| File name: | 1 (248) |
| Full analysis: | https://app.any.run/tasks/98be709b-7e49-4676-817e-6f2924c9ec51 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 18:54:38 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 5CBAFC172E24B456F2A942FB7DD2BB90 |
| SHA1: | C019A14270CA0A586EAE506F25EC0A08DB70E2A4 |
| SHA256: | 3C4627243A111E3E1BD9288352A99F3D7AC09BB9DF749D4C9813DFF5F0B38621 |
| SSDEEP: | 6144:3drtBNIikDOMA54WTXeQuqYx5gBqvp8GBBLWydO9Vk/8SwuwpyAvEh3GXG7fETSa:3pLeoMA59TOCBq+aB6ydO9Wx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- Unicorn-33560.exe (PID: 5112)
- 1 (248).exe (PID: 5200)
- Unicorn-16238.exe (PID: 6048)
- Unicorn-8624.exe (PID: 5156)
- Unicorn-19336.exe (PID: 5776)
- Unicorn-15251.exe (PID: 4424)
- Unicorn-60923.exe (PID: 6516)
- Unicorn-43932.exe (PID: 4408)
- Unicorn-49390.exe (PID: 2240)
- Unicorn-38529.exe (PID: 5360)
- Unicorn-34445.exe (PID: 2772)
- Unicorn-50781.exe (PID: 5608)
- Unicorn-26831.exe (PID: 5008)
- Unicorn-50781.exe (PID: 300)
- Unicorn-46432.exe (PID: 3272)
- Unicorn-40567.exe (PID: 4988)
- Unicorn-44320.exe (PID: 7256)
- Unicorn-25099.exe (PID: 7336)
- Unicorn-21207.exe (PID: 7224)
- Unicorn-49695.exe (PID: 7364)
- Unicorn-41435.exe (PID: 7396)
- Unicorn-17485.exe (PID: 7416)
- Unicorn-64548.exe (PID: 7448)
- Unicorn-14792.exe (PID: 7476)
- Unicorn-57771.exe (PID: 7484)
- Unicorn-14792.exe (PID: 7468)
- Unicorn-22696.exe (PID: 7516)
- Unicorn-7179.exe (PID: 7492)
- Unicorn-16830.exe (PID: 7524)
- Unicorn-37351.exe (PID: 7424)
- Unicorn-27050.exe (PID: 7532)
- Unicorn-20221.exe (PID: 7956)
- Unicorn-57771.exe (PID: 7508)
- Unicorn-36557.exe (PID: 8008)
- Unicorn-26342.exe (PID: 8024)
- Unicorn-2322.exe (PID: 8100)
- Unicorn-39249.exe (PID: 7980)
- Unicorn-56162.exe (PID: 8128)
- Unicorn-547.exe (PID: 7604)
- Unicorn-59307.exe (PID: 5084)
- Unicorn-57553.exe (PID: 8164)
- Unicorn-65529.exe (PID: 736)
- Unicorn-37517.exe (PID: 2568)
- Unicorn-52462.exe (PID: 2108)
- Unicorn-27302.exe (PID: 2140)
- Unicorn-59975.exe (PID: 6724)
- Unicorn-43547.exe (PID: 7648)
- Unicorn-43547.exe (PID: 7752)
- Unicorn-62021.exe (PID: 2980)
- Unicorn-20989.exe (PID: 7624)
- Unicorn-8736.exe (PID: 7708)
- Unicorn-20989.exe (PID: 7660)
- Unicorn-16905.exe (PID: 7884)
- Unicorn-18942.exe (PID: 7924)
- Unicorn-62576.exe (PID: 7824)
- Unicorn-62576.exe (PID: 7864)
- Unicorn-59121.exe (PID: 8052)
- Unicorn-8736.exe (PID: 7688)
- Unicorn-2249.exe (PID: 7940)
- Unicorn-20989.exe (PID: 7612)
- Unicorn-48186.exe (PID: 7948)
- Unicorn-5207.exe (PID: 7916)
- Unicorn-11859.exe (PID: 7964)
- Unicorn-27403.exe (PID: 5772)
- Unicorn-45062.exe (PID: 1912)
- Unicorn-53945.exe (PID: 6576)
- Unicorn-3474.exe (PID: 2040)
- Unicorn-5420.exe (PID: 7196)
- Unicorn-40231.exe (PID: 7860)
- Unicorn-33936.exe (PID: 6108)
- Unicorn-51907.exe (PID: 7404)
- Unicorn-11621.exe (PID: 7332)
- Unicorn-3474.exe (PID: 2984)
- Unicorn-46353.exe (PID: 7292)
- Unicorn-47008.exe (PID: 8188)
- Unicorn-64735.exe (PID: 8200)
- Unicorn-45499.exe (PID: 8252)
- Unicorn-53038.exe (PID: 8228)
- Unicorn-56375.exe (PID: 8316)
- Unicorn-7366.exe (PID: 8236)
- Unicorn-14719.exe (PID: 8340)
- Unicorn-28171.exe (PID: 8408)
- Unicorn-17956.exe (PID: 8416)
- Unicorn-56951.exe (PID: 8380)
- Unicorn-18441.exe (PID: 8472)
- Unicorn-57143.exe (PID: 8532)
- Unicorn-24471.exe (PID: 8508)
- Unicorn-57890.exe (PID: 8492)
- Unicorn-2083.exe (PID: 8444)
- Unicorn-16879.exe (PID: 8572)
- Unicorn-51013.exe (PID: 8524)
- Unicorn-35907.exe (PID: 8564)
- Unicorn-43329.exe (PID: 8640)
- Unicorn-30812.exe (PID: 8612)
- Unicorn-33023.exe (PID: 8672)
- Unicorn-40926.exe (PID: 8700)
- Unicorn-36291.exe (PID: 8768)
- Unicorn-45851.exe (PID: 8792)
- Unicorn-12986.exe (PID: 8844)
- Unicorn-43713.exe (PID: 8856)
- Unicorn-45659.exe (PID: 8912)
- Unicorn-21709.exe (PID: 8924)
- Unicorn-60049.exe (PID: 8876)
- Unicorn-52421.exe (PID: 9004)
- Unicorn-27185.exe (PID: 9032)
- Unicorn-27917.exe (PID: 8968)
- Unicorn-9442.exe (PID: 8976)
- Unicorn-57060.exe (PID: 9104)
- Unicorn-38045.exe (PID: 8952)
- Unicorn-42115.exe (PID: 9096)
- Unicorn-27185.exe (PID: 8960)
- Unicorn-23408.exe (PID: 9192)
- Unicorn-24387.exe (PID: 8984)
- Unicorn-23376.exe (PID: 9172)
- Unicorn-1082.exe (PID: 9184)
- Unicorn-3220.exe (PID: 9068)
- Unicorn-42115.exe (PID: 9088)
- Unicorn-55551.exe (PID: 6972)
- Unicorn-52421.exe (PID: 8996)
- Unicorn-11288.exe (PID: 6632)
- Unicorn-43961.exe (PID: 8632)
- Unicorn-11288.exe (PID: 5408)
- Unicorn-9150.exe (PID: 8660)
- Unicorn-28279.exe (PID: 5328)
- Unicorn-60952.exe (PID: 8720)
- Unicorn-34931.exe (PID: 6040)
- Unicorn-15665.exe (PID: 7844)
- Unicorn-61357.exe (PID: 2516)
- Unicorn-8072.exe (PID: 9260)
- Unicorn-61357.exe (PID: 8300)
- Unicorn-3988.exe (PID: 8276)
- Unicorn-59966.exe (PID: 7856)
- Unicorn-42883.exe (PID: 9220)
- Unicorn-34614.exe (PID: 9292)
- Unicorn-30174.exe (PID: 9324)
- Unicorn-21202.exe (PID: 9316)
- Unicorn-65456.exe (PID: 7200)
- Unicorn-11964.exe (PID: 9380)
- Unicorn-13287.exe (PID: 9452)
- Unicorn-11964.exe (PID: 9388)
- Unicorn-21202.exe (PID: 9308)
- Unicorn-59795.exe (PID: 9396)
- Unicorn-13287.exe (PID: 9444)
- Unicorn-30439.exe (PID: 9332)
- Unicorn-4927.exe (PID: 9548)
- Unicorn-22390.exe (PID: 9592)
- Unicorn-49297.exe (PID: 9576)
- Unicorn-12348.exe (PID: 9624)
- Unicorn-2789.exe (PID: 9600)
- Unicorn-31377.exe (PID: 9644)
- Unicorn-42313.exe (PID: 9660)
- Unicorn-45113.exe (PID: 9652)
- Unicorn-26353.exe (PID: 9712)
Executable content was dropped or overwritten
- Unicorn-19336.exe (PID: 5776)
- 1 (248).exe (PID: 5200)
- Unicorn-8624.exe (PID: 5156)
- Unicorn-33560.exe (PID: 5112)
- Unicorn-16238.exe (PID: 6048)
- Unicorn-60923.exe (PID: 6516)
- Unicorn-15251.exe (PID: 4424)
- Unicorn-34445.exe (PID: 2772)
- Unicorn-49390.exe (PID: 2240)
- Unicorn-38529.exe (PID: 5360)
- Unicorn-50781.exe (PID: 300)
- Unicorn-46432.exe (PID: 3272)
- Unicorn-50781.exe (PID: 5608)
- Unicorn-43932.exe (PID: 4408)
- Unicorn-44320.exe (PID: 7256)
- Unicorn-25099.exe (PID: 7336)
- Unicorn-21207.exe (PID: 7224)
- Unicorn-41435.exe (PID: 7396)
- Unicorn-17485.exe (PID: 7416)
- Unicorn-37351.exe (PID: 7424)
- Unicorn-49695.exe (PID: 7364)
- Unicorn-64548.exe (PID: 7448)
- Unicorn-57771.exe (PID: 7484)
- Unicorn-14792.exe (PID: 7468)
- Unicorn-57771.exe (PID: 7508)
- Unicorn-27050.exe (PID: 7532)
- Unicorn-40567.exe (PID: 4988)
- Unicorn-20221.exe (PID: 7956)
- Unicorn-26831.exe (PID: 5008)
- Unicorn-36557.exe (PID: 8008)
- Unicorn-56162.exe (PID: 8128)
- Unicorn-2322.exe (PID: 8100)
- Unicorn-57553.exe (PID: 8164)
- Unicorn-39249.exe (PID: 7980)
- Unicorn-65456.exe (PID: 7200)
- Unicorn-65529.exe (PID: 736)
- Unicorn-547.exe (PID: 7604)
- Unicorn-59307.exe (PID: 5084)
- Unicorn-37517.exe (PID: 2568)
- Unicorn-52462.exe (PID: 2108)
- Unicorn-27302.exe (PID: 2140)
- Unicorn-43547.exe (PID: 7648)
- Unicorn-14792.exe (PID: 7476)
- Unicorn-43547.exe (PID: 7752)
- Unicorn-62021.exe (PID: 2980)
- Unicorn-59975.exe (PID: 6724)
- Unicorn-20989.exe (PID: 7624)
- Unicorn-16905.exe (PID: 7884)
- Unicorn-8736.exe (PID: 7708)
- Unicorn-20989.exe (PID: 7660)
- Unicorn-22696.exe (PID: 7516)
- Unicorn-18942.exe (PID: 7924)
- Unicorn-7179.exe (PID: 7492)
- Unicorn-62576.exe (PID: 7824)
- Unicorn-62576.exe (PID: 7864)
- Unicorn-8736.exe (PID: 7688)
- Unicorn-2249.exe (PID: 7940)
- Unicorn-5207.exe (PID: 7916)
- Unicorn-48186.exe (PID: 7948)
- Unicorn-16830.exe (PID: 7524)
- Unicorn-27403.exe (PID: 5772)
- Unicorn-45062.exe (PID: 1912)
- Unicorn-51907.exe (PID: 7404)
- Unicorn-53945.exe (PID: 6576)
- Unicorn-3474.exe (PID: 2040)
- Unicorn-40231.exe (PID: 7860)
- Unicorn-33936.exe (PID: 6108)
- Unicorn-46353.exe (PID: 7292)
- Unicorn-47008.exe (PID: 8188)
- Unicorn-64735.exe (PID: 8200)
- Unicorn-45499.exe (PID: 8252)
- Unicorn-26342.exe (PID: 8024)
- Unicorn-56375.exe (PID: 8316)
- Unicorn-53038.exe (PID: 8228)
- Unicorn-7366.exe (PID: 8236)
- Unicorn-14719.exe (PID: 8340)
- Unicorn-28171.exe (PID: 8408)
- Unicorn-17956.exe (PID: 8416)
- Unicorn-56951.exe (PID: 8380)
- Unicorn-18441.exe (PID: 8472)
- Unicorn-57143.exe (PID: 8532)
- Unicorn-24471.exe (PID: 8508)
- Unicorn-57890.exe (PID: 8492)
- Unicorn-2083.exe (PID: 8444)
- Unicorn-16879.exe (PID: 8572)
- Unicorn-51013.exe (PID: 8524)
- Unicorn-35907.exe (PID: 8564)
- Unicorn-43329.exe (PID: 8640)
- Unicorn-30812.exe (PID: 8612)
- Unicorn-33023.exe (PID: 8672)
- Unicorn-40926.exe (PID: 8700)
- Unicorn-36291.exe (PID: 8768)
- Unicorn-45851.exe (PID: 8792)
- Unicorn-12986.exe (PID: 8844)
- Unicorn-43713.exe (PID: 8856)
- Unicorn-45659.exe (PID: 8912)
- Unicorn-21709.exe (PID: 8924)
- Unicorn-50490.exe (PID: 8828)
- Unicorn-60049.exe (PID: 8876)
- Unicorn-52421.exe (PID: 9004)
- Unicorn-27185.exe (PID: 9032)
- Unicorn-27917.exe (PID: 8968)
- Unicorn-9442.exe (PID: 8976)
- Unicorn-57060.exe (PID: 9104)
- Unicorn-27185.exe (PID: 8960)
- Unicorn-23408.exe (PID: 9192)
- Unicorn-24387.exe (PID: 8984)
- Unicorn-59121.exe (PID: 8052)
- Unicorn-11859.exe (PID: 7964)
- Unicorn-1082.exe (PID: 9184)
- Unicorn-3220.exe (PID: 9068)
- Unicorn-52421.exe (PID: 8996)
- Unicorn-28279.exe (PID: 5328)
- Unicorn-55551.exe (PID: 6972)
- Unicorn-11288.exe (PID: 5408)
- Unicorn-9150.exe (PID: 8660)
- Unicorn-60952.exe (PID: 8720)
- Unicorn-43961.exe (PID: 8632)
- Unicorn-34931.exe (PID: 6040)
- Unicorn-5420.exe (PID: 7196)
- Unicorn-15665.exe (PID: 7844)
- Unicorn-8072.exe (PID: 9260)
- Unicorn-61357.exe (PID: 2516)
- Unicorn-59966.exe (PID: 7856)
- Unicorn-42883.exe (PID: 9220)
- Unicorn-61357.exe (PID: 8300)
- Unicorn-3988.exe (PID: 8276)
- Unicorn-49005.exe (PID: 9276)
- Unicorn-30174.exe (PID: 9324)
- Unicorn-21202.exe (PID: 9316)
- Unicorn-30439.exe (PID: 9332)
- Unicorn-34614.exe (PID: 9292)
- Unicorn-11964.exe (PID: 9388)
- Unicorn-21202.exe (PID: 9308)
- Unicorn-13287.exe (PID: 9444)
- Unicorn-11964.exe (PID: 9380)
- Unicorn-4927.exe (PID: 9548)
- Unicorn-22390.exe (PID: 9592)
- Unicorn-49297.exe (PID: 9576)
- Unicorn-2789.exe (PID: 9600)
- Unicorn-12348.exe (PID: 9624)
- Unicorn-31377.exe (PID: 9644)
- Unicorn-45113.exe (PID: 9652)
- Unicorn-30007.exe (PID: 9696)
- Unicorn-10786.exe (PID: 9768)
- Unicorn-64071.exe (PID: 9752)
- Unicorn-37329.exe (PID: 9824)
- Unicorn-1035.exe (PID: 9856)
- Unicorn-8648.exe (PID: 9848)
- Unicorn-20989.exe (PID: 7612)
- Unicorn-40697.exe (PID: 9876)
- Unicorn-25652.exe (PID: 9944)
- Unicorn-42115.exe (PID: 9088)
- Unicorn-23376.exe (PID: 9172)
- Unicorn-54725.exe (PID: 10028)
- Unicorn-11288.exe (PID: 6632)
- Unicorn-35675.exe (PID: 9996)
- Unicorn-62317.exe (PID: 9988)
- Unicorn-26353.exe (PID: 9712)
- Unicorn-25177.exe (PID: 9732)
- Unicorn-56571.exe (PID: 10136)
- Unicorn-13692.exe (PID: 10048)
- Unicorn-65394.exe (PID: 10112)
- Unicorn-9416.exe (PID: 10156)
- Unicorn-3121.exe (PID: 10092)
- Unicorn-13287.exe (PID: 9452)
- Unicorn-52971.exe (PID: 10192)
- Unicorn-8601.exe (PID: 10176)
- Unicorn-32913.exe (PID: 4428)
- Unicorn-50833.exe (PID: 8904)
- Unicorn-54917.exe (PID: 8896)
- Unicorn-26329.exe (PID: 10216)
- Unicorn-65223.exe (PID: 10236)
- Unicorn-42313.exe (PID: 9660)
- Unicorn-18636.exe (PID: 10252)
- Unicorn-27459.exe (PID: 4920)
- Unicorn-20469.exe (PID: 10056)
- Unicorn-3474.exe (PID: 2984)
- Unicorn-2208.exe (PID: 10272)
- Unicorn-12222.exe (PID: 10368)
- Unicorn-29043.exe (PID: 10424)
- Unicorn-11621.exe (PID: 7332)
- Unicorn-38045.exe (PID: 8952)
- Unicorn-27097.exe (PID: 10400)
- Unicorn-29427.exe (PID: 10592)
- Unicorn-50786.exe (PID: 10468)
- Unicorn-59795.exe (PID: 9396)
- Unicorn-63667.exe (PID: 10508)
- Unicorn-2784.exe (PID: 10620)
- Unicorn-53116.exe (PID: 10656)
- Unicorn-49661.exe (PID: 10680)
- Unicorn-18279.exe (PID: 10308)
- Unicorn-25321.exe (PID: 10280)
- Unicorn-61113.exe (PID: 10780)
- Unicorn-26778.exe (PID: 10928)
- Unicorn-32424.exe (PID: 10796)
- Unicorn-17943.exe (PID: 10836)
- Unicorn-46531.exe (PID: 10892)
- Unicorn-29379.exe (PID: 10992)
- Unicorn-32887.exe (PID: 10844)
- Unicorn-17127.exe (PID: 10964)
- Unicorn-38363.exe (PID: 10860)
- Unicorn-59551.exe (PID: 10940)
- Unicorn-14434.exe (PID: 10980)
- Unicorn-54315.exe (PID: 10704)
INFO
Checks supported languages
- Unicorn-33560.exe (PID: 5112)
- 1 (248).exe (PID: 5200)
- Unicorn-16238.exe (PID: 6048)
- Unicorn-8624.exe (PID: 5156)
- Unicorn-19336.exe (PID: 5776)
- Unicorn-60923.exe (PID: 6516)
- Unicorn-43932.exe (PID: 4408)
- Unicorn-34445.exe (PID: 2772)
- Unicorn-15251.exe (PID: 4424)
- Unicorn-38529.exe (PID: 5360)
- Unicorn-50781.exe (PID: 300)
- Unicorn-26831.exe (PID: 5008)
- Unicorn-46432.exe (PID: 3272)
- Unicorn-49390.exe (PID: 2240)
- Unicorn-50781.exe (PID: 5608)
- Unicorn-40567.exe (PID: 4988)
- Unicorn-49695.exe (PID: 7364)
- Unicorn-44320.exe (PID: 7256)
- Unicorn-25099.exe (PID: 7336)
- Unicorn-41435.exe (PID: 7396)
- Unicorn-37351.exe (PID: 7424)
- Unicorn-17485.exe (PID: 7416)
- Unicorn-64548.exe (PID: 7448)
- Unicorn-14792.exe (PID: 7468)
- Unicorn-14792.exe (PID: 7476)
- Unicorn-7179.exe (PID: 7492)
- Unicorn-22696.exe (PID: 7516)
- Unicorn-16830.exe (PID: 7524)
- Unicorn-57771.exe (PID: 7484)
- Unicorn-57771.exe (PID: 7508)
- Unicorn-26342.exe (PID: 8024)
- Unicorn-65529.exe (PID: 736)
- Unicorn-547.exe (PID: 7604)
- Unicorn-59307.exe (PID: 5084)
- Unicorn-37517.exe (PID: 2568)
- Unicorn-56162.exe (PID: 8128)
- Unicorn-62021.exe (PID: 2980)
- Unicorn-43547.exe (PID: 7752)
- Unicorn-52462.exe (PID: 2108)
- Unicorn-18942.exe (PID: 7924)
- Unicorn-20989.exe (PID: 7660)
- Unicorn-62576.exe (PID: 7864)
- Unicorn-20989.exe (PID: 7624)
- Unicorn-20989.exe (PID: 7612)
- Unicorn-2249.exe (PID: 7940)
- Unicorn-5207.exe (PID: 7916)
- Unicorn-48186.exe (PID: 7948)
- Unicorn-11621.exe (PID: 7332)
- Unicorn-8736.exe (PID: 7688)
- Unicorn-45062.exe (PID: 1912)
- Unicorn-51907.exe (PID: 7404)
- Unicorn-3474.exe (PID: 2040)
- Unicorn-5420.exe (PID: 7196)
- Unicorn-46353.exe (PID: 7292)
- Unicorn-53038.exe (PID: 8228)
- Unicorn-56375.exe (PID: 8316)
- Unicorn-14719.exe (PID: 8340)
- Unicorn-56951.exe (PID: 8380)
- Unicorn-18441.exe (PID: 8472)
- Unicorn-24471.exe (PID: 8508)
- Unicorn-2083.exe (PID: 8444)
- Unicorn-16879.exe (PID: 8572)
- Unicorn-43329.exe (PID: 8640)
- Unicorn-40926.exe (PID: 8700)
- Unicorn-36291.exe (PID: 8768)
- Unicorn-57143.exe (PID: 8532)
- Unicorn-45851.exe (PID: 8792)
- Unicorn-50490.exe (PID: 8828)
- Unicorn-43713.exe (PID: 8856)
- Unicorn-60049.exe (PID: 8876)
- Unicorn-27917.exe (PID: 8968)
- Unicorn-38045.exe (PID: 8952)
- Unicorn-21709.exe (PID: 8924)
- Unicorn-24387.exe (PID: 8984)
- Unicorn-52421.exe (PID: 8996)
- Unicorn-27185.exe (PID: 8960)
- Unicorn-27185.exe (PID: 9032)
- Unicorn-42115.exe (PID: 9096)
- Unicorn-42115.exe (PID: 9088)
- Unicorn-57060.exe (PID: 9104)
- Unicorn-23376.exe (PID: 9172)
- Unicorn-23408.exe (PID: 9192)
- Unicorn-28279.exe (PID: 5328)
- Unicorn-43961.exe (PID: 8632)
- Unicorn-60952.exe (PID: 8720)
- Unicorn-15665.exe (PID: 7844)
- Unicorn-1082.exe (PID: 9184)
- Unicorn-34931.exe (PID: 6040)
- Unicorn-11288.exe (PID: 5408)
- Unicorn-61357.exe (PID: 8300)
- Unicorn-42883.exe (PID: 9220)
- Unicorn-3988.exe (PID: 8276)
- Unicorn-8072.exe (PID: 9260)
- Unicorn-61357.exe (PID: 2516)
- Unicorn-21202.exe (PID: 9316)
- Unicorn-11964.exe (PID: 9388)
- Unicorn-59795.exe (PID: 9396)
- Unicorn-13287.exe (PID: 9444)
- Unicorn-22390.exe (PID: 9592)
- Unicorn-2789.exe (PID: 9600)
- Unicorn-13287.exe (PID: 9452)
- Unicorn-31377.exe (PID: 9644)
- Unicorn-45113.exe (PID: 9652)
- Unicorn-12348.exe (PID: 9624)
- Unicorn-42313.exe (PID: 9660)
- Unicorn-26353.exe (PID: 9712)
- Unicorn-64071.exe (PID: 9752)
- Unicorn-37329.exe (PID: 9824)
- Unicorn-1035.exe (PID: 9856)
- Unicorn-62317.exe (PID: 9988)
- Unicorn-54725.exe (PID: 10028)
- Unicorn-10786.exe (PID: 9768)
- Unicorn-13692.exe (PID: 10048)
- Unicorn-52971.exe (PID: 10192)
- Unicorn-3121.exe (PID: 10092)
- Unicorn-8601.exe (PID: 10176)
- Unicorn-26329.exe (PID: 10216)
- Unicorn-65223.exe (PID: 10236)
- Unicorn-54917.exe (PID: 8896)
- Unicorn-32913.exe (PID: 4428)
- Unicorn-50833.exe (PID: 8904)
- Unicorn-18636.exe (PID: 10252)
- Unicorn-12222.exe (PID: 10368)
- Unicorn-25321.exe (PID: 10280)
- Unicorn-18279.exe (PID: 10308)
- Unicorn-27097.exe (PID: 10400)
- Unicorn-2208.exe (PID: 10272)
- Unicorn-63667.exe (PID: 10508)
- Unicorn-50786.exe (PID: 10468)
- Unicorn-2784.exe (PID: 10620)
- Unicorn-29427.exe (PID: 10592)
- Unicorn-54315.exe (PID: 10704)
- Unicorn-61113.exe (PID: 10780)
- Unicorn-53116.exe (PID: 10656)
- Unicorn-46531.exe (PID: 10892)
- Unicorn-38363.exe (PID: 10860)
- Unicorn-29379.exe (PID: 10992)
- Unicorn-17127.exe (PID: 10964)
- Unicorn-14434.exe (PID: 10980)
- Unicorn-6821.exe (PID: 11020)
- Unicorn-38939.exe (PID: 11040)
- Unicorn-8212.exe (PID: 11048)
- Unicorn-49800.exe (PID: 11072)
- Unicorn-55275.exe (PID: 11136)
- Unicorn-36893.exe (PID: 11112)
- Unicorn-47662.exe (PID: 11200)
- Unicorn-51746.exe (PID: 11192)
- Unicorn-6074.exe (PID: 11216)
- Unicorn-1990.exe (PID: 11208)
- Unicorn-6074.exe (PID: 11224)
- Unicorn-6074.exe (PID: 11232)
- Unicorn-26586.exe (PID: 11176)
- Unicorn-44969.exe (PID: 1748)
- Unicorn-16280.exe (PID: 10676)
- Unicorn-44969.exe (PID: 3024)
- Unicorn-2545.exe (PID: 872)
- Unicorn-14797.exe (PID: 11316)
- Unicorn-27049.exe (PID: 11344)
- Unicorn-12104.exe (PID: 11380)
- Unicorn-12104.exe (PID: 11388)
- Unicorn-57776.exe (PID: 11372)
- Unicorn-50999.exe (PID: 11456)
- Unicorn-18226.exe (PID: 11416)
- Unicorn-15614.exe (PID: 11508)
- Unicorn-57797.exe (PID: 11532)
- Unicorn-25679.exe (PID: 11516)
- Unicorn-57797.exe (PID: 11536)
- Unicorn-163.exe (PID: 11584)
- Unicorn-196.exe (PID: 11636)
- Unicorn-4512.exe (PID: 11668)
- Unicorn-26109.exe (PID: 11688)
- Unicorn-8496.exe (PID: 11768)
- Unicorn-41004.exe (PID: 11740)
- Unicorn-22795.exe (PID: 11788)
- Unicorn-6193.exe (PID: 11732)
- Unicorn-51383.exe (PID: 11836)
- Unicorn-21787.exe (PID: 11876)
- Unicorn-23733.exe (PID: 11944)
- Unicorn-32633.exe (PID: 12000)
- Unicorn-56318.exe (PID: 12024)
- Unicorn-50916.exe (PID: 12096)
- Unicorn-39131.exe (PID: 11804)
- Unicorn-28357.exe (PID: 12172)
- Unicorn-28357.exe (PID: 12180)
- Unicorn-5144.exe (PID: 12224)
- Unicorn-7190.exe (PID: 12240)
- Unicorn-42577.exe (PID: 12304)
- Unicorn-22956.exe (PID: 12112)
- Unicorn-63168.exe (PID: 12188)
- Unicorn-13796.exe (PID: 12372)
- Unicorn-62036.exe (PID: 12388)
- Unicorn-26140.exe (PID: 12348)
- Unicorn-1544.exe (PID: 12360)
- Unicorn-46469.exe (PID: 12456)
- Unicorn-59468.exe (PID: 12500)
- Unicorn-15834.exe (PID: 12404)
- Unicorn-19827.exe (PID: 12492)
- Unicorn-49183.exe (PID: 12564)
- Unicorn-37485.exe (PID: 12588)
- Unicorn-57906.exe (PID: 12604)
- Unicorn-42961.exe (PID: 12612)
- Unicorn-537.exe (PID: 12624)
- Unicorn-9831.exe (PID: 12672)
- Unicorn-21699.exe (PID: 12396)
- Unicorn-23340.exe (PID: 12336)
- Unicorn-30517.exe (PID: 12728)
- Unicorn-7958.exe (PID: 12780)
- Unicorn-5820.exe (PID: 12820)
- Unicorn-16703.exe (PID: 12884)
- Unicorn-16703.exe (PID: 12892)
- Unicorn-59681.exe (PID: 12948)
- Unicorn-24386.exe (PID: 12720)
- Unicorn-2867.exe (PID: 12968)
- Unicorn-41761.exe (PID: 12988)
- Unicorn-34884.exe (PID: 13056)
- Unicorn-49951.exe (PID: 13088)
- Unicorn-34169.exe (PID: 13072)
- Unicorn-45767.exe (PID: 13140)
- Unicorn-38061.exe (PID: 13256)
- Unicorn-35269.exe (PID: 13276)
- Unicorn-30469.exe (PID: 13308)
- Unicorn-46806.exe (PID: 4812)
- Unicorn-43707.exe (PID: 13024)
- Unicorn-5773.exe (PID: 6740)
- Unicorn-13941.exe (PID: 12708)
- Unicorn-15232.exe (PID: 5640)
- Unicorn-43921.exe (PID: 7348)
- Unicorn-37434.exe (PID: 12880)
- Unicorn-35653.exe (PID: 4284)
- Unicorn-11062.exe (PID: 13340)
- Unicorn-40413.exe (PID: 13380)
- Unicorn-9686.exe (PID: 13392)
- Unicorn-10625.exe (PID: 13648)
- Unicorn-30390.exe (PID: 13740)
- Unicorn-21917.exe (PID: 13316)
- Unicorn-43727.exe (PID: 13796)
Create files in a temporary directory
- 1 (248).exe (PID: 5200)
- Unicorn-8624.exe (PID: 5156)
- Unicorn-16238.exe (PID: 6048)
- Unicorn-33560.exe (PID: 5112)
- Unicorn-60923.exe (PID: 6516)
- Unicorn-15251.exe (PID: 4424)
- Unicorn-19336.exe (PID: 5776)
- Unicorn-49390.exe (PID: 2240)
- Unicorn-38529.exe (PID: 5360)
- Unicorn-50781.exe (PID: 300)
- Unicorn-46432.exe (PID: 3272)
- Unicorn-50781.exe (PID: 5608)
- Unicorn-34445.exe (PID: 2772)
- Unicorn-21207.exe (PID: 7224)
- Unicorn-37351.exe (PID: 7424)
- Unicorn-43932.exe (PID: 4408)
- Unicorn-14792.exe (PID: 7468)
- Unicorn-57771.exe (PID: 7508)
- Unicorn-36557.exe (PID: 8008)
- Unicorn-2322.exe (PID: 8100)
- Unicorn-25099.exe (PID: 7336)
- Unicorn-41435.exe (PID: 7396)
- Unicorn-547.exe (PID: 7604)
- Unicorn-59307.exe (PID: 5084)
- Unicorn-49695.exe (PID: 7364)
- Unicorn-65529.exe (PID: 736)
- Unicorn-37517.exe (PID: 2568)
- Unicorn-52462.exe (PID: 2108)
- Unicorn-62021.exe (PID: 2980)
- Unicorn-17485.exe (PID: 7416)
- Unicorn-59975.exe (PID: 6724)
- Unicorn-14792.exe (PID: 7476)
- Unicorn-43547.exe (PID: 7752)
- Unicorn-8736.exe (PID: 7708)
- Unicorn-16905.exe (PID: 7884)
- Unicorn-57771.exe (PID: 7484)
- Unicorn-18942.exe (PID: 7924)
- Unicorn-62576.exe (PID: 7864)
- Unicorn-7179.exe (PID: 7492)
- Unicorn-8736.exe (PID: 7688)
- Unicorn-22696.exe (PID: 7516)
- Unicorn-5207.exe (PID: 7916)
- Unicorn-48186.exe (PID: 7948)
- Unicorn-26831.exe (PID: 5008)
- Unicorn-40567.exe (PID: 4988)
- Unicorn-16830.exe (PID: 7524)
- Unicorn-53945.exe (PID: 6576)
- Unicorn-3474.exe (PID: 2040)
- Unicorn-44320.exe (PID: 7256)
- Unicorn-51907.exe (PID: 7404)
- Unicorn-39249.exe (PID: 7980)
- Unicorn-47008.exe (PID: 8188)
- Unicorn-45499.exe (PID: 8252)
- Unicorn-46353.exe (PID: 7292)
- Unicorn-26342.exe (PID: 8024)
- Unicorn-57553.exe (PID: 8164)
- Unicorn-53038.exe (PID: 8228)
- Unicorn-7366.exe (PID: 8236)
- Unicorn-65456.exe (PID: 7200)
- Unicorn-14719.exe (PID: 8340)
- Unicorn-17956.exe (PID: 8416)
- Unicorn-2083.exe (PID: 8444)
- Unicorn-18441.exe (PID: 8472)
- Unicorn-57143.exe (PID: 8532)
- Unicorn-35907.exe (PID: 8564)
- Unicorn-64548.exe (PID: 7448)
- Unicorn-43329.exe (PID: 8640)
- Unicorn-40926.exe (PID: 8700)
- Unicorn-30812.exe (PID: 8612)
- Unicorn-45851.exe (PID: 8792)
- Unicorn-36291.exe (PID: 8768)
- Unicorn-12986.exe (PID: 8844)
- Unicorn-43547.exe (PID: 7648)
- Unicorn-20989.exe (PID: 7624)
- Unicorn-20989.exe (PID: 7660)
- Unicorn-50490.exe (PID: 8828)
- Unicorn-43713.exe (PID: 8856)
- Unicorn-45659.exe (PID: 8912)
- Unicorn-60049.exe (PID: 8876)
- Unicorn-9442.exe (PID: 8976)
- Unicorn-57060.exe (PID: 9104)
- Unicorn-62576.exe (PID: 7824)
- Unicorn-24387.exe (PID: 8984)
- Unicorn-59121.exe (PID: 8052)
- Unicorn-11859.exe (PID: 7964)
- Unicorn-1082.exe (PID: 9184)
- Unicorn-2249.exe (PID: 7940)
- Unicorn-28279.exe (PID: 5328)
- Unicorn-27050.exe (PID: 7532)
- Unicorn-43961.exe (PID: 8632)
- Unicorn-11288.exe (PID: 5408)
- Unicorn-60952.exe (PID: 8720)
- Unicorn-27403.exe (PID: 5772)
- Unicorn-20221.exe (PID: 7956)
- Unicorn-45062.exe (PID: 1912)
- Unicorn-33936.exe (PID: 6108)
- Unicorn-5420.exe (PID: 7196)
- Unicorn-61357.exe (PID: 2516)
- Unicorn-15665.exe (PID: 7844)
- Unicorn-64735.exe (PID: 8200)
- Unicorn-56162.exe (PID: 8128)
- Unicorn-42883.exe (PID: 9220)
- Unicorn-49005.exe (PID: 9276)
- Unicorn-34614.exe (PID: 9292)
- Unicorn-56375.exe (PID: 8316)
- Unicorn-11964.exe (PID: 9388)
- Unicorn-28171.exe (PID: 8408)
- Unicorn-56951.exe (PID: 8380)
- Unicorn-4927.exe (PID: 9548)
- Unicorn-51013.exe (PID: 8524)
- Unicorn-49297.exe (PID: 9576)
- Unicorn-2789.exe (PID: 9600)
- Unicorn-57890.exe (PID: 8492)
- Unicorn-27302.exe (PID: 2140)
- Unicorn-31377.exe (PID: 9644)
- Unicorn-45113.exe (PID: 9652)
The sample compiled with chinese language support
- 1 (248).exe (PID: 5200)
- Unicorn-50786.exe (PID: 10468)
- Unicorn-25177.exe (PID: 9732)
- Unicorn-10786.exe (PID: 9768)
- Unicorn-40926.exe (PID: 8700)
- Unicorn-43547.exe (PID: 7648)
- Unicorn-43932.exe (PID: 4408)
- Unicorn-64071.exe (PID: 9752)
- Unicorn-36291.exe (PID: 8768)
- Unicorn-37329.exe (PID: 9824)
- Unicorn-1035.exe (PID: 9856)
- Unicorn-40697.exe (PID: 9876)
- Unicorn-14792.exe (PID: 7476)
- Unicorn-3474.exe (PID: 2040)
- Unicorn-16905.exe (PID: 7884)
- Unicorn-45851.exe (PID: 8792)
- Unicorn-2789.exe (PID: 9600)
- Unicorn-43713.exe (PID: 8856)
- Unicorn-63667.exe (PID: 10508)
- Unicorn-20989.exe (PID: 7624)
- Unicorn-57771.exe (PID: 7484)
- Unicorn-25652.exe (PID: 9944)
- Unicorn-21709.exe (PID: 8924)
- Unicorn-20989.exe (PID: 7660)
- Unicorn-27917.exe (PID: 8968)
- Unicorn-12222.exe (PID: 10368)
- Unicorn-22696.exe (PID: 7516)
- Unicorn-38045.exe (PID: 8952)
- Unicorn-18942.exe (PID: 7924)
- Unicorn-42115.exe (PID: 9088)
- Unicorn-62576.exe (PID: 7864)
- Unicorn-62576.exe (PID: 7824)
- Unicorn-7179.exe (PID: 7492)
- Unicorn-1082.exe (PID: 9184)
- Unicorn-27050.exe (PID: 7532)
- Unicorn-11859.exe (PID: 7964)
- Unicorn-55551.exe (PID: 6972)
- Unicorn-5207.exe (PID: 7916)
- Unicorn-60923.exe (PID: 6516)
- Unicorn-28279.exe (PID: 5328)
- Unicorn-48186.exe (PID: 7948)
- Unicorn-26831.exe (PID: 5008)
- Unicorn-14792.exe (PID: 7468)
- Unicorn-43961.exe (PID: 8632)
- Unicorn-27185.exe (PID: 8960)
- Unicorn-11288.exe (PID: 5408)
- Unicorn-16830.exe (PID: 7524)
- Unicorn-54725.exe (PID: 10028)
- Unicorn-50781.exe (PID: 300)
- Unicorn-35675.exe (PID: 9996)
- Unicorn-9150.exe (PID: 8660)
- Unicorn-40567.exe (PID: 4988)
- Unicorn-40231.exe (PID: 7860)
- Unicorn-52421.exe (PID: 8996)
- Unicorn-5420.exe (PID: 7196)
- Unicorn-34445.exe (PID: 2772)
- Unicorn-36557.exe (PID: 8008)
- Unicorn-25099.exe (PID: 7336)
- Unicorn-8072.exe (PID: 9260)
- Unicorn-57553.exe (PID: 8164)
- Unicorn-49005.exe (PID: 9276)
- Unicorn-19336.exe (PID: 5776)
- Unicorn-33560.exe (PID: 5112)
- Unicorn-8624.exe (PID: 5156)
- Unicorn-42883.exe (PID: 9220)
- Unicorn-34614.exe (PID: 9292)
- Unicorn-45499.exe (PID: 8252)
- Unicorn-61113.exe (PID: 10780)
- Unicorn-2322.exe (PID: 8100)
- Unicorn-56571.exe (PID: 10136)
- Unicorn-11964.exe (PID: 9380)
- Unicorn-30174.exe (PID: 9324)
- Unicorn-65456.exe (PID: 7200)
- Unicorn-11621.exe (PID: 7332)
- Unicorn-65529.exe (PID: 736)
- Unicorn-2784.exe (PID: 10620)
- Unicorn-49695.exe (PID: 7364)
- Unicorn-14719.exe (PID: 8340)
- Unicorn-30439.exe (PID: 9332)
- Unicorn-3988.exe (PID: 8276)
- Unicorn-53116.exe (PID: 10656)
- Unicorn-16238.exe (PID: 6048)
- Unicorn-9416.exe (PID: 10156)
- Unicorn-17956.exe (PID: 8416)
- Unicorn-51907.exe (PID: 7404)
- Unicorn-21202.exe (PID: 9316)
- Unicorn-56951.exe (PID: 8380)
- Unicorn-28171.exe (PID: 8408)
- Unicorn-8601.exe (PID: 10176)
- Unicorn-18441.exe (PID: 8472)
- Unicorn-2083.exe (PID: 8444)
- Unicorn-4927.exe (PID: 9548)
- Unicorn-547.exe (PID: 7604)
- Unicorn-17485.exe (PID: 7416)
- Unicorn-38529.exe (PID: 5360)
- Unicorn-50833.exe (PID: 8904)
- Unicorn-61357.exe (PID: 8300)
- Unicorn-54917.exe (PID: 8896)
- Unicorn-41435.exe (PID: 7396)
- Unicorn-21207.exe (PID: 7224)
- Unicorn-37517.exe (PID: 2568)
- Unicorn-29043.exe (PID: 10424)
- Unicorn-24471.exe (PID: 8508)
- Unicorn-26778.exe (PID: 10928)
- Unicorn-49297.exe (PID: 9576)
- Unicorn-57890.exe (PID: 8492)
- Unicorn-37351.exe (PID: 7424)
- Unicorn-62021.exe (PID: 2980)
- Unicorn-53945.exe (PID: 6576)
- Unicorn-21202.exe (PID: 9308)
- Unicorn-27302.exe (PID: 2140)
- Unicorn-50781.exe (PID: 5608)
- Unicorn-45113.exe (PID: 9652)
- Unicorn-32424.exe (PID: 10796)
- Unicorn-22390.exe (PID: 9592)
- Unicorn-65223.exe (PID: 10236)
- Unicorn-64548.exe (PID: 7448)
- Unicorn-30007.exe (PID: 9696)
- Unicorn-49661.exe (PID: 10680)
- Unicorn-18279.exe (PID: 10308)
- Unicorn-15251.exe (PID: 4424)
- Unicorn-25321.exe (PID: 10280)
- Unicorn-33023.exe (PID: 8672)
- Unicorn-52971.exe (PID: 10192)
- Unicorn-26353.exe (PID: 9712)
- Unicorn-8648.exe (PID: 9848)
- Unicorn-17943.exe (PID: 10836)
- Unicorn-46531.exe (PID: 10892)
- Unicorn-45659.exe (PID: 8912)
- Unicorn-43547.exe (PID: 7752)
- Unicorn-27185.exe (PID: 9032)
- Unicorn-43329.exe (PID: 8640)
- Unicorn-18636.exe (PID: 10252)
- Unicorn-59975.exe (PID: 6724)
- Unicorn-27459.exe (PID: 4920)
- Unicorn-32887.exe (PID: 10844)
- Unicorn-20989.exe (PID: 7612)
- Unicorn-60952.exe (PID: 8720)
- Unicorn-62317.exe (PID: 9988)
- Unicorn-29379.exe (PID: 10992)
- Unicorn-27403.exe (PID: 5772)
- Unicorn-38363.exe (PID: 10860)
- Unicorn-45062.exe (PID: 1912)
- Unicorn-59551.exe (PID: 10940)
- Unicorn-29427.exe (PID: 10592)
- Unicorn-20469.exe (PID: 10056)
- Unicorn-57771.exe (PID: 7508)
- Unicorn-3474.exe (PID: 2984)
- Unicorn-33936.exe (PID: 6108)
- Unicorn-56162.exe (PID: 8128)
- Unicorn-39249.exe (PID: 7980)
- Unicorn-13692.exe (PID: 10048)
- Unicorn-14434.exe (PID: 10980)
- Unicorn-49390.exe (PID: 2240)
- Unicorn-64735.exe (PID: 8200)
- Unicorn-26342.exe (PID: 8024)
- Unicorn-54315.exe (PID: 10704)
- Unicorn-7366.exe (PID: 8236)
- Unicorn-50490.exe (PID: 8828)
- Unicorn-15665.exe (PID: 7844)
- Unicorn-44320.exe (PID: 7256)
- Unicorn-61357.exe (PID: 2516)
- Unicorn-3220.exe (PID: 9068)
Reads the computer name
- 1 (248).exe (PID: 5200)
- Unicorn-33560.exe (PID: 5112)
- Unicorn-16238.exe (PID: 6048)
- Unicorn-8624.exe (PID: 5156)
- Unicorn-19336.exe (PID: 5776)
- Unicorn-60923.exe (PID: 6516)
- Unicorn-15251.exe (PID: 4424)
- Unicorn-43932.exe (PID: 4408)
- Unicorn-34445.exe (PID: 2772)
- Unicorn-49390.exe (PID: 2240)
- Unicorn-38529.exe (PID: 5360)
- Unicorn-50781.exe (PID: 5608)
- Unicorn-50781.exe (PID: 300)
- Unicorn-40567.exe (PID: 4988)
- Unicorn-46432.exe (PID: 3272)
- Unicorn-21207.exe (PID: 7224)
- Unicorn-44320.exe (PID: 7256)
- Unicorn-26831.exe (PID: 5008)
- Unicorn-41435.exe (PID: 7396)
- Unicorn-49695.exe (PID: 7364)
- Unicorn-17485.exe (PID: 7416)
- Unicorn-37351.exe (PID: 7424)
- Unicorn-14792.exe (PID: 7476)
- Unicorn-57771.exe (PID: 7484)
- Unicorn-25099.exe (PID: 7336)
- Unicorn-7179.exe (PID: 7492)
- Unicorn-27050.exe (PID: 7532)
- Unicorn-14792.exe (PID: 7468)
- Unicorn-22696.exe (PID: 7516)
- Unicorn-16830.exe (PID: 7524)
- Unicorn-39249.exe (PID: 7980)
- Unicorn-56162.exe (PID: 8128)
- Unicorn-57553.exe (PID: 8164)
- Unicorn-65529.exe (PID: 736)
- Unicorn-2322.exe (PID: 8100)
- Unicorn-65456.exe (PID: 7200)
- Unicorn-37517.exe (PID: 2568)
- Unicorn-59307.exe (PID: 5084)
- Unicorn-20989.exe (PID: 7624)
- Unicorn-8736.exe (PID: 7708)
- Unicorn-16905.exe (PID: 7884)
- Unicorn-62576.exe (PID: 7824)
- Unicorn-62576.exe (PID: 7864)
- Unicorn-8736.exe (PID: 7688)
- Unicorn-5207.exe (PID: 7916)
- Unicorn-2249.exe (PID: 7940)
- Unicorn-48186.exe (PID: 7948)
- Unicorn-53945.exe (PID: 6576)
- Unicorn-3474.exe (PID: 2040)
- Unicorn-45062.exe (PID: 1912)
- Unicorn-3474.exe (PID: 2984)
- Unicorn-53038.exe (PID: 8228)
- Unicorn-56375.exe (PID: 8316)
- Unicorn-57143.exe (PID: 8532)
- Unicorn-57890.exe (PID: 8492)
- Unicorn-16879.exe (PID: 8572)
- Unicorn-51013.exe (PID: 8524)
- Unicorn-24471.exe (PID: 8508)
- Unicorn-30812.exe (PID: 8612)
- Unicorn-45659.exe (PID: 8912)
- Unicorn-50490.exe (PID: 8828)
- Unicorn-21709.exe (PID: 8924)
- Unicorn-24387.exe (PID: 8984)
- Unicorn-38045.exe (PID: 8952)
- Unicorn-23408.exe (PID: 9192)
- Unicorn-27185.exe (PID: 9032)
- Unicorn-1082.exe (PID: 9184)
- Unicorn-11288.exe (PID: 5408)
- Unicorn-28279.exe (PID: 5328)
- Unicorn-43961.exe (PID: 8632)
- Unicorn-42115.exe (PID: 9088)
- Unicorn-15665.exe (PID: 7844)
- Unicorn-42883.exe (PID: 9220)
- Unicorn-59966.exe (PID: 7856)
- Unicorn-3988.exe (PID: 8276)
- Unicorn-34614.exe (PID: 9292)
- Unicorn-30174.exe (PID: 9324)
- Unicorn-21202.exe (PID: 9308)
- Unicorn-4927.exe (PID: 9548)
- Unicorn-49297.exe (PID: 9576)
- Unicorn-42313.exe (PID: 9660)
- Unicorn-26353.exe (PID: 9712)
- Unicorn-25177.exe (PID: 9732)
- Unicorn-10786.exe (PID: 9768)
- Unicorn-1035.exe (PID: 9856)
- Unicorn-37329.exe (PID: 9824)
- Unicorn-40697.exe (PID: 9876)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 2096)
- BackgroundTransferHost.exe (PID: 7628)
- BackgroundTransferHost.exe (PID: 7844)
- BackgroundTransferHost.exe (PID: 7188)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 7628)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 7628)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 7628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
486
Monitored processes
355
Malicious processes
49
Suspicious processes
53
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 300 | C:\Users\admin\AppData\Local\Temp\Unicorn-50781.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-50781.exe | Unicorn-60923.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 736 | C:\Users\admin\AppData\Local\Temp\Unicorn-65529.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-65529.exe | Unicorn-41435.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 872 | C:\Users\admin\AppData\Local\Temp\Unicorn-2545.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-2545.exe | — | Unicorn-62576.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1748 | C:\Users\admin\AppData\Local\Temp\Unicorn-44969.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-44969.exe | — | Unicorn-23408.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1912 | C:\Users\admin\AppData\Local\Temp\Unicorn-45062.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-45062.exe | Unicorn-44320.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2040 | C:\Users\admin\AppData\Local\Temp\Unicorn-3474.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3474.exe | Unicorn-36557.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2096 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2100 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2108 | C:\Users\admin\AppData\Local\Temp\Unicorn-52462.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-52462.exe | Unicorn-50781.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2140 | C:\Users\admin\AppData\Local\Temp\Unicorn-27302.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-27302.exe | Unicorn-15251.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
9 065
Read events
9 050
Write events
15
Delete events
0
Modification events
| (PID) Process: | (2096) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2096) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2096) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7628) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7628) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7628) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7844) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7844) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7844) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7188) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
1 035
Suspicious files
5
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5156 | Unicorn-8624.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-15251.exe | executable | |
MD5:A223A236CCE444C2E104E497D62F43F9 | SHA256:85EF3EEFB37A780E25FE232894FCC45EC902EB34D6F0CD992D0313C2E9AE5274 | |||
| 6048 | Unicorn-16238.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-19336.exe | executable | |
MD5:27D3B904AB438DF0CC05845FDD9D3300 | SHA256:49250012376BAFDAE41338966396933520BB59E747DDCF592EAE52D8E4046A1E | |||
| 5776 | Unicorn-19336.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-34445.exe | executable | |
MD5:8BB06BC30E4778336B80E64D498F8523 | SHA256:46E03EF2BE29D193C025E6BA6A3A30F99CA1746FE03C4DF3C93E0CAF4B43A921 | |||
| 5200 | 1 (248).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-33560.exe | executable | |
MD5:E207F69E7CE716358E71136448FEF2F4 | SHA256:95CBE726EFC8B5F923A08878C907493ED33C7098F6D2D999BD61766B52BEBD5B | |||
| 4424 | Unicorn-15251.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-38529.exe | executable | |
MD5:4CCD8CC31866A14B2EE7AFED16D82899 | SHA256:C64E6CACFC05DAAFEEEECAA213C00B24C4A03510B8BE11E18FFEA8BF11EA62E2 | |||
| 5112 | Unicorn-33560.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-16238.exe | executable | |
MD5:3A7185D5DEC7CBA09B108E6A320188FE | SHA256:19AB4DF1755D0BCA2572CF3DB27E22629FBFAC609A07581BA53D58B315780F3B | |||
| 5112 | Unicorn-33560.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-60923.exe | executable | |
MD5:322B8B874D4330244C5BAF50262C6835 | SHA256:547FE533D6350D91E42E7B5121ED4A028BA83A5B6EAB920EA5201DD36FCF94DF | |||
| 5200 | 1 (248).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-43932.exe | executable | |
MD5:D73A2D798803FB92F980DB26CEA1E536 | SHA256:ADCE016CFD1604C32A4A962211A7CEFE8042F38051B1493FFAD92EE6B142E5D5 | |||
| 6048 | Unicorn-16238.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49390.exe | executable | |
MD5:C768D53772FBEBD1F31DFEFD5252AC74 | SHA256:B3782C6AA3E1B860E8105929703F236B58136B779EF967F641400A83AAD81705 | |||
| 5112 | Unicorn-33560.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-40567.exe | executable | |
MD5:267CE01FC363D9C7107A72A0AA175574 | SHA256:9DC7C8FC7DB643CCA5545E256A7A55105AC43C54AAE534B74437FAC7A7C56301 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
16
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.180:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
7628 | BackgroundTransferHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
6488 | backgroundTaskHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
8820 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
8820 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.48.23.180:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
2104 | svchost.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3216 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.159.68:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 23.54.109.203:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2112 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6488 | backgroundTaskHost.exe | 20.74.47.205:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6488 | backgroundTaskHost.exe | 23.54.109.203:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |