| File name: | 1 (250) |
| Full analysis: | https://app.any.run/tasks/16cfa03c-5578-42c2-83d2-2d2aaaeacfe0 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 18:47:07 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 5CD3917781711DA6355BEFEE7CA57650 |
| SHA1: | 1AFD2F9BBD99AEF606A2DC5FB7928D3B33E2DC2B |
| SHA256: | 9B00E22C8607A6B85CEB995E8CFC7F8DB0B472639F51F96E912ADD4A460F920F |
| SSDEEP: | 6144:O7zTl02+aDULA5LoW4e75OMx5t3Xlp8GBn/K4VOH+k/8SwjwpyAvEhHDFO2lQmwa:O3hF8LA5kWzF3V+ani4VOHRx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- Unicorn-36023.exe (PID: 4620)
- Unicorn-22619.exe (PID: 4164)
- 1 (250).exe (PID: 5280)
- Unicorn-29177.exe (PID: 3888)
- Unicorn-31721.exe (PID: 1052)
- Unicorn-43973.exe (PID: 5728)
- Unicorn-24107.exe (PID: 1056)
- Unicorn-64485.exe (PID: 6192)
- Unicorn-53101.exe (PID: 5156)
- Unicorn-2509.exe (PID: 5008)
- Unicorn-30543.exe (PID: 1660)
- Unicorn-30543.exe (PID: 5800)
- Unicorn-5938.exe (PID: 7052)
- Unicorn-45488.exe (PID: 1228)
- Unicorn-11803.exe (PID: 5256)
- Unicorn-932.exe (PID: 1012)
- Unicorn-20729.exe (PID: 6592)
- Unicorn-5592.exe (PID: 736)
- Unicorn-7730.exe (PID: 5360)
- Unicorn-9768.exe (PID: 1912)
- Unicorn-48571.exe (PID: 6184)
- Unicorn-48571.exe (PID: 208)
- Unicorn-44487.exe (PID: 4988)
- Unicorn-65353.exe (PID: 5548)
- Unicorn-12998.exe (PID: 7180)
- Unicorn-21663.exe (PID: 1812)
- Unicorn-15798.exe (PID: 7188)
- Unicorn-36873.exe (PID: 6476)
- Unicorn-44487.exe (PID: 5404)
- Unicorn-56739.exe (PID: 4120)
- Unicorn-2063.exe (PID: 7196)
- Unicorn-2063.exe (PID: 7204)
- Unicorn-31441.exe (PID: 7360)
- Unicorn-42301.exe (PID: 7336)
- Unicorn-25310.exe (PID: 7352)
- Unicorn-23273.exe (PID: 7316)
- Unicorn-41555.exe (PID: 7388)
- Unicorn-17605.exe (PID: 7408)
- Unicorn-18997.exe (PID: 7428)
- Unicorn-45374.exe (PID: 7444)
- Unicorn-52245.exe (PID: 7484)
- Unicorn-1653.exe (PID: 7504)
- Unicorn-41939.exe (PID: 7540)
- Unicorn-52800.exe (PID: 7560)
- Unicorn-26157.exe (PID: 7580)
- Unicorn-58275.exe (PID: 7612)
- Unicorn-46023.exe (PID: 7588)
- Unicorn-3599.exe (PID: 7644)
- Unicorn-15296.exe (PID: 7604)
- Unicorn-42493.exe (PID: 7684)
- Unicorn-42493.exe (PID: 7692)
- Unicorn-9074.exe (PID: 7732)
- Unicorn-45923.exe (PID: 7828)
- Unicorn-9074.exe (PID: 7724)
- Unicorn-31633.exe (PID: 7712)
- Unicorn-39801.exe (PID: 7756)
- Unicorn-45923.exe (PID: 7776)
- Unicorn-62359.exe (PID: 7700)
- Unicorn-30870.exe (PID: 7748)
- Unicorn-51788.exe (PID: 7792)
- Unicorn-10589.exe (PID: 7916)
- Unicorn-57097.exe (PID: 7908)
- Unicorn-29586.exe (PID: 7676)
- Unicorn-32401.exe (PID: 7976)
- Unicorn-24233.exe (PID: 7952)
- Unicorn-12556.exe (PID: 8048)
- Unicorn-17745.exe (PID: 7996)
- Unicorn-16641.exe (PID: 8084)
- Unicorn-59619.exe (PID: 8108)
- Unicorn-32401.exe (PID: 7968)
- Unicorn-26587.exe (PID: 7784)
- Unicorn-31393.exe (PID: 4736)
- Unicorn-26270.exe (PID: 7960)
- Unicorn-27501.exe (PID: 8076)
- Unicorn-47367.exe (PID: 8092)
- Unicorn-63682.exe (PID: 7988)
- Unicorn-12364.exe (PID: 6824)
- Unicorn-35669.exe (PID: 8116)
- Unicorn-23225.exe (PID: 6960)
- Unicorn-32785.exe (PID: 7156)
- Unicorn-15878.exe (PID: 8124)
- Unicorn-10510.exe (PID: 8100)
- Unicorn-41337.exe (PID: 8200)
- Unicorn-6810.exe (PID: 7524)
- Unicorn-41913.exe (PID: 8316)
- Unicorn-37807.exe (PID: 8248)
- Unicorn-1373.exe (PID: 8240)
- Unicorn-63795.exe (PID: 8256)
- Unicorn-63402.exe (PID: 8304)
- Unicorn-41913.exe (PID: 8324)
- Unicorn-15296.exe (PID: 7596)
- Unicorn-64279.exe (PID: 8436)
- Unicorn-37637.exe (PID: 8420)
- Unicorn-64371.exe (PID: 8360)
- Unicorn-46552.exe (PID: 8368)
- Unicorn-29469.exe (PID: 8404)
- Unicorn-3573.exe (PID: 8352)
- Unicorn-64834.exe (PID: 8452)
- Unicorn-21877.exe (PID: 8532)
- Unicorn-60771.exe (PID: 8516)
- Unicorn-21877.exe (PID: 8524)
- Unicorn-9624.exe (PID: 8476)
- Unicorn-27907.exe (PID: 8648)
- Unicorn-21877.exe (PID: 8556)
- Unicorn-9432.exe (PID: 8676)
- Unicorn-21877.exe (PID: 8484)
- Unicorn-14071.exe (PID: 8748)
- Unicorn-64855.exe (PID: 8592)
- Unicorn-2011.exe (PID: 8492)
- Unicorn-9332.exe (PID: 8832)
- Unicorn-16639.exe (PID: 8824)
- Unicorn-22239.exe (PID: 8792)
- Unicorn-25537.exe (PID: 8764)
- Unicorn-35975.exe (PID: 8804)
- Unicorn-14071.exe (PID: 8740)
- Unicorn-62260.exe (PID: 8848)
- Unicorn-61134.exe (PID: 8840)
- Unicorn-33672.exe (PID: 8784)
- Unicorn-15197.exe (PID: 8880)
- Unicorn-29666.exe (PID: 8956)
- Unicorn-14071.exe (PID: 8756)
- Unicorn-7247.exe (PID: 9168)
- Unicorn-3293.exe (PID: 3156)
- Unicorn-33234.exe (PID: 9160)
- Unicorn-19883.exe (PID: 1300)
- Unicorn-28483.exe (PID: 9124)
- Unicorn-23221.exe (PID: 3332)
- Unicorn-662.exe (PID: 9232)
- Unicorn-30537.exe (PID: 9320)
- Unicorn-40111.exe (PID: 9276)
- Unicorn-42235.exe (PID: 9292)
- Unicorn-62655.exe (PID: 9340)
- Unicorn-64601.exe (PID: 9376)
- Unicorn-9925.exe (PID: 9368)
- Unicorn-29791.exe (PID: 9392)
- Unicorn-5649.exe (PID: 9488)
- Unicorn-7808.exe (PID: 9512)
- Unicorn-22500.exe (PID: 9468)
- Unicorn-44565.exe (PID: 9544)
- Unicorn-26182.exe (PID: 9528)
- Unicorn-2770.exe (PID: 9564)
- Unicorn-57372.exe (PID: 9560)
- Unicorn-58763.exe (PID: 9592)
- Unicorn-49780.exe (PID: 9652)
- Unicorn-1970.exe (PID: 9704)
- Unicorn-5862.exe (PID: 9808)
- Unicorn-38462.exe (PID: 9748)
- Unicorn-61185.exe (PID: 9788)
- Unicorn-1778.exe (PID: 9796)
- Unicorn-63899.exe (PID: 9836)
- Unicorn-24812.exe (PID: 9952)
- Unicorn-60278.exe (PID: 9916)
- Unicorn-8476.exe (PID: 9924)
- Unicorn-29381.exe (PID: 10012)
- Unicorn-19821.exe (PID: 10004)
- Unicorn-57200.exe (PID: 10020)
- Unicorn-16553.exe (PID: 9984)
Executable content was dropped or overwritten
- 1 (250).exe (PID: 5280)
- Unicorn-22619.exe (PID: 4164)
- Unicorn-36023.exe (PID: 4620)
- Unicorn-29177.exe (PID: 3888)
- Unicorn-31721.exe (PID: 1052)
- Unicorn-43973.exe (PID: 5728)
- Unicorn-53101.exe (PID: 5156)
- Unicorn-64485.exe (PID: 6192)
- Unicorn-2509.exe (PID: 5008)
- Unicorn-30543.exe (PID: 1660)
- Unicorn-65353.exe (PID: 5548)
- Unicorn-11803.exe (PID: 5256)
- Unicorn-5938.exe (PID: 7052)
- Unicorn-932.exe (PID: 1012)
- Unicorn-20729.exe (PID: 6592)
- Unicorn-7730.exe (PID: 5360)
- Unicorn-5592.exe (PID: 736)
- Unicorn-9768.exe (PID: 1912)
- Unicorn-48571.exe (PID: 208)
- Unicorn-30543.exe (PID: 5800)
- Unicorn-44487.exe (PID: 4988)
- Unicorn-36873.exe (PID: 6476)
- Unicorn-56739.exe (PID: 4120)
- Unicorn-48571.exe (PID: 6184)
- Unicorn-45488.exe (PID: 1228)
- Unicorn-21663.exe (PID: 1812)
- Unicorn-12998.exe (PID: 7180)
- Unicorn-2063.exe (PID: 7204)
- Unicorn-2063.exe (PID: 7196)
- Unicorn-23273.exe (PID: 7316)
- Unicorn-42301.exe (PID: 7336)
- Unicorn-25310.exe (PID: 7352)
- Unicorn-41555.exe (PID: 7388)
- Unicorn-17605.exe (PID: 7408)
- Unicorn-18997.exe (PID: 7428)
- Unicorn-45374.exe (PID: 7444)
- Unicorn-52245.exe (PID: 7484)
- Unicorn-1653.exe (PID: 7504)
- Unicorn-41939.exe (PID: 7540)
- Unicorn-52800.exe (PID: 7560)
- Unicorn-15296.exe (PID: 7596)
- Unicorn-26157.exe (PID: 7580)
- Unicorn-44487.exe (PID: 5404)
- Unicorn-3599.exe (PID: 7644)
- Unicorn-15296.exe (PID: 7604)
- Unicorn-46023.exe (PID: 7588)
- Unicorn-42493.exe (PID: 7684)
- Unicorn-31633.exe (PID: 7712)
- Unicorn-9074.exe (PID: 7732)
- Unicorn-29586.exe (PID: 7676)
- Unicorn-45923.exe (PID: 7776)
- Unicorn-30870.exe (PID: 7748)
- Unicorn-24107.exe (PID: 1056)
- Unicorn-15798.exe (PID: 7188)
- Unicorn-51788.exe (PID: 7792)
- Unicorn-10589.exe (PID: 7916)
- Unicorn-26587.exe (PID: 7784)
- Unicorn-57097.exe (PID: 7908)
- Unicorn-24233.exe (PID: 7952)
- Unicorn-31441.exe (PID: 7360)
- Unicorn-32401.exe (PID: 7976)
- Unicorn-12556.exe (PID: 8048)
- Unicorn-17745.exe (PID: 7996)
- Unicorn-16641.exe (PID: 8084)
- Unicorn-59619.exe (PID: 8108)
- Unicorn-32401.exe (PID: 7968)
- Unicorn-26270.exe (PID: 7960)
- Unicorn-31393.exe (PID: 4736)
- Unicorn-27501.exe (PID: 8076)
- Unicorn-47367.exe (PID: 8092)
- Unicorn-63682.exe (PID: 7988)
- Unicorn-35669.exe (PID: 8116)
- Unicorn-23225.exe (PID: 6960)
- Unicorn-12364.exe (PID: 6824)
- Unicorn-6810.exe (PID: 7524)
- Unicorn-10510.exe (PID: 8100)
- Unicorn-32785.exe (PID: 7156)
- Unicorn-41337.exe (PID: 8200)
- Unicorn-63795.exe (PID: 8256)
- Unicorn-1373.exe (PID: 8240)
- Unicorn-58275.exe (PID: 7612)
- Unicorn-37807.exe (PID: 8248)
- Unicorn-41913.exe (PID: 8316)
- Unicorn-41913.exe (PID: 8324)
- Unicorn-63402.exe (PID: 8304)
- Unicorn-64279.exe (PID: 8436)
- Unicorn-37637.exe (PID: 8420)
- Unicorn-46552.exe (PID: 8368)
- Unicorn-64371.exe (PID: 8360)
- Unicorn-29469.exe (PID: 8404)
- Unicorn-3573.exe (PID: 8352)
- Unicorn-21877.exe (PID: 8532)
- Unicorn-45923.exe (PID: 7828)
- Unicorn-21877.exe (PID: 8524)
- Unicorn-60771.exe (PID: 8516)
- Unicorn-9624.exe (PID: 8476)
- Unicorn-62359.exe (PID: 7700)
- Unicorn-64855.exe (PID: 8580)
- Unicorn-21877.exe (PID: 8484)
- Unicorn-21877.exe (PID: 8556)
- Unicorn-39801.exe (PID: 7756)
- Unicorn-2011.exe (PID: 8492)
- Unicorn-64855.exe (PID: 8592)
- Unicorn-14071.exe (PID: 8748)
- Unicorn-16639.exe (PID: 8824)
- Unicorn-9332.exe (PID: 8832)
- Unicorn-25537.exe (PID: 8764)
- Unicorn-35975.exe (PID: 8804)
- Unicorn-33672.exe (PID: 8784)
- Unicorn-22239.exe (PID: 8792)
- Unicorn-61134.exe (PID: 8840)
- Unicorn-14071.exe (PID: 8756)
- Unicorn-29666.exe (PID: 8956)
- Unicorn-15197.exe (PID: 8880)
- Unicorn-28483.exe (PID: 9124)
- Unicorn-48519.exe (PID: 8508)
- Unicorn-7247.exe (PID: 9168)
- Unicorn-3293.exe (PID: 3156)
- Unicorn-33234.exe (PID: 9160)
- Unicorn-19883.exe (PID: 1300)
- Unicorn-662.exe (PID: 9232)
- Unicorn-40111.exe (PID: 9276)
- Unicorn-23221.exe (PID: 3332)
- Unicorn-30537.exe (PID: 9320)
- Unicorn-62655.exe (PID: 9340)
- Unicorn-64601.exe (PID: 9376)
- Unicorn-9925.exe (PID: 9368)
- Unicorn-29791.exe (PID: 9392)
- Unicorn-22500.exe (PID: 9468)
- Unicorn-7808.exe (PID: 9512)
- Unicorn-44565.exe (PID: 9544)
- Unicorn-26182.exe (PID: 9528)
- Unicorn-2770.exe (PID: 9564)
- Unicorn-57372.exe (PID: 9560)
- Unicorn-58763.exe (PID: 9592)
- Unicorn-15878.exe (PID: 8124)
- Unicorn-49780.exe (PID: 9652)
- Unicorn-1970.exe (PID: 9704)
- Unicorn-5862.exe (PID: 9808)
- Unicorn-8092.exe (PID: 9720)
- Unicorn-38462.exe (PID: 9748)
- Unicorn-61185.exe (PID: 9788)
- Unicorn-1778.exe (PID: 9796)
- Unicorn-63899.exe (PID: 9836)
- Unicorn-20829.exe (PID: 9884)
- Unicorn-24812.exe (PID: 9952)
- Unicorn-17299.exe (PID: 9900)
- Unicorn-42493.exe (PID: 7692)
- Unicorn-8476.exe (PID: 9924)
- Unicorn-16287.exe (PID: 9996)
- Unicorn-29381.exe (PID: 10012)
- Unicorn-19821.exe (PID: 10004)
- Unicorn-16553.exe (PID: 9984)
- Unicorn-60278.exe (PID: 9916)
- Unicorn-16553.exe (PID: 9976)
- Unicorn-29500.exe (PID: 968)
- Unicorn-8768.exe (PID: 10120)
- Unicorn-33827.exe (PID: 10164)
- Unicorn-22967.exe (PID: 10188)
- Unicorn-5068.exe (PID: 5200)
- Unicorn-54641.exe (PID: 8500)
- Unicorn-3122.exe (PID: 2908)
- Unicorn-47232.exe (PID: 10332)
- Unicorn-65130.exe (PID: 9104)
- Unicorn-19459.exe (PID: 9212)
- Unicorn-27718.exe (PID: 8996)
- Unicorn-13791.exe (PID: 5116)
- Unicorn-57704.exe (PID: 10084)
- Unicorn-10714.exe (PID: 10144)
- Unicorn-53693.exe (PID: 10180)
- Unicorn-5649.exe (PID: 9488)
- Unicorn-44347.exe (PID: 10416)
- Unicorn-9536.exe (PID: 10440)
- Unicorn-36733.exe (PID: 10460)
- Unicorn-56599.exe (PID: 10468)
- Unicorn-15301.exe (PID: 10512)
- Unicorn-26427.exe (PID: 10492)
- Unicorn-46769.exe (PID: 10612)
- Unicorn-40839.exe (PID: 10544)
- Unicorn-40839.exe (PID: 10536)
- Unicorn-64834.exe (PID: 8452)
- Unicorn-33033.exe (PID: 10620)
- Unicorn-9074.exe (PID: 7724)
- Unicorn-42379.exe (PID: 10288)
- Unicorn-1560.exe (PID: 10340)
- Unicorn-9728.exe (PID: 10368)
- Unicorn-9820.exe (PID: 10648)
- Unicorn-18207.exe (PID: 10712)
- Unicorn-10304.exe (PID: 10688)
- Unicorn-64144.exe (PID: 10728)
- Unicorn-35363.exe (PID: 10880)
- Unicorn-18473.exe (PID: 10760)
- Unicorn-64144.exe (PID: 10792)
- Unicorn-14943.exe (PID: 10872)
- Unicorn-64144.exe (PID: 10736)
- Unicorn-64144.exe (PID: 10784)
- Unicorn-64144.exe (PID: 10832)
- Unicorn-64144.exe (PID: 10744)
- Unicorn-59147.exe (PID: 9756)
- Unicorn-9820.exe (PID: 10656)
- Unicorn-27907.exe (PID: 8648)
- Unicorn-57200.exe (PID: 10020)
- Unicorn-14071.exe (PID: 8740)
- Unicorn-49675.exe (PID: 11088)
- Unicorn-34809.exe (PID: 10968)
- Unicorn-8166.exe (PID: 10976)
- Unicorn-49675.exe (PID: 11048)
- Unicorn-45691.exe (PID: 11080)
- Unicorn-51489.exe (PID: 11240)
- Unicorn-49675.exe (PID: 11056)
- Unicorn-52516.exe (PID: 11096)
- Unicorn-59624.exe (PID: 11164)
- Unicorn-31301.exe (PID: 11064)
- Unicorn-60636.exe (PID: 11072)
- Unicorn-42235.exe (PID: 9292)
- Unicorn-59624.exe (PID: 11172)
- Unicorn-26641.exe (PID: 10768)
- Unicorn-30725.exe (PID: 10752)
- Unicorn-553.exe (PID: 11000)
- Unicorn-51145.exe (PID: 10992)
- Unicorn-12342.exe (PID: 10776)
- Unicorn-27025.exe (PID: 11256)
- Unicorn-53759.exe (PID: 11216)
- Unicorn-39853.exe (PID: 11352)
- Unicorn-51145.exe (PID: 10984)
- Unicorn-13210.exe (PID: 11404)
- Unicorn-27601.exe (PID: 11324)
- Unicorn-27601.exe (PID: 11316)
- Unicorn-54243.exe (PID: 11288)
- Unicorn-9126.exe (PID: 11412)
- Unicorn-58327.exe (PID: 11308)
- Unicorn-6988.exe (PID: 11456)
- Unicorn-50959.exe (PID: 11232)
- Unicorn-5042.exe (PID: 11340)
- Unicorn-53759.exe (PID: 11224)
- Unicorn-14010.exe (PID: 11180)
- Unicorn-1559.exe (PID: 11248)
- Unicorn-20781.exe (PID: 10592)
- Unicorn-5042.exe (PID: 11332)
- Unicorn-25463.exe (PID: 11436)
- Unicorn-36568.exe (PID: 5972)
INFO
The sample compiled with chinese language support
- 1 (250).exe (PID: 5280)
Checks supported languages
- Unicorn-22619.exe (PID: 4164)
- 1 (250).exe (PID: 5280)
- Unicorn-36023.exe (PID: 4620)
- Unicorn-29177.exe (PID: 3888)
- Unicorn-31721.exe (PID: 1052)
- Unicorn-43973.exe (PID: 5728)
- Unicorn-24107.exe (PID: 1056)
- Unicorn-64485.exe (PID: 6192)
- Unicorn-2509.exe (PID: 5008)
- Unicorn-53101.exe (PID: 5156)
- Unicorn-30543.exe (PID: 1660)
- Unicorn-45488.exe (PID: 1228)
- Unicorn-30543.exe (PID: 5800)
- Unicorn-65353.exe (PID: 5548)
- Unicorn-5938.exe (PID: 7052)
- Unicorn-11803.exe (PID: 5256)
- Unicorn-9768.exe (PID: 1912)
- Unicorn-7730.exe (PID: 5360)
- Unicorn-5592.exe (PID: 736)
- Unicorn-932.exe (PID: 1012)
- Unicorn-44487.exe (PID: 4988)
- Unicorn-36873.exe (PID: 6476)
- Unicorn-44487.exe (PID: 5404)
- Unicorn-56739.exe (PID: 4120)
- Unicorn-21663.exe (PID: 1812)
- Unicorn-15798.exe (PID: 7188)
- Unicorn-12998.exe (PID: 7180)
- Unicorn-2063.exe (PID: 7196)
- Unicorn-2063.exe (PID: 7204)
- Unicorn-48571.exe (PID: 208)
- Unicorn-48571.exe (PID: 6184)
- Unicorn-42301.exe (PID: 7336)
- Unicorn-25310.exe (PID: 7352)
- Unicorn-45374.exe (PID: 7444)
- Unicorn-41555.exe (PID: 7388)
- Unicorn-17605.exe (PID: 7408)
- Unicorn-18997.exe (PID: 7428)
- Unicorn-41939.exe (PID: 7540)
- Unicorn-52800.exe (PID: 7560)
- Unicorn-1653.exe (PID: 7504)
- Unicorn-3599.exe (PID: 7644)
- Unicorn-15296.exe (PID: 7604)
- Unicorn-29586.exe (PID: 7676)
- Unicorn-46023.exe (PID: 7588)
- Unicorn-26157.exe (PID: 7580)
- Unicorn-58275.exe (PID: 7612)
- Unicorn-9074.exe (PID: 7724)
- Unicorn-42493.exe (PID: 7684)
- Unicorn-26587.exe (PID: 7784)
- Unicorn-42493.exe (PID: 7692)
- Unicorn-39801.exe (PID: 7756)
- Unicorn-9074.exe (PID: 7732)
- Unicorn-62359.exe (PID: 7700)
- Unicorn-30870.exe (PID: 7748)
- Unicorn-45923.exe (PID: 7776)
- Unicorn-31633.exe (PID: 7712)
- Unicorn-51788.exe (PID: 7792)
- Unicorn-45923.exe (PID: 7828)
- Unicorn-57097.exe (PID: 7908)
- Unicorn-10589.exe (PID: 7916)
- Unicorn-24233.exe (PID: 7952)
- Unicorn-26270.exe (PID: 7960)
- Unicorn-32401.exe (PID: 7976)
- Unicorn-63682.exe (PID: 7988)
- Unicorn-32401.exe (PID: 7968)
- Unicorn-17745.exe (PID: 7996)
- Unicorn-12556.exe (PID: 8048)
- Unicorn-27501.exe (PID: 8076)
- Unicorn-35669.exe (PID: 8116)
- Unicorn-59619.exe (PID: 8108)
- Unicorn-16641.exe (PID: 8084)
- Unicorn-10510.exe (PID: 8100)
- Unicorn-31393.exe (PID: 4736)
- Unicorn-47367.exe (PID: 8092)
- Unicorn-12364.exe (PID: 6824)
- Unicorn-23225.exe (PID: 6960)
- Unicorn-6810.exe (PID: 7524)
- Unicorn-32785.exe (PID: 7156)
- Unicorn-41337.exe (PID: 8200)
- Unicorn-63795.exe (PID: 8256)
- Unicorn-37807.exe (PID: 8248)
- Unicorn-1373.exe (PID: 8240)
- Unicorn-41913.exe (PID: 8324)
- Unicorn-64371.exe (PID: 8360)
- Unicorn-46552.exe (PID: 8368)
- Unicorn-3573.exe (PID: 8352)
- Unicorn-64279.exe (PID: 8436)
- Unicorn-29469.exe (PID: 8404)
- Unicorn-37637.exe (PID: 8420)
- Unicorn-64834.exe (PID: 8452)
- Unicorn-41913.exe (PID: 8316)
- Unicorn-60771.exe (PID: 8516)
- Unicorn-21877.exe (PID: 8524)
- Unicorn-2011.exe (PID: 8492)
- Unicorn-21877.exe (PID: 8532)
- Unicorn-21877.exe (PID: 8556)
- Unicorn-64855.exe (PID: 8580)
- Unicorn-64855.exe (PID: 8592)
- Unicorn-27907.exe (PID: 8648)
- Unicorn-54641.exe (PID: 8500)
- Unicorn-48519.exe (PID: 8508)
- Unicorn-9624.exe (PID: 8476)
- Unicorn-9432.exe (PID: 8676)
- Unicorn-14071.exe (PID: 8756)
- Unicorn-14071.exe (PID: 8740)
- Unicorn-14071.exe (PID: 8748)
- Unicorn-22239.exe (PID: 8792)
- Unicorn-35975.exe (PID: 8804)
- Unicorn-29666.exe (PID: 8956)
- Unicorn-62260.exe (PID: 8848)
- Unicorn-9332.exe (PID: 8832)
- Unicorn-61134.exe (PID: 8840)
- Unicorn-33672.exe (PID: 8784)
- Unicorn-15197.exe (PID: 8880)
- Unicorn-33234.exe (PID: 9160)
- Unicorn-7247.exe (PID: 9168)
- Unicorn-28483.exe (PID: 9124)
- Unicorn-23221.exe (PID: 3332)
- Unicorn-662.exe (PID: 9232)
- Unicorn-3293.exe (PID: 3156)
- Unicorn-19883.exe (PID: 1300)
- Unicorn-40111.exe (PID: 9276)
- Unicorn-42235.exe (PID: 9292)
- Unicorn-30537.exe (PID: 9320)
- Unicorn-9925.exe (PID: 9368)
- Unicorn-62655.exe (PID: 9340)
- Unicorn-29791.exe (PID: 9392)
- Unicorn-7808.exe (PID: 9512)
- Unicorn-26182.exe (PID: 9528)
- Unicorn-64601.exe (PID: 9376)
- Unicorn-22500.exe (PID: 9468)
- Unicorn-5649.exe (PID: 9488)
- Unicorn-49780.exe (PID: 9652)
- Unicorn-58763.exe (PID: 9592)
- Unicorn-1970.exe (PID: 9704)
- Unicorn-8092.exe (PID: 9720)
- Unicorn-2770.exe (PID: 9564)
- Unicorn-57372.exe (PID: 9560)
- Unicorn-1778.exe (PID: 9796)
- Unicorn-61185.exe (PID: 9788)
- Unicorn-38462.exe (PID: 9748)
- Unicorn-59147.exe (PID: 9756)
- Unicorn-20829.exe (PID: 9884)
- Unicorn-17299.exe (PID: 9900)
- Unicorn-8476.exe (PID: 9924)
- Unicorn-60278.exe (PID: 9916)
- Unicorn-57704.exe (PID: 10084)
- Unicorn-16553.exe (PID: 9984)
- Unicorn-8768.exe (PID: 10120)
- Unicorn-29381.exe (PID: 10012)
- Unicorn-57200.exe (PID: 10020)
- Unicorn-19821.exe (PID: 10004)
- Unicorn-16553.exe (PID: 9976)
- Unicorn-33827.exe (PID: 10164)
- Unicorn-22967.exe (PID: 10188)
- Unicorn-29500.exe (PID: 968)
- Unicorn-27718.exe (PID: 8996)
- Unicorn-3122.exe (PID: 2908)
- Unicorn-10714.exe (PID: 10144)
- Unicorn-53693.exe (PID: 10180)
- Unicorn-13791.exe (PID: 5116)
- Unicorn-42379.exe (PID: 10288)
- Unicorn-19459.exe (PID: 9212)
- Unicorn-1560.exe (PID: 10340)
- Unicorn-47232.exe (PID: 10332)
- Unicorn-9728.exe (PID: 10368)
- Unicorn-44347.exe (PID: 10416)
- Unicorn-9536.exe (PID: 10440)
- Unicorn-56599.exe (PID: 10468)
- Unicorn-26427.exe (PID: 10492)
- Unicorn-40839.exe (PID: 10536)
- Unicorn-15301.exe (PID: 10512)
- Unicorn-40839.exe (PID: 10544)
- Unicorn-20781.exe (PID: 10592)
- Unicorn-46769.exe (PID: 10612)
- Unicorn-9820.exe (PID: 10648)
- Unicorn-9820.exe (PID: 10656)
- Unicorn-10304.exe (PID: 10688)
- Unicorn-33033.exe (PID: 10620)
- Unicorn-18207.exe (PID: 10712)
- Unicorn-64144.exe (PID: 10728)
- Unicorn-18473.exe (PID: 10760)
- Unicorn-64144.exe (PID: 10784)
- Unicorn-64144.exe (PID: 10792)
- Unicorn-14943.exe (PID: 10872)
- Unicorn-30725.exe (PID: 10752)
- Unicorn-64144.exe (PID: 10832)
- Unicorn-64144.exe (PID: 10736)
- Unicorn-26641.exe (PID: 10768)
- Unicorn-8166.exe (PID: 10976)
- Unicorn-51145.exe (PID: 10992)
- Unicorn-34809.exe (PID: 10968)
- Unicorn-553.exe (PID: 11000)
- Unicorn-51145.exe (PID: 10984)
- Unicorn-31301.exe (PID: 11064)
- Unicorn-49675.exe (PID: 11056)
- Unicorn-52516.exe (PID: 11096)
- Unicorn-60636.exe (PID: 11072)
- Unicorn-45691.exe (PID: 11080)
- Unicorn-49675.exe (PID: 11048)
- Unicorn-14010.exe (PID: 11180)
- Unicorn-59624.exe (PID: 11164)
- Unicorn-59624.exe (PID: 11172)
- Unicorn-49675.exe (PID: 11088)
- Unicorn-50959.exe (PID: 11232)
- Unicorn-36568.exe (PID: 5972)
- Unicorn-51489.exe (PID: 11240)
- Unicorn-53759.exe (PID: 11216)
- Unicorn-1559.exe (PID: 11248)
- Unicorn-46075.exe (PID: 6208)
- Unicorn-54243.exe (PID: 11288)
- Unicorn-53759.exe (PID: 11224)
- Unicorn-27025.exe (PID: 11256)
- Unicorn-5042.exe (PID: 11332)
- Unicorn-27601.exe (PID: 11324)
- Unicorn-58327.exe (PID: 11308)
- Unicorn-5042.exe (PID: 11340)
- Unicorn-40791.exe (PID: 11504)
- Unicorn-13210.exe (PID: 11404)
- Unicorn-9126.exe (PID: 11412)
- Unicorn-6988.exe (PID: 11456)
- Unicorn-25463.exe (PID: 11436)
- Unicorn-39853.exe (PID: 11352)
- Unicorn-27601.exe (PID: 11316)
- Unicorn-5789.exe (PID: 11548)
- Unicorn-5789.exe (PID: 11540)
- Unicorn-5789.exe (PID: 11556)
- Unicorn-60200.exe (PID: 11564)
- Unicorn-20201.exe (PID: 11628)
- Unicorn-54335.exe (PID: 11572)
- Unicorn-41175.exe (PID: 11700)
- Unicorn-7656.exe (PID: 11824)
- Unicorn-44513.exe (PID: 11840)
- Unicorn-56957.exe (PID: 11664)
- Unicorn-46743.exe (PID: 11684)
- Unicorn-20009.exe (PID: 11772)
- Unicorn-32261.exe (PID: 11792)
- Unicorn-31445.exe (PID: 11860)
- Unicorn-2665.exe (PID: 11880)
- Unicorn-61425.exe (PID: 11900)
- Unicorn-57241.exe (PID: 11972)
- Unicorn-57896.exe (PID: 11948)
- Unicorn-63463.exe (PID: 11924)
- Unicorn-63371.exe (PID: 11964)
- Unicorn-37283.exe (PID: 12012)
- Unicorn-49649.exe (PID: 12064)
- Unicorn-43527.exe (PID: 12040)
- Unicorn-1103.exe (PID: 12096)
- Unicorn-64502.exe (PID: 12144)
- Unicorn-44082.exe (PID: 12112)
- Unicorn-20868.exe (PID: 12160)
- Unicorn-43527.exe (PID: 12032)
- Unicorn-43335.exe (PID: 12208)
- Unicorn-8524.exe (PID: 12184)
- Unicorn-43890.exe (PID: 12224)
- Unicorn-33029.exe (PID: 12248)
- Unicorn-22458.exe (PID: 12272)
- Unicorn-15222.exe (PID: 6760)
- Unicorn-39827.exe (PID: 5744)
- Unicorn-48550.exe (PID: 12072)
- Unicorn-61424.exe (PID: 1244)
- Unicorn-6862.exe (PID: 12352)
- Unicorn-27191.exe (PID: 12416)
- Unicorn-15130.exe (PID: 12292)
- Unicorn-3241.exe (PID: 12376)
- Unicorn-27658.exe (PID: 12448)
- Unicorn-8686.exe (PID: 12516)
- Unicorn-33953.exe (PID: 12576)
- Unicorn-10003.exe (PID: 12532)
- Unicorn-22255.exe (PID: 12612)
- Unicorn-7045.exe (PID: 12596)
- Unicorn-17979.exe (PID: 12796)
- Unicorn-31815.exe (PID: 12700)
- Unicorn-26260.exe (PID: 12836)
- Unicorn-32126.exe (PID: 12844)
- Unicorn-30253.exe (PID: 12880)
- Unicorn-29988.exe (PID: 12872)
- Unicorn-26169.exe (PID: 12888)
- Unicorn-38229.exe (PID: 12980)
- Unicorn-21130.exe (PID: 12948)
- Unicorn-50573.exe (PID: 12964)
- Unicorn-58655.exe (PID: 12996)
- Unicorn-29829.exe (PID: 13016)
- Unicorn-10195.exe (PID: 12956)
- Unicorn-58327.exe (PID: 12932)
- Unicorn-36344.exe (PID: 13096)
- Unicorn-8633.exe (PID: 13164)
- Unicorn-18284.exe (PID: 13184)
- Unicorn-56210.exe (PID: 13104)
- Unicorn-24969.exe (PID: 13220)
- Unicorn-24969.exe (PID: 13216)
- Unicorn-60409.exe (PID: 13272)
- Unicorn-26915.exe (PID: 1276)
- Unicorn-28810.exe (PID: 5740)
- Unicorn-39935.exe (PID: 4108)
- Unicorn-57755.exe (PID: 3272)
- Unicorn-25545.exe (PID: 13356)
- Unicorn-35105.exe (PID: 13408)
- Unicorn-10600.exe (PID: 13368)
- Unicorn-10500.exe (PID: 13428)
- Unicorn-37051.exe (PID: 13456)
- Unicorn-26836.exe (PID: 13464)
- Unicorn-32967.exe (PID: 13472)
- Unicorn-47257.exe (PID: 13544)
- Unicorn-21845.exe (PID: 13656)
- Unicorn-33521.exe (PID: 13536)
- Unicorn-62131.exe (PID: 13692)
- Unicorn-42265.exe (PID: 13684)
- Unicorn-31550.exe (PID: 12680)
- Unicorn-51063.exe (PID: 13784)
- Unicorn-59993.exe (PID: 13792)
- Unicorn-27875.exe (PID: 13740)
- Unicorn-41611.exe (PID: 13748)
- Unicorn-37435.exe (PID: 13812)
- Unicorn-11347.exe (PID: 13856)
- Unicorn-11347.exe (PID: 13848)
- Unicorn-8965.exe (PID: 13964)
- Unicorn-29742.exe (PID: 13940)
- Unicorn-3100.exe (PID: 13956)
- Unicorn-9156.exe (PID: 12812)
- Unicorn-37554.exe (PID: 13992)
- Unicorn-3008.exe (PID: 14020)
- Unicorn-62899.exe (PID: 14148)
- Unicorn-55.exe (PID: 14108)
- Unicorn-39579.exe (PID: 14216)
- Unicorn-37554.exe (PID: 13988)
- Unicorn-32727.exe (PID: 14288)
- Unicorn-32727.exe (PID: 14296)
- Unicorn-46463.exe (PID: 14272)
- Unicorn-46463.exe (PID: 14276)
- Unicorn-32072.exe (PID: 14320)
- Unicorn-7476.exe (PID: 14332)
- Unicorn-23904.exe (PID: 4040)
- Unicorn-37938.exe (PID: 7144)
- Unicorn-23904.exe (PID: 456)
- Unicorn-10169.exe (PID: 5036)
- Unicorn-32072.exe (PID: 14312)
- Unicorn-23904.exe (PID: 14304)
- Unicorn-23904.exe (PID: 5596)
- Unicorn-27897.exe (PID: 14448)
- Unicorn-10745.exe (PID: 14480)
- Unicorn-59291.exe (PID: 14512)
- Unicorn-30611.exe (PID: 14468)
- Unicorn-10745.exe (PID: 14488)
- Unicorn-10745.exe (PID: 14504)
- Unicorn-10745.exe (PID: 14492)
Reads the computer name
- 1 (250).exe (PID: 5280)
- Unicorn-36023.exe (PID: 4620)
- Unicorn-29177.exe (PID: 3888)
- Unicorn-22619.exe (PID: 4164)
- Unicorn-24107.exe (PID: 1056)
- Unicorn-43973.exe (PID: 5728)
- Unicorn-64485.exe (PID: 6192)
- Unicorn-31721.exe (PID: 1052)
- Unicorn-2509.exe (PID: 5008)
- Unicorn-30543.exe (PID: 5800)
- Unicorn-30543.exe (PID: 1660)
- Unicorn-11803.exe (PID: 5256)
- Unicorn-45488.exe (PID: 1228)
- Unicorn-5938.exe (PID: 7052)
- Unicorn-53101.exe (PID: 5156)
- Unicorn-65353.exe (PID: 5548)
- Unicorn-932.exe (PID: 1012)
- Unicorn-7730.exe (PID: 5360)
- Unicorn-9768.exe (PID: 1912)
- Unicorn-20729.exe (PID: 6592)
- Unicorn-5592.exe (PID: 736)
- Unicorn-48571.exe (PID: 6184)
- Unicorn-44487.exe (PID: 4988)
- Unicorn-56739.exe (PID: 4120)
- Unicorn-21663.exe (PID: 1812)
- Unicorn-12998.exe (PID: 7180)
- Unicorn-15798.exe (PID: 7188)
- Unicorn-36873.exe (PID: 6476)
- Unicorn-44487.exe (PID: 5404)
- Unicorn-2063.exe (PID: 7204)
- Unicorn-2063.exe (PID: 7196)
- Unicorn-23273.exe (PID: 7316)
- Unicorn-31441.exe (PID: 7360)
- Unicorn-42301.exe (PID: 7336)
- Unicorn-25310.exe (PID: 7352)
- Unicorn-41555.exe (PID: 7388)
- Unicorn-18997.exe (PID: 7428)
- Unicorn-17605.exe (PID: 7408)
- Unicorn-45374.exe (PID: 7444)
- Unicorn-1653.exe (PID: 7504)
- Unicorn-41939.exe (PID: 7540)
- Unicorn-58275.exe (PID: 7612)
- Unicorn-3599.exe (PID: 7644)
- Unicorn-46023.exe (PID: 7588)
- Unicorn-52800.exe (PID: 7560)
- Unicorn-15296.exe (PID: 7596)
- Unicorn-26587.exe (PID: 7784)
- Unicorn-42493.exe (PID: 7692)
- Unicorn-31633.exe (PID: 7712)
- Unicorn-42493.exe (PID: 7684)
- Unicorn-62359.exe (PID: 7700)
- Unicorn-39801.exe (PID: 7756)
- Unicorn-45923.exe (PID: 7828)
- Unicorn-30870.exe (PID: 7748)
- Unicorn-45923.exe (PID: 7776)
- Unicorn-51788.exe (PID: 7792)
- Unicorn-29586.exe (PID: 7676)
- Unicorn-10589.exe (PID: 7916)
- Unicorn-57097.exe (PID: 7908)
- Unicorn-32401.exe (PID: 7976)
- Unicorn-24233.exe (PID: 7952)
- Unicorn-59619.exe (PID: 8108)
- Unicorn-12556.exe (PID: 8048)
- Unicorn-17745.exe (PID: 7996)
- Unicorn-16641.exe (PID: 8084)
- Unicorn-31393.exe (PID: 4736)
- Unicorn-26270.exe (PID: 7960)
- Unicorn-32401.exe (PID: 7968)
- Unicorn-12364.exe (PID: 6824)
- Unicorn-63682.exe (PID: 7988)
- Unicorn-27501.exe (PID: 8076)
- Unicorn-23225.exe (PID: 6960)
- Unicorn-35669.exe (PID: 8116)
- Unicorn-10510.exe (PID: 8100)
- Unicorn-15878.exe (PID: 8124)
- Unicorn-63795.exe (PID: 8256)
- Unicorn-41913.exe (PID: 8316)
- Unicorn-63402.exe (PID: 8304)
- Unicorn-64371.exe (PID: 8360)
- Unicorn-41913.exe (PID: 8324)
- Unicorn-46552.exe (PID: 8368)
- Unicorn-64279.exe (PID: 8436)
- Unicorn-37637.exe (PID: 8420)
- Unicorn-29469.exe (PID: 8404)
- Unicorn-60771.exe (PID: 8516)
- Unicorn-21877.exe (PID: 8532)
- Unicorn-9624.exe (PID: 8476)
- Unicorn-21877.exe (PID: 8524)
- Unicorn-54641.exe (PID: 8500)
- Unicorn-27907.exe (PID: 8648)
- Unicorn-64855.exe (PID: 8580)
- Unicorn-48519.exe (PID: 8508)
- Unicorn-21877.exe (PID: 8484)
- Unicorn-2011.exe (PID: 8492)
- Unicorn-64855.exe (PID: 8592)
- Unicorn-21877.exe (PID: 8556)
- Unicorn-14071.exe (PID: 8748)
- Unicorn-16639.exe (PID: 8824)
- Unicorn-9332.exe (PID: 8832)
- Unicorn-25537.exe (PID: 8764)
- Unicorn-35975.exe (PID: 8804)
- Unicorn-15197.exe (PID: 8880)
- Unicorn-14071.exe (PID: 8740)
- Unicorn-62260.exe (PID: 8848)
- Unicorn-33672.exe (PID: 8784)
- Unicorn-7247.exe (PID: 9168)
- Unicorn-28483.exe (PID: 9124)
- Unicorn-3293.exe (PID: 3156)
- Unicorn-33234.exe (PID: 9160)
- Unicorn-19883.exe (PID: 1300)
- Unicorn-23221.exe (PID: 3332)
- Unicorn-662.exe (PID: 9232)
- Unicorn-42235.exe (PID: 9292)
- Unicorn-9925.exe (PID: 9368)
- Unicorn-29791.exe (PID: 9392)
- Unicorn-30537.exe (PID: 9320)
- Unicorn-64601.exe (PID: 9376)
- Unicorn-22500.exe (PID: 9468)
- Unicorn-44565.exe (PID: 9544)
- Unicorn-26182.exe (PID: 9528)
- Unicorn-57372.exe (PID: 9560)
- Unicorn-58763.exe (PID: 9592)
- Unicorn-49780.exe (PID: 9652)
- Unicorn-1970.exe (PID: 9704)
- Unicorn-5862.exe (PID: 9808)
- Unicorn-61185.exe (PID: 9788)
- Unicorn-1778.exe (PID: 9796)
- Unicorn-63899.exe (PID: 9836)
- Unicorn-20829.exe (PID: 9884)
- Unicorn-24812.exe (PID: 9952)
- Unicorn-60278.exe (PID: 9916)
- Unicorn-8476.exe (PID: 9924)
- Unicorn-8092.exe (PID: 9720)
- Unicorn-57200.exe (PID: 10020)
- Unicorn-16553.exe (PID: 9984)
- Unicorn-19821.exe (PID: 10004)
- Unicorn-16287.exe (PID: 9996)
- Unicorn-16553.exe (PID: 9976)
- Unicorn-57704.exe (PID: 10084)
- Unicorn-8768.exe (PID: 10120)
- Unicorn-29500.exe (PID: 968)
- Unicorn-22967.exe (PID: 10188)
Create files in a temporary directory
- Unicorn-22619.exe (PID: 4164)
- Unicorn-36023.exe (PID: 4620)
- Unicorn-29177.exe (PID: 3888)
- 1 (250).exe (PID: 5280)
- Unicorn-31721.exe (PID: 1052)
- Unicorn-43973.exe (PID: 5728)
- Unicorn-64485.exe (PID: 6192)
- Unicorn-2509.exe (PID: 5008)
- Unicorn-65353.exe (PID: 5548)
- Unicorn-30543.exe (PID: 1660)
- Unicorn-11803.exe (PID: 5256)
- Unicorn-5938.exe (PID: 7052)
- Unicorn-53101.exe (PID: 5156)
- Unicorn-20729.exe (PID: 6592)
- Unicorn-7730.exe (PID: 5360)
- Unicorn-9768.exe (PID: 1912)
- Unicorn-48571.exe (PID: 208)
- Unicorn-30543.exe (PID: 5800)
- Unicorn-44487.exe (PID: 4988)
- Unicorn-45488.exe (PID: 1228)
- Unicorn-12998.exe (PID: 7180)
- Unicorn-15798.exe (PID: 7188)
- Unicorn-2063.exe (PID: 7196)
- Unicorn-932.exe (PID: 1012)
- Unicorn-42301.exe (PID: 7336)
- Unicorn-25310.exe (PID: 7352)
- Unicorn-41555.exe (PID: 7388)
- Unicorn-17605.exe (PID: 7408)
- Unicorn-48571.exe (PID: 6184)
- Unicorn-1653.exe (PID: 7504)
- Unicorn-41939.exe (PID: 7540)
- Unicorn-52800.exe (PID: 7560)
- Unicorn-26157.exe (PID: 7580)
- Unicorn-15296.exe (PID: 7596)
- Unicorn-44487.exe (PID: 5404)
- Unicorn-56739.exe (PID: 4120)
- Unicorn-3599.exe (PID: 7644)
- Unicorn-9074.exe (PID: 7732)
- Unicorn-31633.exe (PID: 7712)
- Unicorn-29586.exe (PID: 7676)
- Unicorn-30870.exe (PID: 7748)
- Unicorn-42493.exe (PID: 7684)
- Unicorn-36873.exe (PID: 6476)
- Unicorn-45923.exe (PID: 7776)
- Unicorn-21663.exe (PID: 1812)
- Unicorn-24107.exe (PID: 1056)
- Unicorn-51788.exe (PID: 7792)
- Unicorn-2063.exe (PID: 7204)
- Unicorn-10589.exe (PID: 7916)
- Unicorn-57097.exe (PID: 7908)
- Unicorn-26587.exe (PID: 7784)
- Unicorn-31441.exe (PID: 7360)
- Unicorn-23273.exe (PID: 7316)
- Unicorn-32401.exe (PID: 7976)
- Unicorn-12556.exe (PID: 8048)
- Unicorn-16641.exe (PID: 8084)
- Unicorn-59619.exe (PID: 8108)
- Unicorn-32401.exe (PID: 7968)
- Unicorn-31393.exe (PID: 4736)
- Unicorn-26270.exe (PID: 7960)
- Unicorn-18997.exe (PID: 7428)
- Unicorn-27501.exe (PID: 8076)
- Unicorn-5592.exe (PID: 736)
- Unicorn-35669.exe (PID: 8116)
- Unicorn-23225.exe (PID: 6960)
- Unicorn-10510.exe (PID: 8100)
- Unicorn-12364.exe (PID: 6824)
- Unicorn-32785.exe (PID: 7156)
- Unicorn-52245.exe (PID: 7484)
- Unicorn-41337.exe (PID: 8200)
- Unicorn-63795.exe (PID: 8256)
- Unicorn-6810.exe (PID: 7524)
- Unicorn-37807.exe (PID: 8248)
- Unicorn-1373.exe (PID: 8240)
- Unicorn-58275.exe (PID: 7612)
- Unicorn-63402.exe (PID: 8304)
- Unicorn-41913.exe (PID: 8316)
- Unicorn-41913.exe (PID: 8324)
- Unicorn-29469.exe (PID: 8404)
- Unicorn-37637.exe (PID: 8420)
- Unicorn-46552.exe (PID: 8368)
- Unicorn-64371.exe (PID: 8360)
- Unicorn-15296.exe (PID: 7604)
- Unicorn-3573.exe (PID: 8352)
- Unicorn-21877.exe (PID: 8532)
- Unicorn-45923.exe (PID: 7828)
- Unicorn-9624.exe (PID: 8476)
- Unicorn-60771.exe (PID: 8516)
- Unicorn-21877.exe (PID: 8524)
- Unicorn-64855.exe (PID: 8580)
- Unicorn-46023.exe (PID: 7588)
- Unicorn-62359.exe (PID: 7700)
- Unicorn-21877.exe (PID: 8484)
- Unicorn-21877.exe (PID: 8556)
- Unicorn-39801.exe (PID: 7756)
- Unicorn-2011.exe (PID: 8492)
- Unicorn-64855.exe (PID: 8592)
- Unicorn-14071.exe (PID: 8748)
- Unicorn-16639.exe (PID: 8824)
- Unicorn-9332.exe (PID: 8832)
- Unicorn-25537.exe (PID: 8764)
- Unicorn-35975.exe (PID: 8804)
- Unicorn-22239.exe (PID: 8792)
- Unicorn-33672.exe (PID: 8784)
- Unicorn-61134.exe (PID: 8840)
- Unicorn-14071.exe (PID: 8756)
- Unicorn-29666.exe (PID: 8956)
- Unicorn-15197.exe (PID: 8880)
- Unicorn-48519.exe (PID: 8508)
- Unicorn-7247.exe (PID: 9168)
- Unicorn-28483.exe (PID: 9124)
- Unicorn-3293.exe (PID: 3156)
- Unicorn-33234.exe (PID: 9160)
- Unicorn-19883.exe (PID: 1300)
- Unicorn-24233.exe (PID: 7952)
- Unicorn-662.exe (PID: 9232)
- Unicorn-40111.exe (PID: 9276)
- Unicorn-23221.exe (PID: 3332)
- Unicorn-17745.exe (PID: 7996)
- Unicorn-30537.exe (PID: 9320)
- Unicorn-45374.exe (PID: 7444)
- Unicorn-62655.exe (PID: 9340)
- Unicorn-64601.exe (PID: 9376)
- Unicorn-9925.exe (PID: 9368)
- Unicorn-29791.exe (PID: 9392)
- Unicorn-63682.exe (PID: 7988)
- Unicorn-22500.exe (PID: 9468)
- Unicorn-7808.exe (PID: 9512)
- Unicorn-44565.exe (PID: 9544)
- Unicorn-26182.exe (PID: 9528)
- Unicorn-47367.exe (PID: 8092)
- Unicorn-57372.exe (PID: 9560)
- Unicorn-2770.exe (PID: 9564)
- Unicorn-58763.exe (PID: 9592)
- Unicorn-15878.exe (PID: 8124)
- Unicorn-49780.exe (PID: 9652)
- Unicorn-1970.exe (PID: 9704)
- Unicorn-5862.exe (PID: 9808)
- Unicorn-38462.exe (PID: 9748)
- Unicorn-8092.exe (PID: 9720)
- Unicorn-64279.exe (PID: 8436)
- Unicorn-61185.exe (PID: 9788)
- Unicorn-1778.exe (PID: 9796)
- Unicorn-59147.exe (PID: 9756)
- Unicorn-63899.exe (PID: 9836)
- Unicorn-24812.exe (PID: 9952)
- Unicorn-20829.exe (PID: 9884)
- Unicorn-17299.exe (PID: 9900)
- Unicorn-60278.exe (PID: 9916)
- Unicorn-42493.exe (PID: 7692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
543
Monitored processes
411
Malicious processes
61
Suspicious processes
60
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\Users\admin\AppData\Local\Temp\Unicorn-48571.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-48571.exe | Unicorn-30543.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 456 | C:\Users\admin\AppData\Local\Temp\Unicorn-23904.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-23904.exe | — | Unicorn-42493.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 736 | C:\Users\admin\AppData\Local\Temp\Unicorn-5592.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5592.exe | Unicorn-65353.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 968 | C:\Users\admin\AppData\Local\Temp\Unicorn-29500.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-29500.exe | Unicorn-30543.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1012 | C:\Users\admin\AppData\Local\Temp\Unicorn-932.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-932.exe | Unicorn-53101.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1052 | C:\Users\admin\AppData\Local\Temp\Unicorn-31721.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-31721.exe | Unicorn-36023.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1056 | C:\Users\admin\AppData\Local\Temp\Unicorn-24107.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24107.exe | Unicorn-22619.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1228 | C:\Users\admin\AppData\Local\Temp\Unicorn-45488.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-45488.exe | Unicorn-29177.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1244 | C:\Users\admin\AppData\Local\Temp\Unicorn-61424.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-61424.exe | — | Unicorn-31721.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1276 | C:\Users\admin\AppData\Local\Temp\Unicorn-26915.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-26915.exe | — | Unicorn-1373.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
8 101
Read events
8 101
Write events
0
Delete events
0
Modification events
Executable files
1 044
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4164 | Unicorn-22619.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-36023.exe | executable | |
MD5:986C046A95EA9FBE531028EE0290228A | SHA256:B461D1CFE12EA428D68326DC7189F6C5199CB04D23C2B0CFD8ACFF05E2507428 | |||
| 3888 | Unicorn-29177.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-43973.exe | executable | |
MD5:5916D429B38834C32E2BE8DE6AE4D285 | SHA256:E741B15566BEC44BBA074D473CF89F556327BBF1A3DC77706FD90CF9D864269C | |||
| 5280 | 1 (250).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-64485.exe | executable | |
MD5:57BF22C4970168F5EC9FA69082061C10 | SHA256:3900CED431D1A7C1B98B64BFAEC97685768BB141EB7A005B844D44D811258321 | |||
| 1052 | Unicorn-31721.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53101.exe | executable | |
MD5:C4A8508822E3EE1A2401E85E691218C4 | SHA256:93658F0B7FC2ADD952BFDE062AE28B97AC05ACA312B36832A2A1ECCA74BE2CFF | |||
| 4620 | Unicorn-36023.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-31721.exe | executable | |
MD5:F2C9AE9E0C3AD42F951DDB97F132DC9B | SHA256:BF30AB910A07F49FC56C71D00F7DFF52754C32A684442E4A7741CBAD62D0F424 | |||
| 5728 | Unicorn-43973.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-30543.exe | executable | |
MD5:DD48B6A1C442BB31D7F0E0424248868F | SHA256:199E7DD8C3AA2FEC2E29E14B2F62866911F558E3FE154AAA89B6F5BB59B0B192 | |||
| 4620 | Unicorn-36023.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-2509.exe | executable | |
MD5:EB27E82F6E11B0C938F879B148126780 | SHA256:DF5A710C9CACFE183F1673A37DD26E5549A8C4856ACA58843C61702DD7ACC053 | |||
| 6192 | Unicorn-64485.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-65353.exe | executable | |
MD5:92220224749722DE4D95D23DFE675B4E | SHA256:71928FEF775D3EF9B7152C1301DD7BD05CEEA1FEDC45940CC951C7A5EA044287 | |||
| 4164 | Unicorn-22619.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5938.exe | executable | |
MD5:97097C945250DB1F82965A9CED48FEB8 | SHA256:35AB8C92A54B05F139321ACB0DA16E8204D39DD9382AC354F613F83C1FB1B06A | |||
| 5156 | Unicorn-53101.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-932.exe | executable | |
MD5:335151E0C9B8FD8C275D21881A20C48C | SHA256:2F2A294D667CBF82A1984CAA0394697C68FCB16F9331177897CFC954EB361708 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
23
DNS requests
15
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
8940 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.53.40.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6800 | backgroundTaskHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
8940 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 23.53.40.176:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
2104 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2112 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3216 | svchost.exe | 20.198.162.78:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | SG | whitelisted |
6544 | svchost.exe | 20.190.159.131:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 23.54.109.203:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
6800 | backgroundTaskHost.exe | 20.223.35.26:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6800 | backgroundTaskHost.exe | 23.54.109.203:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |