| File name: | 1 (535) |
| Full analysis: | https://app.any.run/tasks/47672e67-6e47-4b9d-9f36-273421ba4de6 |
| Verdict: | Malicious activity |
| Analysis date: | March 25, 2025, 00:27:40 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | 31E200096F88CF628BE88ED6D5FD83F0 |
| SHA1: | 01F114E739C5B10F6C889C0A4B708F39FE68C679 |
| SHA256: | 1836C477554808EA9094D51962227F15110FD0EC3283421AE9BA98186D25FB34 |
| SSDEEP: | 6144:S7Lpf7IteDEFA5UlzAe+/ofxotBQHvJGBH/WyeO9Fk/8SwjwpyAvEhihxffhsvYa:SvhMDFA5qz70B4hOHOyeO9wx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- Unicorn-16612.exe (PID: 4220)
- Unicorn-8681.exe (PID: 4620)
- 1 (535).exe (PID: 6184)
- Unicorn-56901.exe (PID: 3304)
- Unicorn-47573.exe (PID: 920)
- Unicorn-22087.exe (PID: 5640)
- Unicorn-58220.exe (PID: 3896)
- Unicorn-14173.exe (PID: 3008)
- Unicorn-62393.exe (PID: 6080)
- Unicorn-21473.exe (PID: 5436)
- Unicorn-15866.exe (PID: 2772)
- Unicorn-44747.exe (PID: 856)
- Unicorn-34654.exe (PID: 6676)
- Unicorn-64350.exe (PID: 2340)
- Unicorn-55893.exe (PID: 5400)
- Unicorn-2634.exe (PID: 3020)
- Unicorn-23037.exe (PID: 2268)
- Unicorn-3158.exe (PID: 5064)
- Unicorn-22500.exe (PID: 1040)
- Unicorn-50398.exe (PID: 2092)
- Unicorn-25572.exe (PID: 6068)
- Unicorn-64347.exe (PID: 5008)
- Unicorn-63335.exe (PID: 5720)
- Unicorn-7153.exe (PID: 7172)
- Unicorn-4353.exe (PID: 1096)
- Unicorn-58955.exe (PID: 7180)
- Unicorn-53205.exe (PID: 2600)
- Unicorn-1894.exe (PID: 7296)
- Unicorn-37860.exe (PID: 5260)
- Unicorn-58215.exe (PID: 7320)
- Unicorn-12475.exe (PID: 7312)
- Unicorn-6331.exe (PID: 7352)
- Unicorn-32955.exe (PID: 5228)
- Unicorn-42730.exe (PID: 7344)
- Unicorn-2019.exe (PID: 7360)
- Unicorn-11374.exe (PID: 7428)
- Unicorn-36201.exe (PID: 7440)
- Unicorn-42590.exe (PID: 7456)
- Unicorn-39259.exe (PID: 7488)
- Unicorn-45927.exe (PID: 7408)
- Unicorn-16981.exe (PID: 7448)
- Unicorn-64609.exe (PID: 7556)
- Unicorn-42980.exe (PID: 7508)
- Unicorn-47191.exe (PID: 7572)
- Unicorn-23638.exe (PID: 7536)
- Unicorn-37374.exe (PID: 7528)
- Unicorn-22509.exe (PID: 7612)
- Unicorn-47710.exe (PID: 7604)
- Unicorn-63189.exe (PID: 7844)
- Unicorn-17396.exe (PID: 7860)
- Unicorn-26599.exe (PID: 7884)
- Unicorn-25697.exe (PID: 7588)
- Unicorn-17907.exe (PID: 7944)
- Unicorn-29130.exe (PID: 7816)
- Unicorn-17907.exe (PID: 8016)
- Unicorn-1617.exe (PID: 8044)
- Unicorn-16242.exe (PID: 7640)
- Unicorn-48215.exe (PID: 7384)
- Unicorn-60104.exe (PID: 7416)
- Unicorn-63460.exe (PID: 7620)
- Unicorn-57330.exe (PID: 7628)
- Unicorn-51571.exe (PID: 7596)
- Unicorn-48225.exe (PID: 7792)
- Unicorn-23114.exe (PID: 7520)
- Unicorn-29684.exe (PID: 7808)
- Unicorn-51297.exe (PID: 7740)
- Unicorn-42223.exe (PID: 8028)
- Unicorn-9954.exe (PID: 5084)
- Unicorn-28606.exe (PID: 7896)
- Unicorn-25051.exe (PID: 8116)
- Unicorn-10473.exe (PID: 8156)
- Unicorn-31059.exe (PID: 8124)
- Unicorn-49413.exe (PID: 8084)
- Unicorn-58343.exe (PID: 8092)
- Unicorn-2637.exe (PID: 8144)
- Unicorn-2158.exe (PID: 8764)
- Unicorn-47830.exe (PID: 8756)
- Unicorn-52449.exe (PID: 8796)
- Unicorn-16359.exe (PID: 1764)
- Unicorn-51135.exe (PID: 8568)
- Unicorn-47588.exe (PID: 8184)
- Unicorn-57938.exe (PID: 8052)
- Unicorn-10097.exe (PID: 8212)
- Unicorn-23277.exe (PID: 4724)
- Unicorn-40644.exe (PID: 7204)
- Unicorn-19800.exe (PID: 4812)
- Unicorn-53988.exe (PID: 8880)
- Unicorn-61010.exe (PID: 8072)
- Unicorn-56030.exe (PID: 8244)
- Unicorn-32990.exe (PID: 7400)
- Unicorn-53750.exe (PID: 9064)
- Unicorn-53997.exe (PID: 8136)
- Unicorn-28763.exe (PID: 8980)
- Unicorn-1483.exe (PID: 8676)
- Unicorn-61155.exe (PID: 8684)
- Unicorn-17517.exe (PID: 8620)
- Unicorn-29880.exe (PID: 8236)
- Unicorn-47420.exe (PID: 8708)
- Unicorn-52818.exe (PID: 8260)
- Unicorn-64852.exe (PID: 8344)
- Unicorn-43742.exe (PID: 8400)
- Unicorn-46674.exe (PID: 8320)
- Unicorn-3679.exe (PID: 8176)
- Unicorn-3046.exe (PID: 968)
- Unicorn-37979.exe (PID: 8964)
- Unicorn-46447.exe (PID: 9024)
- Unicorn-53616.exe (PID: 8588)
- Unicorn-25444.exe (PID: 3132)
- Unicorn-2753.exe (PID: 9008)
- Unicorn-42814.exe (PID: 8892)
- Unicorn-61899.exe (PID: 8220)
- Unicorn-5335.exe (PID: 9320)
- Unicorn-3938.exe (PID: 9396)
- Unicorn-55740.exe (PID: 9404)
- Unicorn-42459.exe (PID: 8648)
- Unicorn-17362.exe (PID: 8992)
- Unicorn-15675.exe (PID: 8108)
- Unicorn-23771.exe (PID: 9856)
- Unicorn-20158.exe (PID: 9876)
- Unicorn-60601.exe (PID: 8724)
- Unicorn-15078.exe (PID: 9960)
- Unicorn-21857.exe (PID: 9484)
- Unicorn-45275.exe (PID: 9744)
- Unicorn-48103.exe (PID: 6744)
- Unicorn-17633.exe (PID: 8536)
- Unicorn-1119.exe (PID: 3032)
- Unicorn-62034.exe (PID: 4200)
- Unicorn-967.exe (PID: 6808)
- Unicorn-52839.exe (PID: 9304)
- Unicorn-26302.exe (PID: 9804)
- Unicorn-14551.exe (PID: 9292)
- Unicorn-36080.exe (PID: 10176)
- Unicorn-35428.exe (PID: 11008)
- Unicorn-52312.exe (PID: 9016)
- Unicorn-57702.exe (PID: 11040)
- Unicorn-4597.exe (PID: 9644)
- Unicorn-9918.exe (PID: 10376)
- Unicorn-51171.exe (PID: 11080)
- Unicorn-48587.exe (PID: 8560)
- Unicorn-42555.exe (PID: 9812)
- Unicorn-16568.exe (PID: 8596)
- Unicorn-19789.exe (PID: 9752)
- Unicorn-33857.exe (PID: 5892)
- Unicorn-62421.exe (PID: 9820)
- Unicorn-41418.exe (PID: 3956)
- Unicorn-47323.exe (PID: 10820)
- Unicorn-46055.exe (PID: 8552)
- Unicorn-6493.exe (PID: 10292)
- Unicorn-6996.exe (PID: 9356)
- Unicorn-35794.exe (PID: 2192)
- Unicorn-36056.exe (PID: 9708)
- Unicorn-50550.exe (PID: 9420)
- Unicorn-25819.exe (PID: 10276)
- Unicorn-27602.exe (PID: 9592)
- Unicorn-36059.exe (PID: 9764)
- Unicorn-19971.exe (PID: 9520)
- Unicorn-52470.exe (PID: 6468)
- Unicorn-37241.exe (PID: 5376)
- Unicorn-55270.exe (PID: 12292)
- Unicorn-37217.exe (PID: 9092)
- Unicorn-39007.exe (PID: 10988)
- Unicorn-21592.exe (PID: 10220)
- Unicorn-28242.exe (PID: 8472)
- Unicorn-3100.exe (PID: 10284)
- Unicorn-48082.exe (PID: 6476)
- Unicorn-40545.exe (PID: 11872)
- Unicorn-47058.exe (PID: 9284)
- Unicorn-21461.exe (PID: 10540)
- Unicorn-4439.exe (PID: 1188)
- Unicorn-29019.exe (PID: 11100)
- Unicorn-54226.exe (PID: 10524)
- Unicorn-26722.exe (PID: 11136)
- Unicorn-64731.exe (PID: 5972)
- Unicorn-37366.exe (PID: 8672)
- Unicorn-65474.exe (PID: 7748)
- Unicorn-62789.exe (PID: 11216)
- Unicorn-16769.exe (PID: 8460)
- Unicorn-29016.exe (PID: 11728)
- Unicorn-35931.exe (PID: 9628)
- Unicorn-55804.exe (PID: 11860)
- Unicorn-9565.exe (PID: 10328)
- Unicorn-54997.exe (PID: 8816)
- Unicorn-16715.exe (PID: 10976)
- Unicorn-33129.exe (PID: 8736)
- Unicorn-34529.exe (PID: 12816)
- Unicorn-10859.exe (PID: 2692)
- Unicorn-42079.exe (PID: 10948)
- Unicorn-22622.exe (PID: 8484)
- Unicorn-64247.exe (PID: 11144)
- Unicorn-44007.exe (PID: 8392)
- Unicorn-57191.exe (PID: 7580)
- Unicorn-42489.exe (PID: 10576)
- Unicorn-54713.exe (PID: 10348)
- Unicorn-5031.exe (PID: 11524)
- Unicorn-54121.exe (PID: 11692)
- Unicorn-54713.exe (PID: 10356)
- Unicorn-58994.exe (PID: 10592)
- Unicorn-51418.exe (PID: 14388)
- Unicorn-6005.exe (PID: 5132)
- Unicorn-57700.exe (PID: 13572)
- Unicorn-37228.exe (PID: 10680)
- Unicorn-40504.exe (PID: 8284)
- Unicorn-7269.exe (PID: 13612)
- Unicorn-5621.exe (PID: 9436)
- Unicorn-42442.exe (PID: 8604)
- Unicorn-9050.exe (PID: 11884)
- Unicorn-40330.exe (PID: 13684)
- Unicorn-32184.exe (PID: 10648)
- Unicorn-48722.exe (PID: 5308)
- Unicorn-23653.exe (PID: 10384)
- Unicorn-3555.exe (PID: 12028)
- Unicorn-12054.exe (PID: 8328)
- Unicorn-25799.exe (PID: 11336)
- Unicorn-65371.exe (PID: 12016)
- Unicorn-13405.exe (PID: 8496)
- Unicorn-63587.exe (PID: 11208)
- Unicorn-33509.exe (PID: 14508)
- Unicorn-51204.exe (PID: 4024)
- Unicorn-51418.exe (PID: 14404)
- Unicorn-30639.exe (PID: 15684)
- Unicorn-61756.exe (PID: 7156)
- Unicorn-57071.exe (PID: 13704)
- Unicorn-25590.exe (PID: 15252)
- Unicorn-888.exe (PID: 15272)
- Unicorn-29909.exe (PID: 9164)
- Unicorn-3573.exe (PID: 8268)
- Unicorn-56410.exe (PID: 8164)
- Unicorn-2525.exe (PID: 9040)
- Unicorn-51805.exe (PID: 15756)
- Unicorn-22123.exe (PID: 12560)
- Unicorn-32249.exe (PID: 10424)
- Unicorn-38914.exe (PID: 11680)
- Unicorn-63215.exe (PID: 13636)
- Unicorn-32908.exe (PID: 15676)
- Unicorn-44036.exe (PID: 15212)
- Unicorn-64094.exe (PID: 13852)
- Unicorn-63161.exe (PID: 13476)
Starts itself from another location
- Unicorn-16612.exe (PID: 4220)
- Unicorn-8681.exe (PID: 4620)
- Unicorn-56901.exe (PID: 3304)
- Unicorn-47573.exe (PID: 920)
- Unicorn-22087.exe (PID: 5640)
- Unicorn-64350.exe (PID: 2340)
- Unicorn-14173.exe (PID: 3008)
- 1 (535).exe (PID: 6184)
- Unicorn-58220.exe (PID: 3896)
- Unicorn-21473.exe (PID: 5436)
- Unicorn-15866.exe (PID: 2772)
- Unicorn-64347.exe (PID: 5008)
- Unicorn-34654.exe (PID: 6676)
- Unicorn-62393.exe (PID: 6080)
- Unicorn-55893.exe (PID: 5400)
- Unicorn-37860.exe (PID: 5260)
- Unicorn-2634.exe (PID: 3020)
- Unicorn-44747.exe (PID: 856)
- Unicorn-23037.exe (PID: 2268)
- Unicorn-22500.exe (PID: 1040)
- Unicorn-3158.exe (PID: 5064)
- Unicorn-50398.exe (PID: 2092)
- Unicorn-25572.exe (PID: 6068)
- Unicorn-63335.exe (PID: 5720)
- Unicorn-7153.exe (PID: 7172)
- Unicorn-4353.exe (PID: 1096)
- Unicorn-58955.exe (PID: 7180)
- Unicorn-53205.exe (PID: 2600)
- Unicorn-1894.exe (PID: 7296)
- Unicorn-58215.exe (PID: 7320)
- Unicorn-12475.exe (PID: 7312)
- Unicorn-6331.exe (PID: 7352)
- Unicorn-32955.exe (PID: 5228)
- Unicorn-42730.exe (PID: 7344)
- Unicorn-2019.exe (PID: 7360)
- Unicorn-48215.exe (PID: 7384)
- Unicorn-32990.exe (PID: 7400)
- Unicorn-36201.exe (PID: 7440)
- Unicorn-42590.exe (PID: 7456)
- Unicorn-39259.exe (PID: 7488)
- Unicorn-45927.exe (PID: 7408)
- Unicorn-16981.exe (PID: 7448)
- Unicorn-64609.exe (PID: 7556)
- Unicorn-42980.exe (PID: 7508)
- Unicorn-47191.exe (PID: 7572)
- Unicorn-57191.exe (PID: 7580)
- Unicorn-22509.exe (PID: 7612)
- Unicorn-47710.exe (PID: 7604)
- Unicorn-37374.exe (PID: 7528)
- Unicorn-11374.exe (PID: 7428)
- Unicorn-63189.exe (PID: 7844)
- Unicorn-17396.exe (PID: 7860)
- Unicorn-26599.exe (PID: 7884)
- Unicorn-63460.exe (PID: 7620)
- Unicorn-25697.exe (PID: 7588)
- Unicorn-17907.exe (PID: 7944)
- Unicorn-1617.exe (PID: 8044)
- Unicorn-17907.exe (PID: 8016)
- Unicorn-16242.exe (PID: 7640)
- Unicorn-23638.exe (PID: 7536)
- Unicorn-29130.exe (PID: 7816)
- Unicorn-57330.exe (PID: 7628)
- Unicorn-60104.exe (PID: 7416)
- Unicorn-51571.exe (PID: 7596)
- Unicorn-48225.exe (PID: 7792)
- Unicorn-23114.exe (PID: 7520)
- Unicorn-29684.exe (PID: 7808)
- Unicorn-51297.exe (PID: 7740)
- Unicorn-42223.exe (PID: 8028)
- Unicorn-9954.exe (PID: 5084)
- Unicorn-65474.exe (PID: 7748)
- Unicorn-31059.exe (PID: 8124)
- Unicorn-25051.exe (PID: 8116)
- Unicorn-10473.exe (PID: 8156)
- Unicorn-49413.exe (PID: 8084)
- Unicorn-58343.exe (PID: 8092)
- Unicorn-2637.exe (PID: 8144)
- Unicorn-2158.exe (PID: 8764)
- Unicorn-28606.exe (PID: 7896)
- Unicorn-52449.exe (PID: 8796)
- Unicorn-16359.exe (PID: 1764)
- Unicorn-51135.exe (PID: 8568)
- Unicorn-47588.exe (PID: 8184)
- Unicorn-47830.exe (PID: 8756)
- Unicorn-57938.exe (PID: 8052)
- Unicorn-10097.exe (PID: 8212)
- Unicorn-23277.exe (PID: 4724)
- Unicorn-53988.exe (PID: 8880)
- Unicorn-61010.exe (PID: 8072)
- Unicorn-56030.exe (PID: 8244)
- Unicorn-53750.exe (PID: 9064)
- Unicorn-28763.exe (PID: 8980)
- Unicorn-1483.exe (PID: 8676)
- Unicorn-61155.exe (PID: 8684)
- Unicorn-17517.exe (PID: 8620)
- Unicorn-29880.exe (PID: 8236)
- Unicorn-64852.exe (PID: 8344)
- Unicorn-47420.exe (PID: 8708)
- Unicorn-52818.exe (PID: 8260)
- Unicorn-43742.exe (PID: 8400)
- Unicorn-46674.exe (PID: 8320)
- Unicorn-3046.exe (PID: 968)
- Unicorn-3679.exe (PID: 8176)
- Unicorn-37979.exe (PID: 8964)
- Unicorn-46447.exe (PID: 9024)
- Unicorn-53616.exe (PID: 8588)
- Unicorn-42814.exe (PID: 8892)
- Unicorn-61899.exe (PID: 8220)
- Unicorn-5335.exe (PID: 9320)
- Unicorn-4439.exe (PID: 1188)
- Unicorn-3938.exe (PID: 9396)
- Unicorn-55740.exe (PID: 9404)
- Unicorn-42459.exe (PID: 8648)
- Unicorn-13405.exe (PID: 8496)
- Unicorn-15675.exe (PID: 8108)
- Unicorn-23771.exe (PID: 9856)
- Unicorn-2753.exe (PID: 9008)
- Unicorn-20158.exe (PID: 9876)
- Unicorn-60601.exe (PID: 8724)
- Unicorn-15078.exe (PID: 9960)
- Unicorn-21857.exe (PID: 9484)
- Unicorn-5621.exe (PID: 9436)
- Unicorn-48103.exe (PID: 6744)
- Unicorn-1119.exe (PID: 3032)
- Unicorn-19800.exe (PID: 4812)
- Unicorn-44007.exe (PID: 8392)
- Unicorn-62034.exe (PID: 4200)
- Unicorn-967.exe (PID: 6808)
- Unicorn-52839.exe (PID: 9304)
- Unicorn-26302.exe (PID: 9804)
- Unicorn-45275.exe (PID: 9744)
- Unicorn-36080.exe (PID: 10176)
- Unicorn-17633.exe (PID: 8536)
- Unicorn-35428.exe (PID: 11008)
- Unicorn-52312.exe (PID: 9016)
- Unicorn-57702.exe (PID: 11040)
- Unicorn-4597.exe (PID: 9644)
- Unicorn-51171.exe (PID: 11080)
- Unicorn-9918.exe (PID: 10376)
- Unicorn-17362.exe (PID: 8992)
- Unicorn-42555.exe (PID: 9812)
- Unicorn-48587.exe (PID: 8560)
- Unicorn-19789.exe (PID: 9752)
- Unicorn-62421.exe (PID: 9820)
- Unicorn-41418.exe (PID: 3956)
- Unicorn-33857.exe (PID: 5892)
- Unicorn-47323.exe (PID: 10820)
- Unicorn-46055.exe (PID: 8552)
- Unicorn-6493.exe (PID: 10292)
- Unicorn-6996.exe (PID: 9356)
- Unicorn-35794.exe (PID: 2192)
- Unicorn-25444.exe (PID: 3132)
- Unicorn-39007.exe (PID: 10988)
- Unicorn-36056.exe (PID: 9708)
- Unicorn-50550.exe (PID: 9420)
- Unicorn-25819.exe (PID: 10276)
- Unicorn-27602.exe (PID: 9592)
- Unicorn-36059.exe (PID: 9764)
- Unicorn-19971.exe (PID: 9520)
- Unicorn-52470.exe (PID: 6468)
- Unicorn-37241.exe (PID: 5376)
- Unicorn-55270.exe (PID: 12304)
- Unicorn-55270.exe (PID: 12292)
- Unicorn-37217.exe (PID: 9092)
- Unicorn-21592.exe (PID: 10220)
- Unicorn-28242.exe (PID: 8472)
- Unicorn-3100.exe (PID: 10284)
- Unicorn-48082.exe (PID: 6476)
- Unicorn-53997.exe (PID: 8136)
- Unicorn-40545.exe (PID: 11872)
- Unicorn-47058.exe (PID: 9284)
- Unicorn-21461.exe (PID: 10540)
- Unicorn-54226.exe (PID: 10524)
- Unicorn-29019.exe (PID: 11100)
- Unicorn-26722.exe (PID: 11136)
- Unicorn-64731.exe (PID: 5972)
- Unicorn-2525.exe (PID: 9040)
- Unicorn-62789.exe (PID: 11216)
- Unicorn-57700.exe (PID: 13572)
- Unicorn-16769.exe (PID: 8460)
- Unicorn-63215.exe (PID: 13636)
- Unicorn-37366.exe (PID: 8672)
- Unicorn-7269.exe (PID: 13612)
- Unicorn-38914.exe (PID: 11680)
- Unicorn-35931.exe (PID: 9628)
- Unicorn-55804.exe (PID: 11860)
- Unicorn-9565.exe (PID: 10328)
- Unicorn-54997.exe (PID: 8816)
- Unicorn-16715.exe (PID: 10976)
- Unicorn-33129.exe (PID: 8736)
- Unicorn-34529.exe (PID: 12816)
- Unicorn-7669.exe (PID: 9604)
- Unicorn-29016.exe (PID: 11728)
- Unicorn-22622.exe (PID: 8484)
- Unicorn-42079.exe (PID: 10948)
- Unicorn-64247.exe (PID: 11144)
- Unicorn-10859.exe (PID: 2692)
- Unicorn-42442.exe (PID: 8604)
- Unicorn-44036.exe (PID: 15212)
- Unicorn-14551.exe (PID: 9292)
INFO
Checks supported languages
- 1 (535).exe (PID: 6184)
- Unicorn-56901.exe (PID: 3304)
- Unicorn-8681.exe (PID: 4620)
- Unicorn-47573.exe (PID: 920)
- Unicorn-22087.exe (PID: 5640)
- Unicorn-64350.exe (PID: 2340)
- Unicorn-58220.exe (PID: 3896)
- Unicorn-62393.exe (PID: 6080)
- Unicorn-14173.exe (PID: 3008)
- Unicorn-21473.exe (PID: 5436)
- Unicorn-15866.exe (PID: 2772)
- Unicorn-64347.exe (PID: 5008)
- Unicorn-34654.exe (PID: 6676)
- Unicorn-44747.exe (PID: 856)
- Unicorn-37860.exe (PID: 5260)
- Unicorn-32955.exe (PID: 5228)
- Unicorn-16612.exe (PID: 4220)
- Unicorn-55893.exe (PID: 5400)
- Unicorn-23037.exe (PID: 2268)
- Unicorn-2634.exe (PID: 3020)
- Unicorn-22500.exe (PID: 1040)
- Unicorn-50398.exe (PID: 2092)
- Unicorn-3158.exe (PID: 5064)
- Unicorn-25572.exe (PID: 6068)
- Unicorn-63335.exe (PID: 5720)
- Unicorn-53205.exe (PID: 2600)
- Unicorn-4353.exe (PID: 1096)
- Unicorn-7153.exe (PID: 7172)
- Unicorn-58215.exe (PID: 7320)
- Unicorn-12475.exe (PID: 7312)
- Unicorn-58955.exe (PID: 7180)
- Unicorn-1894.exe (PID: 7296)
- Unicorn-6331.exe (PID: 7352)
- Unicorn-42730.exe (PID: 7344)
- Unicorn-48215.exe (PID: 7384)
- Unicorn-2019.exe (PID: 7360)
- Unicorn-32990.exe (PID: 7400)
- Unicorn-11374.exe (PID: 7428)
- Unicorn-45927.exe (PID: 7408)
- Unicorn-60104.exe (PID: 7416)
- Unicorn-36201.exe (PID: 7440)
- Unicorn-16981.exe (PID: 7448)
- Unicorn-42590.exe (PID: 7456)
- Unicorn-39259.exe (PID: 7488)
- Unicorn-37374.exe (PID: 7528)
- Unicorn-42980.exe (PID: 7508)
- Unicorn-23114.exe (PID: 7520)
- Unicorn-23638.exe (PID: 7536)
- Unicorn-64609.exe (PID: 7556)
- Unicorn-47191.exe (PID: 7572)
- Unicorn-25697.exe (PID: 7588)
- Unicorn-57191.exe (PID: 7580)
- Unicorn-47710.exe (PID: 7604)
- Unicorn-22509.exe (PID: 7612)
- Unicorn-63460.exe (PID: 7620)
- Unicorn-16242.exe (PID: 7640)
- Unicorn-57330.exe (PID: 7628)
- Unicorn-51571.exe (PID: 7596)
- Unicorn-51297.exe (PID: 7740)
- Unicorn-65474.exe (PID: 7748)
- Unicorn-63189.exe (PID: 7844)
- Unicorn-17396.exe (PID: 7860)
- Unicorn-26599.exe (PID: 7884)
- Unicorn-29684.exe (PID: 7808)
- Unicorn-29130.exe (PID: 7816)
- Unicorn-48225.exe (PID: 7792)
- Unicorn-28606.exe (PID: 7896)
- Unicorn-17907.exe (PID: 7944)
- Unicorn-17907.exe (PID: 8016)
- Unicorn-42223.exe (PID: 8028)
- Unicorn-57938.exe (PID: 8052)
- Unicorn-1617.exe (PID: 8044)
- Unicorn-61010.exe (PID: 8072)
- Unicorn-58343.exe (PID: 8092)
- Unicorn-49413.exe (PID: 8084)
- Unicorn-25051.exe (PID: 8116)
- Unicorn-15675.exe (PID: 8108)
- Unicorn-31059.exe (PID: 8124)
- Unicorn-2637.exe (PID: 8144)
- Unicorn-53997.exe (PID: 8136)
- Unicorn-10473.exe (PID: 8156)
- Unicorn-56410.exe (PID: 8164)
- Unicorn-3679.exe (PID: 8176)
- Unicorn-47588.exe (PID: 8184)
- Unicorn-16359.exe (PID: 1764)
- Unicorn-40644.exe (PID: 7204)
- Unicorn-19800.exe (PID: 4812)
- Unicorn-23277.exe (PID: 4724)
- Unicorn-4439.exe (PID: 1188)
- Unicorn-9954.exe (PID: 5084)
- Unicorn-61756.exe (PID: 7156)
- Unicorn-62034.exe (PID: 4200)
- Unicorn-25444.exe (PID: 3132)
- Unicorn-61899.exe (PID: 8220)
- Unicorn-29880.exe (PID: 8236)
- Unicorn-47830.exe (PID: 8756)
- Unicorn-2158.exe (PID: 8764)
- Unicorn-10097.exe (PID: 8212)
- Unicorn-52449.exe (PID: 8796)
- Unicorn-56030.exe (PID: 8244)
- Unicorn-52818.exe (PID: 8260)
- Unicorn-34671.exe (PID: 8304)
- Unicorn-46674.exe (PID: 8320)
- Unicorn-64852.exe (PID: 8344)
- Unicorn-33857.exe (PID: 5892)
- Unicorn-44007.exe (PID: 8392)
- Unicorn-43742.exe (PID: 8400)
- Unicorn-48103.exe (PID: 6744)
- Unicorn-16769.exe (PID: 8460)
- Unicorn-41418.exe (PID: 3956)
- Unicorn-28242.exe (PID: 8472)
- Unicorn-3046.exe (PID: 968)
- Unicorn-17633.exe (PID: 8536)
- Unicorn-39506.exe (PID: 8544)
- Unicorn-46055.exe (PID: 8552)
- Unicorn-48587.exe (PID: 8560)
- Unicorn-51135.exe (PID: 8568)
- Unicorn-53616.exe (PID: 8588)
- Unicorn-16568.exe (PID: 8596)
- Unicorn-42442.exe (PID: 8604)
- Unicorn-17517.exe (PID: 8620)
- Unicorn-42459.exe (PID: 8648)
- Unicorn-1483.exe (PID: 8676)
- Unicorn-61155.exe (PID: 8684)
- Unicorn-47420.exe (PID: 8708)
- Unicorn-60601.exe (PID: 8724)
- Unicorn-33129.exe (PID: 8736)
- Unicorn-54997.exe (PID: 8816)
- Unicorn-53988.exe (PID: 8880)
- Unicorn-42814.exe (PID: 8892)
- Unicorn-37979.exe (PID: 8964)
- Unicorn-22622.exe (PID: 8484)
- Unicorn-13405.exe (PID: 8496)
- Unicorn-28763.exe (PID: 8980)
- Unicorn-17362.exe (PID: 8992)
- Unicorn-62718.exe (PID: 8692)
- Unicorn-52312.exe (PID: 9016)
- Unicorn-46447.exe (PID: 9024)
- Unicorn-2525.exe (PID: 9040)
- Unicorn-53750.exe (PID: 9064)
- Unicorn-2753.exe (PID: 9008)
- Unicorn-3573.exe (PID: 8268)
- Unicorn-37366.exe (PID: 8672)
- Unicorn-26453.exe (PID: 6640)
- Unicorn-29909.exe (PID: 9164)
- Unicorn-3287.exe (PID: 7020)
- Unicorn-35794.exe (PID: 2192)
- Unicorn-61531.exe (PID: 9276)
- Unicorn-967.exe (PID: 6808)
- Unicorn-47058.exe (PID: 9284)
- Unicorn-14551.exe (PID: 9292)
- Unicorn-52839.exe (PID: 9304)
- Unicorn-26091.exe (PID: 9312)
- Unicorn-5335.exe (PID: 9320)
- Unicorn-64728.exe (PID: 9340)
- Unicorn-3140.exe (PID: 9388)
- Unicorn-3938.exe (PID: 9396)
- Unicorn-55740.exe (PID: 9404)
- Unicorn-55740.exe (PID: 9412)
- Unicorn-50550.exe (PID: 9420)
- Unicorn-5621.exe (PID: 9436)
- Unicorn-49596.exe (PID: 9468)
- Unicorn-21857.exe (PID: 9484)
- Unicorn-10683.exe (PID: 9496)
- Unicorn-23771.exe (PID: 9856)
- Unicorn-20158.exe (PID: 9876)
- Unicorn-48082.exe (PID: 6476)
- Unicorn-39003.exe (PID: 9572)
- Unicorn-27602.exe (PID: 9592)
- Unicorn-7669.exe (PID: 9604)
- Unicorn-4597.exe (PID: 9644)
- Unicorn-29787.exe (PID: 9656)
- Unicorn-65490.exe (PID: 9700)
- Unicorn-36056.exe (PID: 9708)
- Unicorn-49446.exe (PID: 9716)
- Unicorn-6996.exe (PID: 9356)
- Unicorn-19789.exe (PID: 9752)
- Unicorn-36059.exe (PID: 9764)
- Unicorn-26302.exe (PID: 9804)
- Unicorn-62421.exe (PID: 9820)
- Unicorn-23643.exe (PID: 9676)
- Unicorn-37241.exe (PID: 5376)
- Unicorn-42555.exe (PID: 9812)
- Unicorn-45275.exe (PID: 9744)
- Unicorn-15078.exe (PID: 9960)
- Unicorn-30808.exe (PID: 10196)
- Unicorn-64731.exe (PID: 5972)
- Unicorn-21592.exe (PID: 10220)
- Unicorn-30214.exe (PID: 10184)
- Unicorn-35931.exe (PID: 9628)
- Unicorn-40504.exe (PID: 8284)
- Unicorn-36080.exe (PID: 10176)
- Unicorn-54240.exe (PID: 8432)
- Unicorn-37217.exe (PID: 9092)
- Unicorn-34021.exe (PID: 9188)
- Unicorn-45423.exe (PID: 9204)
- Unicorn-27599.exe (PID: 8452)
- Unicorn-19971.exe (PID: 9520)
- Unicorn-1119.exe (PID: 3032)
- Unicorn-12054.exe (PID: 8328)
- Unicorn-20719.exe (PID: 208)
- Unicorn-14854.exe (PID: 2084)
- Unicorn-25819.exe (PID: 10276)
- Unicorn-54082.exe (PID: 10232)
- Unicorn-45671.exe (PID: 9540)
- Unicorn-3100.exe (PID: 10284)
- Unicorn-6493.exe (PID: 10292)
- Unicorn-55237.exe (PID: 10316)
- Unicorn-9565.exe (PID: 10328)
- Unicorn-54713.exe (PID: 10348)
- Unicorn-9918.exe (PID: 10376)
- Unicorn-39876.exe (PID: 10392)
- Unicorn-32249.exe (PID: 10424)
- Unicorn-363.exe (PID: 10300)
- Unicorn-50510.exe (PID: 10444)
- Unicorn-23143.exe (PID: 10460)
- Unicorn-57702.exe (PID: 11040)
- Unicorn-35428.exe (PID: 11008)
- Unicorn-33749.exe (PID: 10472)
- Unicorn-55015.exe (PID: 10492)
- Unicorn-51171.exe (PID: 11080)
- Unicorn-58087.exe (PID: 10516)
- Unicorn-54226.exe (PID: 10524)
- Unicorn-48871.exe (PID: 10532)
- Unicorn-21461.exe (PID: 10540)
- Unicorn-64600.exe (PID: 10552)
- Unicorn-58470.exe (PID: 10560)
- Unicorn-42489.exe (PID: 10576)
- Unicorn-45259.exe (PID: 10584)
- Unicorn-7407.exe (PID: 10600)
- Unicorn-58994.exe (PID: 10592)
- Unicorn-26584.exe (PID: 10640)
- Unicorn-32184.exe (PID: 10648)
- Unicorn-32184.exe (PID: 10656)
- Unicorn-37228.exe (PID: 10664)
- Unicorn-51785.exe (PID: 10672)
- Unicorn-37228.exe (PID: 10680)
- Unicorn-23492.exe (PID: 10632)
- Unicorn-59595.exe (PID: 10688)
- Unicorn-7793.exe (PID: 10708)
- Unicorn-60504.exe (PID: 10812)
- Unicorn-47323.exe (PID: 10820)
- Unicorn-7793.exe (PID: 10700)
- Unicorn-41182.exe (PID: 10780)
- Unicorn-31963.exe (PID: 10864)
- Unicorn-3683.exe (PID: 10908)
- Unicorn-16341.exe (PID: 10940)
- Unicorn-38221.exe (PID: 10508)
- Unicorn-42079.exe (PID: 10948)
- Unicorn-64245.exe (PID: 10436)
- Unicorn-16715.exe (PID: 10976)
- Unicorn-39007.exe (PID: 10988)
- Unicorn-29019.exe (PID: 11100)
- Unicorn-19961.exe (PID: 10500)
- Unicorn-32356.exe (PID: 11116)
- Unicorn-64247.exe (PID: 11144)
- Unicorn-63587.exe (PID: 11208)
- Unicorn-49852.exe (PID: 11200)
- Unicorn-62789.exe (PID: 11216)
- Unicorn-38886.exe (PID: 11244)
- Unicorn-23650.exe (PID: 11228)
- Unicorn-24533.exe (PID: 11252)
- Unicorn-52470.exe (PID: 6468)
- Unicorn-55270.exe (PID: 12292)
- Unicorn-55270.exe (PID: 12304)
- Unicorn-37189.exe (PID: 5988)
- Unicorn-23453.exe (PID: 2416)
- Unicorn-10859.exe (PID: 2692)
- Unicorn-52198.exe (PID: 11312)
- Unicorn-25799.exe (PID: 11336)
- Unicorn-50159.exe (PID: 11356)
- Unicorn-37688.exe (PID: 11348)
- Unicorn-52396.exe (PID: 11396)
- Unicorn-12497.exe (PID: 11484)
- Unicorn-34789.exe (PID: 11588)
- Unicorn-21054.exe (PID: 11604)
- Unicorn-20988.exe (PID: 11636)
- Unicorn-30529.exe (PID: 10768)
- Unicorn-53333.exe (PID: 11612)
- Unicorn-38090.exe (PID: 10800)
- Unicorn-38914.exe (PID: 11680)
- Unicorn-54121.exe (PID: 11692)
- Unicorn-29016.exe (PID: 11728)
- Unicorn-29016.exe (PID: 11720)
- Unicorn-29016.exe (PID: 11736)
- Unicorn-54713.exe (PID: 10356)
- Unicorn-35026.exe (PID: 11808)
- Unicorn-29669.exe (PID: 11752)
- Unicorn-7790.exe (PID: 11816)
- Unicorn-16203.exe (PID: 11836)
- Unicorn-23653.exe (PID: 10384)
- Unicorn-55804.exe (PID: 11860)
- Unicorn-9050.exe (PID: 11884)
- Unicorn-40545.exe (PID: 11872)
- Unicorn-13819.exe (PID: 11892)
- Unicorn-58940.exe (PID: 11912)
- Unicorn-65371.exe (PID: 12016)
- Unicorn-22113.exe (PID: 12036)
- Unicorn-6103.exe (PID: 12048)
- Unicorn-26722.exe (PID: 11136)
- Unicorn-3555.exe (PID: 12028)
- Unicorn-9824.exe (PID: 12112)
- Unicorn-17142.exe (PID: 12124)
- Unicorn-20578.exe (PID: 11184)
- Unicorn-46939.exe (PID: 12152)
- Unicorn-17008.exe (PID: 12144)
- Unicorn-31579.exe (PID: 12196)
- Unicorn-29781.exe (PID: 12272)
- Unicorn-45289.exe (PID: 10568)
- Unicorn-19554.exe (PID: 12244)
- Unicorn-12158.exe (PID: 11428)
- Unicorn-59329.exe (PID: 5232)
- Unicorn-809.exe (PID: 5736)
- Unicorn-9739.exe (PID: 3176)
- Unicorn-57700.exe (PID: 13572)
- Unicorn-55411.exe (PID: 11780)
- Unicorn-5031.exe (PID: 11524)
- Unicorn-7269.exe (PID: 13612)
- Unicorn-35934.exe (PID: 11440)
- Unicorn-29121.exe (PID: 11472)
- Unicorn-63215.exe (PID: 13636)
- Unicorn-56833.exe (PID: 11512)
- Unicorn-41534.exe (PID: 4572)
- Unicorn-17357.exe (PID: 12344)
- Unicorn-11759.exe (PID: 12368)
- Unicorn-36699.exe (PID: 12400)
- Unicorn-39899.exe (PID: 12540)
- Unicorn-27621.exe (PID: 12532)
- Unicorn-6877.exe (PID: 11500)
- Unicorn-24658.exe (PID: 12624)
- Unicorn-57881.exe (PID: 12640)
- Unicorn-27070.exe (PID: 12632)
- Unicorn-30683.exe (PID: 12668)
- Unicorn-15306.exe (PID: 12688)
- Unicorn-40673.exe (PID: 12756)
- Unicorn-1269.exe (PID: 12776)
- Unicorn-37091.exe (PID: 12804)
- Unicorn-51725.exe (PID: 12788)
- Unicorn-34529.exe (PID: 12816)
- Unicorn-43221.exe (PID: 12824)
- Unicorn-38780.exe (PID: 12848)
- Unicorn-65234.exe (PID: 12868)
- Unicorn-54783.exe (PID: 12876)
- Unicorn-5739.exe (PID: 12892)
- Unicorn-46182.exe (PID: 12948)
- Unicorn-62928.exe (PID: 13020)
- Unicorn-17257.exe (PID: 13028)
- Unicorn-21336.exe (PID: 13044)
- Unicorn-55378.exe (PID: 13052)
- Unicorn-29909.exe (PID: 13060)
- Unicorn-43614.exe (PID: 13068)
- Unicorn-9571.exe (PID: 13084)
- Unicorn-49608.exe (PID: 13152)
- Unicorn-48575.exe (PID: 13160)
- Unicorn-43218.exe (PID: 13168)
- Unicorn-2903.exe (PID: 13180)
- Unicorn-39413.exe (PID: 6392)
- Unicorn-40924.exe (PID: 4164)
- Unicorn-12907.exe (PID: 12604)
- Unicorn-10830.exe (PID: 13292)
- Unicorn-45869.exe (PID: 13272)
- Unicorn-46134.exe (PID: 13264)
- Unicorn-26268.exe (PID: 13252)
- Unicorn-31940.exe (PID: 13236)
- Unicorn-31940.exe (PID: 13228)
- Unicorn-44036.exe (PID: 15212)
- Unicorn-25590.exe (PID: 15252)
- Unicorn-45332.exe (PID: 14444)
- Unicorn-33505.exe (PID: 14556)
- Unicorn-36612.exe (PID: 6620)
- Unicorn-51418.exe (PID: 14412)
- Unicorn-21323.exe (PID: 13324)
- Unicorn-21099.exe (PID: 13336)
- Unicorn-10976.exe (PID: 13364)
- Unicorn-37468.exe (PID: 14348)
- Unicorn-62353.exe (PID: 14368)
- Unicorn-29672.exe (PID: 13392)
- Unicorn-47245.exe (PID: 14484)
- Unicorn-51418.exe (PID: 14388)
- Unicorn-53110.exe (PID: 14524)
- Unicorn-8083.exe (PID: 14468)
- Unicorn-48722.exe (PID: 5308)
- Unicorn-16245.exe (PID: 14072)
- Unicorn-888.exe (PID: 15272)
- Unicorn-57071.exe (PID: 13704)
- Unicorn-37875.exe (PID: 14088)
- Unicorn-10380.exe (PID: 14064)
- Unicorn-21480.exe (PID: 12644)
- Unicorn-51592.exe (PID: 14124)
- Unicorn-43064.exe (PID: 14180)
- Unicorn-48618.exe (PID: 14216)
- Unicorn-16383.exe (PID: 5332)
- Unicorn-58711.exe (PID: 14240)
- Unicorn-31347.exe (PID: 14004)
- Unicorn-57069.exe (PID: 14340)
- Unicorn-51204.exe (PID: 4024)
- Unicorn-48404.exe (PID: 6940)
- Unicorn-46435.exe (PID: 13104)
- Unicorn-52028.exe (PID: 13732)
- Unicorn-37491.exe (PID: 13964)
- Unicorn-8195.exe (PID: 13916)
- Unicorn-14325.exe (PID: 13924)
- Unicorn-64094.exe (PID: 13852)
- Unicorn-40330.exe (PID: 13684)
- Unicorn-22123.exe (PID: 12560)
- Unicorn-33509.exe (PID: 14508)
- Unicorn-63215.exe (PID: 13644)
- Unicorn-31826.exe (PID: 13556)
- Unicorn-17224.exe (PID: 13484)
- Unicorn-38902.exe (PID: 14492)
- Unicorn-63161.exe (PID: 13476)
- Unicorn-35210.exe (PID: 13456)
- Unicorn-21474.exe (PID: 13448)
- Unicorn-21474.exe (PID: 13440)
- Unicorn-65153.exe (PID: 14420)
- Unicorn-21474.exe (PID: 13432)
- Unicorn-11841.exe (PID: 13716)
- Unicorn-21474.exe (PID: 13424)
- Unicorn-21474.exe (PID: 13416)
- Unicorn-26715.exe (PID: 13872)
- Unicorn-44445.exe (PID: 14516)
- Unicorn-10321.exe (PID: 13840)
- Unicorn-16884.exe (PID: 13772)
- Unicorn-21474.exe (PID: 13400)
- Unicorn-21474.exe (PID: 13408)
- Unicorn-56582.exe (PID: 14056)
- Unicorn-21323.exe (PID: 13316)
- Unicorn-6005.exe (PID: 5132)
- Unicorn-5481.exe (PID: 14380)
- Unicorn-47245.exe (PID: 14500)
- Unicorn-51418.exe (PID: 14404)
- Unicorn-51418.exe (PID: 14396)
- Unicorn-63084.exe (PID: 12724)
- Unicorn-27909.exe (PID: 14968)
- Unicorn-34157.exe (PID: 15544)
- Unicorn-27228.exe (PID: 15096)
- Unicorn-23753.exe (PID: 15304)
- Unicorn-9094.exe (PID: 15620)
- Unicorn-14959.exe (PID: 15604)
- Unicorn-14959.exe (PID: 15608)
- Unicorn-47094.exe (PID: 15076)
- Unicorn-21474.exe (PID: 14712)
- Unicorn-39413.exe (PID: 14696)
- Unicorn-40964.exe (PID: 15068)
- Unicorn-47094.exe (PID: 15080)
- Unicorn-62182.exe (PID: 14080)
- Unicorn-50166.exe (PID: 15108)
Create files in a temporary directory
- Unicorn-16612.exe (PID: 4220)
- Unicorn-8681.exe (PID: 4620)
- Unicorn-56901.exe (PID: 3304)
- Unicorn-47573.exe (PID: 920)
- Unicorn-22087.exe (PID: 5640)
- Unicorn-58220.exe (PID: 3896)
- Unicorn-14173.exe (PID: 3008)
- Unicorn-62393.exe (PID: 6080)
- 1 (535).exe (PID: 6184)
- Unicorn-21473.exe (PID: 5436)
- Unicorn-15866.exe (PID: 2772)
- Unicorn-44747.exe (PID: 856)
- Unicorn-34654.exe (PID: 6676)
- Unicorn-64350.exe (PID: 2340)
- Unicorn-55893.exe (PID: 5400)
- Unicorn-2634.exe (PID: 3020)
- Unicorn-23037.exe (PID: 2268)
- Unicorn-22500.exe (PID: 1040)
- Unicorn-50398.exe (PID: 2092)
- Unicorn-25572.exe (PID: 6068)
- Unicorn-64347.exe (PID: 5008)
- Unicorn-63335.exe (PID: 5720)
- Unicorn-7153.exe (PID: 7172)
- Unicorn-4353.exe (PID: 1096)
- Unicorn-58955.exe (PID: 7180)
- Unicorn-53205.exe (PID: 2600)
- Unicorn-1894.exe (PID: 7296)
- Unicorn-37860.exe (PID: 5260)
- Unicorn-58215.exe (PID: 7320)
- Unicorn-12475.exe (PID: 7312)
- Unicorn-6331.exe (PID: 7352)
- Unicorn-32955.exe (PID: 5228)
- Unicorn-42730.exe (PID: 7344)
- Unicorn-2019.exe (PID: 7360)
- Unicorn-60104.exe (PID: 7416)
- Unicorn-11374.exe (PID: 7428)
- Unicorn-36201.exe (PID: 7440)
- Unicorn-42590.exe (PID: 7456)
- Unicorn-39259.exe (PID: 7488)
- Unicorn-45927.exe (PID: 7408)
- Unicorn-16981.exe (PID: 7448)
- Unicorn-64609.exe (PID: 7556)
- Unicorn-42980.exe (PID: 7508)
- Unicorn-3158.exe (PID: 5064)
- Unicorn-23638.exe (PID: 7536)
- Unicorn-47191.exe (PID: 7572)
- Unicorn-37374.exe (PID: 7528)
- Unicorn-22509.exe (PID: 7612)
- Unicorn-47710.exe (PID: 7604)
- Unicorn-63189.exe (PID: 7844)
- Unicorn-17396.exe (PID: 7860)
- Unicorn-26599.exe (PID: 7884)
- Unicorn-63460.exe (PID: 7620)
- Unicorn-25697.exe (PID: 7588)
- Unicorn-17907.exe (PID: 7944)
- Unicorn-29130.exe (PID: 7816)
- Unicorn-1617.exe (PID: 8044)
- Unicorn-17907.exe (PID: 8016)
- Unicorn-16242.exe (PID: 7640)
- Unicorn-48215.exe (PID: 7384)
- Unicorn-57330.exe (PID: 7628)
- Unicorn-51571.exe (PID: 7596)
- Unicorn-48225.exe (PID: 7792)
- Unicorn-23114.exe (PID: 7520)
- Unicorn-29684.exe (PID: 7808)
- Unicorn-51297.exe (PID: 7740)
- Unicorn-9954.exe (PID: 5084)
- Unicorn-28606.exe (PID: 7896)
- Unicorn-31059.exe (PID: 8124)
- Unicorn-42223.exe (PID: 8028)
- Unicorn-25051.exe (PID: 8116)
- Unicorn-10473.exe (PID: 8156)
- Unicorn-49413.exe (PID: 8084)
- Unicorn-58343.exe (PID: 8092)
- Unicorn-2637.exe (PID: 8144)
- Unicorn-2158.exe (PID: 8764)
- Unicorn-47830.exe (PID: 8756)
- Unicorn-52449.exe (PID: 8796)
- Unicorn-47588.exe (PID: 8184)
- Unicorn-16359.exe (PID: 1764)
- Unicorn-51135.exe (PID: 8568)
- Unicorn-10097.exe (PID: 8212)
- Unicorn-23277.exe (PID: 4724)
- Unicorn-40644.exe (PID: 7204)
- Unicorn-32990.exe (PID: 7400)
- Unicorn-57938.exe (PID: 8052)
- Unicorn-19800.exe (PID: 4812)
- Unicorn-53988.exe (PID: 8880)
- Unicorn-61010.exe (PID: 8072)
- Unicorn-56030.exe (PID: 8244)
- Unicorn-53750.exe (PID: 9064)
- Unicorn-53997.exe (PID: 8136)
- Unicorn-28763.exe (PID: 8980)
- Unicorn-61155.exe (PID: 8684)
- Unicorn-17517.exe (PID: 8620)
- Unicorn-29880.exe (PID: 8236)
- Unicorn-64852.exe (PID: 8344)
- Unicorn-1483.exe (PID: 8676)
- Unicorn-47420.exe (PID: 8708)
- Unicorn-52818.exe (PID: 8260)
- Unicorn-43742.exe (PID: 8400)
- Unicorn-46674.exe (PID: 8320)
- Unicorn-3046.exe (PID: 968)
- Unicorn-3679.exe (PID: 8176)
- Unicorn-37979.exe (PID: 8964)
- Unicorn-46447.exe (PID: 9024)
- Unicorn-53616.exe (PID: 8588)
- Unicorn-25444.exe (PID: 3132)
- Unicorn-2753.exe (PID: 9008)
- Unicorn-61899.exe (PID: 8220)
- Unicorn-42814.exe (PID: 8892)
- Unicorn-5335.exe (PID: 9320)
- Unicorn-3938.exe (PID: 9396)
- Unicorn-55740.exe (PID: 9404)
- Unicorn-42459.exe (PID: 8648)
- Unicorn-17362.exe (PID: 8992)
- Unicorn-15675.exe (PID: 8108)
- Unicorn-23771.exe (PID: 9856)
- Unicorn-20158.exe (PID: 9876)
- Unicorn-60601.exe (PID: 8724)
- Unicorn-15078.exe (PID: 9960)
- Unicorn-21857.exe (PID: 9484)
- Unicorn-45275.exe (PID: 9744)
- Unicorn-48103.exe (PID: 6744)
- Unicorn-1119.exe (PID: 3032)
- Unicorn-17633.exe (PID: 8536)
- Unicorn-62034.exe (PID: 4200)
- Unicorn-967.exe (PID: 6808)
- Unicorn-52839.exe (PID: 9304)
- Unicorn-26302.exe (PID: 9804)
- Unicorn-14551.exe (PID: 9292)
- Unicorn-36080.exe (PID: 10176)
- Unicorn-4597.exe (PID: 9644)
- Unicorn-35428.exe (PID: 11008)
- Unicorn-57702.exe (PID: 11040)
- Unicorn-52312.exe (PID: 9016)
- Unicorn-9918.exe (PID: 10376)
- Unicorn-62421.exe (PID: 9820)
- Unicorn-51171.exe (PID: 11080)
- Unicorn-42555.exe (PID: 9812)
- Unicorn-48587.exe (PID: 8560)
- Unicorn-16568.exe (PID: 8596)
- Unicorn-19789.exe (PID: 9752)
- Unicorn-33857.exe (PID: 5892)
- Unicorn-41418.exe (PID: 3956)
- Unicorn-47323.exe (PID: 10820)
- Unicorn-46055.exe (PID: 8552)
- Unicorn-6493.exe (PID: 10292)
- Unicorn-6996.exe (PID: 9356)
- Unicorn-35794.exe (PID: 2192)
- Unicorn-39007.exe (PID: 10988)
- Unicorn-36056.exe (PID: 9708)
- Unicorn-50550.exe (PID: 9420)
- Unicorn-25819.exe (PID: 10276)
- Unicorn-27602.exe (PID: 9592)
- Unicorn-36059.exe (PID: 9764)
- Unicorn-19971.exe (PID: 9520)
- Unicorn-37241.exe (PID: 5376)
- Unicorn-52470.exe (PID: 6468)
- Unicorn-55270.exe (PID: 12292)
- Unicorn-37217.exe (PID: 9092)
- Unicorn-21592.exe (PID: 10220)
- Unicorn-28242.exe (PID: 8472)
- Unicorn-3100.exe (PID: 10284)
- Unicorn-48082.exe (PID: 6476)
- Unicorn-40545.exe (PID: 11872)
- Unicorn-47058.exe (PID: 9284)
- Unicorn-21461.exe (PID: 10540)
- Unicorn-4439.exe (PID: 1188)
- Unicorn-54226.exe (PID: 10524)
- Unicorn-29019.exe (PID: 11100)
- Unicorn-26722.exe (PID: 11136)
- Unicorn-64731.exe (PID: 5972)
- Unicorn-62789.exe (PID: 11216)
- Unicorn-65474.exe (PID: 7748)
- Unicorn-57700.exe (PID: 13572)
- Unicorn-16769.exe (PID: 8460)
- Unicorn-29016.exe (PID: 11728)
- Unicorn-37366.exe (PID: 8672)
- Unicorn-7269.exe (PID: 13612)
- Unicorn-35931.exe (PID: 9628)
- Unicorn-55804.exe (PID: 11860)
- Unicorn-9565.exe (PID: 10328)
- Unicorn-54997.exe (PID: 8816)
- Unicorn-16715.exe (PID: 10976)
- Unicorn-33129.exe (PID: 8736)
- Unicorn-34529.exe (PID: 12816)
- Unicorn-10859.exe (PID: 2692)
- Unicorn-22622.exe (PID: 8484)
- Unicorn-42079.exe (PID: 10948)
- Unicorn-64247.exe (PID: 11144)
- Unicorn-44007.exe (PID: 8392)
- Unicorn-57191.exe (PID: 7580)
Reads the computer name
- Unicorn-8681.exe (PID: 4620)
- Unicorn-56901.exe (PID: 3304)
- 1 (535).exe (PID: 6184)
- Unicorn-47573.exe (PID: 920)
- Unicorn-22087.exe (PID: 5640)
- Unicorn-64350.exe (PID: 2340)
- Unicorn-58220.exe (PID: 3896)
- Unicorn-14173.exe (PID: 3008)
- Unicorn-62393.exe (PID: 6080)
- Unicorn-21473.exe (PID: 5436)
- Unicorn-15866.exe (PID: 2772)
- Unicorn-64347.exe (PID: 5008)
- Unicorn-44747.exe (PID: 856)
- Unicorn-34654.exe (PID: 6676)
- Unicorn-37860.exe (PID: 5260)
- Unicorn-32955.exe (PID: 5228)
- Unicorn-55893.exe (PID: 5400)
- Unicorn-16612.exe (PID: 4220)
- Unicorn-2634.exe (PID: 3020)
- Unicorn-22500.exe (PID: 1040)
- Unicorn-23037.exe (PID: 2268)
- Unicorn-3158.exe (PID: 5064)
- Unicorn-25572.exe (PID: 6068)
- Unicorn-50398.exe (PID: 2092)
- Unicorn-1894.exe (PID: 7296)
- Unicorn-63335.exe (PID: 5720)
- Unicorn-4353.exe (PID: 1096)
- Unicorn-7153.exe (PID: 7172)
- Unicorn-58955.exe (PID: 7180)
- Unicorn-53205.exe (PID: 2600)
- Unicorn-12475.exe (PID: 7312)
- Unicorn-58215.exe (PID: 7320)
- Unicorn-6331.exe (PID: 7352)
- Unicorn-42730.exe (PID: 7344)
- Unicorn-2019.exe (PID: 7360)
- Unicorn-48215.exe (PID: 7384)
- Unicorn-32990.exe (PID: 7400)
- Unicorn-60104.exe (PID: 7416)
- Unicorn-11374.exe (PID: 7428)
- Unicorn-36201.exe (PID: 7440)
- Unicorn-42590.exe (PID: 7456)
- Unicorn-39259.exe (PID: 7488)
- Unicorn-45927.exe (PID: 7408)
- Unicorn-16981.exe (PID: 7448)
- Unicorn-64609.exe (PID: 7556)
- Unicorn-42980.exe (PID: 7508)
- Unicorn-47191.exe (PID: 7572)
- Unicorn-57191.exe (PID: 7580)
- Unicorn-23638.exe (PID: 7536)
- Unicorn-37374.exe (PID: 7528)
- Unicorn-22509.exe (PID: 7612)
- Unicorn-47710.exe (PID: 7604)
- Unicorn-63189.exe (PID: 7844)
- Unicorn-17396.exe (PID: 7860)
- Unicorn-26599.exe (PID: 7884)
- Unicorn-25697.exe (PID: 7588)
- Unicorn-17907.exe (PID: 7944)
- Unicorn-29130.exe (PID: 7816)
- Unicorn-1617.exe (PID: 8044)
- Unicorn-17907.exe (PID: 8016)
- Unicorn-16242.exe (PID: 7640)
- Unicorn-57330.exe (PID: 7628)
- Unicorn-51571.exe (PID: 7596)
- Unicorn-48225.exe (PID: 7792)
- Unicorn-23114.exe (PID: 7520)
- Unicorn-29684.exe (PID: 7808)
- Unicorn-51297.exe (PID: 7740)
- Unicorn-42223.exe (PID: 8028)
- Unicorn-49413.exe (PID: 8084)
- Unicorn-9954.exe (PID: 5084)
- Unicorn-65474.exe (PID: 7748)
- Unicorn-28606.exe (PID: 7896)
- Unicorn-31059.exe (PID: 8124)
- Unicorn-25051.exe (PID: 8116)
- Unicorn-2637.exe (PID: 8144)
- Unicorn-10473.exe (PID: 8156)
- Unicorn-47588.exe (PID: 8184)
- Unicorn-63460.exe (PID: 7620)
- Unicorn-58343.exe (PID: 8092)
- Unicorn-2158.exe (PID: 8764)
- Unicorn-47830.exe (PID: 8756)
- Unicorn-52449.exe (PID: 8796)
- Unicorn-51135.exe (PID: 8568)
- Unicorn-16359.exe (PID: 1764)
- Unicorn-57938.exe (PID: 8052)
- Unicorn-10097.exe (PID: 8212)
- Unicorn-23277.exe (PID: 4724)
- Unicorn-40644.exe (PID: 7204)
- Unicorn-53988.exe (PID: 8880)
- Unicorn-61010.exe (PID: 8072)
- Unicorn-56030.exe (PID: 8244)
- Unicorn-53750.exe (PID: 9064)
- Unicorn-53997.exe (PID: 8136)
- Unicorn-28763.exe (PID: 8980)
- Unicorn-1483.exe (PID: 8676)
- Unicorn-61155.exe (PID: 8684)
- Unicorn-17517.exe (PID: 8620)
- Unicorn-29880.exe (PID: 8236)
- Unicorn-64852.exe (PID: 8344)
- Unicorn-47420.exe (PID: 8708)
- Unicorn-46674.exe (PID: 8320)
- Unicorn-52818.exe (PID: 8260)
- Unicorn-19800.exe (PID: 4812)
- Unicorn-43742.exe (PID: 8400)
- Unicorn-3046.exe (PID: 968)
- Unicorn-3679.exe (PID: 8176)
- Unicorn-37979.exe (PID: 8964)
- Unicorn-46447.exe (PID: 9024)
- Unicorn-53616.exe (PID: 8588)
- Unicorn-25444.exe (PID: 3132)
- Unicorn-4439.exe (PID: 1188)
- Unicorn-2753.exe (PID: 9008)
- Unicorn-42459.exe (PID: 8648)
- Unicorn-61899.exe (PID: 8220)
- Unicorn-42814.exe (PID: 8892)
- Unicorn-5335.exe (PID: 9320)
- Unicorn-3938.exe (PID: 9396)
- Unicorn-55740.exe (PID: 9404)
- Unicorn-17362.exe (PID: 8992)
- Unicorn-13405.exe (PID: 8496)
- Unicorn-17633.exe (PID: 8536)
- Unicorn-44007.exe (PID: 8392)
- Unicorn-15675.exe (PID: 8108)
- Unicorn-23771.exe (PID: 9856)
- Unicorn-20158.exe (PID: 9876)
- Unicorn-60601.exe (PID: 8724)
- Unicorn-15078.exe (PID: 9960)
- Unicorn-21857.exe (PID: 9484)
- Unicorn-45275.exe (PID: 9744)
- Unicorn-48103.exe (PID: 6744)
- Unicorn-967.exe (PID: 6808)
- Unicorn-4597.exe (PID: 9644)
- Unicorn-1119.exe (PID: 3032)
- Unicorn-5621.exe (PID: 9436)
- Unicorn-62034.exe (PID: 4200)
- Unicorn-52312.exe (PID: 9016)
- Unicorn-9918.exe (PID: 10376)
- Unicorn-48587.exe (PID: 8560)
- Unicorn-14551.exe (PID: 9292)
- Unicorn-37241.exe (PID: 5376)
- Unicorn-52839.exe (PID: 9304)
- Unicorn-26302.exe (PID: 9804)
- Unicorn-36080.exe (PID: 10176)
- Unicorn-28242.exe (PID: 8472)
- Unicorn-33857.exe (PID: 5892)
- Unicorn-35428.exe (PID: 11008)
- Unicorn-51171.exe (PID: 11080)
- Unicorn-57702.exe (PID: 11040)
- Unicorn-62421.exe (PID: 9820)
- Unicorn-42555.exe (PID: 9812)
- Unicorn-16568.exe (PID: 8596)
- Unicorn-19789.exe (PID: 9752)
- Unicorn-41418.exe (PID: 3956)
- Unicorn-25819.exe (PID: 10276)
- Unicorn-6493.exe (PID: 10292)
- Unicorn-27602.exe (PID: 9592)
- Unicorn-47323.exe (PID: 10820)
- Unicorn-46055.exe (PID: 8552)
- Unicorn-6996.exe (PID: 9356)
- Unicorn-16769.exe (PID: 8460)
- Unicorn-35794.exe (PID: 2192)
- Unicorn-39007.exe (PID: 10988)
- Unicorn-36056.exe (PID: 9708)
- Unicorn-21461.exe (PID: 10540)
- Unicorn-50550.exe (PID: 9420)
- Unicorn-36059.exe (PID: 9764)
- Unicorn-19971.exe (PID: 9520)
- Unicorn-54226.exe (PID: 10524)
- Unicorn-52470.exe (PID: 6468)
- Unicorn-55270.exe (PID: 12292)
- Unicorn-55270.exe (PID: 12304)
- Unicorn-37217.exe (PID: 9092)
- Unicorn-64731.exe (PID: 5972)
- Unicorn-3100.exe (PID: 10284)
- Unicorn-48082.exe (PID: 6476)
- Unicorn-40545.exe (PID: 11872)
- Unicorn-47058.exe (PID: 9284)
- Unicorn-21592.exe (PID: 10220)
- Unicorn-29019.exe (PID: 11100)
- Unicorn-16715.exe (PID: 10976)
- Unicorn-26722.exe (PID: 11136)
- Unicorn-2525.exe (PID: 9040)
- Unicorn-37366.exe (PID: 8672)
- Unicorn-62789.exe (PID: 11216)
- Unicorn-57700.exe (PID: 13572)
- Unicorn-7269.exe (PID: 13612)
- Unicorn-63215.exe (PID: 13636)
- Unicorn-34529.exe (PID: 12816)
- Unicorn-38914.exe (PID: 11680)
- Unicorn-29016.exe (PID: 11728)
- Unicorn-35931.exe (PID: 9628)
- Unicorn-42079.exe (PID: 10948)
- Unicorn-55804.exe (PID: 11860)
- Unicorn-42489.exe (PID: 10576)
- Unicorn-9565.exe (PID: 10328)
- Unicorn-54997.exe (PID: 8816)
- Unicorn-33129.exe (PID: 8736)
- Unicorn-10859.exe (PID: 2692)
- Unicorn-7669.exe (PID: 9604)
- Unicorn-62928.exe (PID: 13020)
- Unicorn-64247.exe (PID: 11144)
- Unicorn-22622.exe (PID: 8484)
- Unicorn-42442.exe (PID: 8604)
- Unicorn-44036.exe (PID: 15212)
- Unicorn-54713.exe (PID: 10348)
- Unicorn-58994.exe (PID: 10592)
- Unicorn-888.exe (PID: 15272)
- Unicorn-25590.exe (PID: 15252)
- Unicorn-5031.exe (PID: 11524)
The sample compiled with chinese language support
- 1 (535).exe (PID: 6184)
- Unicorn-22622.exe (PID: 8484)
- Unicorn-51418.exe (PID: 14404)
- Unicorn-19789.exe (PID: 9752)
- Unicorn-45275.exe (PID: 9744)
- Unicorn-31059.exe (PID: 8124)
- Unicorn-42079.exe (PID: 10948)
- Unicorn-58215.exe (PID: 7320)
- Unicorn-35794.exe (PID: 2192)
- Unicorn-26302.exe (PID: 9804)
- Unicorn-42590.exe (PID: 7456)
- Unicorn-63335.exe (PID: 5720)
- Unicorn-26599.exe (PID: 7884)
- Unicorn-23771.exe (PID: 9856)
- Unicorn-17396.exe (PID: 7860)
- Unicorn-35428.exe (PID: 11008)
- Unicorn-21857.exe (PID: 9484)
- Unicorn-28242.exe (PID: 8472)
- Unicorn-25051.exe (PID: 8116)
- Unicorn-25444.exe (PID: 3132)
- Unicorn-2019.exe (PID: 7360)
- Unicorn-15078.exe (PID: 9960)
- Unicorn-63587.exe (PID: 11208)
- Unicorn-52470.exe (PID: 6468)
- Unicorn-32184.exe (PID: 10648)
- Unicorn-40330.exe (PID: 13684)
- Unicorn-9954.exe (PID: 5084)
- Unicorn-29130.exe (PID: 7816)
- Unicorn-5335.exe (PID: 9320)
- Unicorn-7153.exe (PID: 7172)
- Unicorn-47588.exe (PID: 8184)
- Unicorn-64347.exe (PID: 5008)
- Unicorn-40545.exe (PID: 11872)
- Unicorn-32249.exe (PID: 10424)
- Unicorn-1119.exe (PID: 3032)
- Unicorn-29684.exe (PID: 7808)
- Unicorn-64609.exe (PID: 7556)
- Unicorn-58220.exe (PID: 3896)
- Unicorn-42442.exe (PID: 8604)
- Unicorn-19800.exe (PID: 4812)
- Unicorn-16612.exe (PID: 4220)
- Unicorn-25572.exe (PID: 6068)
- Unicorn-43742.exe (PID: 8400)
- Unicorn-51805.exe (PID: 15756)
- Unicorn-888.exe (PID: 15272)
- Unicorn-57700.exe (PID: 13572)
- Unicorn-63189.exe (PID: 7844)
- Unicorn-47830.exe (PID: 8756)
- Unicorn-2158.exe (PID: 8764)
- Unicorn-8681.exe (PID: 4620)
- Unicorn-1483.exe (PID: 8676)
- Unicorn-5621.exe (PID: 9436)
- Unicorn-62421.exe (PID: 9820)
- Unicorn-3046.exe (PID: 968)
- Unicorn-44747.exe (PID: 856)
- Unicorn-63215.exe (PID: 13636)
- Unicorn-63161.exe (PID: 13476)
- Unicorn-64094.exe (PID: 13852)
- Unicorn-54226.exe (PID: 10524)
- Unicorn-20158.exe (PID: 9876)
- Unicorn-51171.exe (PID: 11080)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 6516)
- BackgroundTransferHost.exe (PID: 4464)
- BackgroundTransferHost.exe (PID: 1184)
- BackgroundTransferHost.exe (PID: 2240)
- BackgroundTransferHost.exe (PID: 2092)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 4464)
- slui.exe (PID: 6736)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 4464)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 4464)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:20 00:32:00+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
658
Monitored processes
525
Malicious processes
88
Suspicious processes
62
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\Users\admin\AppData\Local\Temp\Unicorn-20719.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20719.exe | — | Unicorn-21473.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 856 | C:\Users\admin\AppData\Local\Temp\Unicorn-44747.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-44747.exe | Unicorn-56901.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 920 | C:\Users\admin\AppData\Local\Temp\Unicorn-47573.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-47573.exe | Unicorn-8681.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 968 | C:\Users\admin\AppData\Local\Temp\Unicorn-3046.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3046.exe | Unicorn-22509.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1040 | C:\Users\admin\AppData\Local\Temp\Unicorn-22500.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-22500.exe | Unicorn-21473.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1096 | C:\Users\admin\AppData\Local\Temp\Unicorn-4353.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-4353.exe | 1 (535).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1184 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1188 | C:\Users\admin\AppData\Local\Temp\Unicorn-4439.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-4439.exe | Unicorn-57191.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1764 | C:\Users\admin\AppData\Local\Temp\Unicorn-16359.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-16359.exe | Unicorn-16981.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2084 | C:\Users\admin\AppData\Local\Temp\Unicorn-14854.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-14854.exe | — | Unicorn-11374.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
11 495
Read events
11 480
Write events
15
Delete events
0
Modification events
| (PID) Process: | (6516) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6516) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6516) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (4464) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4464) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4464) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (1184) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (1184) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (1184) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2240) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
784
Suspicious files
5
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4464 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8a1fbf0b-48d7-4e89-991b-c1dabfd90370.down_data | — | |
MD5:— | SHA256:— | |||
| 4464 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8a1fbf0b-48d7-4e89-991b-c1dabfd90370.10e2d935-e2bd-4ebe-93b3-a4a35720bfb9.down_meta | binary | |
MD5:53CDF463C2C38A58E0CC4C625EC70AB4 | SHA256:7D638B50A76B44896D0241FD98036700D0313878F02D156EAF77CC185E9ACB9F | |||
| 4464 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:3DF7FB2746153F81A909F024FFD324C7 | SHA256:38CDAD1FB906C90DEC7A127FA57A607C6801B601FE15FB07169F4687AF3EFEA0 | |||
| 4464 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\727b6bd4-640c-4e67-bc9a-c3be91c94b2f.up_meta_secure | binary | |
MD5:A6B66CAE53EDB6811F9670F902358670 | SHA256:980517266FA2FBA153219CF3DD5B9BA8A8AE975339BD07D97A0B5D7A2348D1E5 | |||
| 4220 | Unicorn-16612.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8681.exe | executable | |
MD5:4B03A2D0FCF288A9443FA6A3D411ADDD | SHA256:D51A2592FD03EB89B5411AC9053FBD6224A4E6AAB182C989B232F92E5BAAF646 | |||
| 4464 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
| 920 | Unicorn-47573.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-14173.exe | executable | |
MD5:1CD2D7F99B3DD73323B8B0FF29F5FAD1 | SHA256:56531A5A5159FD563A53CD7DDFAD84165972E100D7622764E8B74324E224E268 | |||
| 4620 | Unicorn-8681.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-62393.exe | executable | |
MD5:30F23A9D3307358C19A1DEDBAEE120E8 | SHA256:7879D8332FEE722B65C15647E035CE6848135BE6B541D007AFB5BB1BC37D5DA3 | |||
| 6184 | 1 (535).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56901.exe | executable | |
MD5:AA7E8B765BA6572230442ADADE9F0242 | SHA256:1BF236F38807B646A957ED7CED287E459C4E1FC8D59CCF277161CE1F3C2D90F5 | |||
| 6184 | 1 (535).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-16612.exe | executable | |
MD5:77E74FE03D7E9C3A0FBD1EAD5745B091 | SHA256:D1B9FDEF993491B999B07BBAE1CA4544DC86EE2F6D4A7C593DA333754E6FE93C | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
16
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5328 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4464 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
8268 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
8268 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2104 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
3216 | svchost.exe | 20.198.162.78:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | SG | whitelisted |
6544 | svchost.exe | 40.126.32.133:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
2112 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5328 | backgroundTaskHost.exe | 20.223.36.55:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5328 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |