| File name: | 1 (20) |
| Full analysis: | https://app.any.run/tasks/974283af-3372-4a52-84cc-2f97b1e2a9e9 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 16:10:55 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 0C8B385DF9BADE9038E3097AB48FD4A0 |
| SHA1: | 5E0D8A57A2539D0102C9E23FDB726C4A6C817DA2 |
| SHA256: | 7377B7A44DB0CC7C14CB82C7DCAD74872EBAD78DBB01015DC190FE514580EA1B |
| SSDEEP: | 6144:2NEglCgJxDmLA5cqXmSpyESxStrqlp8GBV/0yeXdSk/8SwjwpyAvEhupS/gns6yS:2yoRCLA5pXp1rM+aVMyeXd+x4nxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- 1 (20).exe (PID: 7356)
- Unicorn-64131.exe (PID: 8048)
- Unicorn-56710.exe (PID: 8068)
- Unicorn-59227.exe (PID: 7172)
- Unicorn-1858.exe (PID: 7216)
- Unicorn-17217.exe (PID: 5308)
- Unicorn-5387.exe (PID: 2236)
- Unicorn-50182.exe (PID: 1052)
- Unicorn-36607.exe (PID: 4408)
- Unicorn-58096.exe (PID: 3240)
- Unicorn-50488.exe (PID: 7528)
- Unicorn-48724.exe (PID: 8172)
- Unicorn-48703.exe (PID: 8124)
- Unicorn-25681.exe (PID: 632)
- Unicorn-37048.exe (PID: 6592)
- Unicorn-37048.exe (PID: 6752)
- Unicorn-37048.exe (PID: 4188)
- Unicorn-56050.exe (PID: 1180)
- Unicorn-46399.exe (PID: 920)
- Unicorn-34124.exe (PID: 7276)
- Unicorn-56898.exe (PID: 6040)
- Unicorn-19368.exe (PID: 8096)
- Unicorn-45963.exe (PID: 6392)
- Unicorn-45963.exe (PID: 2284)
- Unicorn-34116.exe (PID: 1072)
- Unicorn-9097.exe (PID: 7696)
- Unicorn-12818.exe (PID: 6768)
- Unicorn-39870.exe (PID: 8004)
- Unicorn-24926.exe (PID: 5376)
- Unicorn-50234.exe (PID: 7928)
- Unicorn-30079.exe (PID: 5304)
- Unicorn-55460.exe (PID: 7972)
- Unicorn-60291.exe (PID: 7956)
- Unicorn-52891.exe (PID: 7788)
- Unicorn-44168.exe (PID: 8008)
- Unicorn-49300.exe (PID: 1240)
- Unicorn-56420.exe (PID: 8028)
- Unicorn-23940.exe (PID: 8044)
- Unicorn-28024.exe (PID: 8116)
- Unicorn-49300.exe (PID: 208)
- Unicorn-51952.exe (PID: 5400)
- Unicorn-23940.exe (PID: 3676)
- Unicorn-40276.exe (PID: 8164)
- Unicorn-45963.exe (PID: 4944)
- Unicorn-18787.exe (PID: 1328)
- Unicorn-18787.exe (PID: 2420)
- Unicorn-4789.exe (PID: 2384)
- Unicorn-4789.exe (PID: 7260)
- Unicorn-56591.exe (PID: 7332)
- Unicorn-462.exe (PID: 5344)
- Unicorn-36607.exe (PID: 4724)
- Unicorn-47530.exe (PID: 7204)
- Unicorn-1989.exe (PID: 7336)
- Unicorn-24324.exe (PID: 5280)
- Unicorn-12517.exe (PID: 2096)
- Unicorn-10985.exe (PID: 7412)
- Unicorn-44635.exe (PID: 6712)
- Unicorn-21008.exe (PID: 7596)
- Unicorn-41236.exe (PID: 6872)
- Unicorn-16924.exe (PID: 7584)
- Unicorn-41236.exe (PID: 4040)
- Unicorn-13808.exe (PID: 7568)
- Unicorn-52611.exe (PID: 5084)
- Unicorn-24577.exe (PID: 3100)
- Unicorn-73.exe (PID: 7636)
- Unicorn-43134.exe (PID: 7556)
- Unicorn-5619.exe (PID: 7728)
- Unicorn-36581.exe (PID: 7644)
- Unicorn-13799.exe (PID: 2644)
- Unicorn-24197.exe (PID: 8212)
- Unicorn-1910.exe (PID: 8316)
- Unicorn-54448.exe (PID: 8256)
- Unicorn-14576.exe (PID: 8340)
- Unicorn-971.exe (PID: 8228)
- Unicorn-12647.exe (PID: 7900)
- Unicorn-36642.exe (PID: 8388)
- Unicorn-9907.exe (PID: 8364)
- Unicorn-9907.exe (PID: 8356)
- Unicorn-44915.exe (PID: 5352)
- Unicorn-22906.exe (PID: 8396)
- Unicorn-43924.exe (PID: 8420)
- Unicorn-56368.exe (PID: 8444)
- Unicorn-59876.exe (PID: 8568)
- Unicorn-11998.exe (PID: 8488)
- Unicorn-34879.exe (PID: 8436)
- Unicorn-59876.exe (PID: 8576)
- Unicorn-35948.exe (PID: 8512)
- Unicorn-11998.exe (PID: 8496)
- Unicorn-49300.exe (PID: 736)
- Unicorn-56347.exe (PID: 8608)
- Unicorn-35948.exe (PID: 8504)
- Unicorn-18787.exe (PID: 2268)
- Unicorn-35564.exe (PID: 8844)
- Unicorn-10867.exe (PID: 8768)
- Unicorn-10654.exe (PID: 7264)
- Unicorn-39990.exe (PID: 7340)
- Unicorn-2699.exe (PID: 8744)
- Unicorn-22051.exe (PID: 8680)
- Unicorn-56347.exe (PID: 8616)
- Unicorn-2185.exe (PID: 8672)
- Unicorn-11422.exe (PID: 8648)
- Unicorn-10867.exe (PID: 8776)
- Unicorn-60068.exe (PID: 8728)
- Unicorn-51708.exe (PID: 8544)
- Unicorn-10867.exe (PID: 8796)
- Unicorn-60068.exe (PID: 8736)
- Unicorn-2699.exe (PID: 8752)
- Unicorn-36292.exe (PID: 8888)
- Unicorn-11754.exe (PID: 8980)
- Unicorn-63258.exe (PID: 8960)
- Unicorn-38562.exe (PID: 8904)
- Unicorn-3586.exe (PID: 8936)
- Unicorn-24826.exe (PID: 8896)
- Unicorn-60458.exe (PID: 8952)
- Unicorn-21562.exe (PID: 7668)
- Unicorn-50255.exe (PID: 9124)
- Unicorn-30601.exe (PID: 8972)
- Unicorn-5889.exe (PID: 8988)
- Unicorn-25004.exe (PID: 9100)
- Unicorn-44547.exe (PID: 9108)
- Unicorn-42388.exe (PID: 1244)
- Unicorn-37841.exe (PID: 9192)
- Unicorn-43898.exe (PID: 9208)
- Unicorn-57292.exe (PID: 9172)
- Unicorn-45595.exe (PID: 9180)
- Unicorn-57499.exe (PID: 1056)
- Unicorn-499.exe (PID: 9116)
- Unicorn-25580.exe (PID: 9280)
- Unicorn-6119.exe (PID: 9344)
- Unicorn-6119.exe (PID: 9336)
- Unicorn-22456.exe (PID: 9316)
- Unicorn-47131.exe (PID: 9400)
- Unicorn-30816.exe (PID: 9356)
- Unicorn-17988.exe (PID: 9432)
- Unicorn-48714.exe (PID: 9424)
- Unicorn-1459.exe (PID: 9416)
- Unicorn-30816.exe (PID: 9360)
- Unicorn-51407.exe (PID: 9476)
- Unicorn-26239.exe (PID: 9508)
- Unicorn-35476.exe (PID: 9552)
- Unicorn-2185.exe (PID: 8664)
- Unicorn-51490.exe (PID: 9536)
- Unicorn-61007.exe (PID: 8468)
- Unicorn-65003.exe (PID: 9632)
- Unicorn-17500.exe (PID: 9568)
- Unicorn-20300.exe (PID: 9584)
- Unicorn-27500.exe (PID: 9672)
- Unicorn-22051.exe (PID: 8688)
- Unicorn-40276.exe (PID: 8176)
- Unicorn-25590.exe (PID: 9720)
- Unicorn-56591.exe (PID: 5576)
- Unicorn-6311.exe (PID: 9752)
- Unicorn-64619.exe (PID: 9812)
- Unicorn-44090.exe (PID: 9844)
- Unicorn-12817.exe (PID: 9804)
- Unicorn-19724.exe (PID: 9712)
- Unicorn-63690.exe (PID: 9852)
- Unicorn-8210.exe (PID: 9884)
- Unicorn-44427.exe (PID: 8912)
- Unicorn-13149.exe (PID: 7688)
- Unicorn-44090.exe (PID: 9836)
- Unicorn-28268.exe (PID: 9928)
- Unicorn-57219.exe (PID: 9956)
- Unicorn-39643.exe (PID: 10012)
- Unicorn-4339.exe (PID: 9992)
- Unicorn-17914.exe (PID: 10108)
- Unicorn-19332.exe (PID: 9640)
- Unicorn-54308.exe (PID: 10136)
- Unicorn-9938.exe (PID: 10172)
- Unicorn-9938.exe (PID: 10164)
- Unicorn-56591.exe (PID: 5048)
- Unicorn-51110.exe (PID: 10044)
- Unicorn-16675.exe (PID: 2616)
- Unicorn-26104.exe (PID: 2560)
- Unicorn-6607.exe (PID: 5972)
- Unicorn-14510.exe (PID: 9264)
- Unicorn-27198.exe (PID: 9096)
- Unicorn-46362.exe (PID: 10292)
- Unicorn-35004.exe (PID: 2192)
- Unicorn-50991.exe (PID: 7320)
- Unicorn-20300.exe (PID: 9580)
- Unicorn-39856.exe (PID: 10320)
- Unicorn-57743.exe (PID: 10204)
- Unicorn-2802.exe (PID: 9920)
- Unicorn-30981.exe (PID: 8264)
- Unicorn-52746.exe (PID: 10360)
- Unicorn-36540.exe (PID: 10420)
- Unicorn-49752.exe (PID: 10468)
- Unicorn-44599.exe (PID: 10476)
- Unicorn-36540.exe (PID: 10412)
- Unicorn-33416.exe (PID: 10488)
- Unicorn-48792.exe (PID: 10428)
- Unicorn-55490.exe (PID: 10544)
- Unicorn-20265.exe (PID: 10532)
- Unicorn-53452.exe (PID: 10516)
Starts itself from another location
- Unicorn-50488.exe (PID: 7528)
- 1 (20).exe (PID: 7356)
- Unicorn-56710.exe (PID: 8068)
- Unicorn-64131.exe (PID: 8048)
- Unicorn-59227.exe (PID: 7172)
- Unicorn-47530.exe (PID: 7204)
- Unicorn-1858.exe (PID: 7216)
- Unicorn-17217.exe (PID: 5308)
- Unicorn-5387.exe (PID: 2236)
- Unicorn-50182.exe (PID: 1052)
- Unicorn-46399.exe (PID: 920)
- Unicorn-36607.exe (PID: 4408)
- Unicorn-56050.exe (PID: 1180)
- Unicorn-462.exe (PID: 5344)
- Unicorn-36607.exe (PID: 4724)
- Unicorn-58096.exe (PID: 3240)
- Unicorn-48724.exe (PID: 8172)
- Unicorn-48703.exe (PID: 8124)
- Unicorn-37048.exe (PID: 4188)
- Unicorn-37048.exe (PID: 6752)
- Unicorn-25681.exe (PID: 632)
- Unicorn-37048.exe (PID: 6592)
- Unicorn-34124.exe (PID: 7276)
- Unicorn-49300.exe (PID: 208)
- Unicorn-19368.exe (PID: 8096)
- Unicorn-49300.exe (PID: 1240)
- Unicorn-39990.exe (PID: 7340)
- Unicorn-45963.exe (PID: 4944)
- Unicorn-45963.exe (PID: 6392)
- Unicorn-56898.exe (PID: 6040)
- Unicorn-49300.exe (PID: 736)
- Unicorn-45963.exe (PID: 2284)
- Unicorn-34116.exe (PID: 1072)
- Unicorn-9097.exe (PID: 7696)
- Unicorn-5619.exe (PID: 7728)
- Unicorn-12818.exe (PID: 6768)
- Unicorn-39870.exe (PID: 8004)
- Unicorn-24926.exe (PID: 5376)
- Unicorn-50234.exe (PID: 7928)
- Unicorn-30079.exe (PID: 5304)
- Unicorn-55460.exe (PID: 7972)
- Unicorn-60291.exe (PID: 7956)
- Unicorn-56420.exe (PID: 8028)
- Unicorn-52891.exe (PID: 7788)
- Unicorn-44915.exe (PID: 5352)
- Unicorn-44168.exe (PID: 8008)
- Unicorn-23940.exe (PID: 8044)
- Unicorn-28024.exe (PID: 8116)
- Unicorn-51952.exe (PID: 5400)
- Unicorn-23940.exe (PID: 3676)
- Unicorn-18787.exe (PID: 1328)
- Unicorn-18787.exe (PID: 2268)
- Unicorn-40276.exe (PID: 8164)
- Unicorn-50991.exe (PID: 7320)
- Unicorn-18787.exe (PID: 2420)
- Unicorn-40276.exe (PID: 8176)
- Unicorn-4789.exe (PID: 2384)
- Unicorn-56591.exe (PID: 5048)
- Unicorn-13149.exe (PID: 7688)
- Unicorn-56591.exe (PID: 5576)
- Unicorn-10654.exe (PID: 7264)
- Unicorn-1989.exe (PID: 7336)
- Unicorn-44635.exe (PID: 6712)
- Unicorn-12517.exe (PID: 2096)
- Unicorn-24324.exe (PID: 5280)
- Unicorn-10985.exe (PID: 7412)
- Unicorn-21008.exe (PID: 7596)
- Unicorn-16924.exe (PID: 7584)
- Unicorn-21562.exe (PID: 7668)
- Unicorn-41236.exe (PID: 4040)
- Unicorn-73.exe (PID: 7636)
- Unicorn-43134.exe (PID: 7556)
- Unicorn-24577.exe (PID: 3100)
- Unicorn-52611.exe (PID: 5084)
- Unicorn-13808.exe (PID: 7568)
- Unicorn-4789.exe (PID: 7260)
- Unicorn-36581.exe (PID: 7644)
- Unicorn-24197.exe (PID: 8212)
- Unicorn-971.exe (PID: 8228)
- Unicorn-1910.exe (PID: 8316)
- Unicorn-54448.exe (PID: 8256)
- Unicorn-14576.exe (PID: 8340)
- Unicorn-9907.exe (PID: 8364)
- Unicorn-12647.exe (PID: 7900)
- Unicorn-13799.exe (PID: 2644)
- Unicorn-36642.exe (PID: 8388)
- Unicorn-43924.exe (PID: 8420)
- Unicorn-56368.exe (PID: 8444)
- Unicorn-2185.exe (PID: 8664)
- Unicorn-22906.exe (PID: 8396)
- Unicorn-59876.exe (PID: 8568)
- Unicorn-61007.exe (PID: 8468)
- Unicorn-34879.exe (PID: 8436)
- Unicorn-59876.exe (PID: 8576)
- Unicorn-11998.exe (PID: 8496)
- Unicorn-56347.exe (PID: 8608)
- Unicorn-35948.exe (PID: 8504)
- Unicorn-35948.exe (PID: 8512)
- Unicorn-35564.exe (PID: 8844)
- Unicorn-10867.exe (PID: 8768)
- Unicorn-2699.exe (PID: 8744)
- Unicorn-22051.exe (PID: 8680)
- Unicorn-56347.exe (PID: 8616)
- Unicorn-10867.exe (PID: 8776)
- Unicorn-2185.exe (PID: 8672)
- Unicorn-2699.exe (PID: 8752)
- Unicorn-51708.exe (PID: 8544)
- Unicorn-10867.exe (PID: 8796)
- Unicorn-60068.exe (PID: 8736)
- Unicorn-60068.exe (PID: 8728)
- Unicorn-11998.exe (PID: 8488)
- Unicorn-36292.exe (PID: 8888)
- Unicorn-11754.exe (PID: 8980)
- Unicorn-63258.exe (PID: 8960)
- Unicorn-38562.exe (PID: 8904)
- Unicorn-44427.exe (PID: 8912)
- Unicorn-3586.exe (PID: 8936)
- Unicorn-24826.exe (PID: 8896)
- Unicorn-56591.exe (PID: 7332)
- Unicorn-60458.exe (PID: 8952)
- Unicorn-41236.exe (PID: 6872)
- Unicorn-50255.exe (PID: 9124)
- Unicorn-30601.exe (PID: 8972)
- Unicorn-5889.exe (PID: 8988)
- Unicorn-25004.exe (PID: 9100)
- Unicorn-44547.exe (PID: 9108)
- Unicorn-42388.exe (PID: 1244)
- Unicorn-37841.exe (PID: 9192)
- Unicorn-11422.exe (PID: 8648)
- Unicorn-45595.exe (PID: 9180)
- Unicorn-57292.exe (PID: 9172)
- Unicorn-57499.exe (PID: 1056)
- Unicorn-499.exe (PID: 9116)
- Unicorn-25580.exe (PID: 9280)
- Unicorn-43898.exe (PID: 9208)
- Unicorn-22456.exe (PID: 9316)
- Unicorn-9907.exe (PID: 8356)
- Unicorn-6119.exe (PID: 9344)
- Unicorn-6119.exe (PID: 9336)
- Unicorn-30816.exe (PID: 9360)
- Unicorn-30816.exe (PID: 9356)
- Unicorn-47131.exe (PID: 9400)
- Unicorn-17988.exe (PID: 9432)
- Unicorn-1459.exe (PID: 9416)
- Unicorn-48714.exe (PID: 9424)
- Unicorn-51407.exe (PID: 9476)
- Unicorn-26239.exe (PID: 9508)
- Unicorn-35476.exe (PID: 9552)
- Unicorn-51490.exe (PID: 9536)
- Unicorn-19332.exe (PID: 9640)
- Unicorn-20300.exe (PID: 9580)
- Unicorn-17500.exe (PID: 9568)
- Unicorn-22051.exe (PID: 8688)
- Unicorn-25590.exe (PID: 9720)
- Unicorn-20300.exe (PID: 9584)
- Unicorn-27500.exe (PID: 9672)
- Unicorn-19724.exe (PID: 9712)
- Unicorn-64619.exe (PID: 9812)
- Unicorn-44090.exe (PID: 9844)
- Unicorn-6311.exe (PID: 9752)
- Unicorn-12817.exe (PID: 9804)
- Unicorn-44090.exe (PID: 9836)
- Unicorn-63690.exe (PID: 9852)
- Unicorn-2802.exe (PID: 9920)
- Unicorn-8210.exe (PID: 9884)
- Unicorn-28268.exe (PID: 9928)
- Unicorn-4339.exe (PID: 9992)
- Unicorn-39643.exe (PID: 10012)
- Unicorn-57219.exe (PID: 9956)
- Unicorn-17914.exe (PID: 10108)
- Unicorn-54308.exe (PID: 10136)
- Unicorn-9938.exe (PID: 10172)
- Unicorn-9938.exe (PID: 10164)
- Unicorn-51110.exe (PID: 10044)
INFO
Checks supported languages
- 1 (20).exe (PID: 7356)
- Unicorn-50488.exe (PID: 7528)
- Unicorn-56710.exe (PID: 8068)
- Unicorn-59227.exe (PID: 7172)
- Unicorn-64131.exe (PID: 8048)
- Unicorn-1858.exe (PID: 7216)
- Unicorn-47530.exe (PID: 7204)
- Unicorn-17217.exe (PID: 5308)
- Unicorn-50182.exe (PID: 1052)
- Unicorn-58096.exe (PID: 3240)
- Unicorn-46399.exe (PID: 920)
- Unicorn-36607.exe (PID: 4408)
- Unicorn-56050.exe (PID: 1180)
- Unicorn-462.exe (PID: 5344)
- Unicorn-37048.exe (PID: 4188)
- Unicorn-49300.exe (PID: 1240)
- Unicorn-49300.exe (PID: 736)
- Unicorn-34124.exe (PID: 7276)
- Unicorn-56898.exe (PID: 6040)
- Unicorn-45963.exe (PID: 6392)
- Unicorn-45963.exe (PID: 4944)
- Unicorn-5387.exe (PID: 2236)
- Unicorn-45963.exe (PID: 2284)
- Unicorn-34116.exe (PID: 1072)
- Unicorn-36607.exe (PID: 4724)
- Unicorn-25681.exe (PID: 632)
- Unicorn-5619.exe (PID: 7728)
- Unicorn-30079.exe (PID: 5304)
- Unicorn-24926.exe (PID: 5376)
- Unicorn-44915.exe (PID: 5352)
- Unicorn-40276.exe (PID: 8164)
- Unicorn-13149.exe (PID: 7688)
- Unicorn-56591.exe (PID: 7332)
- Unicorn-40276.exe (PID: 8176)
- Unicorn-12517.exe (PID: 2096)
- Unicorn-10985.exe (PID: 7412)
- Unicorn-56591.exe (PID: 5048)
- Unicorn-4789.exe (PID: 7260)
- Unicorn-24577.exe (PID: 3100)
- Unicorn-13808.exe (PID: 7568)
- Unicorn-21562.exe (PID: 7668)
- Unicorn-42388.exe (PID: 1244)
- Unicorn-13799.exe (PID: 2644)
- Unicorn-9907.exe (PID: 8356)
- Unicorn-971.exe (PID: 8228)
- Unicorn-9907.exe (PID: 8364)
- Unicorn-22906.exe (PID: 8396)
- Unicorn-43924.exe (PID: 8420)
- Unicorn-59876.exe (PID: 8568)
- Unicorn-56347.exe (PID: 8608)
- Unicorn-11422.exe (PID: 8648)
- Unicorn-2185.exe (PID: 8664)
- Unicorn-60068.exe (PID: 8728)
- Unicorn-2699.exe (PID: 8752)
- Unicorn-22051.exe (PID: 8680)
- Unicorn-60068.exe (PID: 8736)
- Unicorn-22051.exe (PID: 8688)
- Unicorn-36292.exe (PID: 8888)
- Unicorn-60458.exe (PID: 8952)
- Unicorn-24826.exe (PID: 8896)
- Unicorn-44427.exe (PID: 8912)
- Unicorn-5889.exe (PID: 8988)
- Unicorn-30601.exe (PID: 8972)
- Unicorn-63258.exe (PID: 8960)
- Unicorn-10867.exe (PID: 8796)
- Unicorn-25004.exe (PID: 9100)
- Unicorn-44547.exe (PID: 9108)
- Unicorn-25580.exe (PID: 9280)
- Unicorn-22456.exe (PID: 9316)
- Unicorn-30816.exe (PID: 9356)
- Unicorn-6119.exe (PID: 9344)
- Unicorn-37841.exe (PID: 9192)
- Unicorn-43898.exe (PID: 9208)
- Unicorn-51490.exe (PID: 9536)
- Unicorn-17988.exe (PID: 9432)
- Unicorn-20300.exe (PID: 9584)
- Unicorn-2699.exe (PID: 8744)
- Unicorn-64619.exe (PID: 9812)
- Unicorn-35476.exe (PID: 9552)
- Unicorn-17500.exe (PID: 9568)
- Unicorn-19332.exe (PID: 9640)
- Unicorn-19724.exe (PID: 9712)
- Unicorn-25590.exe (PID: 9720)
- Unicorn-2802.exe (PID: 9920)
- Unicorn-57219.exe (PID: 9956)
- Unicorn-4339.exe (PID: 9992)
- Unicorn-39643.exe (PID: 10012)
- Unicorn-51110.exe (PID: 10044)
- Unicorn-54308.exe (PID: 10136)
- Unicorn-44090.exe (PID: 9844)
- Unicorn-63690.exe (PID: 9852)
- Unicorn-8210.exe (PID: 9884)
- Unicorn-16675.exe (PID: 2616)
- Unicorn-6607.exe (PID: 5972)
- Unicorn-46362.exe (PID: 10292)
- Unicorn-39856.exe (PID: 10320)
- Unicorn-52746.exe (PID: 10360)
- Unicorn-27198.exe (PID: 9096)
- Unicorn-55490.exe (PID: 10544)
- Unicorn-49368.exe (PID: 10524)
- Unicorn-59435.exe (PID: 10712)
- Unicorn-7633.exe (PID: 10720)
- Unicorn-32329.exe (PID: 10768)
- Unicorn-30100.exe (PID: 10752)
- Unicorn-42906.exe (PID: 10688)
- Unicorn-8610.exe (PID: 10776)
- Unicorn-35345.exe (PID: 10816)
- Unicorn-54474.exe (PID: 10948)
- Unicorn-23604.exe (PID: 11068)
- Unicorn-21609.exe (PID: 10812)
- Unicorn-34053.exe (PID: 10844)
- Unicorn-13339.exe (PID: 11084)
- Unicorn-29908.exe (PID: 11116)
- Unicorn-21474.exe (PID: 11100)
- Unicorn-59191.exe (PID: 11180)
- Unicorn-63540.exe (PID: 11188)
- Unicorn-62663.exe (PID: 11216)
- Unicorn-61811.exe (PID: 11108)
- Unicorn-35144.exe (PID: 11276)
- Unicorn-63156.exe (PID: 11304)
- Unicorn-60011.exe (PID: 11344)
- Unicorn-43888.exe (PID: 11392)
- Unicorn-47899.exe (PID: 11476)
- Unicorn-47650.exe (PID: 11440)
- Unicorn-10831.exe (PID: 11536)
- Unicorn-44656.exe (PID: 11576)
- Unicorn-44599.exe (PID: 10476)
- Unicorn-36540.exe (PID: 10412)
- Unicorn-14021.exe (PID: 11596)
- Unicorn-65268.exe (PID: 11640)
- Unicorn-30549.exe (PID: 11708)
- Unicorn-36415.exe (PID: 11724)
- Unicorn-48911.exe (PID: 11768)
- Unicorn-56524.exe (PID: 11756)
- Unicorn-30549.exe (PID: 11700)
- Unicorn-15361.exe (PID: 11844)
- Unicorn-40438.exe (PID: 11884)
- Unicorn-36993.exe (PID: 11988)
- Unicorn-33424.exe (PID: 12040)
- Unicorn-13558.exe (PID: 12032)
- Unicorn-53844.exe (PID: 12092)
- Unicorn-30549.exe (PID: 11716)
- Unicorn-36859.exe (PID: 12220)
- Unicorn-51414.exe (PID: 12252)
- Unicorn-44586.exe (PID: 12112)
- Unicorn-58099.exe (PID: 12184)
- Unicorn-12625.exe (PID: 10332)
- Unicorn-56074.exe (PID: 12380)
- Unicorn-38861.exe (PID: 12420)
- Unicorn-36060.exe (PID: 12412)
- Unicorn-38861.exe (PID: 12428)
- Unicorn-21290.exe (PID: 4896)
- Unicorn-27760.exe (PID: 12556)
- Unicorn-51659.exe (PID: 12496)
- Unicorn-22878.exe (PID: 12596)
- Unicorn-39547.exe (PID: 12684)
- Unicorn-34659.exe (PID: 12700)
- Unicorn-10071.exe (PID: 12512)
- Unicorn-49687.exe (PID: 13016)
- Unicorn-52070.exe (PID: 12892)
- Unicorn-3253.exe (PID: 13036)
- Unicorn-60298.exe (PID: 13096)
- Unicorn-28520.exe (PID: 13056)
- Unicorn-4517.exe (PID: 12732)
- Unicorn-13335.exe (PID: 13188)
- Unicorn-62536.exe (PID: 13248)
- Unicorn-60891.exe (PID: 13256)
- Unicorn-7798.exe (PID: 6228)
- Unicorn-9697.exe (PID: 13328)
- Unicorn-29864.exe (PID: 13360)
- Unicorn-23925.exe (PID: 13412)
- Unicorn-31172.exe (PID: 13440)
- Unicorn-7414.exe (PID: 13496)
- Unicorn-7414.exe (PID: 13488)
- Unicorn-14259.exe (PID: 13556)
- Unicorn-39148.exe (PID: 13664)
- Unicorn-64207.exe (PID: 13596)
- Unicorn-22812.exe (PID: 13608)
- Unicorn-33977.exe (PID: 13724)
- Unicorn-64482.exe (PID: 13876)
- Unicorn-20242.exe (PID: 13708)
- Unicorn-36859.exe (PID: 12228)
- Unicorn-22812.exe (PID: 13604)
- Unicorn-54206.exe (PID: 14112)
- Unicorn-6859.exe (PID: 13996)
- Unicorn-19038.exe (PID: 14176)
- Unicorn-6786.exe (PID: 14136)
- Unicorn-5909.exe (PID: 14200)
- Unicorn-54206.exe (PID: 14116)
- Unicorn-53137.exe (PID: 14144)
- Unicorn-38254.exe (PID: 13900)
- Unicorn-59075.exe (PID: 14008)
- Unicorn-46038.exe (PID: 14316)
- Unicorn-40553.exe (PID: 14492)
- Unicorn-52168.exe (PID: 14332)
- Unicorn-46038.exe (PID: 14292)
- Unicorn-46038.exe (PID: 14308)
- Unicorn-46038.exe (PID: 14324)
- Unicorn-13256.exe (PID: 14448)
- Unicorn-25646.exe (PID: 14536)
- Unicorn-47317.exe (PID: 14556)
- Unicorn-64674.exe (PID: 14592)
- Unicorn-48090.exe (PID: 14624)
- Unicorn-45323.exe (PID: 14660)
- Unicorn-64975.exe (PID: 14188)
- Unicorn-54206.exe (PID: 14128)
- Unicorn-56258.exe (PID: 14652)
- Unicorn-59634.exe (PID: 14964)
- Unicorn-27363.exe (PID: 14792)
- Unicorn-19771.exe (PID: 15024)
- Unicorn-14517.exe (PID: 14992)
- Unicorn-59826.exe (PID: 15076)
- Unicorn-206.exe (PID: 14688)
- Unicorn-31621.exe (PID: 14924)
- Unicorn-50772.exe (PID: 15232)
- Unicorn-42028.exe (PID: 15292)
- Unicorn-1187.exe (PID: 15320)
- Unicorn-47819.exe (PID: 15368)
- Unicorn-30051.exe (PID: 15592)
- Unicorn-34396.exe (PID: 15680)
- Unicorn-36666.exe (PID: 15664)
- Unicorn-49110.exe (PID: 15772)
- Unicorn-48587.exe (PID: 15784)
- Unicorn-11062.exe (PID: 15404)
- Unicorn-9993.exe (PID: 15432)
- Unicorn-20928.exe (PID: 15448)
- Unicorn-42915.exe (PID: 15424)
- Unicorn-37242.exe (PID: 15564)
- Unicorn-2299.exe (PID: 16016)
- Unicorn-24688.exe (PID: 15984)
- Unicorn-35131.exe (PID: 16076)
- Unicorn-46878.exe (PID: 16132)
- Unicorn-52479.exe (PID: 16140)
- Unicorn-48971.exe (PID: 16304)
- Unicorn-52811.exe (PID: 16272)
- Unicorn-3034.exe (PID: 16312)
- Unicorn-26653.exe (PID: 16364)
- Unicorn-50454.exe (PID: 16360)
- Unicorn-23205.exe (PID: 15884)
- Unicorn-31623.exe (PID: 15928)
- Unicorn-58669.exe (PID: 16504)
- Unicorn-53622.exe (PID: 16528)
- Unicorn-33315.exe (PID: 16628)
- Unicorn-18950.exe (PID: 16680)
- Unicorn-28300.exe (PID: 16792)
- Unicorn-2058.exe (PID: 16884)
- Unicorn-14949.exe (PID: 17160)
- Unicorn-64726.exe (PID: 16416)
- Unicorn-28463.exe (PID: 16476)
- Unicorn-6069.exe (PID: 16460)
- Unicorn-28654.exe (PID: 17132)
- Unicorn-35884.exe (PID: 17220)
- Unicorn-6341.exe (PID: 17192)
- Unicorn-63578.exe (PID: 17320)
- Unicorn-33698.exe (PID: 17372)
- Unicorn-34030.exe (PID: 14884)
Reads the computer name
- 1 (20).exe (PID: 7356)
- Unicorn-50488.exe (PID: 7528)
- Unicorn-56710.exe (PID: 8068)
- Unicorn-64131.exe (PID: 8048)
- Unicorn-47530.exe (PID: 7204)
- Unicorn-1858.exe (PID: 7216)
- Unicorn-17217.exe (PID: 5308)
- Unicorn-5387.exe (PID: 2236)
- Unicorn-50182.exe (PID: 1052)
- Unicorn-46399.exe (PID: 920)
- Unicorn-462.exe (PID: 5344)
- Unicorn-58096.exe (PID: 3240)
- Unicorn-56050.exe (PID: 1180)
- Unicorn-36607.exe (PID: 4724)
- Unicorn-48724.exe (PID: 8172)
- Unicorn-37048.exe (PID: 6592)
- Unicorn-37048.exe (PID: 6752)
- Unicorn-49300.exe (PID: 1240)
- Unicorn-49300.exe (PID: 736)
- Unicorn-49300.exe (PID: 208)
- Unicorn-56898.exe (PID: 6040)
- Unicorn-45963.exe (PID: 6392)
- Unicorn-34116.exe (PID: 1072)
- Unicorn-55460.exe (PID: 7972)
- Unicorn-39990.exe (PID: 7340)
- Unicorn-9097.exe (PID: 7696)
- Unicorn-56420.exe (PID: 8028)
- Unicorn-44168.exe (PID: 8008)
- Unicorn-23940.exe (PID: 3676)
- Unicorn-18787.exe (PID: 2268)
- Unicorn-52891.exe (PID: 7788)
- Unicorn-4789.exe (PID: 2384)
- Unicorn-10654.exe (PID: 7264)
- Unicorn-44635.exe (PID: 6712)
- Unicorn-24926.exe (PID: 5376)
- Unicorn-30079.exe (PID: 5304)
- Unicorn-18787.exe (PID: 1328)
- Unicorn-12647.exe (PID: 7900)
- Unicorn-13808.exe (PID: 7568)
- Unicorn-73.exe (PID: 7636)
- Unicorn-54448.exe (PID: 8256)
- Unicorn-14576.exe (PID: 8340)
- Unicorn-9907.exe (PID: 8364)
- Unicorn-2185.exe (PID: 8664)
- Unicorn-59876.exe (PID: 8568)
- Unicorn-34879.exe (PID: 8436)
- Unicorn-56368.exe (PID: 8444)
- Unicorn-2699.exe (PID: 8744)
- Unicorn-22051.exe (PID: 8688)
- Unicorn-10867.exe (PID: 8776)
- Unicorn-56347.exe (PID: 8616)
- Unicorn-51708.exe (PID: 8544)
- Unicorn-60458.exe (PID: 8952)
- Unicorn-3586.exe (PID: 8936)
- Unicorn-50255.exe (PID: 9124)
- Unicorn-57292.exe (PID: 9172)
- Unicorn-51490.exe (PID: 9536)
- Unicorn-47131.exe (PID: 9400)
- Unicorn-48714.exe (PID: 9424)
- Unicorn-19332.exe (PID: 9640)
- Unicorn-27500.exe (PID: 9672)
- Unicorn-20300.exe (PID: 9584)
- Unicorn-44090.exe (PID: 9836)
- Unicorn-2802.exe (PID: 9920)
- Unicorn-57219.exe (PID: 9956)
- Unicorn-39643.exe (PID: 10012)
Create files in a temporary directory
- 1 (20).exe (PID: 7356)
- Unicorn-1858.exe (PID: 7216)
- Unicorn-50488.exe (PID: 7528)
- Unicorn-59227.exe (PID: 7172)
- Unicorn-36607.exe (PID: 4408)
- Unicorn-64131.exe (PID: 8048)
- Unicorn-48724.exe (PID: 8172)
- Unicorn-5387.exe (PID: 2236)
- Unicorn-50182.exe (PID: 1052)
- Unicorn-37048.exe (PID: 6752)
- Unicorn-34124.exe (PID: 7276)
- Unicorn-58096.exe (PID: 3240)
- Unicorn-34116.exe (PID: 1072)
- Unicorn-12818.exe (PID: 6768)
- Unicorn-48703.exe (PID: 8124)
- Unicorn-39870.exe (PID: 8004)
- Unicorn-37048.exe (PID: 6592)
- Unicorn-60291.exe (PID: 7956)
- Unicorn-56420.exe (PID: 8028)
- Unicorn-52891.exe (PID: 7788)
- Unicorn-56050.exe (PID: 1180)
- Unicorn-44168.exe (PID: 8008)
- Unicorn-37048.exe (PID: 4188)
- Unicorn-28024.exe (PID: 8116)
- Unicorn-49300.exe (PID: 208)
- Unicorn-49300.exe (PID: 1240)
- Unicorn-46399.exe (PID: 920)
- Unicorn-18787.exe (PID: 1328)
- Unicorn-45963.exe (PID: 4944)
- Unicorn-45963.exe (PID: 6392)
- Unicorn-56591.exe (PID: 7332)
- Unicorn-56710.exe (PID: 8068)
- Unicorn-47530.exe (PID: 7204)
- Unicorn-17217.exe (PID: 5308)
- Unicorn-36607.exe (PID: 4724)
- Unicorn-1989.exe (PID: 7336)
- Unicorn-24324.exe (PID: 5280)
- Unicorn-9097.exe (PID: 7696)
- Unicorn-10985.exe (PID: 7412)
- Unicorn-41236.exe (PID: 4040)
- Unicorn-21008.exe (PID: 7596)
- Unicorn-43134.exe (PID: 7556)
- Unicorn-25681.exe (PID: 632)
- Unicorn-50234.exe (PID: 7928)
- Unicorn-73.exe (PID: 7636)
- Unicorn-19368.exe (PID: 8096)
- Unicorn-54448.exe (PID: 8256)
- Unicorn-1910.exe (PID: 8316)
- Unicorn-12647.exe (PID: 7900)
- Unicorn-36642.exe (PID: 8388)
- Unicorn-9907.exe (PID: 8364)
- Unicorn-9907.exe (PID: 8356)
- Unicorn-22906.exe (PID: 8396)
- Unicorn-43924.exe (PID: 8420)
- Unicorn-56368.exe (PID: 8444)
- Unicorn-59876.exe (PID: 8568)
- Unicorn-51952.exe (PID: 5400)
- Unicorn-11998.exe (PID: 8488)
- Unicorn-34879.exe (PID: 8436)
- Unicorn-59876.exe (PID: 8576)
- Unicorn-35948.exe (PID: 8512)
- Unicorn-56347.exe (PID: 8608)
- Unicorn-45963.exe (PID: 2284)
- Unicorn-35948.exe (PID: 8504)
- Unicorn-23940.exe (PID: 3676)
- Unicorn-40276.exe (PID: 8164)
- Unicorn-18787.exe (PID: 2268)
- Unicorn-49300.exe (PID: 736)
- Unicorn-18787.exe (PID: 2420)
- Unicorn-10867.exe (PID: 8768)
- Unicorn-4789.exe (PID: 2384)
- Unicorn-4789.exe (PID: 7260)
- Unicorn-35564.exe (PID: 8844)
- Unicorn-56898.exe (PID: 6040)
- Unicorn-2699.exe (PID: 8744)
- Unicorn-462.exe (PID: 5344)
- Unicorn-11422.exe (PID: 8648)
- Unicorn-10867.exe (PID: 8776)
- Unicorn-60068.exe (PID: 8728)
- Unicorn-2699.exe (PID: 8752)
- Unicorn-12517.exe (PID: 2096)
- Unicorn-60068.exe (PID: 8736)
- Unicorn-36292.exe (PID: 8888)
- Unicorn-63258.exe (PID: 8960)
- Unicorn-13149.exe (PID: 7688)
- Unicorn-60458.exe (PID: 8952)
- Unicorn-38562.exe (PID: 8904)
- Unicorn-3586.exe (PID: 8936)
- Unicorn-24826.exe (PID: 8896)
- Unicorn-24577.exe (PID: 3100)
- Unicorn-13808.exe (PID: 7568)
- Unicorn-50255.exe (PID: 9124)
- Unicorn-44547.exe (PID: 9108)
- Unicorn-5619.exe (PID: 7728)
- Unicorn-24926.exe (PID: 5376)
- Unicorn-45595.exe (PID: 9180)
- Unicorn-36581.exe (PID: 7644)
- Unicorn-37841.exe (PID: 9192)
- Unicorn-30079.exe (PID: 5304)
- Unicorn-971.exe (PID: 8228)
- Unicorn-25580.exe (PID: 9280)
- Unicorn-43898.exe (PID: 9208)
- Unicorn-57499.exe (PID: 1056)
- Unicorn-22456.exe (PID: 9316)
- Unicorn-13799.exe (PID: 2644)
- Unicorn-30816.exe (PID: 9356)
- Unicorn-1459.exe (PID: 9416)
- Unicorn-23940.exe (PID: 8044)
- Unicorn-35476.exe (PID: 9552)
- Unicorn-2185.exe (PID: 8664)
- Unicorn-65003.exe (PID: 9632)
- Unicorn-61007.exe (PID: 8468)
- Unicorn-22051.exe (PID: 8688)
- Unicorn-56347.exe (PID: 8616)
- Unicorn-19724.exe (PID: 9712)
- Unicorn-2185.exe (PID: 8672)
- Unicorn-8210.exe (PID: 9884)
- Unicorn-16924.exe (PID: 7584)
- Unicorn-30601.exe (PID: 8972)
- Unicorn-25004.exe (PID: 9100)
- Unicorn-28268.exe (PID: 9928)
- Unicorn-55460.exe (PID: 7972)
- Unicorn-52611.exe (PID: 5084)
- Unicorn-48714.exe (PID: 9424)
The sample compiled with chinese language support
- 1 (20).exe (PID: 7356)
- Unicorn-38562.exe (PID: 8904)
- Unicorn-2802.exe (PID: 9920)
- Unicorn-3586.exe (PID: 8936)
- Unicorn-60458.exe (PID: 8952)
- Unicorn-5889.exe (PID: 8988)
- Unicorn-41236.exe (PID: 6872)
- Unicorn-16924.exe (PID: 7584)
- Unicorn-1858.exe (PID: 7216)
- Unicorn-21562.exe (PID: 7668)
- Unicorn-17217.exe (PID: 5308)
- Unicorn-12818.exe (PID: 6768)
- Unicorn-50255.exe (PID: 9124)
- Unicorn-30601.exe (PID: 8972)
- Unicorn-43134.exe (PID: 7556)
- Unicorn-52746.exe (PID: 10360)
- Unicorn-50234.exe (PID: 7928)
- Unicorn-13149.exe (PID: 7688)
- Unicorn-4789.exe (PID: 7260)
- Unicorn-21008.exe (PID: 7596)
- Unicorn-24577.exe (PID: 3100)
- Unicorn-25681.exe (PID: 632)
- Unicorn-59227.exe (PID: 7172)
- Unicorn-50182.exe (PID: 1052)
- Unicorn-37048.exe (PID: 6592)
- Unicorn-24926.exe (PID: 5376)
- Unicorn-48703.exe (PID: 8124)
- Unicorn-42388.exe (PID: 1244)
- Unicorn-45595.exe (PID: 9180)
- Unicorn-24197.exe (PID: 8212)
- Unicorn-19368.exe (PID: 8096)
- Unicorn-37841.exe (PID: 9192)
- Unicorn-39870.exe (PID: 8004)
- Unicorn-52611.exe (PID: 5084)
- Unicorn-25004.exe (PID: 9100)
- Unicorn-5619.exe (PID: 7728)
- Unicorn-73.exe (PID: 7636)
- Unicorn-36607.exe (PID: 4408)
- Unicorn-30079.exe (PID: 5304)
- Unicorn-57219.exe (PID: 9956)
- Unicorn-36540.exe (PID: 10420)
- Unicorn-64131.exe (PID: 8048)
- Unicorn-43898.exe (PID: 9208)
- Unicorn-971.exe (PID: 8228)
- Unicorn-1910.exe (PID: 8316)
- Unicorn-56420.exe (PID: 8028)
- Unicorn-57499.exe (PID: 1056)
- Unicorn-12647.exe (PID: 7900)
- Unicorn-54448.exe (PID: 8256)
- Unicorn-65003.exe (PID: 9632)
- Unicorn-57292.exe (PID: 9172)
- Unicorn-55460.exe (PID: 7972)
- Unicorn-14576.exe (PID: 8340)
- Unicorn-4339.exe (PID: 9992)
- Unicorn-36642.exe (PID: 8388)
- Unicorn-44599.exe (PID: 10476)
- Unicorn-49752.exe (PID: 10468)
- Unicorn-16675.exe (PID: 2616)
- Unicorn-26104.exe (PID: 2560)
- Unicorn-46399.exe (PID: 920)
- Unicorn-39643.exe (PID: 10012)
- Unicorn-9907.exe (PID: 8356)
- Unicorn-25580.exe (PID: 9280)
- Unicorn-37048.exe (PID: 6752)
- Unicorn-52891.exe (PID: 7788)
- Unicorn-56050.exe (PID: 1180)
- Unicorn-22456.exe (PID: 9316)
- Unicorn-6119.exe (PID: 9336)
- Unicorn-6607.exe (PID: 5972)
- Unicorn-499.exe (PID: 9116)
- Unicorn-22906.exe (PID: 8396)
- Unicorn-36540.exe (PID: 10412)
- Unicorn-30816.exe (PID: 9356)
- Unicorn-17914.exe (PID: 10108)
- Unicorn-37048.exe (PID: 4188)
- Unicorn-1459.exe (PID: 9416)
- Unicorn-14510.exe (PID: 9264)
- Unicorn-51110.exe (PID: 10044)
- Unicorn-43924.exe (PID: 8420)
- Unicorn-27198.exe (PID: 9096)
- Unicorn-30981.exe (PID: 8264)
- Unicorn-26239.exe (PID: 9508)
- Unicorn-6119.exe (PID: 9344)
- Unicorn-44168.exe (PID: 8008)
- Unicorn-30816.exe (PID: 9360)
- Unicorn-23940.exe (PID: 8044)
- Unicorn-17988.exe (PID: 9432)
- Unicorn-2185.exe (PID: 8664)
- Unicorn-33416.exe (PID: 10488)
- Unicorn-54308.exe (PID: 10136)
- Unicorn-35004.exe (PID: 2192)
- Unicorn-35476.exe (PID: 9552)
- Unicorn-51490.exe (PID: 9536)
- Unicorn-59876.exe (PID: 8568)
- Unicorn-46362.exe (PID: 10292)
- Unicorn-34879.exe (PID: 8436)
- Unicorn-19332.exe (PID: 9640)
- Unicorn-20300.exe (PID: 9580)
- Unicorn-9938.exe (PID: 10164)
- Unicorn-51407.exe (PID: 9476)
- Unicorn-35948.exe (PID: 8512)
- Unicorn-27500.exe (PID: 9672)
- Unicorn-35948.exe (PID: 8504)
- Unicorn-40276.exe (PID: 8176)
- Unicorn-28024.exe (PID: 8116)
- Unicorn-48792.exe (PID: 10428)
- Unicorn-22051.exe (PID: 8688)
- Unicorn-49300.exe (PID: 1240)
- Unicorn-56591.exe (PID: 5576)
- Unicorn-10867.exe (PID: 8768)
- Unicorn-56591.exe (PID: 5048)
- Unicorn-23940.exe (PID: 3676)
- Unicorn-45963.exe (PID: 4944)
- Unicorn-4789.exe (PID: 2384)
- Unicorn-25590.exe (PID: 9720)
- Unicorn-51952.exe (PID: 5400)
- Unicorn-49300.exe (PID: 736)
- Unicorn-10867.exe (PID: 8796)
- Unicorn-47530.exe (PID: 7204)
- Unicorn-51708.exe (PID: 8544)
- Unicorn-50488.exe (PID: 7528)
- Unicorn-12517.exe (PID: 2096)
- Unicorn-57743.exe (PID: 10204)
- Unicorn-60068.exe (PID: 8728)
- Unicorn-22051.exe (PID: 8680)
- Unicorn-462.exe (PID: 5344)
- Unicorn-56710.exe (PID: 8068)
- Unicorn-44635.exe (PID: 6712)
- Unicorn-19724.exe (PID: 9712)
- Unicorn-39856.exe (PID: 10320)
- Unicorn-60068.exe (PID: 8736)
- Unicorn-39990.exe (PID: 7340)
- Unicorn-55490.exe (PID: 10544)
- Unicorn-1989.exe (PID: 7336)
- Unicorn-5387.exe (PID: 2236)
- Unicorn-12817.exe (PID: 9804)
- Unicorn-34116.exe (PID: 1072)
- Unicorn-48724.exe (PID: 8172)
- Unicorn-17500.exe (PID: 9568)
- Unicorn-36292.exe (PID: 8888)
- Unicorn-20265.exe (PID: 10532)
- Unicorn-44090.exe (PID: 9836)
- Unicorn-53452.exe (PID: 10516)
- Unicorn-10985.exe (PID: 7412)
- Unicorn-44090.exe (PID: 9844)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 744)
- BackgroundTransferHost.exe (PID: 4688)
- BackgroundTransferHost.exe (PID: 6184)
- BackgroundTransferHost.exe (PID: 7812)
- BackgroundTransferHost.exe (PID: 6112)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 4688)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 4688)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 4688)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | DOS Executable Generic (100) |
|---|
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
669
Monitored processes
537
Malicious processes
81
Suspicious processes
67
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\Users\admin\AppData\Local\Temp\Unicorn-49300.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49300.exe | Unicorn-36607.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 632 | C:\Users\admin\AppData\Local\Temp\Unicorn-25681.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-25681.exe | Unicorn-64131.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 736 | C:\Users\admin\AppData\Local\Temp\Unicorn-49300.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49300.exe | Unicorn-58096.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 744 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 920 | C:\Users\admin\AppData\Local\Temp\Unicorn-46399.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46399.exe | Unicorn-56710.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1052 | C:\Users\admin\AppData\Local\Temp\Unicorn-50182.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-50182.exe | Unicorn-64131.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1056 | C:\Users\admin\AppData\Local\Temp\Unicorn-57499.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-57499.exe | Unicorn-59227.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1072 | C:\Users\admin\AppData\Local\Temp\Unicorn-34116.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-34116.exe | Unicorn-48724.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1180 | C:\Users\admin\AppData\Local\Temp\Unicorn-56050.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56050.exe | Unicorn-50488.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1240 | C:\Users\admin\AppData\Local\Temp\Unicorn-49300.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49300.exe | Unicorn-462.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
12 178
Read events
12 163
Write events
15
Delete events
0
Modification events
| (PID) Process: | (744) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (744) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (744) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (4688) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4688) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4688) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6184) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6184) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6184) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7812) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
809
Suspicious files
5
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4688 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\5ab27a89-30c4-4292-8886-3e4f79719d55.down_data | — | |
MD5:— | SHA256:— | |||
| 7356 | 1 (20).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56710.exe | executable | |
MD5:8C4FA4EC9DA96836FC362FC32DD4B854 | SHA256:ADA22CBA2A7C2DF5E6C5D24912A298A495BF217DF93C178E6FEA06A0EB0DC6F4 | |||
| 8048 | Unicorn-64131.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-59227.exe | executable | |
MD5:2E335576CADF674E336BC88CD4A95C75 | SHA256:AF4AF80C71464842EF6A64E7E3B75C36920796EF09D19046000FA3EAC7F6E055 | |||
| 8068 | Unicorn-56710.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-1858.exe | executable | |
MD5:BFE7ABA797A1B33233C9084C631632BD | SHA256:98322F0CABDA8B2D8C2254112239FBC85AF1E1109BBE7A92BD0A5CCB7477A6CD | |||
| 7216 | Unicorn-1858.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-36607.exe | executable | |
MD5:F993D6545A4FAD78F0D23144CF891910 | SHA256:67247E30A85078BE2788EE46891B6BAEAFB640CA5C49D3BC87B9A19806CB2B56 | |||
| 7172 | Unicorn-59227.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5387.exe | executable | |
MD5:FCC3DBA23DFAE1B7805DAFE64B27D979 | SHA256:C58F6495F77CAE6F7DAFA10051F665EDA3743134817EE4B949638B24804C6167 | |||
| 7356 | 1 (20).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-462.exe | executable | |
MD5:4FBCE42921B10E21580155ABEAA6AE18 | SHA256:E04E1E451C34DCFFEE25E89FE00EAF814A3ABA7C494214AF698E5860B3307D7F | |||
| 5308 | Unicorn-17217.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-58096.exe | executable | |
MD5:F1B7467526120881F0426AA7D02B22A6 | SHA256:39DD2A03A895D65747A5761A5AD3A75EBBA9675DAE26449D83CD60B50B6FA13B | |||
| 8068 | Unicorn-56710.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46399.exe | executable | |
MD5:3C470C6F52E2C48080A76D6E0E96D57B | SHA256:B0CFB22868B26EDB2BE3B9B61D4BF65D85B8DB8743AA132BF209817458732217 | |||
| 4688 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1ab01f98-b414-4212-93e8-88d07d9419e3.41c5cea0-13f1-4c73-9b3c-241b09dd848f.down_meta | binary | |
MD5:C53C46A3AEC2B9BC4A75E4C35E28F6A5 | SHA256:A51646E6128D8F66C8A5B627E13B87EDAF7FABB48AE8F3C03033FD8725C356D5 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
15
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.141:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7564 | backgroundTaskHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
9068 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
4688 | BackgroundTransferHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
9068 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.48.23.141:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.159.2:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 23.54.109.203:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2112 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
7564 | backgroundTaskHost.exe | 20.199.58.43:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
7564 | backgroundTaskHost.exe | 23.54.109.203:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |