| File name: | 1 (592) |
| Full analysis: | https://app.any.run/tasks/afaf17e0-a593-4573-8020-7d4fa73a94e5 |
| Verdict: | Malicious activity |
| Analysis date: | March 25, 2025, 03:11:56 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 49C550BD79E68FE94E135203ED6D3720 |
| SHA1: | 4C1A51D72B0967A6661B89C3E072B9825FD7AA2B |
| SHA256: | F2463D84919F6945476147E1316CA6D02D340FF5E969E2F6D0A6C4B4A258786D |
| SSDEEP: | 6144:87IpQkErNDa5A7oy+qe/x21xBIBUlpSFBVLWydbPjk/8SwuwpyAvEh7E/eHET558:8EazQ5A7V+FFBiwzVyydbPTx1DgmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- 1 (592).exe (PID: 7632)
- Unicorn-16724.exe (PID: 7712)
- Unicorn-46205.exe (PID: 7776)
- Unicorn-44560.exe (PID: 7428)
- Unicorn-42867.exe (PID: 7796)
- Unicorn-11311.exe (PID: 7612)
- Unicorn-40838.exe (PID: 7420)
- Unicorn-55451.exe (PID: 7592)
- Unicorn-64189.exe (PID: 644)
- Unicorn-11459.exe (PID: 5512)
- Unicorn-41439.exe (PID: 7176)
- Unicorn-4853.exe (PID: 5972)
- Unicorn-41439.exe (PID: 7184)
- Unicorn-40982.exe (PID: 7180)
- Unicorn-45046.exe (PID: 4464)
- Unicorn-47412.exe (PID: 5228)
- Unicorn-58528.exe (PID: 8084)
- Unicorn-58528.exe (PID: 8132)
- Unicorn-63805.exe (PID: 5124)
- Unicorn-6099.exe (PID: 7268)
- Unicorn-59680.exe (PID: 5352)
- Unicorn-10899.exe (PID: 6656)
- Unicorn-3690.exe (PID: 6972)
- Unicorn-6374.exe (PID: 4436)
- Unicorn-11164.exe (PID: 6516)
- Unicorn-11164.exe (PID: 6268)
- Unicorn-37323.exe (PID: 5328)
- Unicorn-11164.exe (PID: 4112)
- Unicorn-58263.exe (PID: 5112)
- Unicorn-10707.exe (PID: 7464)
- Unicorn-30765.exe (PID: 4408)
- Unicorn-4444.exe (PID: 7440)
- Unicorn-47323.exe (PID: 7528)
- Unicorn-41725.exe (PID: 7300)
- Unicorn-25389.exe (PID: 5504)
- Unicorn-64838.exe (PID: 3240)
- Unicorn-18298.exe (PID: 632)
- Unicorn-39815.exe (PID: 1628)
- Unicorn-37126.exe (PID: 2384)
- Unicorn-43417.exe (PID: 2420)
- Unicorn-43587.exe (PID: 7700)
- Unicorn-30864.exe (PID: 7704)
- Unicorn-22234.exe (PID: 6592)
- Unicorn-59710.exe (PID: 7932)
- Unicorn-46624.exe (PID: 7580)
- Unicorn-31357.exe (PID: 1012)
- Unicorn-46624.exe (PID: 736)
- Unicorn-1372.exe (PID: 7284)
- Unicorn-339.exe (PID: 664)
- Unicorn-46276.exe (PID: 8144)
- Unicorn-13027.exe (PID: 8036)
- Unicorn-33469.exe (PID: 7232)
- Unicorn-1850.exe (PID: 536)
- Unicorn-26762.exe (PID: 5376)
- Unicorn-46276.exe (PID: 7972)
- Unicorn-50848.exe (PID: 5364)
- Unicorn-34429.exe (PID: 1912)
- Unicorn-46359.exe (PID: 1188)
- Unicorn-18285.exe (PID: 904)
- Unicorn-40675.exe (PID: 8056)
- Unicorn-1372.exe (PID: 668)
- Unicorn-28874.exe (PID: 8164)
- Unicorn-796.exe (PID: 5960)
- Unicorn-42016.exe (PID: 8064)
- Unicorn-9379.exe (PID: 6468)
- Unicorn-43936.exe (PID: 672)
- Unicorn-26557.exe (PID: 1852)
- Unicorn-21962.exe (PID: 4452)
- Unicorn-8284.exe (PID: 6192)
- Unicorn-54334.exe (PID: 8160)
- Unicorn-24838.exe (PID: 8108)
- Unicorn-4006.exe (PID: 7908)
- Unicorn-51728.exe (PID: 2192)
- Unicorn-58339.exe (PID: 6436)
- Unicorn-31862.exe (PID: 7240)
- Unicorn-2062.exe (PID: 5508)
- Unicorn-12402.exe (PID: 7760)
- Unicorn-5459.exe (PID: 7296)
- Unicorn-58339.exe (PID: 5304)
- Unicorn-8506.exe (PID: 1348)
- Unicorn-45214.exe (PID: 8200)
- Unicorn-24182.exe (PID: 8276)
- Unicorn-17437.exe (PID: 8016)
- Unicorn-30042.exe (PID: 8256)
- Unicorn-63373.exe (PID: 8348)
- Unicorn-13788.exe (PID: 8360)
- Unicorn-28397.exe (PID: 8284)
- Unicorn-30598.exe (PID: 8104)
- Unicorn-35197.exe (PID: 3888)
- Unicorn-13103.exe (PID: 8340)
- Unicorn-422.exe (PID: 2108)
- Unicorn-45812.exe (PID: 8380)
- Unicorn-53943.exe (PID: 8496)
- Unicorn-62880.exe (PID: 8528)
- Unicorn-13871.exe (PID: 8504)
- Unicorn-49341.exe (PID: 8588)
- Unicorn-29475.exe (PID: 8580)
- Unicorn-5459.exe (PID: 7304)
- Unicorn-12371.exe (PID: 8644)
- Unicorn-64032.exe (PID: 8652)
- Unicorn-65101.exe (PID: 8660)
- Unicorn-12524.exe (PID: 8188)
- Unicorn-23296.exe (PID: 8792)
- Unicorn-47918.exe (PID: 8716)
- Unicorn-44734.exe (PID: 8760)
- Unicorn-18531.exe (PID: 8724)
- Unicorn-45949.exe (PID: 8784)
- Unicorn-56461.exe (PID: 8860)
- Unicorn-41469.exe (PID: 8988)
- Unicorn-7260.exe (PID: 8852)
- Unicorn-1514.exe (PID: 8820)
- Unicorn-56087.exe (PID: 8324)
- Unicorn-19574.exe (PID: 8828)
- Unicorn-33798.exe (PID: 8752)
- Unicorn-39549.exe (PID: 8884)
- Unicorn-23021.exe (PID: 8928)
Executable content was dropped or overwritten
- 1 (592).exe (PID: 7632)
- Unicorn-46205.exe (PID: 7776)
- Unicorn-16724.exe (PID: 7712)
- Unicorn-44560.exe (PID: 7428)
- Unicorn-42867.exe (PID: 7796)
- Unicorn-55451.exe (PID: 7592)
- Unicorn-40838.exe (PID: 7420)
- Unicorn-63805.exe (PID: 5124)
- Unicorn-64189.exe (PID: 644)
- Unicorn-41439.exe (PID: 7176)
- Unicorn-41439.exe (PID: 7184)
- Unicorn-11311.exe (PID: 7612)
- Unicorn-45046.exe (PID: 4464)
- Unicorn-47412.exe (PID: 5228)
- Unicorn-58528.exe (PID: 8084)
- Unicorn-58528.exe (PID: 8132)
- Unicorn-11459.exe (PID: 5512)
- Unicorn-3690.exe (PID: 6972)
- Unicorn-6099.exe (PID: 7268)
- Unicorn-59680.exe (PID: 5352)
- Unicorn-10899.exe (PID: 6656)
- Unicorn-11164.exe (PID: 6268)
- Unicorn-1850.exe (PID: 536)
- Unicorn-6374.exe (PID: 4436)
- Unicorn-11164.exe (PID: 4112)
- Unicorn-58263.exe (PID: 5112)
- Unicorn-40982.exe (PID: 7180)
- Unicorn-4853.exe (PID: 5972)
- Unicorn-10707.exe (PID: 7464)
- Unicorn-4444.exe (PID: 7440)
- Unicorn-47323.exe (PID: 7528)
- Unicorn-30765.exe (PID: 4408)
- Unicorn-41725.exe (PID: 7300)
- Unicorn-25389.exe (PID: 5504)
- Unicorn-37126.exe (PID: 2384)
- Unicorn-8284.exe (PID: 6192)
- Unicorn-18298.exe (PID: 632)
- Unicorn-39815.exe (PID: 1628)
- Unicorn-64838.exe (PID: 3240)
- Unicorn-43417.exe (PID: 2420)
- Unicorn-43587.exe (PID: 7700)
- Unicorn-30864.exe (PID: 7704)
- Unicorn-31357.exe (PID: 1012)
- Unicorn-22234.exe (PID: 6592)
- Unicorn-59710.exe (PID: 7932)
- Unicorn-46624.exe (PID: 7580)
- Unicorn-40675.exe (PID: 8056)
- Unicorn-1372.exe (PID: 7284)
- Unicorn-46624.exe (PID: 736)
- Unicorn-11164.exe (PID: 6516)
- Unicorn-33469.exe (PID: 7232)
- Unicorn-13027.exe (PID: 8036)
- Unicorn-46276.exe (PID: 8144)
- Unicorn-37323.exe (PID: 5328)
- Unicorn-26762.exe (PID: 5376)
- Unicorn-30598.exe (PID: 8104)
- Unicorn-46276.exe (PID: 7972)
- Unicorn-34429.exe (PID: 1912)
- Unicorn-46359.exe (PID: 1188)
- Unicorn-35197.exe (PID: 3888)
- Unicorn-422.exe (PID: 2108)
- Unicorn-28874.exe (PID: 8164)
- Unicorn-18285.exe (PID: 904)
- Unicorn-1372.exe (PID: 668)
- Unicorn-9379.exe (PID: 6468)
- Unicorn-5459.exe (PID: 7304)
- Unicorn-26557.exe (PID: 1852)
- Unicorn-12524.exe (PID: 8188)
- Unicorn-21962.exe (PID: 4452)
- Unicorn-29087.exe (PID: 7912)
- Unicorn-58339.exe (PID: 5304)
- Unicorn-51728.exe (PID: 2192)
- Unicorn-24838.exe (PID: 8108)
- Unicorn-4006.exe (PID: 7908)
- Unicorn-31862.exe (PID: 7240)
- Unicorn-58339.exe (PID: 6436)
- Unicorn-2062.exe (PID: 5508)
- Unicorn-12402.exe (PID: 7760)
- Unicorn-5459.exe (PID: 7296)
- Unicorn-45214.exe (PID: 8200)
- Unicorn-24182.exe (PID: 8276)
- Unicorn-17437.exe (PID: 8016)
- Unicorn-30042.exe (PID: 8256)
- Unicorn-13788.exe (PID: 8360)
- Unicorn-63373.exe (PID: 8348)
- Unicorn-339.exe (PID: 664)
- Unicorn-56087.exe (PID: 8324)
- Unicorn-28397.exe (PID: 8284)
- Unicorn-45812.exe (PID: 8380)
- Unicorn-13103.exe (PID: 8340)
- Unicorn-53943.exe (PID: 8496)
- Unicorn-62880.exe (PID: 8528)
- Unicorn-13871.exe (PID: 8504)
- Unicorn-12371.exe (PID: 8644)
- Unicorn-64032.exe (PID: 8652)
- Unicorn-43936.exe (PID: 672)
- Unicorn-65101.exe (PID: 8660)
- Unicorn-23296.exe (PID: 8792)
- Unicorn-47918.exe (PID: 8716)
- Unicorn-44734.exe (PID: 8760)
- Unicorn-18531.exe (PID: 8724)
- Unicorn-8506.exe (PID: 1348)
- Unicorn-7260.exe (PID: 8852)
- Unicorn-45949.exe (PID: 8784)
- Unicorn-56461.exe (PID: 8860)
- Unicorn-41469.exe (PID: 8988)
- Unicorn-1514.exe (PID: 8820)
- Unicorn-19574.exe (PID: 8828)
- Unicorn-33798.exe (PID: 8752)
- Unicorn-39549.exe (PID: 8884)
- Unicorn-50848.exe (PID: 5364)
- Unicorn-43773.exe (PID: 9048)
- Unicorn-23021.exe (PID: 8928)
- Unicorn-16917.exe (PID: 8908)
- Unicorn-23963.exe (PID: 8996)
- Unicorn-21110.exe (PID: 8964)
- Unicorn-8220.exe (PID: 9024)
- Unicorn-29475.exe (PID: 8580)
- Unicorn-22262.exe (PID: 9152)
- Unicorn-1402.exe (PID: 9140)
- Unicorn-56388.exe (PID: 9100)
- Unicorn-10451.exe (PID: 9092)
- Unicorn-796.exe (PID: 5960)
- Unicorn-36491.exe (PID: 9176)
- Unicorn-6876.exe (PID: 8896)
- Unicorn-54334.exe (PID: 8160)
- Unicorn-45252.exe (PID: 684)
- Unicorn-47089.exe (PID: 9196)
- Unicorn-39683.exe (PID: 8404)
- Unicorn-58822.exe (PID: 4980)
- Unicorn-55439.exe (PID: 872)
- Unicorn-49341.exe (PID: 8588)
- Unicorn-39683.exe (PID: 8408)
- Unicorn-5740.exe (PID: 9348)
- Unicorn-42016.exe (PID: 8064)
- Unicorn-23715.exe (PID: 9056)
- Unicorn-45252.exe (PID: 6584)
- Unicorn-7001.exe (PID: 9324)
- Unicorn-1251.exe (PID: 9416)
- Unicorn-45133.exe (PID: 4380)
- Unicorn-17587.exe (PID: 9448)
- Unicorn-55439.exe (PID: 3024)
- Unicorn-19804.exe (PID: 9524)
- Unicorn-888.exe (PID: 9408)
- Unicorn-64571.exe (PID: 9388)
- Unicorn-16789.exe (PID: 9508)
- Unicorn-4899.exe (PID: 9500)
- Unicorn-29123.exe (PID: 9664)
- Unicorn-55325.exe (PID: 9476)
- Unicorn-29123.exe (PID: 9656)
- Unicorn-24765.exe (PID: 9516)
- Unicorn-15859.exe (PID: 9612)
- Unicorn-46109.exe (PID: 9604)
- Unicorn-55325.exe (PID: 9468)
- Unicorn-46119.exe (PID: 9556)
- Unicorn-42859.exe (PID: 9640)
- Unicorn-42859.exe (PID: 9648)
- Unicorn-48989.exe (PID: 9676)
- Unicorn-45268.exe (PID: 9684)
- Unicorn-53924.exe (PID: 9948)
- Unicorn-18813.exe (PID: 9872)
- Unicorn-20737.exe (PID: 9908)
Executes application which crashes
- Unicorn-35309.exe (PID: 1852)
- Unicorn-29549.exe (PID: 8404)
- Unicorn-30864.exe (PID: 7704)
- Unicorn-10899.exe (PID: 6656)
- Unicorn-24182.exe (PID: 8276)
- Unicorn-35531.exe (PID: 8980)
- Unicorn-30042.exe (PID: 8256)
INFO
The sample compiled with chinese language support
- 1 (592).exe (PID: 7632)
- Unicorn-3690.exe (PID: 6972)
- Unicorn-12524.exe (PID: 8188)
- Unicorn-58339.exe (PID: 6436)
- Unicorn-63805.exe (PID: 5124)
- Unicorn-18298.exe (PID: 632)
- Unicorn-58528.exe (PID: 8084)
- Unicorn-7001.exe (PID: 9324)
- Unicorn-44734.exe (PID: 8760)
- Unicorn-31862.exe (PID: 7240)
- Unicorn-2062.exe (PID: 5508)
- Unicorn-12402.exe (PID: 7760)
- Unicorn-43417.exe (PID: 2420)
- Unicorn-39683.exe (PID: 8404)
- Unicorn-41439.exe (PID: 7176)
- Unicorn-46205.exe (PID: 7776)
- Unicorn-5459.exe (PID: 7296)
- Unicorn-59680.exe (PID: 5352)
- Unicorn-43587.exe (PID: 7700)
- Unicorn-58339.exe (PID: 5304)
- Unicorn-5740.exe (PID: 9348)
- Unicorn-45133.exe (PID: 4380)
- Unicorn-45214.exe (PID: 8200)
- Unicorn-45949.exe (PID: 8784)
- Unicorn-8506.exe (PID: 1348)
- Unicorn-17587.exe (PID: 9448)
- Unicorn-7260.exe (PID: 8852)
- Unicorn-56461.exe (PID: 8860)
- Unicorn-63373.exe (PID: 8348)
- Unicorn-41469.exe (PID: 8988)
- Unicorn-55439.exe (PID: 3024)
- Unicorn-19804.exe (PID: 9524)
- Unicorn-58822.exe (PID: 4980)
- Unicorn-1251.exe (PID: 9416)
- Unicorn-4006.exe (PID: 7908)
- Unicorn-41725.exe (PID: 7300)
- Unicorn-39815.exe (PID: 1628)
- Unicorn-1372.exe (PID: 7284)
- Unicorn-339.exe (PID: 664)
- Unicorn-6374.exe (PID: 4436)
- Unicorn-1514.exe (PID: 8820)
- Unicorn-17437.exe (PID: 8016)
- Unicorn-41439.exe (PID: 7184)
- Unicorn-11311.exe (PID: 7612)
- Unicorn-37323.exe (PID: 5328)
- Unicorn-28397.exe (PID: 8284)
- Unicorn-22234.exe (PID: 6592)
- Unicorn-56087.exe (PID: 8324)
- Unicorn-26762.exe (PID: 5376)
- Unicorn-19574.exe (PID: 8828)
- Unicorn-16724.exe (PID: 7712)
- Unicorn-6099.exe (PID: 7268)
- Unicorn-31357.exe (PID: 1012)
- Unicorn-1850.exe (PID: 536)
- Unicorn-42867.exe (PID: 7796)
- Unicorn-11164.exe (PID: 4112)
- Unicorn-33798.exe (PID: 8752)
- Unicorn-45812.exe (PID: 8380)
- Unicorn-39549.exe (PID: 8884)
- Unicorn-4853.exe (PID: 5972)
- Unicorn-40982.exe (PID: 7180)
- Unicorn-45046.exe (PID: 4464)
- Unicorn-18285.exe (PID: 904)
- Unicorn-64189.exe (PID: 644)
- Unicorn-44560.exe (PID: 7428)
- Unicorn-34429.exe (PID: 1912)
- Unicorn-10707.exe (PID: 7464)
- Unicorn-46276.exe (PID: 7972)
- Unicorn-30598.exe (PID: 8104)
- Unicorn-50848.exe (PID: 5364)
- Unicorn-55451.exe (PID: 7592)
- Unicorn-13103.exe (PID: 8340)
- Unicorn-47323.exe (PID: 7528)
- Unicorn-4444.exe (PID: 7440)
- Unicorn-23021.exe (PID: 8928)
- Unicorn-888.exe (PID: 9408)
- Unicorn-16917.exe (PID: 8908)
- Unicorn-46276.exe (PID: 8144)
- Unicorn-59710.exe (PID: 7932)
- Unicorn-43773.exe (PID: 9048)
- Unicorn-11164.exe (PID: 6516)
- Unicorn-53943.exe (PID: 8496)
- Unicorn-47412.exe (PID: 5228)
- Unicorn-55439.exe (PID: 872)
- Unicorn-46359.exe (PID: 1188)
- Unicorn-62880.exe (PID: 8528)
- Unicorn-40675.exe (PID: 8056)
- Unicorn-8220.exe (PID: 9024)
- Unicorn-49341.exe (PID: 8588)
- Unicorn-13027.exe (PID: 8036)
- Unicorn-28874.exe (PID: 8164)
- Unicorn-22262.exe (PID: 9152)
- Unicorn-1402.exe (PID: 9140)
- Unicorn-16789.exe (PID: 9508)
- Unicorn-9379.exe (PID: 6468)
- Unicorn-23715.exe (PID: 9056)
- Unicorn-42016.exe (PID: 8064)
- Unicorn-4899.exe (PID: 9500)
- Unicorn-1372.exe (PID: 668)
- Unicorn-64571.exe (PID: 9388)
- Unicorn-13871.exe (PID: 8504)
- Unicorn-21110.exe (PID: 8964)
- Unicorn-46624.exe (PID: 736)
- Unicorn-56388.exe (PID: 9100)
- Unicorn-47089.exe (PID: 9196)
- Unicorn-12371.exe (PID: 8644)
- Unicorn-64032.exe (PID: 8652)
- Unicorn-39683.exe (PID: 8408)
- Unicorn-6876.exe (PID: 8896)
- Unicorn-29123.exe (PID: 9664)
- Unicorn-5459.exe (PID: 7304)
- Unicorn-58528.exe (PID: 8132)
- Unicorn-26557.exe (PID: 1852)
- Unicorn-25389.exe (PID: 5504)
- Unicorn-21962.exe (PID: 4452)
- Unicorn-45252.exe (PID: 6584)
- Unicorn-37126.exe (PID: 2384)
- Unicorn-29123.exe (PID: 9656)
- Unicorn-65101.exe (PID: 8660)
- Unicorn-45252.exe (PID: 684)
- Unicorn-54334.exe (PID: 8160)
- Unicorn-11459.exe (PID: 5512)
- Unicorn-8284.exe (PID: 6192)
- Unicorn-24765.exe (PID: 9516)
- Unicorn-23296.exe (PID: 8792)
- Unicorn-47918.exe (PID: 8716)
- Unicorn-55325.exe (PID: 9468)
- Unicorn-40838.exe (PID: 7420)
- Unicorn-46109.exe (PID: 9604)
- Unicorn-55325.exe (PID: 9476)
- Unicorn-46119.exe (PID: 9556)
- Unicorn-796.exe (PID: 5960)
- Unicorn-15859.exe (PID: 9612)
- Unicorn-42859.exe (PID: 9640)
- Unicorn-35197.exe (PID: 3888)
- Unicorn-13788.exe (PID: 8360)
- Unicorn-23963.exe (PID: 8996)
- Unicorn-48989.exe (PID: 9676)
- Unicorn-24838.exe (PID: 8108)
- Unicorn-45268.exe (PID: 9684)
- Unicorn-51728.exe (PID: 2192)
- Unicorn-10451.exe (PID: 9092)
- Unicorn-36491.exe (PID: 9176)
- Unicorn-18531.exe (PID: 8724)
- Unicorn-42859.exe (PID: 9648)
- Unicorn-11164.exe (PID: 6268)
- Unicorn-58263.exe (PID: 5112)
- Unicorn-18813.exe (PID: 9872)
- Unicorn-53924.exe (PID: 9948)
- Unicorn-20737.exe (PID: 9908)
- Unicorn-29475.exe (PID: 8580)
- Unicorn-422.exe (PID: 2108)
- Unicorn-30765.exe (PID: 4408)
Checks supported languages
- 1 (592).exe (PID: 7632)
- Unicorn-16724.exe (PID: 7712)
- Unicorn-46205.exe (PID: 7776)
- Unicorn-42867.exe (PID: 7796)
- Unicorn-44560.exe (PID: 7428)
- Unicorn-11311.exe (PID: 7612)
- Unicorn-55451.exe (PID: 7592)
- Unicorn-64189.exe (PID: 644)
- Unicorn-40838.exe (PID: 7420)
- Unicorn-63805.exe (PID: 5124)
- Unicorn-4853.exe (PID: 5972)
- Unicorn-41439.exe (PID: 7176)
- Unicorn-35309.exe (PID: 1852)
- Unicorn-41439.exe (PID: 7184)
- Unicorn-40982.exe (PID: 7180)
- Unicorn-11459.exe (PID: 5512)
- Unicorn-47412.exe (PID: 5228)
- Unicorn-45046.exe (PID: 4464)
- Unicorn-3690.exe (PID: 6972)
- Unicorn-58528.exe (PID: 8084)
- Unicorn-58528.exe (PID: 8132)
- Unicorn-10899.exe (PID: 6656)
- Unicorn-59680.exe (PID: 5352)
- Unicorn-11164.exe (PID: 6268)
- Unicorn-6374.exe (PID: 4436)
- Unicorn-6099.exe (PID: 7268)
- Unicorn-58263.exe (PID: 5112)
- Unicorn-1850.exe (PID: 536)
- Unicorn-11164.exe (PID: 6516)
- Unicorn-37323.exe (PID: 5328)
- Unicorn-11164.exe (PID: 4112)
- Unicorn-30765.exe (PID: 4408)
- Unicorn-10707.exe (PID: 7464)
- Unicorn-4444.exe (PID: 7440)
- Unicorn-47323.exe (PID: 7528)
- Unicorn-41725.exe (PID: 7300)
- Unicorn-25389.exe (PID: 5504)
- Unicorn-37126.exe (PID: 2384)
- Unicorn-64838.exe (PID: 3240)
- Unicorn-2062.exe (PID: 5508)
- Unicorn-39815.exe (PID: 1628)
- Unicorn-8284.exe (PID: 6192)
- Unicorn-18298.exe (PID: 632)
- Unicorn-43417.exe (PID: 2420)
- Unicorn-43587.exe (PID: 7700)
- Unicorn-30864.exe (PID: 7704)
- Unicorn-31357.exe (PID: 1012)
- Unicorn-22234.exe (PID: 6592)
- Unicorn-46624.exe (PID: 736)
- Unicorn-46624.exe (PID: 7580)
- Unicorn-1372.exe (PID: 668)
- Unicorn-59710.exe (PID: 7932)
- Unicorn-1372.exe (PID: 7284)
- Unicorn-33469.exe (PID: 7232)
- Unicorn-40675.exe (PID: 8056)
- Unicorn-796.exe (PID: 5960)
- Unicorn-13027.exe (PID: 8036)
- Unicorn-339.exe (PID: 664)
- Unicorn-26762.exe (PID: 5376)
- Unicorn-28874.exe (PID: 8164)
- Unicorn-50848.exe (PID: 5364)
- Unicorn-35197.exe (PID: 3888)
- Unicorn-30598.exe (PID: 8104)
- Unicorn-46276.exe (PID: 8144)
- Unicorn-46276.exe (PID: 7972)
- Unicorn-34429.exe (PID: 1912)
- Unicorn-46359.exe (PID: 1188)
- Unicorn-18285.exe (PID: 904)
- Unicorn-42016.exe (PID: 8064)
- Unicorn-26557.exe (PID: 1852)
- Unicorn-9379.exe (PID: 6468)
- Unicorn-24838.exe (PID: 8108)
- Unicorn-422.exe (PID: 2108)
- Unicorn-12524.exe (PID: 8188)
- Unicorn-43936.exe (PID: 672)
- Unicorn-54334.exe (PID: 8160)
- Unicorn-21962.exe (PID: 4452)
- Unicorn-5459.exe (PID: 7304)
- Unicorn-29087.exe (PID: 7912)
- Unicorn-12402.exe (PID: 7760)
- Unicorn-17437.exe (PID: 8016)
- Unicorn-58339.exe (PID: 6436)
- Unicorn-8506.exe (PID: 1348)
- Unicorn-51728.exe (PID: 2192)
- Unicorn-4006.exe (PID: 7908)
- Unicorn-5459.exe (PID: 7296)
- Unicorn-45214.exe (PID: 8200)
- Unicorn-58339.exe (PID: 5304)
- Unicorn-30042.exe (PID: 8256)
- Unicorn-31862.exe (PID: 7240)
- Unicorn-24182.exe (PID: 8276)
- Unicorn-28397.exe (PID: 8284)
- Unicorn-56087.exe (PID: 8324)
- Unicorn-13788.exe (PID: 8360)
- Unicorn-13871.exe (PID: 8504)
- Unicorn-53943.exe (PID: 8496)
- Unicorn-62880.exe (PID: 8528)
- Unicorn-63373.exe (PID: 8348)
- Unicorn-13103.exe (PID: 8340)
- Unicorn-45812.exe (PID: 8380)
- Unicorn-29475.exe (PID: 8580)
- Unicorn-12371.exe (PID: 8644)
- Unicorn-64032.exe (PID: 8652)
- Unicorn-65101.exe (PID: 8660)
- Unicorn-47918.exe (PID: 8716)
- Unicorn-18531.exe (PID: 8724)
- Unicorn-49341.exe (PID: 8588)
- Unicorn-33798.exe (PID: 8752)
- Unicorn-44734.exe (PID: 8760)
- Unicorn-7260.exe (PID: 8852)
- Unicorn-45949.exe (PID: 8784)
- Unicorn-23296.exe (PID: 8792)
- Unicorn-1514.exe (PID: 8820)
- Unicorn-19574.exe (PID: 8828)
- Unicorn-56461.exe (PID: 8860)
- Unicorn-21110.exe (PID: 8964)
- Unicorn-39549.exe (PID: 8884)
- Unicorn-16917.exe (PID: 8908)
- Unicorn-6876.exe (PID: 8896)
- Unicorn-23021.exe (PID: 8928)
- Unicorn-35531.exe (PID: 8980)
- Unicorn-8220.exe (PID: 9024)
- Unicorn-43773.exe (PID: 9048)
- Unicorn-23715.exe (PID: 9056)
- Unicorn-10451.exe (PID: 9092)
- Unicorn-22262.exe (PID: 9152)
- Unicorn-56388.exe (PID: 9100)
- Unicorn-1402.exe (PID: 9140)
- Unicorn-47089.exe (PID: 9196)
- Unicorn-36491.exe (PID: 9176)
- Unicorn-23963.exe (PID: 8996)
- Unicorn-41469.exe (PID: 8988)
- Unicorn-45252.exe (PID: 6584)
- Unicorn-45252.exe (PID: 684)
- Unicorn-58822.exe (PID: 4980)
- Unicorn-39683.exe (PID: 8408)
- Unicorn-39683.exe (PID: 8404)
- Unicorn-45133.exe (PID: 4380)
- Unicorn-55439.exe (PID: 3024)
- Unicorn-55439.exe (PID: 872)
- Unicorn-7001.exe (PID: 9324)
- Unicorn-888.exe (PID: 9408)
- Unicorn-1251.exe (PID: 9416)
- Unicorn-17587.exe (PID: 9448)
- Unicorn-5740.exe (PID: 9348)
- Unicorn-64571.exe (PID: 9388)
- Unicorn-4899.exe (PID: 9500)
- Unicorn-55325.exe (PID: 9476)
- Unicorn-16789.exe (PID: 9508)
- Unicorn-55325.exe (PID: 9468)
- Unicorn-19804.exe (PID: 9524)
- Unicorn-24765.exe (PID: 9516)
- Unicorn-46119.exe (PID: 9556)
- Unicorn-46109.exe (PID: 9604)
- Unicorn-15859.exe (PID: 9612)
- Unicorn-42859.exe (PID: 9648)
- Unicorn-29123.exe (PID: 9656)
- Unicorn-48989.exe (PID: 9676)
- Unicorn-45268.exe (PID: 9684)
- Unicorn-29123.exe (PID: 9664)
- Unicorn-42859.exe (PID: 9640)
- Unicorn-20737.exe (PID: 9908)
- Unicorn-40603.exe (PID: 9916)
- Unicorn-24381.exe (PID: 9940)
- Unicorn-18559.exe (PID: 9964)
- Unicorn-53924.exe (PID: 9948)
- Unicorn-53924.exe (PID: 9956)
- Unicorn-16528.exe (PID: 10028)
- Unicorn-669.exe (PID: 10020)
- Unicorn-18813.exe (PID: 9872)
- Unicorn-21142.exe (PID: 10148)
- Unicorn-61018.exe (PID: 10220)
- Unicorn-27770.exe (PID: 9444)
- Unicorn-54888.exe (PID: 10212)
- Unicorn-27770.exe (PID: 9540)
- Unicorn-50883.exe (PID: 10112)
- Unicorn-11977.exe (PID: 6228)
- Unicorn-175.exe (PID: 9992)
- Unicorn-8755.exe (PID: 744)
- Unicorn-47684.exe (PID: 864)
- Unicorn-64596.exe (PID: 10088)
- Unicorn-61882.exe (PID: 10184)
- Unicorn-53709.exe (PID: 5528)
- Unicorn-51223.exe (PID: 10188)
- Unicorn-49883.exe (PID: 9796)
- Unicorn-24493.exe (PID: 9868)
- Unicorn-63915.exe (PID: 5308)
- Unicorn-36147.exe (PID: 3176)
- Unicorn-16211.exe (PID: 10136)
- Unicorn-56506.exe (PID: 10192)
- Unicorn-47383.exe (PID: 4008)
- Unicorn-65259.exe (PID: 6264)
- Unicorn-10028.exe (PID: 10252)
- Unicorn-5587.exe (PID: 6944)
- Unicorn-5852.exe (PID: 10264)
- Unicorn-35720.exe (PID: 6988)
- Unicorn-56230.exe (PID: 10352)
- Unicorn-54779.exe (PID: 9904)
- Unicorn-50180.exe (PID: 4692)
- Unicorn-53252.exe (PID: 7672)
- Unicorn-47684.exe (PID: 968)
- Unicorn-12204.exe (PID: 10444)
- Unicorn-7030.exe (PID: 10496)
- Unicorn-42390.exe (PID: 10536)
- Unicorn-10019.exe (PID: 10568)
- Unicorn-26631.exe (PID: 10488)
- Unicorn-57876.exe (PID: 10436)
- Unicorn-47810.exe (PID: 10428)
- Unicorn-42390.exe (PID: 10528)
- Unicorn-20765.exe (PID: 10480)
- Unicorn-45572.exe (PID: 10632)
- Unicorn-11939.exe (PID: 10684)
- Unicorn-28659.exe (PID: 10676)
- Unicorn-38243.exe (PID: 10800)
- Unicorn-6154.exe (PID: 10764)
- Unicorn-44612.exe (PID: 10740)
- Unicorn-8954.exe (PID: 10772)
- Unicorn-23837.exe (PID: 10812)
- Unicorn-33268.exe (PID: 10840)
- Unicorn-10019.exe (PID: 10560)
- Unicorn-29885.exe (PID: 10584)
- Unicorn-20954.exe (PID: 10576)
- Unicorn-39707.exe (PID: 10624)
- Unicorn-48260.exe (PID: 10668)
- Unicorn-42203.exe (PID: 10700)
- Unicorn-32381.exe (PID: 10932)
- Unicorn-9722.exe (PID: 10956)
- Unicorn-55837.exe (PID: 11032)
- Unicorn-55837.exe (PID: 11024)
- Unicorn-55837.exe (PID: 11016)
- Unicorn-19722.exe (PID: 11044)
- Unicorn-58814.exe (PID: 10884)
- Unicorn-17005.exe (PID: 10864)
- Unicorn-9722.exe (PID: 10964)
- Unicorn-37704.exe (PID: 11116)
- Unicorn-65380.exe (PID: 11216)
- Unicorn-55588.exe (PID: 11328)
- Unicorn-51094.exe (PID: 11260)
- Unicorn-43165.exe (PID: 11316)
- Unicorn-37704.exe (PID: 11124)
- Unicorn-65188.exe (PID: 11240)
- Unicorn-4742.exe (PID: 11400)
- Unicorn-9075.exe (PID: 11384)
- Unicorn-5898.exe (PID: 11424)
- Unicorn-51700.exe (PID: 11452)
- Unicorn-35635.exe (PID: 11624)
- Unicorn-43860.exe (PID: 11632)
- Unicorn-8198.exe (PID: 11548)
- Unicorn-44566.exe (PID: 11600)
- Unicorn-38436.exe (PID: 11640)
- Unicorn-6387.exe (PID: 11372)
- Unicorn-49828.exe (PID: 11692)
- Unicorn-63563.exe (PID: 11672)
- Unicorn-9017.exe (PID: 11756)
- Unicorn-29629.exe (PID: 11764)
- Unicorn-28090.exe (PID: 11704)
- Unicorn-35495.exe (PID: 11740)
- Unicorn-35495.exe (PID: 11748)
- Unicorn-5884.exe (PID: 11868)
- Unicorn-24700.exe (PID: 11648)
- Unicorn-62765.exe (PID: 11732)
- Unicorn-3123.exe (PID: 12000)
- Unicorn-3703.exe (PID: 12120)
- Unicorn-55505.exe (PID: 12112)
- Unicorn-61373.exe (PID: 12148)
- Unicorn-24717.exe (PID: 12184)
- Unicorn-64788.exe (PID: 12172)
- Unicorn-51257.exe (PID: 12208)
- Unicorn-4851.exe (PID: 12220)
- Unicorn-44505.exe (PID: 12228)
- Unicorn-4732.exe (PID: 11932)
- Unicorn-7228.exe (PID: 11976)
- Unicorn-11015.exe (PID: 12320)
- Unicorn-60491.exe (PID: 12400)
- Unicorn-46756.exe (PID: 12392)
- Unicorn-819.exe (PID: 12408)
- Unicorn-49252.exe (PID: 12464)
- Unicorn-46180.exe (PID: 12484)
- Unicorn-59392.exe (PID: 12280)
- Unicorn-18586.exe (PID: 10664)
- Unicorn-2428.exe (PID: 12576)
- Unicorn-57405.exe (PID: 12612)
- Unicorn-8396.exe (PID: 12640)
- Unicorn-4696.exe (PID: 12724)
- Unicorn-59801.exe (PID: 12768)
- Unicorn-26964.exe (PID: 12800)
- Unicorn-25619.exe (PID: 12984)
- Unicorn-26964.exe (PID: 12820)
- Unicorn-52894.exe (PID: 12792)
- Unicorn-39547.exe (PID: 12936)
- Unicorn-18298.exe (PID: 12812)
- Unicorn-33558.exe (PID: 12884)
- Unicorn-45677.exe (PID: 12960)
- Unicorn-6979.exe (PID: 12848)
- Unicorn-45220.exe (PID: 13008)
- Unicorn-45412.exe (PID: 12948)
- Unicorn-7363.exe (PID: 12756)
- Unicorn-7363.exe (PID: 12776)
- Unicorn-30162.exe (PID: 12744)
- Unicorn-21098.exe (PID: 12784)
- Unicorn-40528.exe (PID: 12840)
- Unicorn-20714.exe (PID: 13092)
- Unicorn-33686.exe (PID: 13108)
- Unicorn-42123.exe (PID: 13140)
- Unicorn-27312.exe (PID: 13164)
- Unicorn-29575.exe (PID: 13172)
- Unicorn-5722.exe (PID: 13148)
- Unicorn-36554.exe (PID: 12976)
- Unicorn-29575.exe (PID: 13180)
- Unicorn-16224.exe (PID: 13256)
- Unicorn-26775.exe (PID: 13300)
- Unicorn-14801.exe (PID: 13292)
- Unicorn-12167.exe (PID: 7500)
- Unicorn-1554.exe (PID: 12376)
- Unicorn-61169.exe (PID: 12508)
- Unicorn-29383.exe (PID: 13196)
- Unicorn-35514.exe (PID: 13216)
- Unicorn-35441.exe (PID: 13232)
- Unicorn-62331.exe (PID: 13376)
- Unicorn-22561.exe (PID: 13460)
- Unicorn-11008.exe (PID: 13360)
- Unicorn-13164.exe (PID: 13432)
- Unicorn-36209.exe (PID: 13368)
- Unicorn-24528.exe (PID: 13388)
- Unicorn-63208.exe (PID: 13444)
- Unicorn-29655.exe (PID: 13488)
- Unicorn-52903.exe (PID: 13516)
- Unicorn-34864.exe (PID: 13548)
- Unicorn-54465.exe (PID: 13560)
- Unicorn-4304.exe (PID: 13592)
- Unicorn-20832.exe (PID: 12572)
- Unicorn-14967.exe (PID: 5172)
- Unicorn-1232.exe (PID: 13320)
- Unicorn-62331.exe (PID: 13396)
- Unicorn-39665.exe (PID: 13616)
- Unicorn-39665.exe (PID: 13620)
Reads the computer name
- 1 (592).exe (PID: 7632)
- Unicorn-16724.exe (PID: 7712)
- Unicorn-46205.exe (PID: 7776)
- Unicorn-42867.exe (PID: 7796)
- Unicorn-40838.exe (PID: 7420)
- Unicorn-44560.exe (PID: 7428)
- Unicorn-11311.exe (PID: 7612)
- Unicorn-55451.exe (PID: 7592)
- Unicorn-35309.exe (PID: 1852)
- Unicorn-64189.exe (PID: 644)
- Unicorn-63805.exe (PID: 5124)
- Unicorn-11459.exe (PID: 5512)
- Unicorn-41439.exe (PID: 7184)
- Unicorn-45046.exe (PID: 4464)
- Unicorn-47412.exe (PID: 5228)
- Unicorn-41439.exe (PID: 7176)
- Unicorn-4853.exe (PID: 5972)
- Unicorn-40982.exe (PID: 7180)
- Unicorn-6099.exe (PID: 7268)
- Unicorn-3690.exe (PID: 6972)
- Unicorn-58528.exe (PID: 8132)
- Unicorn-58528.exe (PID: 8084)
- Unicorn-59680.exe (PID: 5352)
- Unicorn-10899.exe (PID: 6656)
- Unicorn-6374.exe (PID: 4436)
- Unicorn-11164.exe (PID: 6268)
- Unicorn-11164.exe (PID: 6516)
- Unicorn-37323.exe (PID: 5328)
- Unicorn-1850.exe (PID: 536)
- Unicorn-58263.exe (PID: 5112)
- Unicorn-11164.exe (PID: 4112)
- Unicorn-10707.exe (PID: 7464)
- Unicorn-30765.exe (PID: 4408)
- Unicorn-4444.exe (PID: 7440)
- Unicorn-47323.exe (PID: 7528)
- Unicorn-41725.exe (PID: 7300)
- Unicorn-37126.exe (PID: 2384)
- Unicorn-25389.exe (PID: 5504)
- Unicorn-64838.exe (PID: 3240)
- Unicorn-18298.exe (PID: 632)
- Unicorn-2062.exe (PID: 5508)
- Unicorn-8284.exe (PID: 6192)
- Unicorn-39815.exe (PID: 1628)
- Unicorn-43417.exe (PID: 2420)
- Unicorn-43587.exe (PID: 7700)
- Unicorn-31357.exe (PID: 1012)
- Unicorn-30864.exe (PID: 7704)
- Unicorn-59710.exe (PID: 7932)
- Unicorn-22234.exe (PID: 6592)
- Unicorn-46624.exe (PID: 7580)
- Unicorn-46624.exe (PID: 736)
- Unicorn-339.exe (PID: 664)
- Unicorn-46276.exe (PID: 8144)
- Unicorn-1372.exe (PID: 7284)
- Unicorn-1372.exe (PID: 668)
- Unicorn-13027.exe (PID: 8036)
- Unicorn-30598.exe (PID: 8104)
- Unicorn-26762.exe (PID: 5376)
- Unicorn-35197.exe (PID: 3888)
- Unicorn-46276.exe (PID: 7972)
- Unicorn-50848.exe (PID: 5364)
- Unicorn-422.exe (PID: 2108)
- Unicorn-796.exe (PID: 5960)
- Unicorn-40675.exe (PID: 8056)
- Unicorn-33469.exe (PID: 7232)
- Unicorn-34429.exe (PID: 1912)
- Unicorn-46359.exe (PID: 1188)
- Unicorn-18285.exe (PID: 904)
- Unicorn-28874.exe (PID: 8164)
- Unicorn-42016.exe (PID: 8064)
- Unicorn-12524.exe (PID: 8188)
- Unicorn-9379.exe (PID: 6468)
- Unicorn-29087.exe (PID: 7912)
- Unicorn-5459.exe (PID: 7304)
- Unicorn-26557.exe (PID: 1852)
- Unicorn-43936.exe (PID: 672)
- Unicorn-21962.exe (PID: 4452)
- Unicorn-54334.exe (PID: 8160)
- Unicorn-58339.exe (PID: 5304)
- Unicorn-24838.exe (PID: 8108)
- Unicorn-51728.exe (PID: 2192)
- Unicorn-58339.exe (PID: 6436)
- Unicorn-4006.exe (PID: 7908)
- Unicorn-31862.exe (PID: 7240)
- Unicorn-12402.exe (PID: 7760)
- Unicorn-45214.exe (PID: 8200)
- Unicorn-8506.exe (PID: 1348)
- Unicorn-24182.exe (PID: 8276)
- Unicorn-5459.exe (PID: 7296)
- Unicorn-13788.exe (PID: 8360)
- Unicorn-30042.exe (PID: 8256)
- Unicorn-17437.exe (PID: 8016)
- Unicorn-56087.exe (PID: 8324)
- Unicorn-63373.exe (PID: 8348)
- Unicorn-28397.exe (PID: 8284)
- Unicorn-62880.exe (PID: 8528)
- Unicorn-13103.exe (PID: 8340)
- Unicorn-53943.exe (PID: 8496)
- Unicorn-45812.exe (PID: 8380)
- Unicorn-29475.exe (PID: 8580)
- Unicorn-49341.exe (PID: 8588)
- Unicorn-13871.exe (PID: 8504)
- Unicorn-12371.exe (PID: 8644)
- Unicorn-65101.exe (PID: 8660)
- Unicorn-23296.exe (PID: 8792)
- Unicorn-47918.exe (PID: 8716)
- Unicorn-64032.exe (PID: 8652)
- Unicorn-18531.exe (PID: 8724)
- Unicorn-44734.exe (PID: 8760)
- Unicorn-35531.exe (PID: 8980)
- Unicorn-45949.exe (PID: 8784)
- Unicorn-7260.exe (PID: 8852)
- Unicorn-56461.exe (PID: 8860)
- Unicorn-41469.exe (PID: 8988)
- Unicorn-1514.exe (PID: 8820)
- Unicorn-19574.exe (PID: 8828)
- Unicorn-39549.exe (PID: 8884)
- Unicorn-23021.exe (PID: 8928)
- Unicorn-33798.exe (PID: 8752)
- Unicorn-16917.exe (PID: 8908)
- Unicorn-43773.exe (PID: 9048)
- Unicorn-21110.exe (PID: 8964)
- Unicorn-23963.exe (PID: 8996)
- Unicorn-8220.exe (PID: 9024)
- Unicorn-22262.exe (PID: 9152)
- Unicorn-56388.exe (PID: 9100)
- Unicorn-1402.exe (PID: 9140)
Create files in a temporary directory
- 1 (592).exe (PID: 7632)
- Unicorn-16724.exe (PID: 7712)
- Unicorn-46205.exe (PID: 7776)
- Unicorn-42867.exe (PID: 7796)
- Unicorn-44560.exe (PID: 7428)
- Unicorn-40838.exe (PID: 7420)
- Unicorn-55451.exe (PID: 7592)
- Unicorn-64189.exe (PID: 644)
- Unicorn-63805.exe (PID: 5124)
- Unicorn-41439.exe (PID: 7176)
- Unicorn-41439.exe (PID: 7184)
- Unicorn-11311.exe (PID: 7612)
- Unicorn-45046.exe (PID: 4464)
- Unicorn-47412.exe (PID: 5228)
- Unicorn-58528.exe (PID: 8132)
- Unicorn-58528.exe (PID: 8084)
- Unicorn-11459.exe (PID: 5512)
- Unicorn-3690.exe (PID: 6972)
- Unicorn-59680.exe (PID: 5352)
- Unicorn-10899.exe (PID: 6656)
- Unicorn-6099.exe (PID: 7268)
- Unicorn-6374.exe (PID: 4436)
- Unicorn-11164.exe (PID: 6268)
- Unicorn-1850.exe (PID: 536)
- Unicorn-58263.exe (PID: 5112)
- Unicorn-11164.exe (PID: 4112)
- Unicorn-4853.exe (PID: 5972)
- Unicorn-40982.exe (PID: 7180)
- Unicorn-10707.exe (PID: 7464)
- Unicorn-30765.exe (PID: 4408)
- Unicorn-4444.exe (PID: 7440)
- Unicorn-47323.exe (PID: 7528)
- Unicorn-41725.exe (PID: 7300)
- Unicorn-25389.exe (PID: 5504)
- Unicorn-37126.exe (PID: 2384)
- Unicorn-64838.exe (PID: 3240)
- Unicorn-8284.exe (PID: 6192)
- Unicorn-39815.exe (PID: 1628)
- Unicorn-18298.exe (PID: 632)
- Unicorn-43417.exe (PID: 2420)
- Unicorn-43587.exe (PID: 7700)
- Unicorn-30864.exe (PID: 7704)
- Unicorn-31357.exe (PID: 1012)
- Unicorn-22234.exe (PID: 6592)
- Unicorn-59710.exe (PID: 7932)
- Unicorn-46624.exe (PID: 7580)
- Unicorn-40675.exe (PID: 8056)
- Unicorn-1372.exe (PID: 7284)
- Unicorn-46624.exe (PID: 736)
- Unicorn-13027.exe (PID: 8036)
- Unicorn-33469.exe (PID: 7232)
- Unicorn-46276.exe (PID: 8144)
- Unicorn-11164.exe (PID: 6516)
- Unicorn-26762.exe (PID: 5376)
- Unicorn-46276.exe (PID: 7972)
- Unicorn-30598.exe (PID: 8104)
- Unicorn-35197.exe (PID: 3888)
- Unicorn-37323.exe (PID: 5328)
- Unicorn-422.exe (PID: 2108)
- Unicorn-34429.exe (PID: 1912)
- Unicorn-46359.exe (PID: 1188)
- Unicorn-1372.exe (PID: 668)
- Unicorn-18285.exe (PID: 904)
- Unicorn-28874.exe (PID: 8164)
- Unicorn-42016.exe (PID: 8064)
- Unicorn-9379.exe (PID: 6468)
- Unicorn-5459.exe (PID: 7304)
- Unicorn-26557.exe (PID: 1852)
- Unicorn-58339.exe (PID: 5304)
- Unicorn-29087.exe (PID: 7912)
- Unicorn-24838.exe (PID: 8108)
- Unicorn-4006.exe (PID: 7908)
- Unicorn-21962.exe (PID: 4452)
- Unicorn-51728.exe (PID: 2192)
- Unicorn-58339.exe (PID: 6436)
- Unicorn-31862.exe (PID: 7240)
- Unicorn-2062.exe (PID: 5508)
- Unicorn-5459.exe (PID: 7296)
- Unicorn-12402.exe (PID: 7760)
- Unicorn-45214.exe (PID: 8200)
- Unicorn-24182.exe (PID: 8276)
- Unicorn-17437.exe (PID: 8016)
- Unicorn-339.exe (PID: 664)
- Unicorn-30042.exe (PID: 8256)
- Unicorn-63373.exe (PID: 8348)
- Unicorn-13788.exe (PID: 8360)
- Unicorn-56087.exe (PID: 8324)
- Unicorn-28397.exe (PID: 8284)
- Unicorn-45812.exe (PID: 8380)
- Unicorn-13103.exe (PID: 8340)
- Unicorn-53943.exe (PID: 8496)
- Unicorn-13871.exe (PID: 8504)
- Unicorn-62880.exe (PID: 8528)
- Unicorn-12371.exe (PID: 8644)
- Unicorn-64032.exe (PID: 8652)
- Unicorn-12524.exe (PID: 8188)
- Unicorn-65101.exe (PID: 8660)
- Unicorn-43936.exe (PID: 672)
- Unicorn-23296.exe (PID: 8792)
- Unicorn-47918.exe (PID: 8716)
- Unicorn-18531.exe (PID: 8724)
- Unicorn-44734.exe (PID: 8760)
- Unicorn-8506.exe (PID: 1348)
- Unicorn-7260.exe (PID: 8852)
- Unicorn-56461.exe (PID: 8860)
- Unicorn-41469.exe (PID: 8988)
- Unicorn-45949.exe (PID: 8784)
- Unicorn-1514.exe (PID: 8820)
- Unicorn-19574.exe (PID: 8828)
- Unicorn-33798.exe (PID: 8752)
- Unicorn-50848.exe (PID: 5364)
- Unicorn-39549.exe (PID: 8884)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 7440)
- BackgroundTransferHost.exe (PID: 5508)
- BackgroundTransferHost.exe (PID: 3896)
- BackgroundTransferHost.exe (PID: 7224)
- BackgroundTransferHost.exe (PID: 8160)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 5508)
- WerFault.exe (PID: 4608)
- WerFault.exe (PID: 8512)
- WerFault.exe (PID: 9832)
- WerFault.exe (PID: 9784)
- WerFault.exe (PID: 11908)
- WerFault.exe (PID: 12308)
- WerFault.exe (PID: 11904)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 5508)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 5508)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
497
Monitored processes
354
Malicious processes
50
Suspicious processes
42
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 536 | C:\Users\admin\AppData\Local\Temp\Unicorn-1850.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-1850.exe | 1 (592).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 632 | C:\Users\admin\AppData\Local\Temp\Unicorn-18298.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-18298.exe | Unicorn-40838.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 644 | C:\Users\admin\AppData\Local\Temp\Unicorn-64189.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-64189.exe | Unicorn-44560.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 664 | C:\Users\admin\AppData\Local\Temp\Unicorn-339.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-339.exe | Unicorn-42867.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 668 | C:\Users\admin\AppData\Local\Temp\Unicorn-1372.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-1372.exe | Unicorn-37323.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 672 | C:\Users\admin\AppData\Local\Temp\Unicorn-43936.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-43936.exe | Unicorn-64838.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 684 | C:\Users\admin\AppData\Local\Temp\Unicorn-45252.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-45252.exe | Unicorn-40675.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 736 | C:\Users\admin\AppData\Local\Temp\Unicorn-46624.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46624.exe | Unicorn-11164.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 744 | C:\Users\admin\AppData\Local\Temp\Unicorn-8755.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8755.exe | — | Unicorn-31357.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 864 | C:\Users\admin\AppData\Local\Temp\Unicorn-47684.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-47684.exe | — | Unicorn-59710.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
20 251
Read events
20 236
Write events
15
Delete events
0
Modification events
| (PID) Process: | (7440) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7440) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7440) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (5508) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (5508) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (5508) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (3896) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (3896) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (3896) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7224) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
849
Suspicious files
38
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5508 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\a868fd4a-8f7f-4084-b967-ec09dae7b285.down_data | — | |
MD5:— | SHA256:— | |||
| 7632 | 1 (592).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-55451.exe | executable | |
MD5:057E67C6925C5CD1FBD45BE29F6B1D70 | SHA256:138C6BF23F8FDBFAA3E3073F971372EE287F348E7DEB078C2A7E1B14294301E7 | |||
| 5508 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:7F25EBAAD8C487FC7D62A580BF639130 | SHA256:2C940FE4BE43AF724AB7D222D142B75EEC5523AAC34F17847C0BDF8129900E56 | |||
| 7776 | Unicorn-46205.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-44560.exe | executable | |
MD5:06F8F1D6092AF1B7E96D1BDFDE096D48 | SHA256:A62A086047BFC6DC7B57E40955D833B7441CD9C634BE0D82ECA3382006977428 | |||
| 5508 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\a868fd4a-8f7f-4084-b967-ec09dae7b285.fdce63c1-c0ce-44cc-aea1-fea7729c49b9.down_meta | binary | |
MD5:BAAE29D366D408D554D39B5D61845E16 | SHA256:6B2AF316CCE504B5CFF14C439AADB77035BD4582A456E827A52710256841268E | |||
| 7712 | Unicorn-16724.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46205.exe | executable | |
MD5:146D21E8F0BA64F30E4FBBE8CC4F596E | SHA256:585E0B845C48F705F2AD31321CC7A4E1E73912D35026B290E8E6F708D67BDB46 | |||
| 7796 | Unicorn-42867.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-11311.exe | executable | |
MD5:E23EB84247C68A60A453E8DB3FA86DA1 | SHA256:8867871EFD88242B3D03C8E4F91BAAA3B59CAF50291A0AFCBA7AC9FB5A205527 | |||
| 7420 | Unicorn-40838.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63805.exe | executable | |
MD5:82365971CAF7FE520C23C5A67A02310F | SHA256:611C6309F09CB759924E7C91EFB92C60A0E9A2509A8B76E5AE432333E1A88BD5 | |||
| 7632 | 1 (592).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-42867.exe | executable | |
MD5:6B3E0DA9DF8942654BE580EE16A2C616 | SHA256:C0505245DCE8ACBD071E74FC85E7BF62B9ADC2916979DBA37DB86CDDF88D0148 | |||
| 5508 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\fc18e271-31ab-4e39-9329-7d2c8519d986.fdce63c1-c0ce-44cc-aea1-fea7729c49b9.down_meta | binary | |
MD5:BAAE29D366D408D554D39B5D61845E16 | SHA256:6B2AF316CCE504B5CFF14C439AADB77035BD4582A456E827A52710256841268E | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
35
DNS requests
20
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7312 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
7228 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7228 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
3284 | svchost.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5508 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
3284 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 40.126.32.76:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
6544 | svchost.exe | 40.126.32.76:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 20.198.162.78:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | SG | whitelisted |
3216 | svchost.exe | 20.198.162.78:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | SG | whitelisted |
5496 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
7312 | backgroundTaskHost.exe | 20.199.58.43:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |