| File name: | 1 (125) |
| Full analysis: | https://app.any.run/tasks/4a3ca3b9-45b5-452f-b55b-2df1e68e60fb |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 10:22:49 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | 2F5A5FD4C9FA6698C8A4B606F6E3BED0 |
| SHA1: | 81E5DBC52366B166F43120B25BADFE8EBD451358 |
| SHA256: | 565889A47C901DA0B62895A3EC5F29AF9BE2394025B4DB39FDF61A0EDAA2294D |
| SSDEEP: | 12288:o+ikqHA5NbciBBshaHsyeFV1x4DxmDsR:o+9n5lBBsh5F |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- Unicorn-16905.exe (PID: 668)
- 1 (125).exe (PID: 7012)
- Unicorn-62649.exe (PID: 4400)
- Unicorn-9291.exe (PID: 5116)
- Unicorn-39629.exe (PID: 4040)
- Unicorn-64688.exe (PID: 5364)
- Unicorn-31269.exe (PID: 4112)
- Unicorn-18270.exe (PID: 3008)
- Unicorn-2104.exe (PID: 856)
- Unicorn-9992.exe (PID: 1388)
- Unicorn-22053.exe (PID: 2420)
- Unicorn-25138.exe (PID: 7084)
- Unicorn-40479.exe (PID: 1184)
- Unicorn-63360.exe (PID: 4724)
- Unicorn-2082.exe (PID: 920)
- Unicorn-41954.exe (PID: 5392)
- Unicorn-45389.exe (PID: 6388)
- Unicorn-57584.exe (PID: 5228)
- Unicorn-36609.exe (PID: 6576)
- Unicorn-10049.exe (PID: 6800)
- Unicorn-21979.exe (PID: 5384)
- Unicorn-7828.exe (PID: 1764)
- Unicorn-64303.exe (PID: 5436)
- Unicorn-4491.exe (PID: 6872)
- Unicorn-3862.exe (PID: 5596)
- Unicorn-3256.exe (PID: 1188)
- Unicorn-61503.exe (PID: 2984)
- Unicorn-31093.exe (PID: 7244)
- Unicorn-10480.exe (PID: 7260)
- Unicorn-37023.exe (PID: 7284)
- Unicorn-39815.exe (PID: 7272)
- Unicorn-34601.exe (PID: 7316)
- Unicorn-26987.exe (PID: 7332)
- Unicorn-42769.exe (PID: 7324)
- Unicorn-26168.exe (PID: 7344)
- Unicorn-57133.exe (PID: 7416)
- Unicorn-16101.exe (PID: 7404)
- Unicorn-7740.exe (PID: 7456)
- Unicorn-62871.exe (PID: 7532)
- Unicorn-50501.exe (PID: 7788)
- Unicorn-786.exe (PID: 7820)
- Unicorn-56749.exe (PID: 7544)
- Unicorn-32245.exe (PID: 7516)
- Unicorn-36883.exe (PID: 7576)
- Unicorn-30198.exe (PID: 7488)
- Unicorn-56941.exe (PID: 7468)
- Unicorn-42717.exe (PID: 8008)
- Unicorn-63956.exe (PID: 7584)
- Unicorn-24077.exe (PID: 7508)
- Unicorn-30827.exe (PID: 8036)
- Unicorn-64599.exe (PID: 7860)
- Unicorn-49349.exe (PID: 7688)
- Unicorn-13147.exe (PID: 7696)
- Unicorn-36905.exe (PID: 7740)
- Unicorn-44497.exe (PID: 7496)
- Unicorn-17829.exe (PID: 8048)
- Unicorn-16485.exe (PID: 7720)
- Unicorn-12379.exe (PID: 7524)
- Unicorn-53262.exe (PID: 5304)
- Unicorn-4699.exe (PID: 2644)
- Unicorn-49541.exe (PID: 7632)
- Unicorn-24927.exe (PID: 8244)
- Unicorn-35758.exe (PID: 7436)
- Unicorn-25333.exe (PID: 8328)
- Unicorn-47590.exe (PID: 8432)
- Unicorn-30774.exe (PID: 7748)
- Unicorn-64652.exe (PID: 7552)
- Unicorn-6758.exe (PID: 8360)
- Unicorn-48892.exe (PID: 7756)
- Unicorn-8103.exe (PID: 7592)
- Unicorn-7475.exe (PID: 8092)
- Unicorn-34527.exe (PID: 7972)
- Unicorn-17445.exe (PID: 7904)
- Unicorn-50096.exe (PID: 7648)
- Unicorn-13360.exe (PID: 7876)
- Unicorn-31123.exe (PID: 8404)
- Unicorn-31019.exe (PID: 8016)
- Unicorn-32541.exe (PID: 6972)
- Unicorn-47761.exe (PID: 8084)
- Unicorn-40221.exe (PID: 7560)
- Unicorn-28087.exe (PID: 8072)
- Unicorn-19202.exe (PID: 8320)
- Unicorn-33811.exe (PID: 8984)
- Unicorn-41233.exe (PID: 9008)
- Unicorn-35421.exe (PID: 8476)
- Unicorn-58124.exe (PID: 9052)
- Unicorn-39291.exe (PID: 8416)
- Unicorn-14450.exe (PID: 6112)
- Unicorn-56780.exe (PID: 8672)
- Unicorn-5467.exe (PID: 8336)
- Unicorn-64585.exe (PID: 8608)
- Unicorn-60236.exe (PID: 8632)
- Unicorn-29482.exe (PID: 8708)
- Unicorn-392.exe (PID: 8972)
- Unicorn-35348.exe (PID: 8692)
- Unicorn-1980.exe (PID: 8536)
- Unicorn-65038.exe (PID: 8740)
- Unicorn-32141.exe (PID: 7892)
- Unicorn-57548.exe (PID: 8816)
- Unicorn-60885.exe (PID: 8848)
- Unicorn-1316.exe (PID: 9152)
- Unicorn-20652.exe (PID: 7828)
- Unicorn-51439.exe (PID: 9076)
- Unicorn-22134.exe (PID: 8140)
- Unicorn-17829.exe (PID: 8056)
- Unicorn-39536.exe (PID: 9316)
- Unicorn-12239.exe (PID: 5400)
- Unicorn-319.exe (PID: 7444)
- Unicorn-63241.exe (PID: 8396)
- Unicorn-37969.exe (PID: 8344)
- Unicorn-26677.exe (PID: 8548)
- Unicorn-24513.exe (PID: 8776)
- Unicorn-35156.exe (PID: 8484)
- Unicorn-1456.exe (PID: 9952)
- Unicorn-18403.exe (PID: 8064)
- Unicorn-15576.exe (PID: 8596)
- Unicorn-11160.exe (PID: 10140)
- Unicorn-58145.exe (PID: 8888)
- Unicorn-32659.exe (PID: 8580)
- Unicorn-3791.exe (PID: 9240)
- Unicorn-19573.exe (PID: 9260)
- Unicorn-41425.exe (PID: 8944)
- Unicorn-10126.exe (PID: 9440)
- Unicorn-37703.exe (PID: 9068)
- Unicorn-52909.exe (PID: 8828)
- Unicorn-62961.exe (PID: 9108)
- Unicorn-51861.exe (PID: 9348)
- Unicorn-19869.exe (PID: 10232)
- Unicorn-50709.exe (PID: 9120)
- Unicorn-30046.exe (PID: 10152)
- Unicorn-53707.exe (PID: 9400)
- Unicorn-9874.exe (PID: 8156)
- Unicorn-21389.exe (PID: 8860)
- Unicorn-35887.exe (PID: 9408)
- Unicorn-50849.exe (PID: 9924)
- Unicorn-37777.exe (PID: 8272)
- Unicorn-1648.exe (PID: 9916)
- Unicorn-59924.exe (PID: 8560)
- Unicorn-61461.exe (PID: 8752)
- Unicorn-4698.exe (PID: 9368)
- Unicorn-60517.exe (PID: 2316)
- Unicorn-9432.exe (PID: 9692)
- Unicorn-42363.exe (PID: 8880)
- Unicorn-43619.exe (PID: 9800)
- Unicorn-53921.exe (PID: 8352)
- Unicorn-12032.exe (PID: 11312)
- Unicorn-52873.exe (PID: 11296)
- Unicorn-54933.exe (PID: 9932)
- Unicorn-62577.exe (PID: 9188)
- Unicorn-15747.exe (PID: 8700)
- Unicorn-42722.exe (PID: 4980)
- Unicorn-16553.exe (PID: 10284)
- Unicorn-19882.exe (PID: 9128)
- Unicorn-58261.exe (PID: 9180)
- Unicorn-45509.exe (PID: 8952)
- Unicorn-10179.exe (PID: 9648)
- Unicorn-13692.exe (PID: 8800)
- Unicorn-22099.exe (PID: 5084)
- Unicorn-268.exe (PID: 12604)
- Unicorn-25327.exe (PID: 12620)
- Unicorn-49623.exe (PID: 9416)
- Unicorn-56447.exe (PID: 9196)
- Unicorn-20074.exe (PID: 9088)
- Unicorn-584.exe (PID: 8912)
- Unicorn-33111.exe (PID: 12524)
- Unicorn-5379.exe (PID: 11388)
- Unicorn-21959.exe (PID: 13416)
- Unicorn-3215.exe (PID: 9356)
- Unicorn-53205.exe (PID: 9632)
- Unicorn-43205.exe (PID: 8524)
- Unicorn-55488.exe (PID: 9384)
- Unicorn-28369.exe (PID: 6852)
- Unicorn-35643.exe (PID: 10196)
- Unicorn-30481.exe (PID: 9228)
- Unicorn-17269.exe (PID: 11360)
- Unicorn-45103.exe (PID: 9820)
- Unicorn-39675.exe (PID: 9768)
- Unicorn-63205.exe (PID: 10596)
- Unicorn-22313.exe (PID: 9220)
- Unicorn-46823.exe (PID: 9376)
- Unicorn-52437.exe (PID: 9536)
- Unicorn-53323.exe (PID: 4784)
- Unicorn-5784.exe (PID: 9096)
- Unicorn-50024.exe (PID: 12640)
- Unicorn-3859.exe (PID: 13536)
- Unicorn-49936.exe (PID: 13740)
- Unicorn-24279.exe (PID: 13804)
- Unicorn-58996.exe (PID: 9724)
- Unicorn-33605.exe (PID: 11352)
- Unicorn-40023.exe (PID: 10704)
- Unicorn-6774.exe (PID: 12472)
- Unicorn-47445.exe (PID: 10752)
- Unicorn-55753.exe (PID: 9392)
- Unicorn-12203.exe (PID: 10300)
- Unicorn-31251.exe (PID: 15372)
- Unicorn-15107.exe (PID: 15348)
- Unicorn-10011.exe (PID: 2140)
- Unicorn-6555.exe (PID: 15512)
- Unicorn-15554.exe (PID: 9700)
- Unicorn-51145.exe (PID: 10820)
- Unicorn-39971.exe (PID: 9424)
- Unicorn-29691.exe (PID: 11576)
- Unicorn-30615.exe (PID: 11776)
- Unicorn-9131.exe (PID: 5680)
- Unicorn-55756.exe (PID: 2908)
- Unicorn-55701.exe (PID: 10396)
- Unicorn-8711.exe (PID: 13812)
- Unicorn-25733.exe (PID: 12808)
- Unicorn-19935.exe (PID: 9308)
- Unicorn-38175.exe (PID: 7568)
Starts itself from another location
- Unicorn-16905.exe (PID: 668)
- Unicorn-62649.exe (PID: 4400)
- 1 (125).exe (PID: 7012)
- Unicorn-9291.exe (PID: 5116)
- Unicorn-39629.exe (PID: 4040)
- Unicorn-64688.exe (PID: 5364)
- Unicorn-25138.exe (PID: 7084)
- Unicorn-18270.exe (PID: 3008)
- Unicorn-2104.exe (PID: 856)
- Unicorn-31269.exe (PID: 4112)
- Unicorn-9992.exe (PID: 1388)
- Unicorn-22053.exe (PID: 2420)
- Unicorn-3256.exe (PID: 1188)
- Unicorn-40479.exe (PID: 1184)
- Unicorn-63360.exe (PID: 4724)
- Unicorn-41954.exe (PID: 5392)
- Unicorn-2082.exe (PID: 920)
- Unicorn-45389.exe (PID: 6388)
- Unicorn-57584.exe (PID: 5228)
- Unicorn-36609.exe (PID: 6576)
- Unicorn-3862.exe (PID: 5596)
- Unicorn-10049.exe (PID: 6800)
- Unicorn-7828.exe (PID: 1764)
- Unicorn-21979.exe (PID: 5384)
- Unicorn-64303.exe (PID: 5436)
- Unicorn-4491.exe (PID: 6872)
- Unicorn-42722.exe (PID: 4980)
- Unicorn-31093.exe (PID: 7244)
- Unicorn-10480.exe (PID: 7260)
- Unicorn-39815.exe (PID: 7272)
- Unicorn-37023.exe (PID: 7284)
- Unicorn-34601.exe (PID: 7316)
- Unicorn-26987.exe (PID: 7332)
- Unicorn-42769.exe (PID: 7324)
- Unicorn-26168.exe (PID: 7344)
- Unicorn-57133.exe (PID: 7416)
- Unicorn-61503.exe (PID: 2984)
- Unicorn-319.exe (PID: 7444)
- Unicorn-35758.exe (PID: 7436)
- Unicorn-7740.exe (PID: 7456)
- Unicorn-62871.exe (PID: 7532)
- Unicorn-20652.exe (PID: 7828)
- Unicorn-50501.exe (PID: 7788)
- Unicorn-16101.exe (PID: 7404)
- Unicorn-786.exe (PID: 7820)
- Unicorn-36883.exe (PID: 7576)
- Unicorn-32245.exe (PID: 7516)
- Unicorn-30198.exe (PID: 7488)
- Unicorn-56749.exe (PID: 7544)
- Unicorn-56941.exe (PID: 7468)
- Unicorn-42717.exe (PID: 8008)
- Unicorn-63956.exe (PID: 7584)
- Unicorn-24077.exe (PID: 7508)
- Unicorn-38175.exe (PID: 7568)
- Unicorn-32141.exe (PID: 7892)
- Unicorn-49349.exe (PID: 7688)
- Unicorn-36905.exe (PID: 7740)
- Unicorn-13147.exe (PID: 7696)
- Unicorn-44497.exe (PID: 7496)
- Unicorn-17829.exe (PID: 8048)
- Unicorn-12379.exe (PID: 7524)
- Unicorn-18403.exe (PID: 8064)
- Unicorn-28087.exe (PID: 8072)
- Unicorn-4699.exe (PID: 2644)
- Unicorn-53262.exe (PID: 5304)
- Unicorn-49541.exe (PID: 7632)
- Unicorn-24927.exe (PID: 8244)
- Unicorn-30827.exe (PID: 8036)
- Unicorn-47590.exe (PID: 8432)
- Unicorn-64652.exe (PID: 7552)
- Unicorn-64599.exe (PID: 7860)
- Unicorn-30774.exe (PID: 7748)
- Unicorn-6758.exe (PID: 8360)
- Unicorn-48892.exe (PID: 7756)
- Unicorn-8103.exe (PID: 7592)
- Unicorn-7475.exe (PID: 8092)
- Unicorn-17445.exe (PID: 7904)
- Unicorn-31123.exe (PID: 8404)
- Unicorn-50096.exe (PID: 7648)
- Unicorn-13360.exe (PID: 7876)
- Unicorn-16485.exe (PID: 7720)
- Unicorn-31019.exe (PID: 8016)
- Unicorn-32541.exe (PID: 6972)
- Unicorn-40221.exe (PID: 7560)
- Unicorn-47761.exe (PID: 8084)
- Unicorn-19202.exe (PID: 8320)
- Unicorn-33811.exe (PID: 8984)
- Unicorn-41233.exe (PID: 9008)
- Unicorn-35421.exe (PID: 8476)
- Unicorn-58124.exe (PID: 9052)
- Unicorn-39291.exe (PID: 8416)
- Unicorn-14450.exe (PID: 6112)
- Unicorn-5467.exe (PID: 8336)
- Unicorn-53921.exe (PID: 8352)
- Unicorn-60236.exe (PID: 8632)
- Unicorn-29482.exe (PID: 8708)
- Unicorn-392.exe (PID: 8972)
- Unicorn-65038.exe (PID: 8740)
- Unicorn-51439.exe (PID: 9076)
- Unicorn-60885.exe (PID: 8848)
- Unicorn-1980.exe (PID: 8536)
- Unicorn-57548.exe (PID: 8816)
- Unicorn-1316.exe (PID: 9152)
- Unicorn-37969.exe (PID: 8344)
- Unicorn-22134.exe (PID: 8140)
- Unicorn-39536.exe (PID: 9316)
- Unicorn-17829.exe (PID: 8056)
- Unicorn-24513.exe (PID: 8776)
- Unicorn-26677.exe (PID: 8548)
- Unicorn-35156.exe (PID: 8484)
- Unicorn-63241.exe (PID: 8396)
- Unicorn-1456.exe (PID: 9952)
- Unicorn-11160.exe (PID: 10140)
- Unicorn-15576.exe (PID: 8596)
- Unicorn-58145.exe (PID: 8888)
- Unicorn-32659.exe (PID: 8580)
- Unicorn-3791.exe (PID: 9240)
- Unicorn-41425.exe (PID: 8944)
- Unicorn-35348.exe (PID: 8692)
- Unicorn-10126.exe (PID: 9440)
- Unicorn-19573.exe (PID: 9260)
- Unicorn-37703.exe (PID: 9068)
- Unicorn-55488.exe (PID: 9384)
- Unicorn-62961.exe (PID: 9108)
- Unicorn-51861.exe (PID: 9348)
- Unicorn-19869.exe (PID: 10232)
- Unicorn-30046.exe (PID: 10152)
- Unicorn-9874.exe (PID: 8156)
- Unicorn-50709.exe (PID: 9120)
- Unicorn-53707.exe (PID: 9400)
- Unicorn-35887.exe (PID: 9408)
- Unicorn-50849.exe (PID: 9924)
- Unicorn-21389.exe (PID: 8860)
- Unicorn-37777.exe (PID: 8272)
- Unicorn-59924.exe (PID: 8560)
- Unicorn-61461.exe (PID: 8752)
- Unicorn-4698.exe (PID: 9368)
- Unicorn-60517.exe (PID: 2316)
- Unicorn-1648.exe (PID: 9916)
- Unicorn-9432.exe (PID: 9692)
- Unicorn-52909.exe (PID: 8828)
- Unicorn-42363.exe (PID: 8880)
- Unicorn-43619.exe (PID: 9800)
- Unicorn-12032.exe (PID: 11312)
- Unicorn-28369.exe (PID: 6852)
- Unicorn-52873.exe (PID: 11296)
- Unicorn-54933.exe (PID: 9932)
- Unicorn-25333.exe (PID: 8328)
- Unicorn-62577.exe (PID: 9188)
- Unicorn-15747.exe (PID: 8700)
- Unicorn-34527.exe (PID: 7972)
- Unicorn-19882.exe (PID: 9128)
- Unicorn-16553.exe (PID: 10284)
- Unicorn-40023.exe (PID: 10704)
- Unicorn-45509.exe (PID: 8952)
- Unicorn-10179.exe (PID: 9648)
- Unicorn-12239.exe (PID: 5400)
- Unicorn-56780.exe (PID: 8672)
- Unicorn-268.exe (PID: 12604)
- Unicorn-15554.exe (PID: 9700)
- Unicorn-50024.exe (PID: 12640)
- Unicorn-25327.exe (PID: 12620)
- Unicorn-58261.exe (PID: 9180)
- Unicorn-13692.exe (PID: 8800)
- Unicorn-22099.exe (PID: 5084)
- Unicorn-20074.exe (PID: 9088)
- Unicorn-49623.exe (PID: 9416)
- Unicorn-64585.exe (PID: 8608)
- Unicorn-56447.exe (PID: 9196)
- Unicorn-584.exe (PID: 8912)
- Unicorn-21959.exe (PID: 13416)
- Unicorn-33111.exe (PID: 12524)
- Unicorn-5379.exe (PID: 11388)
- Unicorn-49936.exe (PID: 13740)
- Unicorn-24279.exe (PID: 13804)
- Unicorn-9131.exe (PID: 2084)
- Unicorn-43205.exe (PID: 8524)
- Unicorn-3215.exe (PID: 9356)
- Unicorn-35643.exe (PID: 10196)
- Unicorn-30481.exe (PID: 9228)
- Unicorn-17269.exe (PID: 11360)
- Unicorn-8711.exe (PID: 13812)
- Unicorn-46823.exe (PID: 9376)
- Unicorn-39675.exe (PID: 9768)
- Unicorn-45103.exe (PID: 9820)
- Unicorn-63205.exe (PID: 10596)
- Unicorn-22313.exe (PID: 9220)
- Unicorn-53205.exe (PID: 9632)
INFO
Reads the computer name
- 1 (125).exe (PID: 7012)
- Unicorn-16905.exe (PID: 668)
- Unicorn-9291.exe (PID: 5116)
- Unicorn-39629.exe (PID: 4040)
- Unicorn-62649.exe (PID: 4400)
- Unicorn-64688.exe (PID: 5364)
- Unicorn-31269.exe (PID: 4112)
- Unicorn-25138.exe (PID: 7084)
- Unicorn-18270.exe (PID: 3008)
- Unicorn-2104.exe (PID: 856)
- Unicorn-9992.exe (PID: 1388)
- Unicorn-3862.exe (PID: 5596)
- Unicorn-10604.exe (PID: 2108)
- Unicorn-22053.exe (PID: 2420)
- Unicorn-3256.exe (PID: 1188)
- Unicorn-63360.exe (PID: 4724)
- Unicorn-40479.exe (PID: 1184)
- Unicorn-41954.exe (PID: 5392)
- Unicorn-2082.exe (PID: 920)
- Unicorn-10049.exe (PID: 6800)
- Unicorn-36609.exe (PID: 6576)
- Unicorn-21979.exe (PID: 5384)
- Unicorn-45389.exe (PID: 6388)
- Unicorn-64303.exe (PID: 5436)
- Unicorn-4491.exe (PID: 6872)
- Unicorn-61503.exe (PID: 2984)
- Unicorn-39815.exe (PID: 7272)
- Unicorn-37023.exe (PID: 7284)
- Unicorn-31093.exe (PID: 7244)
- Unicorn-34601.exe (PID: 7316)
- Unicorn-26987.exe (PID: 7332)
- Unicorn-26168.exe (PID: 7344)
- Unicorn-42769.exe (PID: 7324)
- Unicorn-57133.exe (PID: 7416)
- Unicorn-319.exe (PID: 7444)
- Unicorn-16101.exe (PID: 7404)
- Unicorn-7740.exe (PID: 7456)
- Unicorn-62871.exe (PID: 7532)
- Unicorn-50501.exe (PID: 7788)
- Unicorn-786.exe (PID: 7820)
- Unicorn-30198.exe (PID: 7488)
- Unicorn-56941.exe (PID: 7468)
- Unicorn-56749.exe (PID: 7544)
- Unicorn-42717.exe (PID: 8008)
- Unicorn-63956.exe (PID: 7584)
- Unicorn-64599.exe (PID: 7860)
- Unicorn-32141.exe (PID: 7892)
- Unicorn-38175.exe (PID: 7568)
- Unicorn-49349.exe (PID: 7688)
- Unicorn-36905.exe (PID: 7740)
- Unicorn-40221.exe (PID: 7560)
- Unicorn-17829.exe (PID: 8048)
- Unicorn-18403.exe (PID: 8064)
- Unicorn-16485.exe (PID: 7720)
- Unicorn-49541.exe (PID: 7632)
- Unicorn-28087.exe (PID: 8072)
- Unicorn-53262.exe (PID: 5304)
- Unicorn-4699.exe (PID: 2644)
- Unicorn-24927.exe (PID: 8244)
- Unicorn-47590.exe (PID: 8432)
- Unicorn-25333.exe (PID: 8328)
- Unicorn-64652.exe (PID: 7552)
- Unicorn-12379.exe (PID: 7524)
- Unicorn-6758.exe (PID: 8360)
- Unicorn-48892.exe (PID: 7756)
- Unicorn-7475.exe (PID: 8092)
- Unicorn-34527.exe (PID: 7972)
- Unicorn-31123.exe (PID: 8404)
- Unicorn-50096.exe (PID: 7648)
- Unicorn-13360.exe (PID: 7876)
- Unicorn-47761.exe (PID: 8084)
- Unicorn-53921.exe (PID: 8352)
- Unicorn-31019.exe (PID: 8016)
- Unicorn-32541.exe (PID: 6972)
- Unicorn-5467.exe (PID: 8336)
- Unicorn-33811.exe (PID: 8984)
- Unicorn-41233.exe (PID: 9008)
- Unicorn-39291.exe (PID: 8416)
- Unicorn-60885.exe (PID: 8848)
- Unicorn-64585.exe (PID: 8608)
- Unicorn-60236.exe (PID: 8632)
- Unicorn-29482.exe (PID: 8708)
- Unicorn-35348.exe (PID: 8692)
- Unicorn-22134.exe (PID: 8140)
- Unicorn-1980.exe (PID: 8536)
- Unicorn-65038.exe (PID: 8740)
- Unicorn-51439.exe (PID: 9076)
- Unicorn-26677.exe (PID: 8548)
- Unicorn-24513.exe (PID: 8776)
- Unicorn-57548.exe (PID: 8816)
- Unicorn-63241.exe (PID: 8396)
- Unicorn-39536.exe (PID: 9316)
- Unicorn-17829.exe (PID: 8056)
- Unicorn-1456.exe (PID: 9952)
- Unicorn-58145.exe (PID: 8888)
- Unicorn-15576.exe (PID: 8596)
- Unicorn-32659.exe (PID: 8580)
- Unicorn-3791.exe (PID: 9240)
- Unicorn-41425.exe (PID: 8944)
- Unicorn-55488.exe (PID: 9384)
- Unicorn-10126.exe (PID: 9440)
- Unicorn-21389.exe (PID: 8860)
- Unicorn-37703.exe (PID: 9068)
- Unicorn-9432.exe (PID: 9692)
- Unicorn-62961.exe (PID: 9108)
- Unicorn-50709.exe (PID: 9120)
- Unicorn-19869.exe (PID: 10232)
- Unicorn-53707.exe (PID: 9400)
- Unicorn-37777.exe (PID: 8272)
- Unicorn-1648.exe (PID: 9916)
- Unicorn-35887.exe (PID: 9408)
- Unicorn-60517.exe (PID: 2316)
- Unicorn-43619.exe (PID: 9800)
- Unicorn-4698.exe (PID: 9368)
- Unicorn-61461.exe (PID: 8752)
- Unicorn-42363.exe (PID: 8880)
- Unicorn-54933.exe (PID: 9932)
- Unicorn-15747.exe (PID: 8700)
- Unicorn-62577.exe (PID: 9188)
- Unicorn-16553.exe (PID: 10284)
- Unicorn-40023.exe (PID: 10704)
- Unicorn-58261.exe (PID: 9180)
- Unicorn-25327.exe (PID: 12620)
- Unicorn-50024.exe (PID: 12640)
- Unicorn-49623.exe (PID: 9416)
- Unicorn-5379.exe (PID: 11388)
- Unicorn-53205.exe (PID: 9632)
- Unicorn-43205.exe (PID: 8524)
- Unicorn-33111.exe (PID: 12524)
- Unicorn-63205.exe (PID: 10596)
- Unicorn-46823.exe (PID: 9376)
- Unicorn-584.exe (PID: 8912)
- Unicorn-52437.exe (PID: 9536)
- Unicorn-55756.exe (PID: 2908)
- Unicorn-55701.exe (PID: 10396)
- Unicorn-53323.exe (PID: 4784)
- Unicorn-10011.exe (PID: 2140)
- Unicorn-55753.exe (PID: 9392)
The sample compiled with chinese language support
- 1 (125).exe (PID: 7012)
- Unicorn-3859.exe (PID: 13536)
- Unicorn-15576.exe (PID: 8596)
- Unicorn-42363.exe (PID: 8880)
- Unicorn-64652.exe (PID: 7552)
- Unicorn-45103.exe (PID: 9820)
- Unicorn-18270.exe (PID: 3008)
- Unicorn-10179.exe (PID: 9648)
- Unicorn-39629.exe (PID: 4040)
- Unicorn-17269.exe (PID: 11360)
- Unicorn-3256.exe (PID: 1188)
- Unicorn-7828.exe (PID: 1764)
- Unicorn-53707.exe (PID: 9400)
- Unicorn-36609.exe (PID: 6576)
- Unicorn-39675.exe (PID: 9768)
- Unicorn-58124.exe (PID: 9052)
- Unicorn-32541.exe (PID: 6972)
- Unicorn-17829.exe (PID: 8056)
Checks supported languages
- 1 (125).exe (PID: 7012)
- Unicorn-62649.exe (PID: 4400)
- Unicorn-16905.exe (PID: 668)
- Unicorn-9291.exe (PID: 5116)
- Unicorn-39629.exe (PID: 4040)
- Unicorn-31269.exe (PID: 4112)
- Unicorn-64688.exe (PID: 5364)
- Unicorn-18270.exe (PID: 3008)
- Unicorn-2104.exe (PID: 856)
- Unicorn-25138.exe (PID: 7084)
- Unicorn-3862.exe (PID: 5596)
- Unicorn-9992.exe (PID: 1388)
- Unicorn-22053.exe (PID: 2420)
- Unicorn-10604.exe (PID: 2108)
- Unicorn-3256.exe (PID: 1188)
- Unicorn-40479.exe (PID: 1184)
- Unicorn-63360.exe (PID: 4724)
- Unicorn-2082.exe (PID: 920)
- Unicorn-45389.exe (PID: 6388)
- Unicorn-4491.exe (PID: 6872)
- Unicorn-7828.exe (PID: 1764)
- Unicorn-57584.exe (PID: 5228)
- Unicorn-42722.exe (PID: 4980)
- Unicorn-21979.exe (PID: 5384)
- Unicorn-64303.exe (PID: 5436)
- Unicorn-10480.exe (PID: 7260)
- Unicorn-39815.exe (PID: 7272)
- Unicorn-37023.exe (PID: 7284)
- Unicorn-34601.exe (PID: 7316)
- Unicorn-42769.exe (PID: 7324)
- Unicorn-26987.exe (PID: 7332)
- Unicorn-26168.exe (PID: 7344)
- Unicorn-16101.exe (PID: 7404)
- Unicorn-319.exe (PID: 7444)
- Unicorn-35758.exe (PID: 7436)
- Unicorn-7740.exe (PID: 7456)
- Unicorn-10049.exe (PID: 6800)
- Unicorn-44497.exe (PID: 7496)
- Unicorn-30198.exe (PID: 7488)
- Unicorn-12379.exe (PID: 7524)
- Unicorn-24077.exe (PID: 7508)
- Unicorn-64652.exe (PID: 7552)
- Unicorn-32245.exe (PID: 7516)
- Unicorn-56941.exe (PID: 7468)
- Unicorn-40221.exe (PID: 7560)
- Unicorn-38175.exe (PID: 7568)
- Unicorn-8103.exe (PID: 7592)
- Unicorn-50096.exe (PID: 7648)
- Unicorn-36883.exe (PID: 7576)
- Unicorn-50501.exe (PID: 7788)
- Unicorn-16485.exe (PID: 7720)
- Unicorn-786.exe (PID: 7820)
- Unicorn-20652.exe (PID: 7828)
- Unicorn-30774.exe (PID: 7748)
- Unicorn-13147.exe (PID: 7696)
- Unicorn-13360.exe (PID: 7876)
- Unicorn-32141.exe (PID: 7892)
- Unicorn-34527.exe (PID: 7972)
- Unicorn-48892.exe (PID: 7756)
- Unicorn-64599.exe (PID: 7860)
- Unicorn-17445.exe (PID: 7904)
- Unicorn-42717.exe (PID: 8008)
- Unicorn-31019.exe (PID: 8016)
- Unicorn-30827.exe (PID: 8036)
- Unicorn-18403.exe (PID: 8064)
- Unicorn-28087.exe (PID: 8072)
- Unicorn-17829.exe (PID: 8056)
- Unicorn-7475.exe (PID: 8092)
- Unicorn-22134.exe (PID: 8140)
- Unicorn-47761.exe (PID: 8084)
- Unicorn-53262.exe (PID: 5304)
- Unicorn-12239.exe (PID: 5400)
- Unicorn-14450.exe (PID: 6112)
- Unicorn-24927.exe (PID: 8244)
- Unicorn-32541.exe (PID: 6972)
- Unicorn-37777.exe (PID: 8272)
- Unicorn-19202.exe (PID: 8320)
- Unicorn-4699.exe (PID: 2644)
- Unicorn-25333.exe (PID: 8328)
- Unicorn-5467.exe (PID: 8336)
- Unicorn-6758.exe (PID: 8360)
- Unicorn-31123.exe (PID: 8404)
- Unicorn-63241.exe (PID: 8396)
- Unicorn-47590.exe (PID: 8432)
- Unicorn-37969.exe (PID: 8344)
- Unicorn-35156.exe (PID: 8484)
- Unicorn-1980.exe (PID: 8536)
- Unicorn-26677.exe (PID: 8548)
- Unicorn-59924.exe (PID: 8560)
- Unicorn-35421.exe (PID: 8476)
- Unicorn-32541.exe (PID: 1132)
- Unicorn-35348.exe (PID: 8692)
- Unicorn-15747.exe (PID: 8700)
- Unicorn-29482.exe (PID: 8708)
- Unicorn-43205.exe (PID: 8524)
- Unicorn-33811.exe (PID: 8984)
- Unicorn-65038.exe (PID: 8740)
- Unicorn-41233.exe (PID: 9008)
- Unicorn-24513.exe (PID: 8776)
- Unicorn-61461.exe (PID: 8752)
- Unicorn-13692.exe (PID: 8800)
- Unicorn-58124.exe (PID: 9052)
- Unicorn-57548.exe (PID: 8816)
- Unicorn-52909.exe (PID: 8828)
- Unicorn-60885.exe (PID: 8848)
- Unicorn-21389.exe (PID: 8860)
- Unicorn-42363.exe (PID: 8880)
- Unicorn-584.exe (PID: 8912)
- Unicorn-41425.exe (PID: 8944)
- Unicorn-45509.exe (PID: 8952)
- Unicorn-37703.exe (PID: 9068)
- Unicorn-51439.exe (PID: 9076)
- Unicorn-5784.exe (PID: 9096)
- Unicorn-20074.exe (PID: 9088)
- Unicorn-62961.exe (PID: 9108)
- Unicorn-1316.exe (PID: 9152)
- Unicorn-56447.exe (PID: 9196)
- Unicorn-46604.exe (PID: 8312)
- Unicorn-62577.exe (PID: 9188)
- Unicorn-9874.exe (PID: 8156)
- Unicorn-30865.exe (PID: 8168)
- Unicorn-34949.exe (PID: 8188)
- Unicorn-17461.exe (PID: 7356)
- Unicorn-22099.exe (PID: 5084)
- Unicorn-34757.exe (PID: 2100)
- Unicorn-22313.exe (PID: 9220)
- Unicorn-3791.exe (PID: 9240)
- Unicorn-53323.exe (PID: 4784)
- Unicorn-19882.exe (PID: 9128)
- Unicorn-47969.exe (PID: 9328)
- Unicorn-64305.exe (PID: 9300)
- Unicorn-19935.exe (PID: 9308)
- Unicorn-39536.exe (PID: 9316)
- Unicorn-58261.exe (PID: 9180)
- Unicorn-42711.exe (PID: 9172)
- Unicorn-53707.exe (PID: 9400)
- Unicorn-10126.exe (PID: 9440)
- Unicorn-4698.exe (PID: 9368)
- Unicorn-46823.exe (PID: 9376)
- Unicorn-55488.exe (PID: 9384)
- Unicorn-49623.exe (PID: 9416)
- Unicorn-1456.exe (PID: 9952)
- Unicorn-10179.exe (PID: 9648)
- Unicorn-53205.exe (PID: 9632)
- Unicorn-44335.exe (PID: 9676)
- Unicorn-15554.exe (PID: 9700)
- Unicorn-64179.exe (PID: 9760)
- Unicorn-39675.exe (PID: 9768)
- Unicorn-43619.exe (PID: 9800)
- Unicorn-45103.exe (PID: 9820)
- Unicorn-5924.exe (PID: 9856)
- Unicorn-58996.exe (PID: 9724)
- Unicorn-34513.exe (PID: 9884)
- Unicorn-9432.exe (PID: 9692)
- Unicorn-48280.exe (PID: 10164)
- Unicorn-39365.exe (PID: 10172)
- Unicorn-19677.exe (PID: 3272)
- Unicorn-60517.exe (PID: 2316)
- Unicorn-7232.exe (PID: 1748)
- Unicorn-56988.exe (PID: 6708)
- Unicorn-28732.exe (PID: 10248)
- Unicorn-41419.exe (PID: 10372)
- Unicorn-9131.exe (PID: 2084)
- Unicorn-56631.exe (PID: 10332)
- Unicorn-20066.exe (PID: 10256)
- Unicorn-6338.exe (PID: 10316)
- Unicorn-42903.exe (PID: 10356)
- Unicorn-58353.exe (PID: 10456)
- Unicorn-58088.exe (PID: 10468)
- Unicorn-52276.exe (PID: 10728)
- Unicorn-45485.exe (PID: 10516)
- Unicorn-55701.exe (PID: 10396)
- Unicorn-48405.exe (PID: 10864)
- Unicorn-7298.exe (PID: 10448)
- Unicorn-22837.exe (PID: 10412)
- Unicorn-10496.exe (PID: 10760)
- Unicorn-3538.exe (PID: 10308)
- Unicorn-54933.exe (PID: 9932)
- Unicorn-10091.exe (PID: 10656)
- Unicorn-51145.exe (PID: 10820)
- Unicorn-2136.exe (PID: 10808)
- Unicorn-55530.exe (PID: 10668)
- Unicorn-19485.exe (PID: 6488)
- Unicorn-40023.exe (PID: 10704)
- Unicorn-47445.exe (PID: 10752)
- Unicorn-14943.exe (PID: 10848)
- Unicorn-29167.exe (PID: 10364)
- Unicorn-3267.exe (PID: 10680)
- Unicorn-24544.exe (PID: 9580)
- Unicorn-9131.exe (PID: 5680)
- Unicorn-12203.exe (PID: 10300)
- Unicorn-3236.exe (PID: 9516)
- Unicorn-40185.exe (PID: 9524)
- Unicorn-28369.exe (PID: 6852)
- Unicorn-52873.exe (PID: 11296)
- Unicorn-12032.exe (PID: 11312)
- Unicorn-53781.exe (PID: 9560)
- Unicorn-63205.exe (PID: 10596)
- Unicorn-23953.exe (PID: 10224)
- Unicorn-6583.exe (PID: 10588)
- Unicorn-52437.exe (PID: 9536)
- Unicorn-16553.exe (PID: 10284)
- Unicorn-62821.exe (PID: 10624)
- Unicorn-38507.exe (PID: 10712)
- Unicorn-37554.exe (PID: 10640)
- Unicorn-53833.exe (PID: 11408)
- Unicorn-4632.exe (PID: 11508)
- Unicorn-33605.exe (PID: 11352)
- Unicorn-55997.exe (PID: 11152)
- Unicorn-41581.exe (PID: 11432)
- Unicorn-30253.exe (PID: 11704)
- Unicorn-24477.exe (PID: 11252)
- Unicorn-51913.exe (PID: 11144)
- Unicorn-53641.exe (PID: 11540)
- Unicorn-9640.exe (PID: 11716)
- Unicorn-26706.exe (PID: 11180)
- Unicorn-11074.exe (PID: 11224)
- Unicorn-17269.exe (PID: 11360)
- Unicorn-40267.exe (PID: 11744)
- Unicorn-48768.exe (PID: 10348)
- Unicorn-30231.exe (PID: 12056)
- Unicorn-61617.exe (PID: 11604)
- Unicorn-63309.exe (PID: 12160)
- Unicorn-32319.exe (PID: 12148)
- Unicorn-30423.exe (PID: 12140)
- Unicorn-62332.exe (PID: 12168)
- Unicorn-10963.exe (PID: 12112)
- Unicorn-59972.exe (PID: 12132)
- Unicorn-41551.exe (PID: 11768)
- Unicorn-30615.exe (PID: 11776)
- Unicorn-26531.exe (PID: 11728)
- Unicorn-50216.exe (PID: 11760)
- Unicorn-5379.exe (PID: 11388)
- Unicorn-268.exe (PID: 12604)
- Unicorn-50024.exe (PID: 12640)
- Unicorn-25327.exe (PID: 12620)
- Unicorn-14107.exe (PID: 11500)
- Unicorn-5622.exe (PID: 12392)
- Unicorn-37195.exe (PID: 12364)
- Unicorn-37195.exe (PID: 12348)
- Unicorn-19350.exe (PID: 12400)
- Unicorn-58576.exe (PID: 12456)
- Unicorn-61124.exe (PID: 12424)
- Unicorn-6774.exe (PID: 12464)
- Unicorn-64077.exe (PID: 11484)
- Unicorn-56796.exe (PID: 12356)
- Unicorn-52712.exe (PID: 12416)
- Unicorn-45577.exe (PID: 12492)
- Unicorn-35851.exe (PID: 11524)
- Unicorn-33442.exe (PID: 11496)
- Unicorn-6774.exe (PID: 12472)
- Unicorn-46013.exe (PID: 12048)
- Unicorn-29241.exe (PID: 12508)
- Unicorn-19707.exe (PID: 11464)
- Unicorn-29241.exe (PID: 12512)
- Unicorn-65265.exe (PID: 13024)
- Unicorn-65265.exe (PID: 13016)
- Unicorn-10663.exe (PID: 12988)
- Unicorn-5238.exe (PID: 12536)
- Unicorn-33111.exe (PID: 12524)
- Unicorn-13162.exe (PID: 13208)
- Unicorn-11818.exe (PID: 13152)
- Unicorn-1591.exe (PID: 13128)
- Unicorn-58789.exe (PID: 13188)
- Unicorn-50356.exe (PID: 13180)
- Unicorn-27269.exe (PID: 13244)
- Unicorn-10362.exe (PID: 13216)
- Unicorn-65265.exe (PID: 13000)
- Unicorn-19218.exe (PID: 13260)
- Unicorn-49936.exe (PID: 13740)
- Unicorn-8711.exe (PID: 13812)
- Unicorn-4139.exe (PID: 12820)
- Unicorn-46272.exe (PID: 13172)
- Unicorn-579.exe (PID: 13052)
- Unicorn-19218.exe (PID: 13284)
- Unicorn-61019.exe (PID: 13160)
- Unicorn-3688.exe (PID: 13444)
- Unicorn-53672.exe (PID: 13428)
- Unicorn-57336.exe (PID: 13492)
- Unicorn-47807.exe (PID: 13516)
- Unicorn-3859.exe (PID: 13536)
- Unicorn-46183.exe (PID: 13552)
- Unicorn-18119.exe (PID: 13276)
- Unicorn-58296.exe (PID: 13572)
- Unicorn-9183.exe (PID: 13136)
- Unicorn-32447.exe (PID: 13560)
- Unicorn-25733.exe (PID: 12808)
- Unicorn-15326.exe (PID: 12968)
- Unicorn-35607.exe (PID: 14868)
- Unicorn-4980.exe (PID: 14876)
- Unicorn-61965.exe (PID: 14944)
- Unicorn-11102.exe (PID: 14856)
- Unicorn-36501.exe (PID: 14772)
- Unicorn-7699.exe (PID: 14532)
- Unicorn-61389.exe (PID: 14732)
- Unicorn-35733.exe (PID: 14548)
- Unicorn-39935.exe (PID: 14020)
- Unicorn-34314.exe (PID: 14168)
- Unicorn-44840.exe (PID: 14496)
- Unicorn-48104.exe (PID: 14464)
- Unicorn-19255.exe (PID: 13880)
- Unicorn-24612.exe (PID: 13724)
- Unicorn-21347.exe (PID: 13700)
- Unicorn-27106.exe (PID: 14248)
- Unicorn-26029.exe (PID: 14320)
- Unicorn-57336.exe (PID: 14116)
- Unicorn-31190.exe (PID: 14232)
- Unicorn-7616.exe (PID: 14264)
- Unicorn-35687.exe (PID: 8200)
- Unicorn-34005.exe (PID: 14340)
- Unicorn-17542.exe (PID: 14508)
- Unicorn-41211.exe (PID: 14012)
- Unicorn-64705.exe (PID: 14488)
- Unicorn-8519.exe (PID: 13900)
- Unicorn-34773.exe (PID: 14448)
- Unicorn-55503.exe (PID: 13848)
- Unicorn-58296.exe (PID: 13604)
- Unicorn-56345.exe (PID: 14520)
- Unicorn-22135.exe (PID: 14352)
- Unicorn-55756.exe (PID: 2908)
- Unicorn-31251.exe (PID: 15372)
- Unicorn-45589.exe (PID: 14884)
- Unicorn-59872.exe (PID: 14892)
- Unicorn-16687.exe (PID: 13888)
- Unicorn-54491.exe (PID: 14480)
- Unicorn-38591.exe (PID: 13872)
- Unicorn-6494.exe (PID: 13708)
- Unicorn-3694.exe (PID: 13732)
- Unicorn-14662.exe (PID: 13716)
- Unicorn-20475.exe (PID: 14960)
- Unicorn-37579.exe (PID: 14600)
- Unicorn-54980.exe (PID: 13916)
- Unicorn-51096.exe (PID: 15232)
- Unicorn-12359.exe (PID: 13580)
- Unicorn-58296.exe (PID: 13644)
Create files in a temporary directory
- Unicorn-16905.exe (PID: 668)
- 1 (125).exe (PID: 7012)
- Unicorn-62649.exe (PID: 4400)
- Unicorn-39629.exe (PID: 4040)
- Unicorn-64688.exe (PID: 5364)
- Unicorn-31269.exe (PID: 4112)
- Unicorn-9291.exe (PID: 5116)
- Unicorn-18270.exe (PID: 3008)
- Unicorn-2104.exe (PID: 856)
- Unicorn-9992.exe (PID: 1388)
- Unicorn-3862.exe (PID: 5596)
- Unicorn-63360.exe (PID: 4724)
- Unicorn-57584.exe (PID: 5228)
- Unicorn-21979.exe (PID: 5384)
- Unicorn-10049.exe (PID: 6800)
- Unicorn-25138.exe (PID: 7084)
- Unicorn-22053.exe (PID: 2420)
- Unicorn-64303.exe (PID: 5436)
- Unicorn-40479.exe (PID: 1184)
- Unicorn-34601.exe (PID: 7316)
- Unicorn-26987.exe (PID: 7332)
- Unicorn-41954.exe (PID: 5392)
- Unicorn-42769.exe (PID: 7324)
- Unicorn-2082.exe (PID: 920)
- Unicorn-36609.exe (PID: 6576)
- Unicorn-61503.exe (PID: 2984)
- Unicorn-7740.exe (PID: 7456)
- Unicorn-10604.exe (PID: 2108)
- Unicorn-50501.exe (PID: 7788)
- Unicorn-32245.exe (PID: 7516)
- Unicorn-30198.exe (PID: 7488)
- Unicorn-56941.exe (PID: 7468)
- Unicorn-4491.exe (PID: 6872)
- Unicorn-63956.exe (PID: 7584)
- Unicorn-64599.exe (PID: 7860)
- Unicorn-30827.exe (PID: 8036)
- Unicorn-36905.exe (PID: 7740)
- Unicorn-10480.exe (PID: 7260)
- Unicorn-13147.exe (PID: 7696)
- Unicorn-57133.exe (PID: 7416)
- Unicorn-44497.exe (PID: 7496)
- Unicorn-7828.exe (PID: 1764)
- Unicorn-17829.exe (PID: 8048)
- Unicorn-12379.exe (PID: 7524)
- Unicorn-4699.exe (PID: 2644)
- Unicorn-53262.exe (PID: 5304)
- Unicorn-49541.exe (PID: 7632)
- Unicorn-24927.exe (PID: 8244)
- Unicorn-16101.exe (PID: 7404)
- Unicorn-25333.exe (PID: 8328)
- Unicorn-47590.exe (PID: 8432)
- Unicorn-30774.exe (PID: 7748)
- Unicorn-64652.exe (PID: 7552)
- Unicorn-45389.exe (PID: 6388)
- Unicorn-39815.exe (PID: 7272)
- Unicorn-48892.exe (PID: 7756)
- Unicorn-42717.exe (PID: 8008)
- Unicorn-62871.exe (PID: 7532)
- Unicorn-8103.exe (PID: 7592)
- Unicorn-7475.exe (PID: 8092)
- Unicorn-3256.exe (PID: 1188)
- Unicorn-34527.exe (PID: 7972)
- Unicorn-16485.exe (PID: 7720)
- Unicorn-31093.exe (PID: 7244)
- Unicorn-32541.exe (PID: 6972)
- Unicorn-36883.exe (PID: 7576)
- Unicorn-47761.exe (PID: 8084)
- Unicorn-40221.exe (PID: 7560)
- Unicorn-31019.exe (PID: 8016)
- Unicorn-19202.exe (PID: 8320)
- Unicorn-33811.exe (PID: 8984)
- Unicorn-35421.exe (PID: 8476)
- Unicorn-786.exe (PID: 7820)
- Unicorn-58124.exe (PID: 9052)
- Unicorn-39291.exe (PID: 8416)
- Unicorn-14450.exe (PID: 6112)
- Unicorn-35758.exe (PID: 7436)
- Unicorn-60236.exe (PID: 8632)
- Unicorn-5467.exe (PID: 8336)
- Unicorn-29482.exe (PID: 8708)
- Unicorn-65038.exe (PID: 8740)
- Unicorn-24513.exe (PID: 8776)
- Unicorn-26677.exe (PID: 8548)
- Unicorn-35348.exe (PID: 8692)
- Unicorn-32141.exe (PID: 7892)
- Unicorn-57548.exe (PID: 8816)
- Unicorn-1316.exe (PID: 9152)
- Unicorn-37969.exe (PID: 8344)
- Unicorn-22134.exe (PID: 8140)
- Unicorn-17829.exe (PID: 8056)
- Unicorn-319.exe (PID: 7444)
- Unicorn-12239.exe (PID: 5400)
- Unicorn-64585.exe (PID: 8608)
- Unicorn-11160.exe (PID: 10140)
- Unicorn-392.exe (PID: 8972)
- Unicorn-49349.exe (PID: 7688)
- Unicorn-1456.exe (PID: 9952)
- Unicorn-15576.exe (PID: 8596)
- Unicorn-24077.exe (PID: 7508)
- Unicorn-58145.exe (PID: 8888)
- Unicorn-32659.exe (PID: 8580)
- Unicorn-18403.exe (PID: 8064)
- Unicorn-3791.exe (PID: 9240)
- Unicorn-10126.exe (PID: 9440)
- Unicorn-19573.exe (PID: 9260)
- Unicorn-41425.exe (PID: 8944)
- Unicorn-37703.exe (PID: 9068)
- Unicorn-52909.exe (PID: 8828)
- Unicorn-56749.exe (PID: 7544)
- Unicorn-62961.exe (PID: 9108)
- Unicorn-51861.exe (PID: 9348)
- Unicorn-19869.exe (PID: 10232)
- Unicorn-53707.exe (PID: 9400)
- Unicorn-21389.exe (PID: 8860)
- Unicorn-35887.exe (PID: 9408)
- Unicorn-37777.exe (PID: 8272)
- Unicorn-50849.exe (PID: 9924)
- Unicorn-1648.exe (PID: 9916)
- Unicorn-59924.exe (PID: 8560)
- Unicorn-50096.exe (PID: 7648)
- Unicorn-4698.exe (PID: 9368)
- Unicorn-60517.exe (PID: 2316)
- Unicorn-42363.exe (PID: 8880)
- Unicorn-41233.exe (PID: 9008)
- Unicorn-43619.exe (PID: 9800)
- Unicorn-13360.exe (PID: 7876)
- Unicorn-31123.exe (PID: 8404)
- Unicorn-30046.exe (PID: 10152)
- Unicorn-52873.exe (PID: 11296)
- Unicorn-39536.exe (PID: 9316)
- Unicorn-50709.exe (PID: 9120)
- Unicorn-15747.exe (PID: 8700)
- Unicorn-17445.exe (PID: 7904)
- Unicorn-20652.exe (PID: 7828)
- Unicorn-28087.exe (PID: 8072)
- Unicorn-56780.exe (PID: 8672)
- Unicorn-37023.exe (PID: 7284)
- Unicorn-42722.exe (PID: 4980)
- Unicorn-16553.exe (PID: 10284)
- Unicorn-58261.exe (PID: 9180)
- Unicorn-19882.exe (PID: 9128)
- Unicorn-45509.exe (PID: 8952)
- Unicorn-13692.exe (PID: 8800)
- Unicorn-10179.exe (PID: 9648)
- Unicorn-22099.exe (PID: 5084)
- Unicorn-1980.exe (PID: 8536)
- Unicorn-51439.exe (PID: 9076)
- Unicorn-35156.exe (PID: 8484)
- Unicorn-60885.exe (PID: 8848)
- Unicorn-62577.exe (PID: 9188)
- Unicorn-26168.exe (PID: 7344)
- Unicorn-49623.exe (PID: 9416)
- Unicorn-56447.exe (PID: 9196)
- Unicorn-20074.exe (PID: 9088)
- Unicorn-584.exe (PID: 8912)
- Unicorn-21959.exe (PID: 13416)
- Unicorn-33111.exe (PID: 12524)
- Unicorn-49936.exe (PID: 13740)
- Unicorn-53205.exe (PID: 9632)
- Unicorn-3215.exe (PID: 9356)
- Unicorn-54933.exe (PID: 9932)
- Unicorn-8711.exe (PID: 13812)
- Unicorn-12032.exe (PID: 11312)
- Unicorn-55488.exe (PID: 9384)
- Unicorn-28369.exe (PID: 6852)
- Unicorn-45103.exe (PID: 9820)
- Unicorn-63205.exe (PID: 10596)
- Unicorn-46823.exe (PID: 9376)
- Unicorn-39675.exe (PID: 9768)
- Unicorn-6758.exe (PID: 8360)
- Unicorn-53921.exe (PID: 8352)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 3240)
- BackgroundTransferHost.exe (PID: 1012)
- BackgroundTransferHost.exe (PID: 1660)
- BackgroundTransferHost.exe (PID: 6388)
- BackgroundTransferHost.exe (PID: 4464)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 1012)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 1012)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 1012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
643
Monitored processes
510
Malicious processes
86
Suspicious processes
57
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\Users\admin\AppData\Local\Temp\Unicorn-9131.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9131.exe | — | Unicorn-32245.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 668 | C:\Users\admin\AppData\Local\Temp\Unicorn-16905.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-16905.exe | Unicorn-62649.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 856 | C:\Users\admin\AppData\Local\Temp\Unicorn-2104.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-2104.exe | Unicorn-16905.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 920 | C:\Users\admin\AppData\Local\Temp\Unicorn-2082.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-2082.exe | Unicorn-16905.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1012 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1132 | C:\Users\admin\AppData\Local\Temp\Unicorn-32541.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-32541.exe | — | Unicorn-20652.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1184 | C:\Users\admin\AppData\Local\Temp\Unicorn-40479.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-40479.exe | Unicorn-39629.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1188 | C:\Users\admin\AppData\Local\Temp\Unicorn-3256.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3256.exe | Unicorn-9291.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1388 | C:\Users\admin\AppData\Local\Temp\Unicorn-9992.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9992.exe | Unicorn-64688.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1660 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
11 549
Read events
11 534
Write events
15
Delete events
0
Modification events
| (PID) Process: | (3240) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (3240) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (3240) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (1012) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (1012) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (1012) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (1660) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (1660) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (1660) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6388) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
825
Suspicious files
5
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1012 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\b43e9c43-dae5-41d1-a79c-420c2fdf4fef.down_data | — | |
MD5:— | SHA256:— | |||
| 668 | Unicorn-16905.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-2104.exe | executable | |
MD5:89ACB070FAB51CC746A1E07F8E8D346F | SHA256:2BA6CAFBA1F5850C77F55878F119BE3548A9F37005B1808DF7130D6FD51E767E | |||
| 4400 | Unicorn-62649.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3862.exe | executable | |
MD5:626CC7721EEA4C328DBCBB45D4F538EB | SHA256:242F12A1BD388B40BB113534195080BEDC4D7574451CE35393BC447B07741D7B | |||
| 4040 | Unicorn-39629.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-18270.exe | executable | |
MD5:A09F03741822F02B57F5FA7A82854933 | SHA256:B3F3E72554DC442ADC8C09F49C4525F8ADF51D2901C80ED7E2A9C7510E50A82F | |||
| 1012 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\b43e9c43-dae5-41d1-a79c-420c2fdf4fef.4a39ffd2-bc73-4d9d-b864-43effdad5f22.down_meta | binary | |
MD5:26E34355D40A8C6F9BF117F3CA834B51 | SHA256:8E734FED693E4E10D9C8E4D6DB7057F07A86A54948F0F3612432CBDA57E58578 | |||
| 1012 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:3B6AB981FD2C21FA45D26411EE76B74F | SHA256:6B97C5B0DEC114D3AC5015250266A30EF47276A60E15CD63BBB12AC7456351B6 | |||
| 1012 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
| 7012 | 1 (125).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-62649.exe | executable | |
MD5:0F897786E5966C8C46A49A041AD57D22 | SHA256:3EBE534B481D80F28601C72F1AC449E5B587AA546FF7E0F5EC6BBCDC67544061 | |||
| 1012 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\615cdbc0-f150-4008-abc0-17176a1806da.up_meta_secure | binary | |
MD5:B921A7266F68694C0A6D74061A653973 | SHA256:0CFC6B1620947352350113EFB4874A33126EF1AC39FD9E8EE79C3DC2E4BD0DCD | |||
| 5116 | Unicorn-9291.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3256.exe | executable | |
MD5:FDA890C49E5709AD7ACA5A016536B39D | SHA256:38FEFB21C60C9091870F28126361B0F405C16DD7D79EF1B9C7E839ECC15FB58E | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
15
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
1012 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
1096 | SIHClient.exe | GET | 200 | 2.19.217.218:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
1096 | SIHClient.exe | GET | 200 | 2.19.217.218:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
2104 | svchost.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6544 | svchost.exe | 20.190.159.128:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
3216 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2112 | svchost.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2392 | backgroundTaskHost.exe | 20.86.201.138:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |