11984)
- Unicorn-9912.exe (PID: 11908)
- Unicorn-11312.exe (PID: 11752)
- Unicorn-53858.exe (PID: 11916)
- Unicorn-29513.exe (PID: 12408)
- Unicorn-9912.exe (PID: 12400)
- Unicorn-10488.exe (PID: 12112)
- Unicorn-6788.exe (PID: 12040)
- Unicorn-55797.exe (PID: 12064)
- Unicorn-23810.exe (PID: 11664)
- Unicorn-61874.exe (PID: 11684)
- Unicorn-32361.exe (PID: 11996)
- Unicorn-37104.exe (PID: 12604)
- Unicorn-46097.exe (PID: 12088)
- Unicorn-12673.exe (PID: 11692)
- Unicorn-32361.exe (PID: 12028)
- Unicorn-43297.exe (PID: 12056)
- Unicorn-51962.exe (PID: 12072)
- Unicorn-46097.exe (PID: 12096)
- Unicorn-37732.exe (PID: 11724)
- Unicorn-9336.exe (PID: 11656)
- Unicorn-9912.exe (PID: 12368)
- Unicorn-8537.exe (PID: 12716)
- Unicorn-50840.exe (PID: 12592)
- Unicorn-21802.exe (PID: 12356)
- Unicorn-53580.exe (PID: 12220)
- Unicorn-51468.exe (PID: 11716)
- Unicorn-50840.exe (PID: 12228)
- Unicorn-17908.exe (PID: 12200)
- Unicorn-4240.exe (PID: 11464)
- Unicorn-9357.exe (PID: 12384)
- Unicorn-23841.exe (PID: 12300)
- Unicorn-24417.exe (PID: 12788)
- Unicorn-24417.exe (PID: 12796)
- Unicorn-61438.exe (PID: 12828)
- Unicorn-3804.exe (PID: 12820)
- Unicorn-24417.exe (PID: 12804)
- Unicorn-53773.exe (PID: 12956)
- Unicorn-16130.exe (PID: 12848)
- Unicorn-39024.exe (PID: 13096)
- Unicorn-64820.exe (PID: 13236)
- Unicorn-11535.exe (PID: 13228)
- Unicorn-10244.exe (PID: 13124)
- Unicorn-15943.exe (PID: 12748)
- Unicorn-52700.exe (PID: 12772)
- Unicorn-7583.exe (PID: 12756)
- Unicorn-24417.exe (PID: 12812)
- Unicorn-59253.exe (PID: 13204)
- Unicorn-63337.exe (PID: 13212)
- Unicorn-13316.exe (PID: 13164)
- Unicorn-45516.exe (PID: 13512)
- Unicorn-16380.exe (PID: 13496)
- Unicorn-63721.exe (PID: 13064)
- Unicorn-5989.exe (PID: 13040)
- Unicorn-54806.exe (PID: 13088)
- Unicorn-13316.exe (PID: 13156)
- Unicorn-23442.exe (PID: 13704)
- Unicorn-33618.exe (PID: 12940)
- Unicorn-45891.exe (PID: 13812)
- Unicorn-43862.exe (PID: 13744)
- Unicorn-32361.exe (PID: 12020)
- Unicorn-26566.exe (PID: 13604)
- Unicorn-1100.exe (PID: 13612)
- Unicorn-48522.exe (PID: 13632)
- Unicorn-6913.exe (PID: 13724)
- Unicorn-12341.exe (PID: 13784)
- Unicorn-62078.exe (PID: 13936)
- Unicorn-65242.exe (PID: 13840)
- Unicorn-57437.exe (PID: 13892)
- Unicorn-54836.exe (PID: 13868)
- Unicorn-46337.exe (PID: 14024)
- Unicorn-22931.exe (PID: 14044)
- Unicorn-20318.exe (PID: 13820)
- Unicorn-3716.exe (PID: 14580)
- Unicorn-4240.exe (PID: 12284)
- Unicorn-15705.exe (PID: 12276)
- Unicorn-63389.exe (PID: 12376)
- Unicorn-53078.exe (PID: 12868)
- Unicorn-43353.exe (PID: 14712)
- Unicorn-18346.exe (PID: 14504)
- Unicorn-12215.exe (PID: 14484)
- Unicorn-47681.exe (PID: 14372)
- Unicorn-63654.exe (PID: 14348)
- Unicorn-57385.exe (PID: 14280)
- Unicorn-34660.exe (PID: 14272)
- Unicorn-48396.exe (PID: 14256)
- Unicorn-19939.exe (PID: 14204)
- Unicorn-50634.exe (PID: 14224)
- Unicorn-31780.exe (PID: 15040)
- Unicorn-56452.exe (PID: 14808)
- Unicorn-48854.exe (PID: 14876)
- Unicorn-41418.exe (PID: 15080)
- Unicorn-59165.exe (PID: 14292)
- Unicorn-55678.exe (PID: 4056)
- Unicorn-62376.exe (PID: 14632)
- Unicorn-10563.exe (PID: 14892)
- Unicorn-47811.exe (PID: 14536)
- Unicorn-31780.exe (PID: 15048)
- Unicorn-35096.exe (PID: 15108)
- Unicorn-41610.exe (PID: 15024)
- Unicorn-25532.exe (PID: 14196)
- Unicorn-28797.exe (PID: 14188)
- Unicorn-54645.exe (PID: 14124)
- Unicorn-3737.exe (PID: 14860)
- Unicorn-36248.exe (PID: 15652)
- Unicorn-60072.exe (PID: 14992)
- Unicorn-39180.exe (PID: 15092)
- Unicorn-32601.exe (PID: 15124)
- Unicorn-37334.exe (PID: 15072)
- Unicorn-8096.exe (PID: 15228)
- Unicorn-61761.exe (PID: 15240)
- Unicorn-50826.exe (PID: 15260)
- Unicorn-34660.exe (PID: 15304)
- Unicorn-29669.exe (PID: 15500)
- Unicorn-33447.exe (PID: 15376)
- Unicorn-17490.exe (PID: 15456)
- Unicorn-12791.exe (PID: 14796)
- Unicorn-9327.exe (PID: 15664)
- Unicorn-22512.exe (PID: 15768)
- Unicorn-56166.exe (PID: 15776)
- Unicorn-19026.exe (PID: 15812)
- Unicorn-14239.exe (PID: 16208)
- Unicorn-20074.exe (PID: 14924)
- Unicorn-58733.exe (PID: 16304)
- Unicorn-14536.exe (PID: 15704)
- Unicorn-14536.exe (PID: 15720)
- Unicorn-22512.exe (PID: 15732)
- Unicorn-47806.exe (PID: 15804)
- Unicorn-52340.exe (PID: 16336)
- Unicorn-62817.exe (PID: 16316)
- Unicorn-58205.exe (PID: 16404)
- Unicorn-58205.exe (PID: 16848)
- Unicorn-52340.exe (PID: 16832)
- Unicorn-58205.exe (PID: 16360)
- Unicorn-58205.exe (PID: 16376)
- Unicorn-58205.exe (PID: 16352)
- Unicorn-14173.exe (PID: 15684)
- Unicorn-26426.exe (PID: 15696)
- Unicorn-34210.exe (PID: 15752)
- Unicorn-52340.exe (PID: 16328)
- Unicorn-52340.exe (PID: 16388)
- Unicorn-19410.exe (PID: 15976)
- Unicorn-49540.exe (PID: 16752)
- Unicorn-23145.exe (PID: 16876)
- Unicorn-27121.exe (PID: 16684)
- Unicorn-38604.exe (PID: 16916)
- Unicorn-50070.exe (PID: 16892)
- Unicorn-33004.exe (PID: 16868)
- Unicorn-58205.exe (PID: 16856)
- Unicorn-59793.exe (PID: 16624)
- Unicorn-27386.exe (PID: 16532)
- Unicorn-63950.exe (PID: 15820)
- Unicorn-40826.exe (PID: 15944)
- Unicorn-40412.exe (PID: 16008)
- Unicorn-52340.exe (PID: 16816)
- Unicorn-30959.exe (PID: 16000)
- Unicorn-41372.exe (PID: 16768)
- Unicorn-58205.exe (PID: 16776)
- Unicorn-7520.exe (PID: 16676)
- Unicorn-38604.exe (PID: 16416)
- Unicorn-52340.exe (PID: 1188)
- Unicorn-35096.exe (PID: 16604)
- Unicorn-38604.exe (PID: 16824)
- Unicorn-22918.exe (PID: 15840)
- Unicorn-42376.exe (PID: 15852)
- Unicorn-55325.exe (PID: 15860)
- Unicorn-12511.exe (PID: 15888)
- Unicorn-58205.exe (PID: 16396)
Reads the computer name
- 1 (1229).exe (PID: 2284)
- Unicorn-55555.exe (PID: 5204)
- Unicorn-11673.exe (PID: 7384)
- Unicorn-49177.exe (PID: 7392)
- Unicorn-9701.exe (PID: 7436)
- Unicorn-9701.exe (PID: 7444)
- Unicorn-47205.exe (PID: 7464)
- Unicorn-60940.exe (PID: 7456)
- Unicorn-51043.exe (PID: 7500)
- Unicorn-30108.exe (PID: 7540)
- Unicorn-58697.exe (PID: 7516)
- Unicorn-10979.exe (PID: 7556)
- Unicorn-17110.exe (PID: 7564)
- Unicorn-49974.exe (PID: 7532)
- Unicorn-7908.exe (PID: 7628)
- Unicorn-7716.exe (PID: 7660)
- Unicorn-60254.exe (PID: 7684)
- Unicorn-27390.exe (PID: 7708)
- Unicorn-17175.exe (PID: 7716)
- Unicorn-51702.exe (PID: 7760)
- Unicorn-21259.exe (PID: 7700)
- Unicorn-28542.exe (PID: 7780)
- Unicorn-65298.exe (PID: 7796)
- Unicorn-53601.exe (PID: 7788)
- Unicorn-48200.exe (PID: 7804)
- Unicorn-49485.exe (PID: 7904)
- Unicorn-48697.exe (PID: 7768)
- Unicorn-58438.exe (PID: 7928)
- Unicorn-39864.exe (PID: 7988)
- Unicorn-45802.exe (PID: 8016)
- Unicorn-23196.exe (PID: 8048)
- Unicorn-9600.exe (PID: 7996)
- Unicorn-26077.exe (PID: 8108)
- Unicorn-5921.exe (PID: 8076)
- Unicorn-31172.exe (PID: 8084)
- Unicorn-48469.exe (PID: 8164)
- Unicorn-18920.exe (PID: 8060)
- Unicorn-46060.exe (PID: 5772)
- Unicorn-38594.exe (PID: 8100)
- Unicorn-46243.exe (PID: 6272)
- Unicorn-41666.exe (PID: 2552)
- Unicorn-38402.exe (PID: 8124)
- Unicorn-28646.exe (PID: 7352)
- Unicorn-38592.exe (PID: 7224)
- Unicorn-15049.exe (PID: 7212)
- Unicorn-61318.exe (PID: 5776)
- Unicorn-40004.exe (PID: 7420)
- Unicorn-45204.exe (PID: 2908)
- Unicorn-9377.exe (PID: 7612)
- Unicorn-37390.exe (PID: 7252)
- Unicorn-26844.exe (PID: 616)
- Unicorn-29776.exe (PID: 7236)
- Unicorn-37560.exe (PID: 3240)
- Unicorn-64369.exe (PID: 6184)
- Unicorn-61053.exe (PID: 3884)
- Unicorn-24391.exe (PID: 5436)
- Unicorn-8801.exe (PID: 736)
- Unicorn-13808.exe (PID: 6228)
- Unicorn-524.exe (PID: 7240)
- Unicorn-13160.exe (PID: 8912)
- Unicorn-18610.exe (PID: 8712)
- Unicorn-40042.exe (PID: 6108)
- Unicorn-26010.exe (PID: 8904)
- Unicorn-20483.exe (PID: 4464)
- Unicorn-14007.exe (PID: 7012)
- Unicorn-52714.exe (PID: 8816)
- Unicorn-15485.exe (PID: 8888)
- Unicorn-61038.exe (PID: 8476)
- Unicorn-54769.exe (PID: 9012)
- Unicorn-24208.exe (PID: 8984)
- Unicorn-13160.exe (PID: 8536)
- Unicorn-37878.exe (PID: 8588)
- Unicorn-25394.exe (PID: 8572)
- Unicorn-19954.exe (PID: 9180)
- Unicorn-34754.exe (PID: 8784)
- Unicorn-22999.exe (PID: 7976)
- Unicorn-31158.exe (PID: 9544)
- Unicorn-3425.exe (PID: 9204)
- Unicorn-13233.exe (PID: 9976)
- Unicorn-45278.exe (PID: 8484)
- Unicorn-7229.exe (PID: 9688)
- Unicorn-37944.exe (PID: 8976)
- Unicorn-57442.exe (PID: 8632)
- Unicorn-6777.exe (PID: 8832)
- Unicorn-61526.exe (PID: 8864)
- Unicorn-64738.exe (PID: 672)
- Unicorn-51666.exe (PID: 9088)
- Unicorn-25900.exe (PID: 9328)
- Unicorn-15694.exe (PID: 10516)
- Unicorn-50898.exe (PID: 8872)
- Unicorn-3534.exe (PID: 9072)
- Unicorn-20390.exe (PID: 4188)
- Unicorn-50322.exe (PID: 11476)
- Unicorn-37176.exe (PID: 8680)
- Unicorn-15834.exe (PID: 11520)
- Unicorn-10907.exe (PID: 10820)
- Unicorn-30840.exe (PID: 8772)
- Unicorn-7312.exe (PID: 10376)
- Unicorn-34946.exe (PID: 8696)
- Unicorn-60632.exe (PID: 9292)
- Unicorn-1763.exe (PID: 9132)
- Unicorn-14120.exe (PID: 8560)
- Unicorn-44806.exe (PID: 11468)
- Unicorn-9912.exe (PID: 12400)
- Unicorn-32361.exe (PID: 12008)
- Unicorn-46097.exe (PID: 12516)
- Unicorn-9912.exe (PID: 12368)
- Unicorn-54915.exe (PID: 12972)
- Unicorn-28522.exe (PID: 10692)
- Unicorn-2626.exe (PID: 10188)
- Unicorn-43965.exe (PID: 9584)
- Unicorn-22392.exe (PID: 4164)
- Unicorn-40020.exe (PID: 9272)
- Unicorn-38034.exe (PID: 10972)
- Unicorn-23239.exe (PID: 10156)
- Unicorn-45937.exe (PID: 8616)
- Unicorn-15589.exe (PID: 9644)
- Unicorn-57582.exe (PID: 9756)
- Unicorn-9719.exe (PID: 13900)
- Unicorn-56098.exe (PID: 11228)
- Unicorn-13316.exe (PID: 13164)
- Unicorn-61438.exe (PID: 12828)
- Unicorn-24417.exe (PID: 12812)
- Unicorn-57473.exe (PID: 10740)
- Unicorn-46337.exe (PID: 14024)
- Unicorn-912.exe (PID: 8824)
- Unicorn-1340.exe (PID: 10212)
- Unicorn-48646.exe (PID: 9612)
- Unicorn-53789.exe (PID: 15544)
- Unicorn-32952.exe (PID: 9152)
- Unicorn-31978.exe (PID: 11628)
- Unicorn-45484.exe (PID: 13196)
- Unicorn-24417.exe (PID: 12796)
Create files in a temporary directory
- 1 (1229).exe (PID: 2284)
- Unicorn-55555.exe (PID: 5204)
- Unicorn-9701.exe (PID: 7436)
- Unicorn-47205.exe (PID: 7464)
- Unicorn-49177.exe (PID: 7392)
- Unicorn-11673.exe (PID: 7384)
- Unicorn-60940.exe (PID: 7456)
- Unicorn-9701.exe (PID: 7444)
- Unicorn-30108.exe (PID: 7540)
- Unicorn-7908.exe (PID: 7628)
- Unicorn-52278.exe (PID: 7644)
- Unicorn-51043.exe (PID: 7500)
- Unicorn-58697.exe (PID: 7516)
- Unicorn-60254.exe (PID: 7684)
- Unicorn-27390.exe (PID: 7708)
- Unicorn-17175.exe (PID: 7716)
- Unicorn-65298.exe (PID: 7796)
- Unicorn-20928.exe (PID: 7572)
- Unicorn-51702.exe (PID: 7760)
- Unicorn-21259.exe (PID: 7700)
- Unicorn-53601.exe (PID: 7788)
- Unicorn-24820.exe (PID: 7812)
- Unicorn-17110.exe (PID: 7564)
- Unicorn-28542.exe (PID: 7780)
- Unicorn-48200.exe (PID: 7804)
- Unicorn-26320.exe (PID: 7940)
- Unicorn-7716.exe (PID: 7660)
- Unicorn-62714.exe (PID: 7892)
- Unicorn-9600.exe (PID: 7996)
- Unicorn-26077.exe (PID: 8108)
- Unicorn-39864.exe (PID: 7988)
- Unicorn-10979.exe (PID: 7556)
- Unicorn-9932.exe (PID: 8068)
- Unicorn-18920.exe (PID: 8060)
- Unicorn-51236.exe (PID: 8180)
- Unicorn-64634.exe (PID: 4696)
- Unicorn-46060.exe (PID: 5772)
- Unicorn-58438.exe (PID: 7928)
- Unicorn-37700.exe (PID: 5256)
- Unicorn-27494.exe (PID: 8144)
- Unicorn-51998.exe (PID: 8188)
- Unicorn-45994.exe (PID: 7980)
- Unicorn-6689.exe (PID: 6972)
- Unicorn-23196.exe (PID: 8048)
- Unicorn-2797.exe (PID: 8172)
- Unicorn-38592.exe (PID: 7224)
- Unicorn-56658.exe (PID: 904)
- Unicorn-41666.exe (PID: 2552)
- Unicorn-20264.exe (PID: 3676)
- Unicorn-3736.exe (PID: 6036)
- Unicorn-40004.exe (PID: 7420)
- Unicorn-63238.exe (PID: 5800)
- Unicorn-45204.exe (PID: 2908)
- Unicorn-44193.exe (PID: 4448)
- Unicorn-51012.exe (PID: 7416)
- Unicorn-37390.exe (PID: 7252)
- Unicorn-37560.exe (PID: 3240)
- Unicorn-49974.exe (PID: 7532)
- Unicorn-29776.exe (PID: 7236)
- Unicorn-45802.exe (PID: 8016)
- Unicorn-24391.exe (PID: 5436)
- Unicorn-64369.exe (PID: 6184)
- Unicorn-61053.exe (PID: 3884)
- Unicorn-14769.exe (PID: 6724)
- Unicorn-23249.exe (PID: 7372)
- Unicorn-41770.exe (PID: 8448)
- Unicorn-3409.exe (PID: 7380)
- Unicorn-524.exe (PID: 7240)
- Unicorn-31172.exe (PID: 8084)
- Unicorn-48469.exe (PID: 8164)
- Unicorn-5921.exe (PID: 8076)
- Unicorn-40042.exe (PID: 6108)
- Unicorn-37110.exe (PID: 8932)
- Unicorn-26895.exe (PID: 8920)
- Unicorn-51090.exe (PID: 8844)
- Unicorn-63482.exe (PID: 8040)
- Unicorn-14007.exe (PID: 7012)
- Unicorn-13808.exe (PID: 6228)
- Unicorn-61038.exe (PID: 8476)
- Unicorn-20483.exe (PID: 4464)
- Unicorn-32751.exe (PID: 5304)
- Unicorn-20176.exe (PID: 1568)
- Unicorn-15485.exe (PID: 8888)
- Unicorn-32411.exe (PID: 7084)
- Unicorn-44236.exe (PID: 8812)
- Unicorn-13160.exe (PID: 8536)
- Unicorn-37878.exe (PID: 8588)
- Unicorn-48697.exe (PID: 7768)
- Unicorn-18239.exe (PID: 1128)
- Unicorn-25394.exe (PID: 8572)
- Unicorn-19954.exe (PID: 9180)
- Unicorn-34754.exe (PID: 8784)
- Unicorn-21361.exe (PID: 9884)
- Unicorn-20255.exe (PID: 9024)
- Unicorn-15049.exe (PID: 7212)
- Unicorn-49485.exe (PID: 7904)
- Unicorn-46243.exe (PID: 6272)
- Unicorn-3425.exe (PID: 9204)
- Unicorn-52714.exe (PID: 8816)
- Unicorn-13233.exe (PID: 9976)
- Unicorn-18610.exe (PID: 8712)
- Unicorn-44297.exe (PID: 9620)
- Unicorn-61526.exe (PID: 8864)
- Unicorn-57442.exe (PID: 8632)
- Unicorn-6777.exe (PID: 8832)
- Unicorn-39990.exe (PID: 8968)
- Unicorn-26394.exe (PID: 8856)
- Unicorn-54473.exe (PID: 1240)
- Unicorn-25900.exe (PID: 9328)
- Unicorn-13160.exe (PID: 8912)
- Unicorn-7229.exe (PID: 9688)
- Unicorn-45470.exe (PID: 8896)
- Unicorn-51474.exe (PID: 8652)
- Unicorn-61318.exe (PID: 5776)
- Unicorn-9377.exe (PID: 7612)
- Unicorn-32761.exe (PID: 8524)
- Unicorn-16254.exe (PID: 9108)
- Unicorn-64738.exe (PID: 672)
- Unicorn-8801.exe (PID: 736)
- Unicorn-33423.exe (PID: 2096)
- Unicorn-3534.exe (PID: 9072)
- Unicorn-62470.exe (PID: 2240)
- Unicorn-26010.exe (PID: 8904)
- Unicorn-20390.exe (PID: 4188)
- Unicorn-31348.exe (PID: 9604)
- Unicorn-50898.exe (PID: 8872)
- Unicorn-30840.exe (PID: 8772)
- Unicorn-29652.exe (PID: 10864)
- Unicorn-10907.exe (PID: 10820)
- Unicorn-34946.exe (PID: 8696)
- Unicorn-37716.exe (PID: 9764)
- Unicorn-26844.exe (PID: 616)
- Unicorn-38402.exe (PID: 8124)
- Unicorn-29745.exe (PID: 9164)
- Unicorn-24526.exe (PID: 9816)
- Unicorn-29513.exe (PID: 12408)
- Unicorn-26284.exe (PID: 9280)
- Unicorn-1763.exe (PID: 9132)
- Unicorn-14120.exe (PID: 8560)
- Unicorn-32361.exe (PID: 12008)
- Unicorn-54769.exe (PID: 9012)
- Unicorn-15694.exe (PID: 10516)
- Unicorn-21802.exe (PID: 12356)
- Unicorn-38594.exe (PID: 8100)
- Unicorn-37669.exe (PID: 728)
- Unicorn-58329.exe (PID: 7352)
- Unicorn-2626.exe (PID: 10188)
- Unicorn-60950.exe (PID: 11536)
- Unicorn-40020.exe (PID: 9272)
- Unicorn-38034.exe (PID: 10972)
- Unicorn-22392.exe (PID: 4164)
- Unicorn-61521.exe (PID: 13908)
- Unicorn-61548.exe (PID: 13924)
- Unicorn-43965.exe (PID: 9584)
- Unicorn-56098.exe (PID: 11228)
- Unicorn-10488.exe (PID: 12112)
- Unicorn-61438.exe (PID: 12828)
- Unicorn-24417.exe (PID: 12812)
- Unicorn-3773.exe (PID: 12348)
- Unicorn-15589.exe (PID: 9644)
- Unicorn-32361.exe (PID: 11976)
- Unicorn-50286.exe (PID: 10948)
- Unicorn-23239.exe (PID: 10156)
- Unicorn-912.exe (PID: 8824)
- Unicorn-28522.exe (PID: 10692)
- Unicorn-45937.exe (PID: 8616)
- Unicorn-49289.exe (PID: 9140)
- Unicorn-57473.exe (PID: 10740)
- Unicorn-22999.exe (PID: 7976)
- Unicorn-46337.exe (PID: 14024)
- Unicorn-1340.exe (PID: 10212)
- Unicorn-32952.exe (PID: 9152)
Creates files or folders in the user directory
- WerFault.exe (PID: 8456)
- WerFault.exe (PID: 8660)
Reads the software policy settings
- slui.exe (PID: 2564)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
702
Monitored processes
566
Malicious processes
85
Suspicious processes
66
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 616 | C:\Users\admin\AppData\Local\Temp\Unicorn-26844.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-26844.exe | Unicorn-62714.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 664 | C:\Users\admin\AppData\Local\Temp\Unicorn-29632.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-29632.exe | — | Unicorn-26320.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Exit code: 3221225785 Version: 1.00 Modules
| |||||||||||||||
| 672 | C:\Users\admin\AppData\Local\Temp\Unicorn-64738.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-64738.exe | Unicorn-46060.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 728 | C:\Users\admin\AppData\Local\Temp\Unicorn-37669.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-37669.exe | Unicorn-7716.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 736 | C:\Users\admin\AppData\Local\Temp\Unicorn-8801.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8801.exe | Unicorn-5921.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 904 | C:\Users\admin\AppData\Local\Temp\Unicorn-56658.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56658.exe | Unicorn-49485.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1128 | C:\Users\admin\AppData\Local\Temp\Unicorn-18239.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-18239.exe | Unicorn-58697.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1188 | C:\Users\admin\AppData\Local\Temp\Unicorn-52340.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-52340.exe | — | Unicorn-23249.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1240 | C:\Users\admin\AppData\Local\Temp\Unicorn-54473.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-54473.exe | Unicorn-27390.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1300 | C:\Users\admin\AppData\Local\Temp\Unicorn-63394.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63394.exe | Unicorn-18920.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
14 797
Read events
14 797
Write events
0
Delete events
0
Modification events
Executable files
704
Suspicious files
6
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2284 | 1 (1229).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-60940.exe | executable | |
MD5:FB605400AF7623EA56EC180BD59E878A | SHA256:63BAB95F4CB7123392EF42C81D47525590CADD7285B501EE531244CCCDE79739 | |||
| 2284 | 1 (1229).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-55555.exe | executable | |
MD5:82419FFD4E5FB676129287B6B1EE21F5 | SHA256:DBEA0297B858886637923E942412D6B0093FB19D21C4CF6BD62F4AEBB2541889 | |||
| 2284 | 1 (1229).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49177.exe | executable | |
MD5:5B8BC1FC992A71733D75AC89C85A3386 | SHA256:8241B1116D243AC3D4926BBD56522E1685670743E87415C795243C5AD934FE24 | |||
| 7464 | Unicorn-47205.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49974.exe | executable | |
MD5:12C10B637F561C5698A4AA13923FD4D0 | SHA256:6D993C532739BA39BC61701E5CFBC0BC222AD1456094142D36D938973D377A2B | |||
| 7384 | Unicorn-11673.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9701.exe | executable | |
MD5:577823229B19F3A03ECBD312A465F590 | SHA256:0D71200BE49FD3750D1929E57C181ABC12502F1A4B10D6FCFBE6758B9A7699A6 | |||
| 5204 | Unicorn-55555.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-47205.exe | executable | |
MD5:08B11404434CA65D23E1C899176DAB74 | SHA256:13FF089A247F70D286C47FA71A7B242B25B5D5660A4E4960322749D318D24EB0 | |||
| 7456 | Unicorn-60940.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-17110.exe | executable | |
MD5:F5F26DE39E71E0B515FFF11AC74EADAE | SHA256:90A8890C2847722D705FBCE376D8C571D2C13489391EC4B5FCC16F9BA432B437 | |||
| 7384 | Unicorn-11673.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-58697.exe | executable | |
MD5:C13C95EB4385F6761BE801F8E10B903F | SHA256:7510B38B1EEEE4398C0A03F4686D7123C8286B70ED687F179CC81D7711942ACB | |||
| 7436 | Unicorn-9701.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-51043.exe | executable | |
MD5:7EBD3398478A3AEB1E414E844D50B791 | SHA256:1056ABAC974D3C6E88CFD2AD8675A3CD427048F9C317D031FCB0D9564D90F32C | |||
| 5204 | Unicorn-55555.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-11673.exe | executable | |
MD5:6474546F20289FFEE3F6AF7F40D414E8 | SHA256:58F778C6DAA7F81725EFC0E13221CC658BDAD862A09473D39B92636B711A5070 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
24
DNS requests
17
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.16.164.24:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
2104 | svchost.exe | GET | 200 | 2.16.164.24:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.16.164.24:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4244 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
5360 | SIHClient.exe | GET | 200 | 2.19.217.218:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5360 | SIHClient.exe | GET | 200 | 2.19.217.218:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 2.16.164.24:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.16.164.24:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
2104 | svchost.exe | 2.16.164.24:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 20.197.71.89:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | SG | whitelisted |
6544 | svchost.exe | 20.190.160.64:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
4244 | backgroundTaskHost.exe | 20.199.58.43:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |