| File name: | 1 (174) |
| Full analysis: | https://app.any.run/tasks/be408f61-1541-4a04-9303-91388f4f3eb8 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 16:53:28 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 3F6896E59A78091D40C8261866761AE0 |
| SHA1: | 4A847EB3A16A2CB8F91CABB4899D513DCA8C7863 |
| SHA256: | E241E62C9EBB90A0C361726433B1869500F01B43B6E71430D6792605FC7F9C75 |
| SSDEEP: | 6144:U7N9DsItGDKoATlJhaYQGofx5tBqZvJG5C/W0eahTk/8S3jwpyAAEgLKf39pPHUT:Uh1b5oATPhvOBghaCO0eahwu4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- 1 (174).exe (PID: 300)
- Unicorn-8858.exe (PID: 7332)
- Unicorn-16885.exe (PID: 7404)
- Unicorn-45932.exe (PID: 7572)
- Unicorn-29020.exe (PID: 7648)
- Unicorn-33104.exe (PID: 7628)
- Unicorn-53259.exe (PID: 7696)
- Unicorn-59964.exe (PID: 7396)
- Unicorn-40046.exe (PID: 6676)
- Unicorn-43576.exe (PID: 4408)
- Unicorn-28392.exe (PID: 856)
- Unicorn-20224.exe (PID: 7512)
- Unicorn-20224.exe (PID: 7544)
- Unicorn-20224.exe (PID: 7524)
- Unicorn-33104.exe (PID: 7636)
- Unicorn-33658.exe (PID: 7672)
- Unicorn-16886.exe (PID: 7784)
- Unicorn-17515.exe (PID: 7516)
- Unicorn-6580.exe (PID: 7480)
- Unicorn-46036.exe (PID: 6264)
- Unicorn-58288.exe (PID: 4244)
- Unicorn-60763.exe (PID: 8072)
- Unicorn-64188.exe (PID: 5400)
- Unicorn-2839.exe (PID: 8052)
- Unicorn-18792.exe (PID: 8092)
- Unicorn-20224.exe (PID: 7536)
- Unicorn-10623.exe (PID: 8108)
- Unicorn-35320.exe (PID: 8128)
- Unicorn-18792.exe (PID: 2504)
- Unicorn-31790.exe (PID: 8156)
- Unicorn-5963.exe (PID: 3888)
- Unicorn-43488.exe (PID: 6240)
- Unicorn-19538.exe (PID: 8004)
- Unicorn-5453.exe (PID: 6372)
- Unicorn-30621.exe (PID: 7760)
- Unicorn-43488.exe (PID: 8008)
- Unicorn-23622.exe (PID: 8016)
- Unicorn-43488.exe (PID: 7988)
- Unicorn-5453.exe (PID: 6228)
- Unicorn-11318.exe (PID: 5204)
- Unicorn-19752.exe (PID: 7236)
- Unicorn-60784.exe (PID: 5548)
- Unicorn-40836.exe (PID: 7644)
- Unicorn-43488.exe (PID: 8036)
- Unicorn-20970.exe (PID: 7736)
- Unicorn-57255.exe (PID: 4200)
- Unicorn-40940.exe (PID: 4652)
- Unicorn-31790.exe (PID: 8148)
- Unicorn-45024.exe (PID: 3268)
- Unicorn-21022.exe (PID: 7356)
- Unicorn-42454.exe (PID: 7352)
- Unicorn-62927.exe (PID: 3896)
- Unicorn-15157.exe (PID: 2240)
- Unicorn-58791.exe (PID: 5352)
- Unicorn-2905.exe (PID: 5360)
- Unicorn-6710.exe (PID: 7904)
- Unicorn-14773.exe (PID: 7964)
- Unicorn-22226.exe (PID: 7960)
- Unicorn-483.exe (PID: 7956)
- Unicorn-54344.exe (PID: 5328)
- Unicorn-60784.exe (PID: 6388)
- Unicorn-6451.exe (PID: 4336)
- Unicorn-11282.exe (PID: 8216)
- Unicorn-22980.exe (PID: 8196)
- Unicorn-51739.exe (PID: 8300)
- Unicorn-27256.exe (PID: 8248)
- Unicorn-52315.exe (PID: 8232)
- Unicorn-31318.exe (PID: 8288)
- Unicorn-5963.exe (PID: 7296)
- Unicorn-39508.exe (PID: 8268)
- Unicorn-11090.exe (PID: 8396)
- Unicorn-19258.exe (PID: 8364)
- Unicorn-51376.exe (PID: 8324)
- Unicorn-60696.exe (PID: 8424)
- Unicorn-11090.exe (PID: 8380)
- Unicorn-12573.exe (PID: 8388)
- Unicorn-43208.exe (PID: 8348)
- Unicorn-13533.exe (PID: 8408)
- Unicorn-19258.exe (PID: 8356)
- Unicorn-2751.exe (PID: 8564)
- Unicorn-43784.exe (PID: 8580)
- Unicorn-12242.exe (PID: 8532)
- Unicorn-4981.exe (PID: 8600)
- Unicorn-10919.exe (PID: 8552)
- Unicorn-23556.exe (PID: 8644)
- Unicorn-22487.exe (PID: 8676)
- Unicorn-22487.exe (PID: 8720)
- Unicorn-3333.exe (PID: 8812)
- Unicorn-43976.exe (PID: 8756)
- Unicorn-65356.exe (PID: 8712)
- Unicorn-19472.exe (PID: 8652)
- Unicorn-31737.exe (PID: 5892)
- Unicorn-43976.exe (PID: 8684)
- Unicorn-61272.exe (PID: 8692)
- Unicorn-57935.exe (PID: 8828)
- Unicorn-23182.exe (PID: 8852)
- Unicorn-41406.exe (PID: 8776)
- Unicorn-57935.exe (PID: 8920)
- Unicorn-10814.exe (PID: 5800)
- Unicorn-30149.exe (PID: 6476)
- Unicorn-57472.exe (PID: 8888)
- Unicorn-11111.exe (PID: 8608)
- Unicorn-49575.exe (PID: 8748)
- Unicorn-3863.exe (PID: 8804)
- Unicorn-23447.exe (PID: 8844)
- Unicorn-21392.exe (PID: 9140)
- Unicorn-21392.exe (PID: 9148)
- Unicorn-21370.exe (PID: 720)
- Unicorn-4287.exe (PID: 9188)
- Unicorn-5034.exe (PID: 7020)
- Unicorn-53680.exe (PID: 1056)
- Unicorn-53192.exe (PID: 5304)
- Unicorn-53680.exe (PID: 3240)
- Unicorn-41428.exe (PID: 9232)
- Unicorn-203.exe (PID: 9196)
- Unicorn-58791.exe (PID: 6576)
- Unicorn-21008.exe (PID: 9224)
- Unicorn-41428.exe (PID: 9240)
- Unicorn-42942.exe (PID: 9284)
- Unicorn-54832.exe (PID: 9392)
- Unicorn-5439.exe (PID: 9308)
- Unicorn-54707.exe (PID: 1568)
- Unicorn-7669.exe (PID: 9368)
- Unicorn-48702.exe (PID: 9360)
- Unicorn-56294.exe (PID: 9452)
- Unicorn-25668.exe (PID: 9476)
- Unicorn-62159.exe (PID: 9444)
- Unicorn-15453.exe (PID: 9488)
- Unicorn-21318.exe (PID: 9500)
- Unicorn-5942.exe (PID: 9584)
- Unicorn-60047.exe (PID: 9576)
- Unicorn-2486.exe (PID: 9620)
- Unicorn-38666.exe (PID: 9528)
- Unicorn-4022.exe (PID: 9784)
- Unicorn-48776.exe (PID: 9768)
- Unicorn-9414.exe (PID: 9872)
- Unicorn-29280.exe (PID: 9880)
- Unicorn-49508.exe (PID: 9812)
- Unicorn-56398.exe (PID: 9928)
- Unicorn-41724.exe (PID: 9964)
- Unicorn-9627.exe (PID: 9944)
- Unicorn-31532.exe (PID: 8636)
- Unicorn-19258.exe (PID: 8372)
- Unicorn-35262.exe (PID: 10032)
- Unicorn-11998.exe (PID: 8820)
- Unicorn-32661.exe (PID: 10076)
- Unicorn-17316.exe (PID: 8736)
- Unicorn-24685.exe (PID: 10112)
- Unicorn-5543.exe (PID: 10152)
- Unicorn-49766.exe (PID: 10200)
- Unicorn-4479.exe (PID: 2692)
- Unicorn-60172.exe (PID: 8860)
- Unicorn-52122.exe (PID: 10004)
- Unicorn-51044.exe (PID: 10040)
- Unicorn-48496.exe (PID: 10284)
- Unicorn-15824.exe (PID: 10312)
- Unicorn-43452.exe (PID: 1764)
- Unicorn-60940.exe (PID: 10400)
- Unicorn-9051.exe (PID: 9984)
- Unicorn-57935.exe (PID: 8836)
- Unicorn-31754.exe (PID: 664)
- Unicorn-56280.exe (PID: 10436)
- Unicorn-15439.exe (PID: 10492)
- Unicorn-7079.exe (PID: 10472)
- Unicorn-9885.exe (PID: 10412)
- Unicorn-16029.exe (PID: 9408)
- Unicorn-18455.exe (PID: 10520)
- Unicorn-7655.exe (PID: 10376)
- Unicorn-35537.exe (PID: 10544)
- Unicorn-64126.exe (PID: 10512)
- Unicorn-46726.exe (PID: 8620)
- Unicorn-54426.exe (PID: 10564)
- Unicorn-46066.exe (PID: 10444)
- Unicorn-25314.exe (PID: 10600)
- Unicorn-53083.exe (PID: 10584)
- Unicorn-30881.exe (PID: 10676)
- Unicorn-53348.exe (PID: 10592)
- Unicorn-24760.exe (PID: 10636)
- Unicorn-40831.exe (PID: 10656)
- Unicorn-49435.exe (PID: 10736)
- Unicorn-34412.exe (PID: 9424)
- Unicorn-33098.exe (PID: 10712)
- Unicorn-49404.exe (PID: 9172)
- Unicorn-57240.exe (PID: 10792)
- Unicorn-8039.exe (PID: 10824)
- Unicorn-8999.exe (PID: 10908)
- Unicorn-36711.exe (PID: 10872)
- Unicorn-50032.exe (PID: 10884)
- Unicorn-36820.exe (PID: 10852)
- Unicorn-38526.exe (PID: 11072)
- Unicorn-57240.exe (PID: 10784)
- Unicorn-62284.exe (PID: 10920)
- Unicorn-25528.exe (PID: 10936)
- Unicorn-62284.exe (PID: 10924)
Starts itself from another location
- Unicorn-8858.exe (PID: 7332)
- Unicorn-59964.exe (PID: 7396)
- Unicorn-16885.exe (PID: 7404)
- 1 (174).exe (PID: 300)
- Unicorn-45932.exe (PID: 7572)
- Unicorn-33104.exe (PID: 7628)
- Unicorn-33104.exe (PID: 7636)
- Unicorn-29020.exe (PID: 7648)
- Unicorn-33658.exe (PID: 7672)
- Unicorn-53259.exe (PID: 7696)
- Unicorn-43576.exe (PID: 4408)
- Unicorn-28392.exe (PID: 856)
- Unicorn-20224.exe (PID: 7512)
- Unicorn-20224.exe (PID: 7536)
- Unicorn-20224.exe (PID: 7544)
- Unicorn-20224.exe (PID: 7524)
- Unicorn-40046.exe (PID: 6676)
- Unicorn-30621.exe (PID: 7760)
- Unicorn-16886.exe (PID: 7784)
- Unicorn-62927.exe (PID: 3896)
- Unicorn-6710.exe (PID: 7904)
- Unicorn-64188.exe (PID: 5400)
- Unicorn-2839.exe (PID: 8052)
- Unicorn-60763.exe (PID: 8072)
- Unicorn-10623.exe (PID: 8108)
- Unicorn-35320.exe (PID: 8128)
- Unicorn-6580.exe (PID: 7480)
- Unicorn-17515.exe (PID: 7516)
- Unicorn-18792.exe (PID: 2504)
- Unicorn-31790.exe (PID: 8148)
- Unicorn-31790.exe (PID: 8156)
- Unicorn-46036.exe (PID: 6264)
- Unicorn-5963.exe (PID: 7296)
- Unicorn-43488.exe (PID: 6240)
- Unicorn-19538.exe (PID: 8004)
- Unicorn-43488.exe (PID: 8008)
- Unicorn-23622.exe (PID: 8016)
- Unicorn-5453.exe (PID: 6372)
- Unicorn-11318.exe (PID: 5204)
- Unicorn-19752.exe (PID: 7236)
- Unicorn-60784.exe (PID: 5548)
- Unicorn-43488.exe (PID: 8036)
- Unicorn-40836.exe (PID: 7644)
- Unicorn-43488.exe (PID: 7988)
- Unicorn-5453.exe (PID: 6228)
- Unicorn-10814.exe (PID: 5800)
- Unicorn-57255.exe (PID: 4200)
- Unicorn-30149.exe (PID: 6476)
- Unicorn-53192.exe (PID: 5304)
- Unicorn-40940.exe (PID: 4652)
- Unicorn-45024.exe (PID: 3268)
- Unicorn-58791.exe (PID: 5352)
- Unicorn-58791.exe (PID: 6576)
- Unicorn-15157.exe (PID: 2240)
- Unicorn-21022.exe (PID: 7356)
- Unicorn-2905.exe (PID: 5360)
- Unicorn-54707.exe (PID: 1568)
- Unicorn-22226.exe (PID: 7960)
- Unicorn-14773.exe (PID: 7964)
- Unicorn-483.exe (PID: 7956)
- Unicorn-54344.exe (PID: 5328)
- Unicorn-60784.exe (PID: 6388)
- Unicorn-22980.exe (PID: 8196)
- Unicorn-6451.exe (PID: 4336)
- Unicorn-11282.exe (PID: 8216)
- Unicorn-51739.exe (PID: 8300)
- Unicorn-27256.exe (PID: 8248)
- Unicorn-18792.exe (PID: 8092)
- Unicorn-31318.exe (PID: 8288)
- Unicorn-52315.exe (PID: 8232)
- Unicorn-42454.exe (PID: 7352)
- Unicorn-39508.exe (PID: 8268)
- Unicorn-19258.exe (PID: 8364)
- Unicorn-51376.exe (PID: 8324)
- Unicorn-12573.exe (PID: 8388)
- Unicorn-13533.exe (PID: 8408)
- Unicorn-19258.exe (PID: 8356)
- Unicorn-58288.exe (PID: 4244)
- Unicorn-5963.exe (PID: 3888)
- Unicorn-43784.exe (PID: 8580)
- Unicorn-12242.exe (PID: 8532)
- Unicorn-2751.exe (PID: 8564)
- Unicorn-31532.exe (PID: 8636)
- Unicorn-4981.exe (PID: 8600)
- Unicorn-19258.exe (PID: 8372)
- Unicorn-23556.exe (PID: 8644)
- Unicorn-43976.exe (PID: 8756)
- Unicorn-22487.exe (PID: 8720)
- Unicorn-3333.exe (PID: 8812)
- Unicorn-46726.exe (PID: 8620)
- Unicorn-22487.exe (PID: 8676)
- Unicorn-19472.exe (PID: 8652)
- Unicorn-65356.exe (PID: 8712)
- Unicorn-43976.exe (PID: 8684)
- Unicorn-61272.exe (PID: 8692)
- Unicorn-11998.exe (PID: 8820)
- Unicorn-57935.exe (PID: 8836)
- Unicorn-57935.exe (PID: 8828)
- Unicorn-31737.exe (PID: 5892)
- Unicorn-11111.exe (PID: 8608)
- Unicorn-57472.exe (PID: 8888)
- Unicorn-49575.exe (PID: 8748)
- Unicorn-57935.exe (PID: 8920)
- Unicorn-17316.exe (PID: 8736)
- Unicorn-3863.exe (PID: 8804)
- Unicorn-23447.exe (PID: 8844)
- Unicorn-20970.exe (PID: 7736)
- Unicorn-21392.exe (PID: 9140)
- Unicorn-21392.exe (PID: 9148)
- Unicorn-21370.exe (PID: 720)
- Unicorn-5034.exe (PID: 7020)
- Unicorn-4287.exe (PID: 9188)
- Unicorn-53680.exe (PID: 1056)
- Unicorn-41428.exe (PID: 9232)
- Unicorn-53680.exe (PID: 3240)
- Unicorn-49404.exe (PID: 9172)
- Unicorn-41428.exe (PID: 9240)
- Unicorn-10919.exe (PID: 8552)
- Unicorn-4479.exe (PID: 2692)
- Unicorn-42942.exe (PID: 9284)
- Unicorn-54832.exe (PID: 9392)
- Unicorn-41406.exe (PID: 8776)
- Unicorn-5439.exe (PID: 9308)
- Unicorn-48702.exe (PID: 9360)
- Unicorn-7669.exe (PID: 9368)
- Unicorn-16029.exe (PID: 9408)
- Unicorn-56294.exe (PID: 9452)
- Unicorn-25668.exe (PID: 9476)
- Unicorn-62159.exe (PID: 9444)
- Unicorn-21318.exe (PID: 9500)
- Unicorn-34412.exe (PID: 9424)
- Unicorn-15453.exe (PID: 9488)
- Unicorn-38666.exe (PID: 9528)
- Unicorn-60047.exe (PID: 9576)
- Unicorn-5942.exe (PID: 9584)
- Unicorn-2486.exe (PID: 9620)
- Unicorn-4022.exe (PID: 9784)
- Unicorn-48776.exe (PID: 9768)
- Unicorn-9414.exe (PID: 9872)
- Unicorn-11090.exe (PID: 8396)
- Unicorn-29280.exe (PID: 9880)
- Unicorn-49508.exe (PID: 9812)
- Unicorn-60696.exe (PID: 8424)
- Unicorn-56398.exe (PID: 9928)
- Unicorn-43208.exe (PID: 8348)
- Unicorn-11090.exe (PID: 8380)
- Unicorn-41724.exe (PID: 9964)
- Unicorn-9627.exe (PID: 9944)
- Unicorn-51044.exe (PID: 10040)
- Unicorn-35262.exe (PID: 10032)
- Unicorn-9051.exe (PID: 9984)
- Unicorn-52122.exe (PID: 10004)
INFO
The sample compiled with chinese language support
- 1 (174).exe (PID: 300)
- Unicorn-52122.exe (PID: 10004)
- Unicorn-61272.exe (PID: 8692)
- Unicorn-65356.exe (PID: 8712)
- Unicorn-29020.exe (PID: 7648)
- Unicorn-19472.exe (PID: 8652)
- Unicorn-43488.exe (PID: 7988)
- Unicorn-57935.exe (PID: 8836)
- Unicorn-19538.exe (PID: 8004)
- Unicorn-9051.exe (PID: 9984)
- Unicorn-51044.exe (PID: 10040)
- Unicorn-10814.exe (PID: 5800)
- Unicorn-59964.exe (PID: 7396)
- Unicorn-30149.exe (PID: 6476)
- Unicorn-16885.exe (PID: 7404)
- Unicorn-56280.exe (PID: 10436)
- Unicorn-57472.exe (PID: 8888)
- Unicorn-8858.exe (PID: 7332)
- Unicorn-11318.exe (PID: 5204)
- Unicorn-43488.exe (PID: 8036)
- Unicorn-23447.exe (PID: 8844)
- Unicorn-20970.exe (PID: 7736)
- Unicorn-23622.exe (PID: 8016)
- Unicorn-32661.exe (PID: 10076)
- Unicorn-31737.exe (PID: 5892)
- Unicorn-11111.exe (PID: 8608)
- Unicorn-5453.exe (PID: 6228)
- Unicorn-49575.exe (PID: 8748)
- Unicorn-24685.exe (PID: 10112)
- Unicorn-33658.exe (PID: 7672)
- Unicorn-42942.exe (PID: 9284)
- Unicorn-57255.exe (PID: 4200)
- Unicorn-5034.exe (PID: 7020)
- Unicorn-4287.exe (PID: 9188)
- Unicorn-62927.exe (PID: 3896)
- Unicorn-58791.exe (PID: 6576)
- Unicorn-54832.exe (PID: 9392)
- Unicorn-42454.exe (PID: 7352)
- Unicorn-15439.exe (PID: 10492)
- Unicorn-58791.exe (PID: 5352)
- Unicorn-21392.exe (PID: 9148)
- Unicorn-53680.exe (PID: 1056)
- Unicorn-7079.exe (PID: 10472)
- Unicorn-16886.exe (PID: 7784)
- Unicorn-21370.exe (PID: 720)
- Unicorn-6710.exe (PID: 7904)
- Unicorn-40940.exe (PID: 4652)
- Unicorn-48702.exe (PID: 9360)
- Unicorn-3863.exe (PID: 8804)
- Unicorn-57935.exe (PID: 8920)
- Unicorn-22226.exe (PID: 7960)
- Unicorn-41428.exe (PID: 9232)
- Unicorn-49766.exe (PID: 10200)
- Unicorn-203.exe (PID: 9196)
- Unicorn-41406.exe (PID: 8776)
- Unicorn-5543.exe (PID: 10152)
- Unicorn-9885.exe (PID: 10412)
- Unicorn-21008.exe (PID: 9224)
- Unicorn-40046.exe (PID: 6676)
- Unicorn-7669.exe (PID: 9368)
- Unicorn-483.exe (PID: 7956)
- Unicorn-45932.exe (PID: 7572)
- Unicorn-16029.exe (PID: 9408)
- Unicorn-64188.exe (PID: 5400)
- Unicorn-60784.exe (PID: 6388)
- Unicorn-18455.exe (PID: 10520)
- Unicorn-25668.exe (PID: 9476)
- Unicorn-54344.exe (PID: 5328)
- Unicorn-21318.exe (PID: 9500)
- Unicorn-28392.exe (PID: 856)
- Unicorn-60763.exe (PID: 8072)
- Unicorn-38666.exe (PID: 9528)
- Unicorn-7655.exe (PID: 10376)
- Unicorn-5439.exe (PID: 9308)
- Unicorn-14773.exe (PID: 7964)
- Unicorn-60047.exe (PID: 9576)
- Unicorn-2905.exe (PID: 5360)
- Unicorn-22980.exe (PID: 8196)
- Unicorn-18792.exe (PID: 2504)
- Unicorn-60172.exe (PID: 8860)
- Unicorn-6451.exe (PID: 4336)
- Unicorn-11282.exe (PID: 8216)
- Unicorn-18792.exe (PID: 8092)
- Unicorn-27256.exe (PID: 8248)
- Unicorn-48776.exe (PID: 9768)
- Unicorn-20224.exe (PID: 7512)
- Unicorn-35537.exe (PID: 10544)
- Unicorn-2839.exe (PID: 8052)
- Unicorn-33104.exe (PID: 7628)
- Unicorn-53680.exe (PID: 3240)
- Unicorn-31754.exe (PID: 664)
- Unicorn-10623.exe (PID: 8108)
- Unicorn-52315.exe (PID: 8232)
- Unicorn-20224.exe (PID: 7544)
- Unicorn-35320.exe (PID: 8128)
- Unicorn-20224.exe (PID: 7536)
- Unicorn-11090.exe (PID: 8396)
- Unicorn-64126.exe (PID: 10512)
- Unicorn-5963.exe (PID: 7296)
- Unicorn-48496.exe (PID: 10284)
- Unicorn-39508.exe (PID: 8268)
- Unicorn-9414.exe (PID: 9872)
- Unicorn-29280.exe (PID: 9880)
- Unicorn-2486.exe (PID: 9620)
- Unicorn-4022.exe (PID: 9784)
- Unicorn-20224.exe (PID: 7524)
- Unicorn-51739.exe (PID: 8300)
- Unicorn-49508.exe (PID: 9812)
- Unicorn-31790.exe (PID: 8148)
- Unicorn-46036.exe (PID: 6264)
- Unicorn-56398.exe (PID: 9928)
- Unicorn-43452.exe (PID: 1764)
- Unicorn-2751.exe (PID: 8564)
- Unicorn-30621.exe (PID: 7760)
- Unicorn-13533.exe (PID: 8408)
- Unicorn-31790.exe (PID: 8156)
- Unicorn-5963.exe (PID: 3888)
- Unicorn-43784.exe (PID: 8580)
- Unicorn-9627.exe (PID: 9944)
- Unicorn-33104.exe (PID: 7636)
- Unicorn-11090.exe (PID: 8380)
- Unicorn-19258.exe (PID: 8364)
- Unicorn-51376.exe (PID: 8324)
- Unicorn-60696.exe (PID: 8424)
- Unicorn-19258.exe (PID: 8372)
- Unicorn-4981.exe (PID: 8600)
- Unicorn-60940.exe (PID: 10400)
- Unicorn-11998.exe (PID: 8820)
- Unicorn-43976.exe (PID: 8684)
- Unicorn-57935.exe (PID: 8828)
- Unicorn-35262.exe (PID: 10032)
- Unicorn-23182.exe (PID: 8852)
- Unicorn-54426.exe (PID: 10564)
- Unicorn-17316.exe (PID: 8736)
- Unicorn-5453.exe (PID: 6372)
- Unicorn-43488.exe (PID: 8008)
- Unicorn-31532.exe (PID: 8636)
- Unicorn-22487.exe (PID: 8676)
- Unicorn-19258.exe (PID: 8356)
- Unicorn-21022.exe (PID: 7356)
- Unicorn-53259.exe (PID: 7696)
- Unicorn-46066.exe (PID: 10444)
- Unicorn-5942.exe (PID: 9584)
- Unicorn-10919.exe (PID: 8552)
- Unicorn-41428.exe (PID: 9240)
- Unicorn-25314.exe (PID: 10600)
- Unicorn-53083.exe (PID: 10584)
- Unicorn-30881.exe (PID: 10676)
- Unicorn-6580.exe (PID: 7480)
- Unicorn-60784.exe (PID: 5548)
- Unicorn-40836.exe (PID: 7644)
- Unicorn-12573.exe (PID: 8388)
- Unicorn-53348.exe (PID: 10592)
- Unicorn-15157.exe (PID: 2240)
- Unicorn-24760.exe (PID: 10636)
- Unicorn-17515.exe (PID: 7516)
- Unicorn-43576.exe (PID: 4408)
- Unicorn-58288.exe (PID: 4244)
- Unicorn-43488.exe (PID: 6240)
- Unicorn-15824.exe (PID: 10312)
- Unicorn-40831.exe (PID: 10656)
- Unicorn-41724.exe (PID: 9964)
- Unicorn-21392.exe (PID: 9140)
- Unicorn-34412.exe (PID: 9424)
- Unicorn-62159.exe (PID: 9444)
- Unicorn-4479.exe (PID: 2692)
- Unicorn-46726.exe (PID: 8620)
- Unicorn-23556.exe (PID: 8644)
- Unicorn-19752.exe (PID: 7236)
- Unicorn-43976.exe (PID: 8756)
- Unicorn-49404.exe (PID: 9172)
- Unicorn-15453.exe (PID: 9488)
- Unicorn-56294.exe (PID: 9452)
- Unicorn-31318.exe (PID: 8288)
- Unicorn-54707.exe (PID: 1568)
- Unicorn-53192.exe (PID: 5304)
- Unicorn-49435.exe (PID: 10736)
- Unicorn-33098.exe (PID: 10712)
- Unicorn-8039.exe (PID: 10824)
- Unicorn-8999.exe (PID: 10908)
- Unicorn-36711.exe (PID: 10872)
- Unicorn-50032.exe (PID: 10884)
- Unicorn-3333.exe (PID: 8812)
- Unicorn-62284.exe (PID: 10920)
- Unicorn-36820.exe (PID: 10852)
- Unicorn-57240.exe (PID: 10792)
- Unicorn-57240.exe (PID: 10784)
- Unicorn-45024.exe (PID: 3268)
- Unicorn-12242.exe (PID: 8532)
- Unicorn-62284.exe (PID: 10924)
- Unicorn-25528.exe (PID: 10936)
- Unicorn-38526.exe (PID: 11072)
Create files in a temporary directory
- Unicorn-8858.exe (PID: 7332)
- 1 (174).exe (PID: 300)
- Unicorn-16885.exe (PID: 7404)
- Unicorn-59964.exe (PID: 7396)
- Unicorn-43576.exe (PID: 4408)
- Unicorn-40046.exe (PID: 6676)
- Unicorn-33104.exe (PID: 7628)
- Unicorn-28392.exe (PID: 856)
- Unicorn-20224.exe (PID: 7512)
- Unicorn-20224.exe (PID: 7544)
- Unicorn-16886.exe (PID: 7784)
- Unicorn-33658.exe (PID: 7672)
- Unicorn-17515.exe (PID: 7516)
- Unicorn-6580.exe (PID: 7480)
- Unicorn-58288.exe (PID: 4244)
- Unicorn-45932.exe (PID: 7572)
- Unicorn-46036.exe (PID: 6264)
- Unicorn-2839.exe (PID: 8052)
- Unicorn-18792.exe (PID: 8092)
- Unicorn-20224.exe (PID: 7536)
- Unicorn-35320.exe (PID: 8128)
- Unicorn-31790.exe (PID: 8156)
- Unicorn-33104.exe (PID: 7636)
- Unicorn-43488.exe (PID: 6240)
- Unicorn-30621.exe (PID: 7760)
- Unicorn-19538.exe (PID: 8004)
- Unicorn-29020.exe (PID: 7648)
- Unicorn-5453.exe (PID: 6228)
- Unicorn-11318.exe (PID: 5204)
- Unicorn-5453.exe (PID: 6372)
- Unicorn-19752.exe (PID: 7236)
- Unicorn-60784.exe (PID: 5548)
- Unicorn-43488.exe (PID: 8036)
- Unicorn-40836.exe (PID: 7644)
- Unicorn-20970.exe (PID: 7736)
- Unicorn-53259.exe (PID: 7696)
- Unicorn-62927.exe (PID: 3896)
- Unicorn-15157.exe (PID: 2240)
- Unicorn-42454.exe (PID: 7352)
- Unicorn-58791.exe (PID: 5352)
- Unicorn-6710.exe (PID: 7904)
- Unicorn-2905.exe (PID: 5360)
- Unicorn-54344.exe (PID: 5328)
- Unicorn-60784.exe (PID: 6388)
- Unicorn-22980.exe (PID: 8196)
- Unicorn-18792.exe (PID: 2504)
- Unicorn-11282.exe (PID: 8216)
- Unicorn-52315.exe (PID: 8232)
- Unicorn-31318.exe (PID: 8288)
- Unicorn-20224.exe (PID: 7524)
- Unicorn-39508.exe (PID: 8268)
- Unicorn-19258.exe (PID: 8356)
- Unicorn-11090.exe (PID: 8380)
- Unicorn-43208.exe (PID: 8348)
- Unicorn-31790.exe (PID: 8148)
- Unicorn-2751.exe (PID: 8564)
- Unicorn-43784.exe (PID: 8580)
- Unicorn-23556.exe (PID: 8644)
- Unicorn-43488.exe (PID: 8008)
- Unicorn-22487.exe (PID: 8720)
- Unicorn-22487.exe (PID: 8676)
- Unicorn-3333.exe (PID: 8812)
- Unicorn-43976.exe (PID: 8684)
- Unicorn-43488.exe (PID: 7988)
- Unicorn-57935.exe (PID: 8828)
- Unicorn-57935.exe (PID: 8836)
- Unicorn-41406.exe (PID: 8776)
- Unicorn-49575.exe (PID: 8748)
- Unicorn-57472.exe (PID: 8888)
- Unicorn-11111.exe (PID: 8608)
- Unicorn-23447.exe (PID: 8844)
- Unicorn-57255.exe (PID: 4200)
- Unicorn-21392.exe (PID: 9140)
- Unicorn-21392.exe (PID: 9148)
- Unicorn-21370.exe (PID: 720)
- Unicorn-4287.exe (PID: 9188)
- Unicorn-40940.exe (PID: 4652)
- Unicorn-53192.exe (PID: 5304)
- Unicorn-53680.exe (PID: 3240)
- Unicorn-41428.exe (PID: 9232)
- Unicorn-10919.exe (PID: 8552)
- Unicorn-203.exe (PID: 9196)
- Unicorn-21022.exe (PID: 7356)
- Unicorn-21008.exe (PID: 9224)
- Unicorn-54832.exe (PID: 9392)
- Unicorn-5439.exe (PID: 9308)
- Unicorn-42942.exe (PID: 9284)
- Unicorn-54707.exe (PID: 1568)
- Unicorn-22226.exe (PID: 7960)
- Unicorn-14773.exe (PID: 7964)
- Unicorn-48702.exe (PID: 9360)
- Unicorn-64188.exe (PID: 5400)
- Unicorn-56294.exe (PID: 9452)
- Unicorn-483.exe (PID: 7956)
- Unicorn-21318.exe (PID: 9500)
- Unicorn-15453.exe (PID: 9488)
- Unicorn-60763.exe (PID: 8072)
- Unicorn-62159.exe (PID: 9444)
- Unicorn-5942.exe (PID: 9584)
- Unicorn-60047.exe (PID: 9576)
- Unicorn-2486.exe (PID: 9620)
- Unicorn-38666.exe (PID: 9528)
- Unicorn-6451.exe (PID: 4336)
- Unicorn-27256.exe (PID: 8248)
- Unicorn-11090.exe (PID: 8396)
- Unicorn-5963.exe (PID: 7296)
- Unicorn-9414.exe (PID: 9872)
- Unicorn-60696.exe (PID: 8424)
- Unicorn-13533.exe (PID: 8408)
- Unicorn-19258.exe (PID: 8364)
- Unicorn-65356.exe (PID: 8712)
- Unicorn-31737.exe (PID: 5892)
Reads the computer name
- Unicorn-8858.exe (PID: 7332)
- Unicorn-45932.exe (PID: 7572)
- Unicorn-33658.exe (PID: 7672)
- Unicorn-53259.exe (PID: 7696)
- Unicorn-33104.exe (PID: 7636)
- Unicorn-43576.exe (PID: 4408)
- Unicorn-59964.exe (PID: 7396)
- Unicorn-40046.exe (PID: 6676)
- Unicorn-28392.exe (PID: 856)
- Unicorn-20224.exe (PID: 7524)
- Unicorn-40836.exe (PID: 7644)
- Unicorn-20224.exe (PID: 7544)
- Unicorn-17515.exe (PID: 7516)
- Unicorn-30621.exe (PID: 7760)
- Unicorn-6580.exe (PID: 7480)
- Unicorn-5963.exe (PID: 3888)
- Unicorn-6710.exe (PID: 7904)
- Unicorn-58288.exe (PID: 4244)
- Unicorn-60763.exe (PID: 8072)
- Unicorn-18792.exe (PID: 8092)
- Unicorn-31790.exe (PID: 8148)
- Unicorn-35320.exe (PID: 8128)
- Unicorn-18792.exe (PID: 2504)
- Unicorn-5453.exe (PID: 6372)
- Unicorn-11318.exe (PID: 5204)
- Unicorn-10814.exe (PID: 5800)
- Unicorn-43488.exe (PID: 6240)
- Unicorn-43488.exe (PID: 7988)
- Unicorn-57255.exe (PID: 4200)
- Unicorn-60784.exe (PID: 6388)
- Unicorn-30149.exe (PID: 6476)
- Unicorn-58791.exe (PID: 6576)
- Unicorn-15157.exe (PID: 2240)
- Unicorn-2905.exe (PID: 5360)
- Unicorn-54707.exe (PID: 1568)
- Unicorn-22226.exe (PID: 7960)
- Unicorn-14773.exe (PID: 7964)
- Unicorn-483.exe (PID: 7956)
- Unicorn-54344.exe (PID: 5328)
- Unicorn-45024.exe (PID: 3268)
- Unicorn-58791.exe (PID: 5352)
- Unicorn-22980.exe (PID: 8196)
- Unicorn-6451.exe (PID: 4336)
- Unicorn-52315.exe (PID: 8232)
- Unicorn-11090.exe (PID: 8396)
- Unicorn-39508.exe (PID: 8268)
- Unicorn-11090.exe (PID: 8380)
- Unicorn-51376.exe (PID: 8324)
- Unicorn-12573.exe (PID: 8388)
- Unicorn-19258.exe (PID: 8356)
- Unicorn-43208.exe (PID: 8348)
- Unicorn-12242.exe (PID: 8532)
- Unicorn-2751.exe (PID: 8564)
- Unicorn-13533.exe (PID: 8408)
- Unicorn-4981.exe (PID: 8600)
- Unicorn-10919.exe (PID: 8552)
- Unicorn-46726.exe (PID: 8620)
- Unicorn-22487.exe (PID: 8720)
- Unicorn-3333.exe (PID: 8812)
- Unicorn-65356.exe (PID: 8712)
- Unicorn-19472.exe (PID: 8652)
- Unicorn-31532.exe (PID: 8636)
- Unicorn-57935.exe (PID: 8828)
- Unicorn-57935.exe (PID: 8920)
- Unicorn-17316.exe (PID: 8736)
- Unicorn-3863.exe (PID: 8804)
- Unicorn-57935.exe (PID: 8836)
- Unicorn-49575.exe (PID: 8748)
- Unicorn-27256.exe (PID: 8248)
- Unicorn-21392.exe (PID: 9140)
- Unicorn-5034.exe (PID: 7020)
- Unicorn-53680.exe (PID: 1056)
- Unicorn-49404.exe (PID: 9172)
- Unicorn-53680.exe (PID: 3240)
- Unicorn-4479.exe (PID: 2692)
- Unicorn-21008.exe (PID: 9224)
- Unicorn-41428.exe (PID: 9240)
- Unicorn-42942.exe (PID: 9284)
- Unicorn-5439.exe (PID: 9308)
- Unicorn-24329.exe (PID: 9268)
- Unicorn-48702.exe (PID: 9360)
- Unicorn-7669.exe (PID: 9368)
- Unicorn-56294.exe (PID: 9452)
- Unicorn-16029.exe (PID: 9408)
- Unicorn-25668.exe (PID: 9476)
- Unicorn-62159.exe (PID: 9444)
- Unicorn-34412.exe (PID: 9424)
- Unicorn-21318.exe (PID: 9500)
- Unicorn-60047.exe (PID: 9576)
- Unicorn-5942.exe (PID: 9584)
- Unicorn-2486.exe (PID: 9620)
- Unicorn-9414.exe (PID: 9872)
- Unicorn-9627.exe (PID: 9944)
- Unicorn-35262.exe (PID: 10032)
- Unicorn-9051.exe (PID: 9984)
Checks supported languages
- Unicorn-45932.exe (PID: 7572)
- Unicorn-16885.exe (PID: 7404)
- Unicorn-29020.exe (PID: 7648)
- Unicorn-33104.exe (PID: 7628)
- Unicorn-53259.exe (PID: 7696)
- Unicorn-8858.exe (PID: 7332)
- Unicorn-40046.exe (PID: 6676)
- Unicorn-59964.exe (PID: 7396)
- Unicorn-64188.exe (PID: 5400)
- Unicorn-43576.exe (PID: 4408)
- Unicorn-20224.exe (PID: 7512)
- Unicorn-20224.exe (PID: 7524)
- Unicorn-20224.exe (PID: 7536)
- Unicorn-20224.exe (PID: 7544)
- Unicorn-20970.exe (PID: 7736)
- Unicorn-30621.exe (PID: 7760)
- Unicorn-6580.exe (PID: 7480)
- Unicorn-17515.exe (PID: 7516)
- Unicorn-5963.exe (PID: 3888)
- Unicorn-62927.exe (PID: 3896)
- Unicorn-31737.exe (PID: 5892)
- Unicorn-5963.exe (PID: 7296)
- Unicorn-46036.exe (PID: 6264)
- Unicorn-2839.exe (PID: 8052)
- Unicorn-60763.exe (PID: 8072)
- Unicorn-18792.exe (PID: 8092)
- Unicorn-18792.exe (PID: 2504)
- Unicorn-10623.exe (PID: 8108)
- Unicorn-31790.exe (PID: 8156)
- Unicorn-58288.exe (PID: 4244)
- Unicorn-5453.exe (PID: 6372)
- Unicorn-19752.exe (PID: 7236)
- Unicorn-23622.exe (PID: 8016)
- Unicorn-45024.exe (PID: 3268)
- Unicorn-53192.exe (PID: 5304)
- Unicorn-40940.exe (PID: 4652)
- Unicorn-15157.exe (PID: 2240)
- Unicorn-2905.exe (PID: 5360)
- Unicorn-58791.exe (PID: 6576)
- Unicorn-54707.exe (PID: 1568)
- Unicorn-58791.exe (PID: 5352)
- Unicorn-54344.exe (PID: 5328)
- Unicorn-22226.exe (PID: 7960)
- Unicorn-14773.exe (PID: 7964)
- Unicorn-6451.exe (PID: 4336)
- Unicorn-22980.exe (PID: 8196)
- Unicorn-27256.exe (PID: 8248)
- Unicorn-39508.exe (PID: 8268)
- Unicorn-31318.exe (PID: 8288)
- Unicorn-43488.exe (PID: 6240)
- Unicorn-60784.exe (PID: 6388)
- Unicorn-43488.exe (PID: 8008)
- Unicorn-43488.exe (PID: 7988)
- Unicorn-51376.exe (PID: 8324)
- Unicorn-60696.exe (PID: 8424)
- Unicorn-12573.exe (PID: 8388)
- Unicorn-13533.exe (PID: 8408)
- Unicorn-11090.exe (PID: 8396)
- Unicorn-11090.exe (PID: 8380)
- Unicorn-19258.exe (PID: 8356)
- Unicorn-10919.exe (PID: 8552)
- Unicorn-12242.exe (PID: 8532)
- Unicorn-2751.exe (PID: 8564)
- Unicorn-31532.exe (PID: 8636)
- Unicorn-19472.exe (PID: 8652)
- Unicorn-46726.exe (PID: 8620)
- Unicorn-22487.exe (PID: 8676)
- Unicorn-49575.exe (PID: 8704)
- Unicorn-22487.exe (PID: 8720)
- Unicorn-65356.exe (PID: 8712)
- Unicorn-43976.exe (PID: 8756)
- Unicorn-43976.exe (PID: 8684)
- Unicorn-49575.exe (PID: 8748)
- Unicorn-3333.exe (PID: 8812)
- Unicorn-11998.exe (PID: 8820)
- Unicorn-57935.exe (PID: 8836)
- Unicorn-57935.exe (PID: 8920)
- Unicorn-17316.exe (PID: 8736)
- Unicorn-57935.exe (PID: 8828)
- Unicorn-3863.exe (PID: 8804)
- Unicorn-21392.exe (PID: 9140)
- Unicorn-21392.exe (PID: 9148)
- Unicorn-203.exe (PID: 9196)
- Unicorn-21370.exe (PID: 720)
- Unicorn-53680.exe (PID: 3240)
- Unicorn-4479.exe (PID: 2692)
- Unicorn-21008.exe (PID: 9224)
- Unicorn-41428.exe (PID: 9240)
- Unicorn-41428.exe (PID: 9232)
- Unicorn-42942.exe (PID: 9284)
- Unicorn-5439.exe (PID: 9308)
- Unicorn-48702.exe (PID: 9360)
- Unicorn-54832.exe (PID: 9392)
- Unicorn-34412.exe (PID: 9424)
- Unicorn-62159.exe (PID: 9444)
- Unicorn-21318.exe (PID: 9500)
- Unicorn-25668.exe (PID: 9476)
- Unicorn-15453.exe (PID: 9488)
- Unicorn-38666.exe (PID: 9528)
- Unicorn-60047.exe (PID: 9576)
- Unicorn-16029.exe (PID: 9408)
- Unicorn-5942.exe (PID: 9584)
- Unicorn-2486.exe (PID: 9620)
- Unicorn-48776.exe (PID: 9768)
- Unicorn-49508.exe (PID: 9812)
- Unicorn-4022.exe (PID: 9784)
- Unicorn-9414.exe (PID: 9872)
- Unicorn-29280.exe (PID: 9880)
- Unicorn-56398.exe (PID: 9928)
- Unicorn-9627.exe (PID: 9944)
- Unicorn-41724.exe (PID: 9964)
- Unicorn-9051.exe (PID: 9984)
- Unicorn-35262.exe (PID: 10032)
- Unicorn-51044.exe (PID: 10040)
- Unicorn-32661.exe (PID: 10076)
- Unicorn-49404.exe (PID: 9172)
- Unicorn-5543.exe (PID: 10152)
- Unicorn-60172.exe (PID: 8860)
- Unicorn-24685.exe (PID: 10112)
- Unicorn-43452.exe (PID: 1764)
- Unicorn-48496.exe (PID: 10284)
- Unicorn-15824.exe (PID: 10312)
- Unicorn-7079.exe (PID: 10472)
- Unicorn-60940.exe (PID: 10400)
- Unicorn-46066.exe (PID: 10444)
- Unicorn-9885.exe (PID: 10412)
- Unicorn-15439.exe (PID: 10492)
- Unicorn-7655.exe (PID: 10376)
- Unicorn-35537.exe (PID: 10544)
- Unicorn-53083.exe (PID: 10584)
- Unicorn-53348.exe (PID: 10592)
- Unicorn-25314.exe (PID: 10600)
- Unicorn-24760.exe (PID: 10636)
- Unicorn-40831.exe (PID: 10656)
- Unicorn-30881.exe (PID: 10676)
- Unicorn-18455.exe (PID: 10520)
- Unicorn-54426.exe (PID: 10564)
- Unicorn-33098.exe (PID: 10712)
- Unicorn-57240.exe (PID: 10784)
- Unicorn-57240.exe (PID: 10792)
- Unicorn-8039.exe (PID: 10824)
- Unicorn-49435.exe (PID: 10736)
- Unicorn-50032.exe (PID: 10884)
- Unicorn-36711.exe (PID: 10872)
- Unicorn-8999.exe (PID: 10908)
- Unicorn-62284.exe (PID: 10920)
- Unicorn-36820.exe (PID: 10852)
- Unicorn-62284.exe (PID: 10924)
- Unicorn-17360.exe (PID: 10956)
- Unicorn-25528.exe (PID: 10936)
- Unicorn-37780.exe (PID: 11008)
- Unicorn-13010.exe (PID: 10984)
- Unicorn-17914.exe (PID: 11020)
- Unicorn-13275.exe (PID: 10996)
- Unicorn-33696.exe (PID: 11032)
- Unicorn-38526.exe (PID: 11072)
- Unicorn-28735.exe (PID: 11096)
- Unicorn-48178.exe (PID: 11084)
- Unicorn-1023.exe (PID: 11148)
- Unicorn-25720.exe (PID: 11168)
- Unicorn-13467.exe (PID: 11212)
- Unicorn-14022.exe (PID: 11228)
- Unicorn-29782.exe (PID: 6656)
- Unicorn-57816.exe (PID: 6324)
- Unicorn-25720.exe (PID: 11176)
- Unicorn-42034.exe (PID: 3032)
- Unicorn-61900.exe (PID: 2084)
- Unicorn-16976.exe (PID: 11324)
- Unicorn-21614.exe (PID: 11352)
- Unicorn-57047.exe (PID: 11336)
- Unicorn-16976.exe (PID: 11316)
- Unicorn-32549.exe (PID: 11344)
- Unicorn-38142.exe (PID: 11428)
- Unicorn-25890.exe (PID: 11452)
- Unicorn-9362.exe (PID: 11420)
- Unicorn-9362.exe (PID: 11412)
- Unicorn-29228.exe (PID: 11404)
- Unicorn-12321.exe (PID: 11520)
- Unicorn-47271.exe (PID: 11608)
- Unicorn-35542.exe (PID: 11552)
- Unicorn-15121.exe (PID: 11528)
- Unicorn-27373.exe (PID: 11580)
- Unicorn-27373.exe (PID: 11584)
- Unicorn-56922.exe (PID: 11620)
- Unicorn-22138.exe (PID: 11672)
- Unicorn-12893.exe (PID: 11700)
- Unicorn-26466.exe (PID: 11736)
- Unicorn-36694.exe (PID: 11708)
- Unicorn-13851.exe (PID: 11788)
- Unicorn-59892.exe (PID: 11804)
- Unicorn-62860.exe (PID: 11768)
- Unicorn-31304.exe (PID: 11836)
- Unicorn-60063.exe (PID: 11880)
- Unicorn-51895.exe (PID: 11896)
- Unicorn-30728.exe (PID: 11912)
- Unicorn-2715.exe (PID: 11820)
- Unicorn-23136.exe (PID: 11856)
- Unicorn-6415.exe (PID: 12000)
- Unicorn-38002.exe (PID: 12020)
- Unicorn-44687.exe (PID: 12048)
- Unicorn-39725.exe (PID: 12056)
- Unicorn-43172.exe (PID: 11944)
- Unicorn-40794.exe (PID: 12172)
- Unicorn-3291.exe (PID: 12088)
- Unicorn-59591.exe (PID: 12072)
- Unicorn-7930.exe (PID: 12112)
- Unicorn-60660.exe (PID: 12180)
- Unicorn-61407.exe (PID: 12216)
- Unicorn-52492.exe (PID: 12200)
- Unicorn-61407.exe (PID: 12212)
- Unicorn-39725.exe (PID: 12064)
- Unicorn-34618.exe (PID: 4208)
- Unicorn-40218.exe (PID: 12292)
- Unicorn-64168.exe (PID: 12276)
- Unicorn-53954.exe (PID: 10140)
- Unicorn-40218.exe (PID: 9068)
- Unicorn-59762.exe (PID: 12344)
- Unicorn-6918.exe (PID: 12368)
- Unicorn-6918.exe (PID: 12372)
- Unicorn-23882.exe (PID: 12256)
- Unicorn-44900.exe (PID: 12456)
- Unicorn-44900.exe (PID: 12460)
- Unicorn-52306.exe (PID: 12488)
- Unicorn-60971.exe (PID: 12512)
- Unicorn-48911.exe (PID: 12552)
- Unicorn-24480.exe (PID: 12536)
- Unicorn-7738.exe (PID: 12416)
- Unicorn-23255.exe (PID: 12424)
- Unicorn-3099.exe (PID: 12392)
- Unicorn-41370.exe (PID: 12496)
- Unicorn-24672.exe (PID: 12704)
- Unicorn-4251.exe (PID: 12668)
- Unicorn-9797.exe (PID: 12776)
- Unicorn-36348.exe (PID: 12748)
- Unicorn-6997.exe (PID: 12768)
- Unicorn-10588.exe (PID: 12584)
- Unicorn-51214.exe (PID: 12636)
- Unicorn-49752.exe (PID: 12816)
- Unicorn-23201.exe (PID: 12832)
- Unicorn-13187.exe (PID: 12848)
- Unicorn-16696.exe (PID: 12884)
- Unicorn-61044.exe (PID: 12800)
- Unicorn-49368.exe (PID: 12868)
- Unicorn-22294.exe (PID: 13028)
- Unicorn-6482.exe (PID: 13260)
- Unicorn-20706.exe (PID: 5232)
- Unicorn-61739.exe (PID: 13332)
- Unicorn-57100.exe (PID: 13372)
- Unicorn-34057.exe (PID: 13412)
- Unicorn-7826.exe (PID: 13396)
- Unicorn-52367.exe (PID: 13452)
- Unicorn-44827.exe (PID: 13420)
- Unicorn-20653.exe (PID: 13104)
- Unicorn-39206.exe (PID: 13140)
- Unicorn-33673.exe (PID: 13168)
- Unicorn-61628.exe (PID: 13696)
- Unicorn-37678.exe (PID: 13752)
- Unicorn-60800.exe (PID: 13472)
- Unicorn-61555.exe (PID: 13500)
- Unicorn-10242.exe (PID: 13868)
- Unicorn-7449.exe (PID: 13848)
- Unicorn-13750.exe (PID: 13924)
- Unicorn-30086.exe (PID: 13944)
- Unicorn-53963.exe (PID: 14012)
- Unicorn-34362.exe (PID: 14004)
- Unicorn-63091.exe (PID: 14044)
- Unicorn-18986.exe (PID: 14068)
- Unicorn-57544.exe (PID: 13764)
- Unicorn-49.exe (PID: 14104)
- Unicorn-32337.exe (PID: 14208)
- Unicorn-55551.exe (PID: 14252)
- Unicorn-21866.exe (PID: 14292)
- Unicorn-33489.exe (PID: 13720)
- Unicorn-64295.exe (PID: 14520)
- Unicorn-43875.exe (PID: 14476)
- Unicorn-27538.exe (PID: 14600)
- Unicorn-27154.exe (PID: 14088)
- Unicorn-13009.exe (PID: 14196)
- Unicorn-14731.exe (PID: 14732)
- Unicorn-59086.exe (PID: 14628)
- Unicorn-17450.exe (PID: 13532)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 7836)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 8004)
- BackgroundTransferHost.exe (PID: 7836)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 7836)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 7836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
531
Monitored processes
384
Malicious processes
50
Suspicious processes
55
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 300 | "C:\Users\admin\AppData\Local\Temp\1 (174).exe" | C:\Users\admin\AppData\Local\Temp\1 (174).exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM | |||||||||||||||
| 664 | C:\Users\admin\AppData\Local\Temp\Unicorn-31754.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-31754.exe | Unicorn-35320.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 720 | C:\Users\admin\AppData\Local\Temp\Unicorn-21370.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-21370.exe | Unicorn-62927.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 856 | C:\Users\admin\AppData\Local\Temp\Unicorn-28392.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-28392.exe | Unicorn-33104.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1056 | C:\Users\admin\AppData\Local\Temp\Unicorn-53680.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53680.exe | Unicorn-58791.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1568 | C:\Users\admin\AppData\Local\Temp\Unicorn-54707.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-54707.exe | Unicorn-17025.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1764 | C:\Users\admin\AppData\Local\Temp\Unicorn-43452.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-43452.exe | Unicorn-11090.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 2084 | C:\Users\admin\AppData\Local\Temp\Unicorn-61900.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-61900.exe | — | Unicorn-57472.exe | |||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 2240 | C:\Users\admin\AppData\Local\Temp\Unicorn-15157.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-15157.exe | Unicorn-45932.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 2504 | C:\Users\admin\AppData\Local\Temp\Unicorn-18792.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-18792.exe | Unicorn-20224.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
Total events
9 190
Read events
9 175
Write events
15
Delete events
0
Modification events
| (PID) Process: | (7472) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7472) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7472) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7836) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7836) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7836) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (8004) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (8004) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (8004) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (5504) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
875
Suspicious files
5
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7836 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\f7b07bb3-789c-4f8d-83f7-2599f7f4bda2.down_data | — | |
MD5:— | SHA256:— | |||
| 300 | 1 (174).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-37904.exe | executable | |
MD5:3A3917B2C373E2F4F75F36D9F8DEE111 | SHA256:89830CBE314DAA54EB6D39429BC8EC442EB344C4F22FF4508EF7FF6C1749705A | |||
| 7648 | Unicorn-29020.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20224.exe | executable | |
MD5:30ECBB9EC522DECCECFFC2608D7F1393 | SHA256:5AAB8A2E17E77877C53522B07778FF43F2D3A4EE05A0274CC5974AA1F8127354 | |||
| 7628 | Unicorn-33104.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-28392.exe | executable | |
MD5:AE39496E0EEB4457D84203E404D56504 | SHA256:FF3F242277CEBD4E3C11AC04491A8EC3306146F0F73370A82D1125261FDF0BDD | |||
| 7404 | Unicorn-16885.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-29020.exe | executable | |
MD5:FFA4CBB8928B0368A2F6582058BD4591 | SHA256:82C4D4FC72348D8A9BFD6423DA562D4FE60521EF347DFE26A4AC3703426225D0 | |||
| 7332 | Unicorn-8858.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-30621.exe | executable | |
MD5:650DDB84734CF5481F37F2413EE8A071 | SHA256:08CCE9B6F6AF0E09634BAFEED6CC901C80E04C3256EFCB62656D4CA11367C3A7 | |||
| 7836 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\f7b07bb3-789c-4f8d-83f7-2599f7f4bda2.051600ce-b795-479b-8f84-759f62eb1d00.down_meta | binary | |
MD5:F0718C47047926D883B2A8B834CE6426 | SHA256:2A99F92752BE05FD2B2BF893EB53FEF1A9BCE7E3924C89243728514D5180E5B6 | |||
| 7836 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
| 7404 | Unicorn-16885.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-16886.exe | executable | |
MD5:4104CA59424B2019E85AAD815F276AA2 | SHA256:FD56A72D30DBD0CDCAAF6CFD703D5685D608E614652F31D96D412AE6E7F3296F | |||
| 7836 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\025fe372-3413-42d8-8b68-7d03fddf11d2.up_meta_secure | binary | |
MD5:3A6D63A8E0EED57FCC76A06AC72EC333 | SHA256:EE09850FE23F28C96343982DA38B85E5B253FD22ADD57F8267A710D8C2ECC6BD | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
25
DNS requests
18
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
8668 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.16.168.124:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.16.168.124:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
2504 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
8668 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7836 | BackgroundTransferHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 2.16.168.124:80 | crl.microsoft.com | Akamai International B.V. | RU | whitelisted |
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 20.190.160.128:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
6544 | svchost.exe | 20.190.160.128:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2504 | backgroundTaskHost.exe | 20.223.36.55:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2504 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |