| File name: | 1 (505) |
| Full analysis: | https://app.any.run/tasks/56501fbf-6a61-4a72-ad0b-d6ef207bb69f |
| Verdict: | Malicious activity |
| Analysis date: | March 25, 2025, 00:48:42 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | 21D0B682DAE666B9C824460D5C4C1B90 |
| SHA1: | 38BC2C7236721AA3CC53766952252E78960F8F0B |
| SHA256: | 41985FE4156B2FF6139CA80D4C75FC3B15A559EE1A27BD1D63F0C3AFC8B7CE54 |
| SSDEEP: | 6144:S7LpfnIieDEvA5clPYe+/vfxotBQHvJGBH/WyeO9Ok/8SwjwpyAvEh62xnlEsvva:SvhIsvA5SPTHB4haHOyeO9Mx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- 1 (505).exe (PID: 2564)
- Unicorn-49325.exe (PID: 7196)
- Unicorn-24183.exe (PID: 7180)
- Unicorn-58950.exe (PID: 2340)
- Unicorn-5216.exe (PID: 7328)
- Unicorn-7100.exe (PID: 7336)
- Unicorn-53653.exe (PID: 7344)
- Unicorn-58112.exe (PID: 7312)
- Unicorn-25594.exe (PID: 7396)
- Unicorn-63933.exe (PID: 7428)
- Unicorn-47061.exe (PID: 7444)
- Unicorn-17914.exe (PID: 7468)
- Unicorn-10985.exe (PID: 7476)
- Unicorn-30586.exe (PID: 7484)
- Unicorn-64305.exe (PID: 7528)
- Unicorn-18665.exe (PID: 7408)
- Unicorn-9712.exe (PID: 7548)
- Unicorn-21911.exe (PID: 7564)
- Unicorn-15021.exe (PID: 7572)
- Unicorn-47512.exe (PID: 7580)
- Unicorn-52017.exe (PID: 7716)
- Unicorn-4108.exe (PID: 7636)
- Unicorn-17290.exe (PID: 7748)
- Unicorn-60876.exe (PID: 7816)
- Unicorn-9572.exe (PID: 7612)
- Unicorn-24538.exe (PID: 7664)
- Unicorn-54151.exe (PID: 7460)
- Unicorn-23543.exe (PID: 7604)
- Unicorn-63676.exe (PID: 7840)
- Unicorn-49941.exe (PID: 7832)
- Unicorn-4656.exe (PID: 8088)
- Unicorn-7588.exe (PID: 6112)
- Unicorn-58865.exe (PID: 6540)
- Unicorn-17281.exe (PID: 7280)
- Unicorn-23946.exe (PID: 8116)
- Unicorn-50350.exe (PID: 2040)
- Unicorn-8688.exe (PID: 8124)
- Unicorn-6146.exe (PID: 6268)
- Unicorn-10930.exe (PID: 1040)
- Unicorn-3546.exe (PID: 7256)
- Unicorn-42213.exe (PID: 5260)
- Unicorn-44916.exe (PID: 8180)
- Unicorn-65482.exe (PID: 6964)
- Unicorn-19914.exe (PID: 7252)
- Unicorn-43235.exe (PID: 7276)
- Unicorn-13316.exe (PID: 1672)
- Unicorn-51237.exe (PID: 7788)
- Unicorn-30894.exe (PID: 7860)
- Unicorn-48168.exe (PID: 7932)
- Unicorn-59895.exe (PID: 6108)
- Unicorn-13545.exe (PID: 7036)
- Unicorn-14640.exe (PID: 6156)
- Unicorn-49610.exe (PID: 4620)
- Unicorn-23031.exe (PID: 7864)
- Unicorn-39548.exe (PID: 3888)
- Unicorn-9220.exe (PID: 7908)
- Unicorn-29489.exe (PID: 5436)
- Unicorn-55551.exe (PID: 8272)
- Unicorn-56852.exe (PID: 3300)
- Unicorn-49815.exe (PID: 6712)
- Unicorn-19994.exe (PID: 7876)
- Unicorn-29425.exe (PID: 6244)
- Unicorn-35445.exe (PID: 7828)
- Unicorn-50039.exe (PID: 8412)
- Unicorn-46605.exe (PID: 5548)
- Unicorn-63595.exe (PID: 4756)
- Unicorn-16823.exe (PID: 8620)
- Unicorn-29220.exe (PID: 8524)
- Unicorn-49143.exe (PID: 6708)
- Unicorn-6420.exe (PID: 7896)
- Unicorn-45739.exe (PID: 8304)
- Unicorn-36314.exe (PID: 3020)
- Unicorn-17268.exe (PID: 2268)
- Unicorn-28268.exe (PID: 4896)
- Unicorn-29294.exe (PID: 3956)
- Unicorn-64564.exe (PID: 8468)
- Unicorn-5859.exe (PID: 7244)
- Unicorn-20180.exe (PID: 7012)
- Unicorn-64439.exe (PID: 8984)
- Unicorn-43471.exe (PID: 8640)
- Unicorn-502.exe (PID: 7288)
- Unicorn-90.exe (PID: 9020)
- Unicorn-41933.exe (PID: 9052)
- Unicorn-45965.exe (PID: 9116)
- Unicorn-43466.exe (PID: 1348)
- Unicorn-29147.exe (PID: 8420)
- Unicorn-44392.exe (PID: 8920)
- Unicorn-37143.exe (PID: 8600)
- Unicorn-9982.exe (PID: 2140)
- Unicorn-56377.exe (PID: 1388)
- Unicorn-48302.exe (PID: 1760)
- Unicorn-50050.exe (PID: 1616)
- Unicorn-44949.exe (PID: 8676)
- Unicorn-7575.exe (PID: 2772)
- Unicorn-30813.exe (PID: 8048)
- Unicorn-50879.exe (PID: 8608)
- Unicorn-62427.exe (PID: 9152)
- Unicorn-55409.exe (PID: 8816)
- Unicorn-38263.exe (PID: 8684)
- Unicorn-13037.exe (PID: 8732)
- Unicorn-39284.exe (PID: 7772)
- Unicorn-2013.exe (PID: 9168)
- Unicorn-24791.exe (PID: 8172)
- Unicorn-16759.exe (PID: 8868)
- Unicorn-7676.exe (PID: 8752)
- Unicorn-26573.exe (PID: 8440)
- Unicorn-38527.exe (PID: 8928)
- Unicorn-25417.exe (PID: 8008)
- Unicorn-24791.exe (PID: 8160)
- Unicorn-56820.exe (PID: 8704)
- Unicorn-43121.exe (PID: 8944)
- Unicorn-24791.exe (PID: 780)
- Unicorn-44730.exe (PID: 9896)
- Unicorn-32699.exe (PID: 9908)
- Unicorn-53613.exe (PID: 8768)
- Unicorn-8076.exe (PID: 8740)
- Unicorn-47053.exe (PID: 2064)
- Unicorn-27860.exe (PID: 8064)
- Unicorn-7941.exe (PID: 8760)
- Unicorn-25564.exe (PID: 8792)
- Unicorn-13474.exe (PID: 1748)
- Unicorn-3681.exe (PID: 8432)
- Unicorn-38527.exe (PID: 8952)
- Unicorn-16884.exe (PID: 8976)
- Unicorn-39860.exe (PID: 5084)
- Unicorn-41972.exe (PID: 9196)
- Unicorn-39412.exe (PID: 8584)
- Unicorn-44220.exe (PID: 1240)
- Unicorn-41815.exe (PID: 8280)
- Unicorn-58172.exe (PID: 732)
- Unicorn-38941.exe (PID: 9228)
- Unicorn-59831.exe (PID: 9060)
- Unicorn-23803.exe (PID: 9328)
- Unicorn-45495.exe (PID: 9632)
- Unicorn-44392.exe (PID: 8964)
- Unicorn-40139.exe (PID: 4200)
- Unicorn-19214.exe (PID: 11688)
- Unicorn-6337.exe (PID: 11676)
- Unicorn-14017.exe (PID: 11644)
- Unicorn-20531.exe (PID: 9088)
- Unicorn-61837.exe (PID: 8188)
- Unicorn-24791.exe (PID: 8220)
- Unicorn-24791.exe (PID: 8256)
- Unicorn-44392.exe (PID: 8936)
- Unicorn-9712.exe (PID: 6960)
- Unicorn-5855.exe (PID: 11404)
- Unicorn-28785.exe (PID: 9512)
- Unicorn-15682.exe (PID: 10760)
- Unicorn-17885.exe (PID: 8480)
- Unicorn-49716.exe (PID: 8804)
- Unicorn-32699.exe (PID: 9916)
- Unicorn-50292.exe (PID: 11068)
- Unicorn-43995.exe (PID: 5244)
- Unicorn-59792.exe (PID: 12696)
- Unicorn-32282.exe (PID: 8240)
- Unicorn-16477.exe (PID: 9700)
- Unicorn-51950.exe (PID: 9440)
- Unicorn-43712.exe (PID: 11080)
- Unicorn-45470.exe (PID: 12224)
- Unicorn-51708.exe (PID: 14380)
- Unicorn-51708.exe (PID: 14372)
- Unicorn-57573.exe (PID: 14364)
- Unicorn-28974.exe (PID: 9316)
- Unicorn-30093.exe (PID: 9684)
- Unicorn-25131.exe (PID: 15212)
- Unicorn-25131.exe (PID: 15204)
- Unicorn-59182.exe (PID: 8904)
- Unicorn-18811.exe (PID: 10816)
- Unicorn-55796.exe (PID: 9692)
- Unicorn-59447.exe (PID: 10128)
- Unicorn-37687.exe (PID: 10796)
- Unicorn-50709.exe (PID: 10736)
- Unicorn-13686.exe (PID: 8844)
- Unicorn-54415.exe (PID: 13272)
- Unicorn-33742.exe (PID: 8296)
- Unicorn-48016.exe (PID: 10500)
- Unicorn-53717.exe (PID: 10772)
- Unicorn-10468.exe (PID: 13824)
- Unicorn-18964.exe (PID: 9948)
- Unicorn-1735.exe (PID: 8828)
- Unicorn-52092.exe (PID: 11432)
- Unicorn-49463.exe (PID: 10108)
- Unicorn-22641.exe (PID: 9576)
- Unicorn-44200.exe (PID: 5596)
- Unicorn-15671.exe (PID: 10516)
- Unicorn-31077.exe (PID: 13164)
- Unicorn-53925.exe (PID: 11620)
- Unicorn-46215.exe (PID: 10528)
- Unicorn-40538.exe (PID: 9720)
- Unicorn-35568.exe (PID: 12532)
- Unicorn-27967.exe (PID: 15244)
- Unicorn-24791.exe (PID: 9308)
- Unicorn-29550.exe (PID: 13668)
- Unicorn-4851.exe (PID: 12460)
- Unicorn-17526.exe (PID: 14452)
- Unicorn-63749.exe (PID: 12108)
- Unicorn-10468.exe (PID: 13764)
- Unicorn-24564.exe (PID: 8884)
- Unicorn-60368.exe (PID: 12636)
- Unicorn-17092.exe (PID: 14256)
- Unicorn-57566.exe (PID: 14792)
- Unicorn-9626.exe (PID: 14872)
- Unicorn-17526.exe (PID: 14484)
- Unicorn-12857.exe (PID: 13528)
- Unicorn-19498.exe (PID: 14244)
- Unicorn-1324.exe (PID: 9272)
- Unicorn-13637.exe (PID: 9808)
- Unicorn-10353.exe (PID: 7632)
- Unicorn-24343.exe (PID: 5048)
- Unicorn-3489.exe (PID: 11268)
- Unicorn-23361.exe (PID: 14824)
- Unicorn-24791.exe (PID: 3900)
- Unicorn-31060.exe (PID: 7600)
- Unicorn-57989.exe (PID: 7944)
- Unicorn-23361.exe (PID: 14708)
Starts itself from another location
- Unicorn-24183.exe (PID: 7180)
- 1 (505).exe (PID: 2564)
- Unicorn-58950.exe (PID: 2340)
- Unicorn-7100.exe (PID: 7336)
- Unicorn-5216.exe (PID: 7328)
- Unicorn-58112.exe (PID: 7312)
- Unicorn-18665.exe (PID: 7408)
- Unicorn-53653.exe (PID: 7344)
- Unicorn-49325.exe (PID: 7196)
- Unicorn-47061.exe (PID: 7444)
- Unicorn-17914.exe (PID: 7468)
- Unicorn-10985.exe (PID: 7476)
- Unicorn-63933.exe (PID: 7428)
- Unicorn-54151.exe (PID: 7460)
- Unicorn-25594.exe (PID: 7396)
- Unicorn-64305.exe (PID: 7528)
- Unicorn-9712.exe (PID: 7548)
- Unicorn-21911.exe (PID: 7564)
- Unicorn-30586.exe (PID: 7484)
- Unicorn-15021.exe (PID: 7572)
- Unicorn-4108.exe (PID: 7636)
- Unicorn-17290.exe (PID: 7748)
- Unicorn-60876.exe (PID: 7816)
- Unicorn-24538.exe (PID: 7664)
- Unicorn-63676.exe (PID: 7840)
- Unicorn-23543.exe (PID: 7604)
- Unicorn-9572.exe (PID: 7612)
- Unicorn-49941.exe (PID: 7832)
- Unicorn-58865.exe (PID: 6540)
- Unicorn-7588.exe (PID: 6112)
- Unicorn-17281.exe (PID: 7280)
- Unicorn-4656.exe (PID: 8088)
- Unicorn-23946.exe (PID: 8116)
- Unicorn-6146.exe (PID: 6268)
- Unicorn-10930.exe (PID: 1040)
- Unicorn-8688.exe (PID: 8124)
- Unicorn-65482.exe (PID: 6964)
- Unicorn-3546.exe (PID: 7256)
- Unicorn-42213.exe (PID: 5260)
- Unicorn-44916.exe (PID: 8180)
- Unicorn-50350.exe (PID: 2040)
- Unicorn-52017.exe (PID: 7716)
- Unicorn-19914.exe (PID: 7252)
- Unicorn-43235.exe (PID: 7276)
- Unicorn-13316.exe (PID: 1672)
- Unicorn-51237.exe (PID: 7788)
- Unicorn-48168.exe (PID: 7932)
- Unicorn-30894.exe (PID: 7860)
- Unicorn-13545.exe (PID: 7036)
- Unicorn-14640.exe (PID: 6156)
- Unicorn-27860.exe (PID: 8064)
- Unicorn-23031.exe (PID: 7864)
- Unicorn-39548.exe (PID: 3888)
- Unicorn-44023.exe (PID: 5056)
- Unicorn-29489.exe (PID: 5436)
- Unicorn-59895.exe (PID: 6108)
- Unicorn-55551.exe (PID: 8272)
- Unicorn-56852.exe (PID: 3300)
- Unicorn-39860.exe (PID: 5084)
- Unicorn-19994.exe (PID: 7876)
- Unicorn-46605.exe (PID: 5548)
- Unicorn-63595.exe (PID: 4756)
- Unicorn-35445.exe (PID: 7828)
- Unicorn-50039.exe (PID: 8412)
- Unicorn-49815.exe (PID: 6712)
- Unicorn-29220.exe (PID: 8524)
- Unicorn-6420.exe (PID: 7896)
- Unicorn-16823.exe (PID: 8620)
- Unicorn-45739.exe (PID: 8304)
- Unicorn-9220.exe (PID: 7908)
- Unicorn-36314.exe (PID: 3020)
- Unicorn-49143.exe (PID: 6708)
- Unicorn-29294.exe (PID: 3956)
- Unicorn-28268.exe (PID: 4896)
- Unicorn-17268.exe (PID: 2268)
- Unicorn-20180.exe (PID: 7012)
- Unicorn-29425.exe (PID: 6244)
- Unicorn-64564.exe (PID: 8468)
- Unicorn-16884.exe (PID: 8976)
- Unicorn-64439.exe (PID: 8984)
- Unicorn-43471.exe (PID: 8640)
- Unicorn-90.exe (PID: 9020)
- Unicorn-502.exe (PID: 7288)
- Unicorn-41933.exe (PID: 9052)
- Unicorn-45965.exe (PID: 9116)
- Unicorn-43995.exe (PID: 5244)
- Unicorn-29147.exe (PID: 8420)
- Unicorn-37143.exe (PID: 8600)
- Unicorn-44392.exe (PID: 8920)
- Unicorn-50050.exe (PID: 1616)
- Unicorn-5859.exe (PID: 7244)
- Unicorn-56377.exe (PID: 1388)
- Unicorn-48302.exe (PID: 1760)
- Unicorn-9982.exe (PID: 2140)
- Unicorn-44949.exe (PID: 8676)
- Unicorn-7575.exe (PID: 2772)
- Unicorn-62427.exe (PID: 9152)
- Unicorn-43466.exe (PID: 1348)
- Unicorn-50879.exe (PID: 8608)
- Unicorn-30813.exe (PID: 8048)
- Unicorn-49610.exe (PID: 4620)
- Unicorn-38263.exe (PID: 8684)
- Unicorn-55409.exe (PID: 8816)
- Unicorn-13037.exe (PID: 8732)
- Unicorn-39284.exe (PID: 7772)
- Unicorn-2013.exe (PID: 9168)
- Unicorn-24791.exe (PID: 8172)
- Unicorn-59182.exe (PID: 8904)
- Unicorn-16759.exe (PID: 8868)
- Unicorn-26573.exe (PID: 8440)
- Unicorn-38527.exe (PID: 8928)
- Unicorn-56820.exe (PID: 8704)
- Unicorn-25417.exe (PID: 8008)
- Unicorn-43121.exe (PID: 8944)
- Unicorn-24791.exe (PID: 8160)
- Unicorn-32699.exe (PID: 9916)
- Unicorn-7676.exe (PID: 8752)
- Unicorn-32699.exe (PID: 9908)
- Unicorn-44730.exe (PID: 9896)
- Unicorn-53613.exe (PID: 8768)
- Unicorn-8076.exe (PID: 8740)
- Unicorn-25564.exe (PID: 8792)
- Unicorn-47053.exe (PID: 2064)
- Unicorn-7941.exe (PID: 8760)
- Unicorn-13474.exe (PID: 1748)
- Unicorn-47512.exe (PID: 7580)
- Unicorn-3681.exe (PID: 8432)
- Unicorn-38527.exe (PID: 8952)
- Unicorn-41815.exe (PID: 8280)
- Unicorn-44220.exe (PID: 1240)
- Unicorn-39412.exe (PID: 8584)
- Unicorn-58172.exe (PID: 732)
- Unicorn-38941.exe (PID: 9228)
- Unicorn-41972.exe (PID: 9196)
- Unicorn-59831.exe (PID: 9060)
- Unicorn-23803.exe (PID: 9328)
- Unicorn-45495.exe (PID: 9632)
- Unicorn-44392.exe (PID: 8964)
- Unicorn-40139.exe (PID: 4200)
- Unicorn-19214.exe (PID: 11688)
- Unicorn-6337.exe (PID: 11676)
- Unicorn-20531.exe (PID: 9088)
- Unicorn-42381.exe (PID: 9524)
- Unicorn-24791.exe (PID: 8220)
- Unicorn-61837.exe (PID: 8188)
- Unicorn-14017.exe (PID: 11644)
- Unicorn-5855.exe (PID: 11404)
- Unicorn-44392.exe (PID: 8936)
- Unicorn-24791.exe (PID: 8256)
- Unicorn-9712.exe (PID: 6960)
- Unicorn-28785.exe (PID: 9512)
- Unicorn-15682.exe (PID: 10760)
- Unicorn-17885.exe (PID: 8480)
- Unicorn-49716.exe (PID: 8804)
- Unicorn-32282.exe (PID: 8240)
- Unicorn-50292.exe (PID: 11068)
- Unicorn-24791.exe (PID: 780)
- Unicorn-60368.exe (PID: 12636)
- Unicorn-60368.exe (PID: 12644)
- Unicorn-51950.exe (PID: 9440)
- Unicorn-59792.exe (PID: 12696)
- Unicorn-16477.exe (PID: 9700)
- Unicorn-43712.exe (PID: 11080)
- Unicorn-57573.exe (PID: 14364)
- Unicorn-51708.exe (PID: 14380)
- Unicorn-51708.exe (PID: 14372)
- Unicorn-18811.exe (PID: 10816)
- Unicorn-30093.exe (PID: 9684)
- Unicorn-27967.exe (PID: 15244)
- Unicorn-25131.exe (PID: 15212)
- Unicorn-25131.exe (PID: 15204)
- Unicorn-28974.exe (PID: 9316)
- Unicorn-48016.exe (PID: 10500)
- Unicorn-53717.exe (PID: 10772)
- Unicorn-31060.exe (PID: 7600)
- Unicorn-10468.exe (PID: 13824)
- Unicorn-18964.exe (PID: 9948)
- Unicorn-10353.exe (PID: 7632)
- Unicorn-57989.exe (PID: 7944)
Starts application with an unusual extension
- Unicorn-29294.exe (PID: 3956)
Executes application which crashes
- Unicorn-29294.exe (PID: 3956)
- Unicorn-23415 (PID: 7696)
- Unicorn-40820.exe (PID: 8836)
INFO
Checks supported languages
- 1 (505).exe (PID: 2564)
- Unicorn-58950.exe (PID: 2340)
- Unicorn-49325.exe (PID: 7196)
- Unicorn-24183.exe (PID: 7180)
- Unicorn-58112.exe (PID: 7312)
- Unicorn-5216.exe (PID: 7328)
- Unicorn-7100.exe (PID: 7336)
- Unicorn-53653.exe (PID: 7344)
- Unicorn-25594.exe (PID: 7396)
- Unicorn-18665.exe (PID: 7408)
- Unicorn-63933.exe (PID: 7428)
- Unicorn-47061.exe (PID: 7444)
- Unicorn-17914.exe (PID: 7468)
- Unicorn-10985.exe (PID: 7476)
- Unicorn-30586.exe (PID: 7484)
- Unicorn-64305.exe (PID: 7528)
- Unicorn-9712.exe (PID: 7548)
- Unicorn-54151.exe (PID: 7460)
- Unicorn-21911.exe (PID: 7564)
- Unicorn-47512.exe (PID: 7580)
- Unicorn-15021.exe (PID: 7572)
- Unicorn-9572.exe (PID: 7612)
- Unicorn-23543.exe (PID: 7604)
- Unicorn-4108.exe (PID: 7636)
- Unicorn-60876.exe (PID: 7816)
- Unicorn-52017.exe (PID: 7716)
- Unicorn-24538.exe (PID: 7664)
- Unicorn-17290.exe (PID: 7748)
- Unicorn-63676.exe (PID: 7840)
- Unicorn-49941.exe (PID: 7832)
- Unicorn-23946.exe (PID: 8116)
- Unicorn-8688.exe (PID: 8124)
- Unicorn-4656.exe (PID: 8088)
- Unicorn-44916.exe (PID: 8180)
- Unicorn-13316.exe (PID: 1672)
- Unicorn-17281.exe (PID: 7280)
- Unicorn-19914.exe (PID: 7252)
- Unicorn-7588.exe (PID: 6112)
- Unicorn-58865.exe (PID: 6540)
- Unicorn-49815.exe (PID: 6712)
- Unicorn-43235.exe (PID: 7276)
- Unicorn-3546.exe (PID: 7256)
- Unicorn-65482.exe (PID: 6964)
- Unicorn-17268.exe (PID: 2268)
- Unicorn-6146.exe (PID: 6268)
- Unicorn-29489.exe (PID: 5436)
- Unicorn-10930.exe (PID: 1040)
- Unicorn-42213.exe (PID: 5260)
- Unicorn-50350.exe (PID: 2040)
- Unicorn-56852.exe (PID: 3300)
- Unicorn-39284.exe (PID: 7772)
- Unicorn-23031.exe (PID: 7864)
- Unicorn-19994.exe (PID: 7876)
- Unicorn-6420.exe (PID: 7896)
- Unicorn-51237.exe (PID: 7788)
- Unicorn-30894.exe (PID: 7860)
- Unicorn-48168.exe (PID: 7932)
- Unicorn-44220.exe (PID: 1240)
- Unicorn-28268.exe (PID: 4896)
- Unicorn-13545.exe (PID: 7036)
- Unicorn-29425.exe (PID: 6244)
- Unicorn-14640.exe (PID: 6156)
- Unicorn-40139.exe (PID: 4200)
- Unicorn-39548.exe (PID: 3888)
- Unicorn-35445.exe (PID: 7828)
- Unicorn-25417.exe (PID: 8008)
- Unicorn-46605.exe (PID: 5548)
- Unicorn-502.exe (PID: 7288)
- Unicorn-7575.exe (PID: 2772)
- Unicorn-48302.exe (PID: 1760)
- Unicorn-5859.exe (PID: 7244)
- Unicorn-59895.exe (PID: 6108)
- Unicorn-30813.exe (PID: 8048)
- Unicorn-27860.exe (PID: 8064)
- Unicorn-9982.exe (PID: 2140)
- Unicorn-63595.exe (PID: 4756)
- Unicorn-43995.exe (PID: 5244)
- Unicorn-49610.exe (PID: 4620)
- Unicorn-20180.exe (PID: 7012)
- Unicorn-50050.exe (PID: 1616)
- Unicorn-41815.exe (PID: 8280)
- Unicorn-36314.exe (PID: 3020)
- Unicorn-45739.exe (PID: 8304)
- Unicorn-49143.exe (PID: 6708)
- Unicorn-55551.exe (PID: 8272)
- Unicorn-29147.exe (PID: 8420)
- Unicorn-3681.exe (PID: 8432)
- Unicorn-26573.exe (PID: 8440)
- Unicorn-17885.exe (PID: 8480)
- Unicorn-50039.exe (PID: 8412)
- Unicorn-29220.exe (PID: 8524)
- Unicorn-39412.exe (PID: 8584)
- Unicorn-16823.exe (PID: 8620)
- Unicorn-43471.exe (PID: 8640)
- Unicorn-50879.exe (PID: 8608)
- Unicorn-38263.exe (PID: 8684)
- Unicorn-55512.exe (PID: 8696)
- Unicorn-56820.exe (PID: 8704)
- Unicorn-64439.exe (PID: 8984)
- Unicorn-13037.exe (PID: 8732)
- Unicorn-7676.exe (PID: 8752)
- Unicorn-25564.exe (PID: 8792)
- Unicorn-90.exe (PID: 9020)
- Unicorn-8076.exe (PID: 8740)
- Unicorn-53613.exe (PID: 8768)
- Unicorn-13686.exe (PID: 8844)
- Unicorn-16759.exe (PID: 8868)
- Unicorn-24564.exe (PID: 8884)
- Unicorn-44392.exe (PID: 8920)
- Unicorn-44392.exe (PID: 8936)
- Unicorn-38527.exe (PID: 8952)
- Unicorn-44392.exe (PID: 8964)
- Unicorn-20531.exe (PID: 9088)
- Unicorn-41933.exe (PID: 9052)
- Unicorn-36977.exe (PID: 9032)
- Unicorn-62427.exe (PID: 9152)
- Unicorn-41972.exe (PID: 9196)
- Unicorn-10477.exe (PID: 9212)
- Unicorn-38527.exe (PID: 8928)
- Unicorn-45965.exe (PID: 9116)
- Unicorn-2013.exe (PID: 9168)
- Unicorn-24791.exe (PID: 780)
- Unicorn-24791.exe (PID: 8220)
- Unicorn-24791.exe (PID: 8160)
- Unicorn-24791.exe (PID: 3900)
- Unicorn-24791.exe (PID: 8172)
- Unicorn-24791.exe (PID: 8256)
- Unicorn-61837.exe (PID: 8188)
- Unicorn-17271.exe (PID: 2088)
- Unicorn-24343.exe (PID: 5048)
- Unicorn-33742.exe (PID: 8296)
- Unicorn-58172.exe (PID: 732)
- Unicorn-59831.exe (PID: 9060)
- Unicorn-62190.exe (PID: 7892)
- Unicorn-13474.exe (PID: 1748)
- Unicorn-43469.exe (PID: 9128)
- Unicorn-47053.exe (PID: 2064)
- Unicorn-1324.exe (PID: 9272)
- Unicorn-26621.exe (PID: 9288)
- Unicorn-24791.exe (PID: 9308)
- Unicorn-10644.exe (PID: 9296)
- Unicorn-23803.exe (PID: 9328)
- Unicorn-38941.exe (PID: 9228)
- Unicorn-32699.exe (PID: 9908)
- Unicorn-57491.exe (PID: 9420)
- Unicorn-11289.exe (PID: 9428)
- Unicorn-51950.exe (PID: 9440)
- Unicorn-28785.exe (PID: 9512)
- Unicorn-32699.exe (PID: 9916)
- Unicorn-9.exe (PID: 9456)
- Unicorn-22641.exe (PID: 9576)
- Unicorn-51722.exe (PID: 9536)
- Unicorn-41151.exe (PID: 684)
- Unicorn-34269.exe (PID: 9588)
- Unicorn-25629.exe (PID: 9608)
- Unicorn-43959.exe (PID: 9644)
- Unicorn-12787.exe (PID: 9664)
- Unicorn-30093.exe (PID: 9684)
- Unicorn-55796.exe (PID: 9692)
- Unicorn-16477.exe (PID: 9700)
- Unicorn-45495.exe (PID: 9632)
- Unicorn-60404.exe (PID: 9728)
- Unicorn-10580.exe (PID: 9752)
- Unicorn-23077.exe (PID: 9780)
- Unicorn-40538.exe (PID: 9720)
- Unicorn-51822.exe (PID: 9800)
- Unicorn-18964.exe (PID: 9928)
- Unicorn-46391.exe (PID: 10064)
- Unicorn-11663.exe (PID: 10072)
- Unicorn-28061.exe (PID: 10024)
- Unicorn-49463.exe (PID: 10108)
- Unicorn-65137.exe (PID: 9832)
- Unicorn-18964.exe (PID: 9948)
- Unicorn-18964.exe (PID: 9936)
- Unicorn-59447.exe (PID: 10128)
- Unicorn-44590.exe (PID: 10192)
- Unicorn-10127.exe (PID: 10204)
- Unicorn-18811.exe (PID: 10824)
- Unicorn-46215.exe (PID: 10528)
- Unicorn-37687.exe (PID: 10796)
- Unicorn-30574.exe (PID: 10228)
- Unicorn-15671.exe (PID: 10516)
- Unicorn-9764.exe (PID: 3124)
- Unicorn-18811.exe (PID: 10816)
- Unicorn-40350.exe (PID: 10536)
- Unicorn-43984.exe (PID: 10780)
- Unicorn-50709.exe (PID: 10736)
- Unicorn-62961.exe (PID: 10324)
- Unicorn-17339.exe (PID: 10264)
- Unicorn-49482.exe (PID: 10808)
- Unicorn-54490.exe (PID: 10092)
- Unicorn-9712.exe (PID: 6960)
- Unicorn-24887.exe (PID: 10468)
- Unicorn-53200.exe (PID: 10388)
- Unicorn-48016.exe (PID: 10500)
- Unicorn-46065.exe (PID: 10744)
- Unicorn-15682.exe (PID: 10760)
- Unicorn-33270.exe (PID: 10728)
- Unicorn-32538.exe (PID: 11180)
- Unicorn-30740.exe (PID: 4284)
- Unicorn-16910.exe (PID: 2692)
- Unicorn-44200.exe (PID: 5596)
- Unicorn-19590.exe (PID: 11356)
- Unicorn-23287.exe (PID: 10752)
- Unicorn-54686.exe (PID: 11140)
- Unicorn-24836.exe (PID: 11100)
- Unicorn-1915.exe (PID: 4572)
- Unicorn-50292.exe (PID: 11068)
- Unicorn-53717.exe (PID: 10772)
- Unicorn-14017.exe (PID: 11644)
- Unicorn-6337.exe (PID: 11676)
- Unicorn-52092.exe (PID: 11432)
- Unicorn-53136.exe (PID: 11520)
- Unicorn-54736.exe (PID: 11092)
- Unicorn-38632.exe (PID: 11584)
- Unicorn-7780.exe (PID: 10804)
- Unicorn-53925.exe (PID: 11620)
- Unicorn-5855.exe (PID: 11372)
- Unicorn-54424.exe (PID: 11364)
- Unicorn-43408.exe (PID: 11076)
- Unicorn-21108.exe (PID: 11592)
- Unicorn-24430.exe (PID: 11244)
- Unicorn-22014.exe (PID: 11704)
- Unicorn-27880.exe (PID: 11712)
- Unicorn-65468.exe (PID: 11768)
- Unicorn-44446.exe (PID: 11780)
- Unicorn-25335.exe (PID: 11788)
- Unicorn-19958.exe (PID: 11864)
- Unicorn-37887.exe (PID: 11880)
- Unicorn-3489.exe (PID: 11268)
- Unicorn-5855.exe (PID: 11404)
- Unicorn-57758.exe (PID: 11912)
- Unicorn-24692.exe (PID: 11956)
- Unicorn-50197.exe (PID: 11920)
- Unicorn-28214.exe (PID: 11896)
- Unicorn-54805.exe (PID: 11888)
- Unicorn-45470.exe (PID: 12224)
- Unicorn-59205.exe (PID: 12192)
- Unicorn-43712.exe (PID: 11080)
- Unicorn-60368.exe (PID: 12644)
- Unicorn-60368.exe (PID: 12636)
- Unicorn-60329.exe (PID: 10476)
- Unicorn-44017.exe (PID: 12044)
- Unicorn-62599.exe (PID: 11468)
- Unicorn-58139.exe (PID: 11748)
- Unicorn-2637.exe (PID: 11736)
- Unicorn-38661.exe (PID: 300)
- Unicorn-59508.exe (PID: 9884)
- Unicorn-59792.exe (PID: 12696)
- Unicorn-62599.exe (PID: 10524)
- Unicorn-54652.exe (PID: 12296)
- Unicorn-23038.exe (PID: 12332)
- Unicorn-3159.exe (PID: 12372)
- Unicorn-59205.exe (PID: 12208)
- Unicorn-35086.exe (PID: 11940)
- Unicorn-4851.exe (PID: 12460)
- Unicorn-16404.exe (PID: 12028)
- Unicorn-59205.exe (PID: 12216)
- Unicorn-55069.exe (PID: 12084)
- Unicorn-32948.exe (PID: 12056)
- Unicorn-25268.exe (PID: 11964)
- Unicorn-2927.exe (PID: 3156)
- Unicorn-63749.exe (PID: 12108)
- Unicorn-25283.exe (PID: 11452)
- Unicorn-40980.exe (PID: 12092)
- Unicorn-35568.exe (PID: 12532)
- Unicorn-8125.exe (PID: 12552)
- Unicorn-41164.exe (PID: 12240)
- Unicorn-34798.exe (PID: 12792)
- Unicorn-57524.exe (PID: 12508)
- Unicorn-65070.exe (PID: 12184)
- Unicorn-19889.exe (PID: 12832)
- Unicorn-3028.exe (PID: 12808)
- Unicorn-37908.exe (PID: 12400)
- Unicorn-34484.exe (PID: 12036)
- Unicorn-32538.exe (PID: 11208)
- Unicorn-62382.exe (PID: 12064)
- Unicorn-50316.exe (PID: 12540)
- Unicorn-39869.exe (PID: 12176)
- Unicorn-36574.exe (PID: 12892)
- Unicorn-54415.exe (PID: 13272)
- Unicorn-40403.exe (PID: 13256)
- Unicorn-5546.exe (PID: 12380)
- Unicorn-12533.exe (PID: 13000)
- Unicorn-49410.exe (PID: 13392)
- Unicorn-1081.exe (PID: 13452)
- Unicorn-34256.exe (PID: 12132)
- Unicorn-59205.exe (PID: 12200)
- Unicorn-14829.exe (PID: 13264)
- Unicorn-31077.exe (PID: 13164)
- Unicorn-1803.exe (PID: 13780)
- Unicorn-50805.exe (PID: 13772)
- Unicorn-56405.exe (PID: 13748)
- Unicorn-44312.exe (PID: 12500)
- Unicorn-56405.exe (PID: 13756)
- Unicorn-56405.exe (PID: 13740)
- Unicorn-29550.exe (PID: 13668)
- Unicorn-48386.exe (PID: 13900)
- Unicorn-22196.exe (PID: 12124)
- Unicorn-34422.exe (PID: 13840)
- Unicorn-10468.exe (PID: 13764)
- Unicorn-34650.exe (PID: 13660)
- Unicorn-34650.exe (PID: 13892)
- Unicorn-45586.exe (PID: 13596)
- Unicorn-21402.exe (PID: 13908)
- Unicorn-26592.exe (PID: 13536)
- Unicorn-57904.exe (PID: 14024)
- Unicorn-12857.exe (PID: 13528)
- Unicorn-64435.exe (PID: 13476)
- Unicorn-23734.exe (PID: 13564)
- Unicorn-37470.exe (PID: 13556)
- Unicorn-57904.exe (PID: 14036)
- Unicorn-51708.exe (PID: 14380)
- Unicorn-51708.exe (PID: 14372)
- Unicorn-57573.exe (PID: 14364)
- Unicorn-45263.exe (PID: 14228)
- Unicorn-17526.exe (PID: 14052)
- Unicorn-37172.exe (PID: 14220)
- Unicorn-57904.exe (PID: 14020)
- Unicorn-8538.exe (PID: 14236)
- Unicorn-65435.exe (PID: 14160)
- Unicorn-61662.exe (PID: 14152)
- Unicorn-63109.exe (PID: 14132)
- Unicorn-56037.exe (PID: 14116)
- Unicorn-34958.exe (PID: 14100)
- Unicorn-54780.exe (PID: 14084)
- Unicorn-64645.exe (PID: 14060)
- Unicorn-41875.exe (PID: 13916)
- Unicorn-45586.exe (PID: 13604)
- Unicorn-51708.exe (PID: 14076)
- Unicorn-64645.exe (PID: 14068)
- Unicorn-25131.exe (PID: 15204)
- Unicorn-19498.exe (PID: 14244)
- Unicorn-27967.exe (PID: 15244)
- Unicorn-17092.exe (PID: 14256)
- Unicorn-29492.exe (PID: 14660)
- Unicorn-31261.exe (PID: 14512)
- Unicorn-51708.exe (PID: 14560)
- Unicorn-17526.exe (PID: 14476)
- Unicorn-17526.exe (PID: 14552)
- Unicorn-43612.exe (PID: 14840)
- Unicorn-25131.exe (PID: 15212)
- Unicorn-38298.exe (PID: 13624)
- Unicorn-34388.exe (PID: 15308)
- Unicorn-17526.exe (PID: 14452)
- Unicorn-34388.exe (PID: 15300)
- Unicorn-51708.exe (PID: 14468)
- Unicorn-50292.exe (PID: 11060)
The sample compiled with chinese language support
- 1 (505).exe (PID: 2564)
- Unicorn-57573.exe (PID: 14364)
- Unicorn-36314.exe (PID: 3020)
- Unicorn-19214.exe (PID: 11688)
- Unicorn-24183.exe (PID: 7180)
- Unicorn-14017.exe (PID: 11644)
- Unicorn-13545.exe (PID: 7036)
- Unicorn-51708.exe (PID: 14372)
- Unicorn-58950.exe (PID: 2340)
- Unicorn-6337.exe (PID: 11676)
- Unicorn-23361.exe (PID: 14708)
- Unicorn-35568.exe (PID: 12532)
- Unicorn-6146.exe (PID: 6268)
- Unicorn-43712.exe (PID: 11080)
- Unicorn-59895.exe (PID: 6108)
- Unicorn-51237.exe (PID: 7788)
Reads the computer name
- Unicorn-58950.exe (PID: 2340)
- 1 (505).exe (PID: 2564)
- Unicorn-49325.exe (PID: 7196)
- Unicorn-24183.exe (PID: 7180)
- Unicorn-58112.exe (PID: 7312)
- Unicorn-7100.exe (PID: 7336)
- Unicorn-5216.exe (PID: 7328)
- Unicorn-53653.exe (PID: 7344)
- Unicorn-18665.exe (PID: 7408)
- Unicorn-63933.exe (PID: 7428)
- Unicorn-25594.exe (PID: 7396)
- Unicorn-17914.exe (PID: 7468)
- Unicorn-10985.exe (PID: 7476)
- Unicorn-30586.exe (PID: 7484)
- Unicorn-54151.exe (PID: 7460)
- Unicorn-47061.exe (PID: 7444)
- Unicorn-64305.exe (PID: 7528)
- Unicorn-9712.exe (PID: 7548)
- Unicorn-21911.exe (PID: 7564)
- Unicorn-15021.exe (PID: 7572)
- Unicorn-47512.exe (PID: 7580)
- Unicorn-52017.exe (PID: 7716)
- Unicorn-17290.exe (PID: 7748)
- Unicorn-24538.exe (PID: 7664)
- Unicorn-4108.exe (PID: 7636)
- Unicorn-60876.exe (PID: 7816)
- Unicorn-9572.exe (PID: 7612)
- Unicorn-23543.exe (PID: 7604)
- Unicorn-63676.exe (PID: 7840)
- Unicorn-49941.exe (PID: 7832)
- Unicorn-4656.exe (PID: 8088)
- Unicorn-7588.exe (PID: 6112)
- Unicorn-6146.exe (PID: 6268)
- Unicorn-50350.exe (PID: 2040)
- Unicorn-10930.exe (PID: 1040)
- Unicorn-3546.exe (PID: 7256)
- Unicorn-44916.exe (PID: 8180)
- Unicorn-58865.exe (PID: 6540)
- Unicorn-17281.exe (PID: 7280)
- Unicorn-8688.exe (PID: 8124)
- Unicorn-13316.exe (PID: 1672)
- Unicorn-19914.exe (PID: 7252)
- Unicorn-43235.exe (PID: 7276)
- Unicorn-51237.exe (PID: 7788)
- Unicorn-13545.exe (PID: 7036)
- Unicorn-48168.exe (PID: 7932)
- Unicorn-30894.exe (PID: 7860)
- Unicorn-59895.exe (PID: 6108)
- Unicorn-14640.exe (PID: 6156)
- Unicorn-27860.exe (PID: 8064)
- Unicorn-39548.exe (PID: 3888)
- Unicorn-9220.exe (PID: 7908)
- Unicorn-49610.exe (PID: 4620)
- Unicorn-23031.exe (PID: 7864)
- Unicorn-44023.exe (PID: 5056)
- Unicorn-29425.exe (PID: 6244)
- Unicorn-29220.exe (PID: 8524)
- Unicorn-49143.exe (PID: 6708)
- Unicorn-45739.exe (PID: 8304)
- Unicorn-19994.exe (PID: 7876)
- Unicorn-39860.exe (PID: 5084)
- Unicorn-49815.exe (PID: 6712)
- Unicorn-6420.exe (PID: 7896)
- Unicorn-35445.exe (PID: 7828)
- Unicorn-50039.exe (PID: 8412)
- Unicorn-29294.exe (PID: 3956)
- Unicorn-17268.exe (PID: 2268)
- Unicorn-28268.exe (PID: 4896)
- Unicorn-64564.exe (PID: 8468)
- Unicorn-20180.exe (PID: 7012)
- Unicorn-43471.exe (PID: 8640)
- Unicorn-43466.exe (PID: 1348)
- Unicorn-9982.exe (PID: 2140)
- Unicorn-56377.exe (PID: 1388)
- Unicorn-16884.exe (PID: 8976)
- Unicorn-64439.exe (PID: 8984)
- Unicorn-90.exe (PID: 9020)
- Unicorn-50050.exe (PID: 1616)
- Unicorn-44392.exe (PID: 8964)
- Unicorn-502.exe (PID: 7288)
- Unicorn-26573.exe (PID: 8440)
- Unicorn-29147.exe (PID: 8420)
- Unicorn-37143.exe (PID: 8600)
- Unicorn-48302.exe (PID: 1760)
- Unicorn-44220.exe (PID: 1240)
- Unicorn-30813.exe (PID: 8048)
- Unicorn-44949.exe (PID: 8676)
- Unicorn-24791.exe (PID: 8160)
- Unicorn-24791.exe (PID: 780)
- Unicorn-59182.exe (PID: 8904)
- Unicorn-39284.exe (PID: 7772)
- Unicorn-7575.exe (PID: 2772)
- Unicorn-38263.exe (PID: 8684)
- Unicorn-43121.exe (PID: 8944)
- Unicorn-55409.exe (PID: 8816)
- Unicorn-38527.exe (PID: 8952)
- Unicorn-13037.exe (PID: 8732)
- Unicorn-7676.exe (PID: 8752)
- Unicorn-16759.exe (PID: 8868)
- Unicorn-23415 (PID: 7696)
- Unicorn-38527.exe (PID: 8928)
- Unicorn-56820.exe (PID: 8704)
- Unicorn-41815.exe (PID: 8280)
- Unicorn-59831.exe (PID: 9060)
- Unicorn-32699.exe (PID: 9908)
- Unicorn-32699.exe (PID: 9916)
- Unicorn-7941.exe (PID: 8760)
- Unicorn-47053.exe (PID: 2064)
- Unicorn-8076.exe (PID: 8740)
- Unicorn-40820.exe (PID: 8836)
- Unicorn-39412.exe (PID: 8584)
- Unicorn-3681.exe (PID: 8432)
- Unicorn-41972.exe (PID: 9196)
- Unicorn-58172.exe (PID: 732)
- Unicorn-23803.exe (PID: 9328)
- Unicorn-40139.exe (PID: 4200)
- Unicorn-24791.exe (PID: 8220)
- Unicorn-5855.exe (PID: 11404)
- Unicorn-61837.exe (PID: 8188)
- Unicorn-9712.exe (PID: 6960)
- Unicorn-15682.exe (PID: 10760)
- Unicorn-28785.exe (PID: 9512)
- Unicorn-17885.exe (PID: 8480)
- Unicorn-60368.exe (PID: 12636)
- Unicorn-45470.exe (PID: 12224)
- Unicorn-50292.exe (PID: 11068)
- Unicorn-51950.exe (PID: 9440)
- Unicorn-43712.exe (PID: 11080)
- Unicorn-43469.exe (PID: 9128)
- Unicorn-18811.exe (PID: 10816)
- Unicorn-30093.exe (PID: 9684)
- Unicorn-51708.exe (PID: 14372)
- Unicorn-57573.exe (PID: 14364)
- Unicorn-10468.exe (PID: 13824)
- Unicorn-25131.exe (PID: 15212)
- Unicorn-25131.exe (PID: 15204)
- Unicorn-27967.exe (PID: 15244)
- Unicorn-33742.exe (PID: 8296)
Create files in a temporary directory
- 1 (505).exe (PID: 2564)
- Unicorn-49325.exe (PID: 7196)
- Unicorn-58950.exe (PID: 2340)
- Unicorn-7100.exe (PID: 7336)
- Unicorn-58112.exe (PID: 7312)
- Unicorn-24183.exe (PID: 7180)
- Unicorn-25594.exe (PID: 7396)
- Unicorn-63933.exe (PID: 7428)
- Unicorn-5216.exe (PID: 7328)
- Unicorn-10985.exe (PID: 7476)
- Unicorn-17914.exe (PID: 7468)
- Unicorn-30586.exe (PID: 7484)
- Unicorn-64305.exe (PID: 7528)
- Unicorn-9712.exe (PID: 7548)
- Unicorn-21911.exe (PID: 7564)
- Unicorn-47512.exe (PID: 7580)
- Unicorn-15021.exe (PID: 7572)
- Unicorn-52017.exe (PID: 7716)
- Unicorn-17290.exe (PID: 7748)
- Unicorn-60876.exe (PID: 7816)
- Unicorn-9572.exe (PID: 7612)
- Unicorn-53653.exe (PID: 7344)
- Unicorn-24538.exe (PID: 7664)
- Unicorn-4108.exe (PID: 7636)
- Unicorn-54151.exe (PID: 7460)
- Unicorn-23543.exe (PID: 7604)
- Unicorn-49941.exe (PID: 7832)
- Unicorn-47061.exe (PID: 7444)
- Unicorn-4656.exe (PID: 8088)
- Unicorn-7588.exe (PID: 6112)
- Unicorn-58865.exe (PID: 6540)
- Unicorn-17281.exe (PID: 7280)
- Unicorn-6146.exe (PID: 6268)
- Unicorn-10930.exe (PID: 1040)
- Unicorn-50350.exe (PID: 2040)
- Unicorn-8688.exe (PID: 8124)
- Unicorn-13316.exe (PID: 1672)
- Unicorn-18665.exe (PID: 7408)
- Unicorn-51237.exe (PID: 7788)
- Unicorn-30894.exe (PID: 7860)
- Unicorn-13545.exe (PID: 7036)
- Unicorn-48168.exe (PID: 7932)
- Unicorn-42213.exe (PID: 5260)
- Unicorn-14640.exe (PID: 6156)
- Unicorn-23031.exe (PID: 7864)
- Unicorn-44916.exe (PID: 8180)
- Unicorn-29489.exe (PID: 5436)
- Unicorn-59895.exe (PID: 6108)
- Unicorn-63676.exe (PID: 7840)
- Unicorn-55551.exe (PID: 8272)
- Unicorn-29425.exe (PID: 6244)
- Unicorn-56852.exe (PID: 3300)
- Unicorn-46605.exe (PID: 5548)
- Unicorn-19994.exe (PID: 7876)
- Unicorn-63595.exe (PID: 4756)
- Unicorn-35445.exe (PID: 7828)
- Unicorn-6420.exe (PID: 7896)
- Unicorn-29220.exe (PID: 8524)
- Unicorn-49143.exe (PID: 6708)
- Unicorn-9220.exe (PID: 7908)
- Unicorn-36314.exe (PID: 3020)
- Unicorn-45739.exe (PID: 8304)
- Unicorn-28268.exe (PID: 4896)
- Unicorn-20180.exe (PID: 7012)
- Unicorn-29294.exe (PID: 3956)
- Unicorn-17268.exe (PID: 2268)
- Unicorn-43235.exe (PID: 7276)
- Unicorn-5859.exe (PID: 7244)
- Unicorn-64564.exe (PID: 8468)
- Unicorn-64439.exe (PID: 8984)
- Unicorn-43471.exe (PID: 8640)
- Unicorn-502.exe (PID: 7288)
- Unicorn-90.exe (PID: 9020)
- Unicorn-41933.exe (PID: 9052)
- Unicorn-45965.exe (PID: 9116)
- Unicorn-37143.exe (PID: 8600)
- Unicorn-29147.exe (PID: 8420)
- Unicorn-50039.exe (PID: 8412)
- Unicorn-44392.exe (PID: 8920)
- Unicorn-50050.exe (PID: 1616)
- Unicorn-9982.exe (PID: 2140)
- Unicorn-56377.exe (PID: 1388)
- Unicorn-48302.exe (PID: 1760)
- Unicorn-7575.exe (PID: 2772)
- Unicorn-62427.exe (PID: 9152)
- Unicorn-44949.exe (PID: 8676)
- Unicorn-49610.exe (PID: 4620)
- Unicorn-65482.exe (PID: 6964)
- Unicorn-43466.exe (PID: 1348)
- Unicorn-50879.exe (PID: 8608)
- Unicorn-30813.exe (PID: 8048)
- Unicorn-38263.exe (PID: 8684)
- Unicorn-23946.exe (PID: 8116)
- Unicorn-13037.exe (PID: 8732)
- Unicorn-39284.exe (PID: 7772)
- Unicorn-55409.exe (PID: 8816)
- Unicorn-2013.exe (PID: 9168)
- Unicorn-24791.exe (PID: 8172)
- Unicorn-16759.exe (PID: 8868)
- Unicorn-23415 (PID: 7696)
- Unicorn-26573.exe (PID: 8440)
- Unicorn-38527.exe (PID: 8928)
- Unicorn-39548.exe (PID: 3888)
- Unicorn-24791.exe (PID: 8160)
- Unicorn-25417.exe (PID: 8008)
- Unicorn-56820.exe (PID: 8704)
- Unicorn-44730.exe (PID: 9896)
- Unicorn-32699.exe (PID: 9908)
- Unicorn-24791.exe (PID: 780)
- Unicorn-27860.exe (PID: 8064)
- Unicorn-53613.exe (PID: 8768)
- Unicorn-7941.exe (PID: 8760)
- Unicorn-25564.exe (PID: 8792)
- Unicorn-13474.exe (PID: 1748)
- Unicorn-3681.exe (PID: 8432)
- Unicorn-39860.exe (PID: 5084)
- Unicorn-38527.exe (PID: 8952)
- Unicorn-49815.exe (PID: 6712)
- Unicorn-44220.exe (PID: 1240)
- Unicorn-45495.exe (PID: 9632)
- Unicorn-58172.exe (PID: 732)
- Unicorn-38941.exe (PID: 9228)
- Unicorn-39412.exe (PID: 8584)
- Unicorn-23803.exe (PID: 9328)
- Unicorn-59831.exe (PID: 9060)
- Unicorn-19214.exe (PID: 11688)
- Unicorn-14017.exe (PID: 11644)
- Unicorn-20531.exe (PID: 9088)
- Unicorn-6337.exe (PID: 11676)
- Unicorn-24791.exe (PID: 8220)
- Unicorn-61837.exe (PID: 8188)
- Unicorn-5855.exe (PID: 11404)
- Unicorn-44392.exe (PID: 8936)
- Unicorn-24791.exe (PID: 8256)
- Unicorn-9712.exe (PID: 6960)
- Unicorn-28785.exe (PID: 9512)
- Unicorn-17885.exe (PID: 8480)
- Unicorn-3546.exe (PID: 7256)
- Unicorn-49716.exe (PID: 8804)
- Unicorn-16884.exe (PID: 8976)
- Unicorn-32699.exe (PID: 9916)
- Unicorn-50292.exe (PID: 11068)
- Unicorn-43995.exe (PID: 5244)
- Unicorn-32282.exe (PID: 8240)
- Unicorn-59792.exe (PID: 12696)
- Unicorn-16823.exe (PID: 8620)
- Unicorn-8076.exe (PID: 8740)
- Unicorn-16477.exe (PID: 9700)
- Unicorn-51950.exe (PID: 9440)
- Unicorn-43712.exe (PID: 11080)
- Unicorn-19914.exe (PID: 7252)
- Unicorn-57573.exe (PID: 14364)
- Unicorn-28974.exe (PID: 9316)
- Unicorn-18811.exe (PID: 10816)
- Unicorn-51708.exe (PID: 14372)
- Unicorn-40139.exe (PID: 4200)
- Unicorn-30093.exe (PID: 9684)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 7696)
- BackgroundTransferHost.exe (PID: 8008)
- BackgroundTransferHost.exe (PID: 2088)
- BackgroundTransferHost.exe (PID: 2092)
- BackgroundTransferHost.exe (PID: 8112)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 8008)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 8008)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 8008)
- WerFault.exe (PID: 11048)
- WerFault.exe (PID: 11424)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:20 00:32:00+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
680
Monitored processes
542
Malicious processes
77
Suspicious processes
68
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 300 | C:\Users\admin\AppData\Local\Temp\Unicorn-38661.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-38661.exe | — | Unicorn-30894.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 684 | C:\Users\admin\AppData\Local\Temp\Unicorn-41151.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-41151.exe | — | Unicorn-8688.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 720 | C:\Users\admin\AppData\Local\Temp\Unicorn-44770.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-44770.exe | — | Unicorn-16884.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 | |||||||||||||||
| 732 | C:\Users\admin\AppData\Local\Temp\Unicorn-58172.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-58172.exe | Unicorn-24538.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 780 | C:\Users\admin\AppData\Local\Temp\Unicorn-24791.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24791.exe | Unicorn-50350.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1040 | C:\Users\admin\AppData\Local\Temp\Unicorn-10930.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-10930.exe | 1 (505).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1240 | C:\Users\admin\AppData\Local\Temp\Unicorn-44220.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-44220.exe | Unicorn-53653.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1348 | C:\Users\admin\AppData\Local\Temp\Unicorn-43466.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-43466.exe | Unicorn-13316.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1388 | C:\Users\admin\AppData\Local\Temp\Unicorn-56377.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56377.exe | Unicorn-25594.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1616 | C:\Users\admin\AppData\Local\Temp\Unicorn-50050.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-50050.exe | Unicorn-30586.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
15 863
Read events
15 848
Write events
15
Delete events
0
Modification events
| (PID) Process: | (7696) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7696) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7696) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (8008) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (8008) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (8008) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2088) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2088) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2088) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2092) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
624
Suspicious files
15
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2564 | 1 (505).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-58950.exe | executable | |
MD5:79A9C6144C043186585EA0287CF01976 | SHA256:54F2641E51E414997C5589AC0391A150D742B414044957287F11471C47003103 | |||
| 2564 | 1 (505).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49325.exe | executable | |
MD5:7274FDCD98E377D690412B5233A6BC39 | SHA256:AFD21AFBB9792CEDF49A169E536912963B7736C6BF5695F9944E955DEEE49B8E | |||
| 2564 | 1 (505).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53653.exe | executable | |
MD5:392DB75221CC0BBEC78027113FA42768 | SHA256:D39A9CA2796669FCF71AA4547F1AF5818882EA494D089D145F077D6D1ED36C60 | |||
| 7312 | Unicorn-58112.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9712.exe | executable | |
MD5:4AA2D13A4F46F25ABB02EB4FE56226BB | SHA256:2C1C8DF8ECC6A12B7B6DC7EDF77997C9B988FB243F55BCD7CF261C88091D597F | |||
| 7344 | Unicorn-53653.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-17914.exe | executable | |
MD5:E46518AD1E2390BFB18CFEA57C3BAF22 | SHA256:F522979FCD32EECEFE6412724AFD4BE7110ABA1C899F0F779D9E368D56861D77 | |||
| 7328 | Unicorn-5216.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63933.exe | executable | |
MD5:5FE298EB6B2395E7E2C5B880F0F8209A | SHA256:519AF53543251BA7C0B709B77BB20E99336AD91CEFD81ABF797BAFA8AC9A127A | |||
| 7180 | Unicorn-24183.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-18665.exe | executable | |
MD5:58AE6D61D6F9D03132B7279AEC264E05 | SHA256:2A2306CDA16CC836FB44D1F292C01B31CD4DD552C76ED5BBA77820AFF52D06D5 | |||
| 7396 | Unicorn-25594.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-64305.exe | executable | |
MD5:5855BBA2B6B1FBD6145CE87127D12904 | SHA256:65D59BE31306AF5E0CA15CB613F4BD7E2574D730AA8B81434077338DFBF87559 | |||
| 2564 | 1 (505).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-30586.exe | executable | |
MD5:0EA2D131DF5A71D4CEF0864009F2F3FA | SHA256:AA71C3F5B26C00438B3DCD9C1FA12EB636194A8DB3502CC3A553123CAEF52EF5 | |||
| 7428 | Unicorn-63933.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-15021.exe | executable | |
MD5:A668CAB645B9F7005FD37120E95B5BB3 | SHA256:CE3DB8F69597012D26CA988445B3C05090417401667F868D092081855BB56F92 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
15
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6036 | backgroundTaskHost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
8008 | BackgroundTransferHost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
7212 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7212 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
3216 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.159.131:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
6036 | backgroundTaskHost.exe | 20.223.35.26:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6036 | backgroundTaskHost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
8008 | BackgroundTransferHost.exe | 104.126.37.131:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |