| File name: | 1 (1158) |
| Full analysis: | https://app.any.run/tasks/fce81c53-d46a-40d5-9906-c6ab9a4f1295 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 08:20:36 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | 574876230CCCD97877917E9BBBB43F90 |
| SHA1: | CC8C163F639FE48872D8C22EADCDB3651D9289C9 |
| SHA256: | 56ADDFF068F9C1D8813A466144E5BE59BE243411574E6C6698BFC5A39C29BC26 |
| SSDEEP: | 12288:r9XzBjHA5stUZBchakOye5SQx4DxmDsR:r9jB05PBch05 |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- 1 (1158).exe (PID: 2148)
- Unicorn-16997.exe (PID: 5956)
- Unicorn-58805.exe (PID: 6132)
- Unicorn-6267.exe (PID: 6828)
- Unicorn-14404.exe (PID: 7332)
- Unicorn-315.exe (PID: 7348)
- Unicorn-34662.exe (PID: 7364)
- Unicorn-40793.exe (PID: 7372)
- Unicorn-8644.exe (PID: 7420)
- Unicorn-5307.exe (PID: 7440)
- Unicorn-9028.exe (PID: 7468)
- Unicorn-19234.exe (PID: 7452)
- Unicorn-40092.exe (PID: 7492)
- Unicorn-25853.exe (PID: 7592)
- Unicorn-41229.exe (PID: 7664)
- Unicorn-5110.exe (PID: 7608)
- Unicorn-57845.exe (PID: 7408)
- Unicorn-51628.exe (PID: 7808)
- Unicorn-57373.exe (PID: 7644)
- Unicorn-51435.exe (PID: 7688)
- Unicorn-51701.exe (PID: 7784)
- Unicorn-51893.exe (PID: 7816)
- Unicorn-15691.exe (PID: 7848)
- Unicorn-63761.exe (PID: 7760)
- Unicorn-13090.exe (PID: 7828)
- Unicorn-10290.exe (PID: 7836)
- Unicorn-8852.exe (PID: 7204)
- Unicorn-13683.exe (PID: 664)
- Unicorn-45868.exe (PID: 7676)
- Unicorn-45090.exe (PID: 1760)
- Unicorn-56340.exe (PID: 7776)
- Unicorn-35277.exe (PID: 7404)
- Unicorn-2604.exe (PID: 5228)
- Unicorn-40683.exe (PID: 2268)
- Unicorn-803.exe (PID: 7700)
- Unicorn-38275.exe (PID: 7396)
- Unicorn-50580.exe (PID: 7560)
- Unicorn-24021.exe (PID: 7476)
- Unicorn-40683.exe (PID: 6512)
- Unicorn-61131.exe (PID: 7732)
- Unicorn-20491.exe (PID: 7484)
- Unicorn-23683.exe (PID: 4208)
- Unicorn-13372.exe (PID: 4452)
- Unicorn-13076.exe (PID: 7600)
- Unicorn-34347.exe (PID: 5864)
- Unicorn-20698.exe (PID: 7996)
- Unicorn-55780.exe (PID: 2616)
- Unicorn-5794.exe (PID: 3268)
- Unicorn-41643.exe (PID: 1184)
- Unicorn-61893.exe (PID: 7772)
- Unicorn-28645.exe (PID: 6268)
- Unicorn-58084.exe (PID: 2240)
- Unicorn-56147.exe (PID: 2560)
- Unicorn-42781.exe (PID: 7308)
- Unicorn-46429.exe (PID: 5960)
- Unicorn-51068.exe (PID: 8164)
- Unicorn-29626.exe (PID: 1128)
- Unicorn-62002.exe (PID: 6436)
- Unicorn-18085.exe (PID: 7176)
- Unicorn-60860.exe (PID: 5280)
- Unicorn-10108.exe (PID: 8064)
- Unicorn-62883.exe (PID: 4920)
- Unicorn-18853.exe (PID: 5364)
- Unicorn-55396.exe (PID: 8156)
- Unicorn-20965.exe (PID: 4188)
- Unicorn-1556.exe (PID: 7948)
- Unicorn-2811.exe (PID: 4448)
- Unicorn-65187.exe (PID: 6800)
- Unicorn-10035.exe (PID: 8080)
- Unicorn-18744.exe (PID: 1228)
- Unicorn-31245.exe (PID: 6080)
- Unicorn-47877.exe (PID: 8136)
- Unicorn-5426.exe (PID: 7260)
- Unicorn-37021.exe (PID: 1324)
- Unicorn-37893.exe (PID: 8348)
- Unicorn-64331.exe (PID: 7576)
- Unicorn-38645.exe (PID: 7292)
- Unicorn-51629.exe (PID: 8928)
- Unicorn-35028.exe (PID: 9008)
- Unicorn-38971.exe (PID: 9036)
- Unicorn-58275.exe (PID: 3332)
- Unicorn-39251.exe (PID: 1188)
- Unicorn-7996.exe (PID: 8232)
- Unicorn-50700.exe (PID: 8328)
- Unicorn-1276.exe (PID: 8680)
- Unicorn-24333.exe (PID: 8224)
- Unicorn-60020.exe (PID: 8284)
- Unicorn-50093.exe (PID: 8568)
- Unicorn-45952.exe (PID: 8276)
- Unicorn-6268.exe (PID: 720)
- Unicorn-39023.exe (PID: 8396)
- Unicorn-50564.exe (PID: 7972)
- Unicorn-47301.exe (PID: 5968)
- Unicorn-18987.exe (PID: 8292)
- Unicorn-56237.exe (PID: 7284)
- Unicorn-57597.exe (PID: 9168)
- Unicorn-49605.exe (PID: 6760)
- Unicorn-41939.exe (PID: 1272)
- Unicorn-22059.exe (PID: 8632)
- Unicorn-17997.exe (PID: 9068)
- Unicorn-26125.exe (PID: 9048)
- Unicorn-9688.exe (PID: 8376)
- Unicorn-22635.exe (PID: 9076)
- Unicorn-16653.exe (PID: 8868)
- Unicorn-51795.exe (PID: 2088)
- Unicorn-53653.exe (PID: 9328)
- Unicorn-16683.exe (PID: 9376)
- Unicorn-30571.exe (PID: 9144)
- Unicorn-48517.exe (PID: 8436)
- Unicorn-43949.exe (PID: 2136)
- Unicorn-39472.exe (PID: 9572)
- Unicorn-39237.exe (PID: 8336)
- Unicorn-57508.exe (PID: 3956)
- Unicorn-40802.exe (PID: 10236)
- Unicorn-17155.exe (PID: 8592)
- Unicorn-22818.exe (PID: 8384)
- Unicorn-40483.exe (PID: 976)
- Unicorn-47524.exe (PID: 9092)
- Unicorn-21320.exe (PID: 3032)
- Unicorn-35795.exe (PID: 8616)
- Unicorn-47227.exe (PID: 7756)
- Unicorn-57330.exe (PID: 7188)
- Unicorn-30227.exe (PID: 8580)
- Unicorn-65292.exe (PID: 8240)
- Unicorn-8380.exe (PID: 6988)
- Unicorn-25885.exe (PID: 920)
- Unicorn-53876.exe (PID: 9152)
- Unicorn-32325.exe (PID: 7908)
- Unicorn-47628.exe (PID: 9272)
- Unicorn-38440.exe (PID: 11372)
- Unicorn-43989.exe (PID: 8496)
- Unicorn-65313.exe (PID: 8916)
- Unicorn-33396.exe (PID: 11436)
- Unicorn-27234.exe (PID: 9264)
- Unicorn-37523.exe (PID: 8248)
- Unicorn-42716.exe (PID: 11392)
- Unicorn-2265.exe (PID: 9548)
- Unicorn-43573.exe (PID: 9592)
- Unicorn-19194.exe (PID: 11624)
- Unicorn-64893.exe (PID: 8424)
- Unicorn-63460.exe (PID: 1040)
- Unicorn-59693.exe (PID: 7984)
- Unicorn-19007.exe (PID: 11872)
- Unicorn-52900.exe (PID: 2420)
- Unicorn-20051.exe (PID: 9180)
- Unicorn-52044.exe (PID: 9236)
- Unicorn-52044.exe (PID: 9228)
- Unicorn-58680.exe (PID: 9528)
- Unicorn-49889.exe (PID: 12892)
- Unicorn-49889.exe (PID: 12884)
- Unicorn-55456.exe (PID: 12916)
- Unicorn-11632.exe (PID: 12424)
- Unicorn-24392.exe (PID: 9500)
- Unicorn-10071.exe (PID: 11584)
- Unicorn-21232.exe (PID: 10980)
- Unicorn-7436.exe (PID: 9208)
- Unicorn-33786.exe (PID: 9188)
- Unicorn-60314.exe (PID: 11916)
- Unicorn-11290.exe (PID: 13128)
- Unicorn-56183.exe (PID: 11068)
- Unicorn-51232.exe (PID: 14052)
- Unicorn-21823.exe (PID: 14092)
- Unicorn-61321.exe (PID: 12924)
- Unicorn-4319.exe (PID: 11500)
- Unicorn-60698.exe (PID: 11148)
- Unicorn-15308.exe (PID: 8504)
- Unicorn-36667.exe (PID: 7616)
- Unicorn-21823.exe (PID: 14084)
- Unicorn-3832.exe (PID: 10548)
- Unicorn-28167.exe (PID: 10648)
- Unicorn-37626.exe (PID: 9584)
- Unicorn-53608.exe (PID: 11032)
- Unicorn-54656.exe (PID: 9516)
- Unicorn-14767.exe (PID: 10392)
- Unicorn-15914.exe (PID: 10444)
- Unicorn-2607.exe (PID: 15268)
- Unicorn-41379.exe (PID: 9384)
- Unicorn-61985.exe (PID: 11444)
- Unicorn-36874.exe (PID: 11756)
- Unicorn-11689.exe (PID: 11160)
- Unicorn-49901.exe (PID: 8540)
- Unicorn-44377.exe (PID: 9844)
- Unicorn-11311.exe (PID: 11204)
- Unicorn-26741.exe (PID: 9100)
- Unicorn-32722.exe (PID: 8300)
- Unicorn-18352.exe (PID: 11532)
- Unicorn-36231.exe (PID: 14892)
- Unicorn-57745.exe (PID: 11212)
- Unicorn-41992.exe (PID: 13860)
- Unicorn-2967.exe (PID: 12432)
- Unicorn-49776.exe (PID: 14028)
- Unicorn-3832.exe (PID: 10536)
- Unicorn-10553.exe (PID: 5164)
- Unicorn-21611.exe (PID: 11660)
- Unicorn-31690.exe (PID: 12592)
- Unicorn-50657.exe (PID: 13992)
- Unicorn-45412.exe (PID: 8452)
- Unicorn-17711.exe (PID: 16456)
- Unicorn-28824.exe (PID: 15288)
- Unicorn-35969.exe (PID: 15316)
- Unicorn-3487.exe (PID: 16528)
- Unicorn-59043.exe (PID: 8212)
Executable content was dropped or overwritten
- Unicorn-16997.exe (PID: 5956)
- 1 (1158).exe (PID: 2148)
- Unicorn-58805.exe (PID: 6132)
- Unicorn-6267.exe (PID: 6828)
- Unicorn-315.exe (PID: 7348)
- Unicorn-14404.exe (PID: 7332)
- Unicorn-34662.exe (PID: 7364)
- Unicorn-40793.exe (PID: 7372)
- Unicorn-8644.exe (PID: 7420)
- Unicorn-57845.exe (PID: 7408)
- Unicorn-5307.exe (PID: 7440)
- Unicorn-9028.exe (PID: 7468)
- Unicorn-19234.exe (PID: 7452)
- Unicorn-20491.exe (PID: 7484)
- Unicorn-25853.exe (PID: 7592)
- Unicorn-45868.exe (PID: 7676)
- Unicorn-51628.exe (PID: 7808)
- Unicorn-56340.exe (PID: 7776)
- Unicorn-51435.exe (PID: 7688)
- Unicorn-63761.exe (PID: 7760)
- Unicorn-51701.exe (PID: 7784)
- Unicorn-15691.exe (PID: 7848)
- Unicorn-51893.exe (PID: 7816)
- Unicorn-40092.exe (PID: 7492)
- Unicorn-13090.exe (PID: 7828)
- Unicorn-10290.exe (PID: 7836)
- Unicorn-13683.exe (PID: 664)
- Unicorn-8852.exe (PID: 7204)
- Unicorn-45090.exe (PID: 1760)
- Unicorn-5110.exe (PID: 7608)
- Unicorn-35277.exe (PID: 7404)
- Unicorn-2604.exe (PID: 5228)
- Unicorn-40683.exe (PID: 2268)
- Unicorn-24021.exe (PID: 7476)
- Unicorn-41229.exe (PID: 7664)
- Unicorn-803.exe (PID: 7700)
- Unicorn-38275.exe (PID: 7396)
- Unicorn-50580.exe (PID: 7560)
- Unicorn-40683.exe (PID: 6512)
- Unicorn-61131.exe (PID: 7732)
- Unicorn-23683.exe (PID: 4208)
- Unicorn-34347.exe (PID: 5864)
- Unicorn-20698.exe (PID: 7996)
- Unicorn-57508.exe (PID: 3956)
- Unicorn-13372.exe (PID: 4452)
- Unicorn-41643.exe (PID: 1184)
- Unicorn-5794.exe (PID: 3268)
- Unicorn-61893.exe (PID: 7772)
- Unicorn-57373.exe (PID: 7644)
- Unicorn-28645.exe (PID: 6268)
- Unicorn-60860.exe (PID: 5280)
- Unicorn-55780.exe (PID: 2616)
- Unicorn-56147.exe (PID: 2560)
- Unicorn-1556.exe (PID: 7948)
- Unicorn-46429.exe (PID: 5960)
- Unicorn-29626.exe (PID: 1128)
- Unicorn-62002.exe (PID: 6436)
- Unicorn-18085.exe (PID: 7176)
- Unicorn-50564.exe (PID: 7972)
- Unicorn-18853.exe (PID: 5364)
- Unicorn-10108.exe (PID: 8064)
- Unicorn-62883.exe (PID: 4920)
- Unicorn-20965.exe (PID: 4188)
- Unicorn-55396.exe (PID: 8156)
- Unicorn-2811.exe (PID: 4448)
- Unicorn-65187.exe (PID: 6800)
- Unicorn-10035.exe (PID: 8080)
- Unicorn-37021.exe (PID: 1324)
- Unicorn-13076.exe (PID: 7600)
- Unicorn-18744.exe (PID: 1228)
- Unicorn-31245.exe (PID: 6080)
- Unicorn-47877.exe (PID: 8136)
- Unicorn-5426.exe (PID: 7260)
- Unicorn-39251.exe (PID: 1188)
- Unicorn-38645.exe (PID: 7292)
- Unicorn-64331.exe (PID: 7576)
- Unicorn-37893.exe (PID: 8348)
- Unicorn-51629.exe (PID: 8928)
- Unicorn-35028.exe (PID: 9008)
- Unicorn-38971.exe (PID: 9036)
- Unicorn-58275.exe (PID: 3332)
- Unicorn-7996.exe (PID: 8232)
- Unicorn-50700.exe (PID: 8328)
- Unicorn-24333.exe (PID: 8224)
- Unicorn-1276.exe (PID: 8680)
- Unicorn-59693.exe (PID: 7984)
- Unicorn-64893.exe (PID: 8424)
- Unicorn-60020.exe (PID: 8284)
- Unicorn-45952.exe (PID: 8276)
- Unicorn-47301.exe (PID: 5968)
- Unicorn-50093.exe (PID: 8568)
- Unicorn-6268.exe (PID: 720)
- Unicorn-39023.exe (PID: 8396)
- Unicorn-32443.exe (PID: 9244)
- Unicorn-18987.exe (PID: 8292)
- Unicorn-56237.exe (PID: 7284)
- Unicorn-57597.exe (PID: 9168)
- Unicorn-49605.exe (PID: 6760)
- Unicorn-22059.exe (PID: 8632)
- Unicorn-17997.exe (PID: 9068)
- Unicorn-9688.exe (PID: 8376)
- Unicorn-26125.exe (PID: 9048)
- Unicorn-16683.exe (PID: 9376)
- Unicorn-22635.exe (PID: 9076)
- Unicorn-51795.exe (PID: 2088)
- Unicorn-16653.exe (PID: 8868)
- Unicorn-53653.exe (PID: 9328)
- Unicorn-30571.exe (PID: 9144)
- Unicorn-48517.exe (PID: 8436)
- Unicorn-43949.exe (PID: 2136)
- Unicorn-39472.exe (PID: 9572)
- Unicorn-39237.exe (PID: 8336)
- Unicorn-22818.exe (PID: 8384)
- Unicorn-57330.exe (PID: 7188)
- Unicorn-40802.exe (PID: 10236)
- Unicorn-51068.exe (PID: 8164)
- Unicorn-17155.exe (PID: 8592)
- Unicorn-40483.exe (PID: 976)
- Unicorn-47524.exe (PID: 9092)
- Unicorn-35795.exe (PID: 8616)
- Unicorn-47227.exe (PID: 7756)
- Unicorn-21320.exe (PID: 3032)
- Unicorn-30227.exe (PID: 8580)
- Unicorn-65313.exe (PID: 8916)
- Unicorn-8380.exe (PID: 6988)
- Unicorn-32325.exe (PID: 7908)
- Unicorn-53876.exe (PID: 9152)
- Unicorn-25885.exe (PID: 920)
- Unicorn-47628.exe (PID: 9272)
- Unicorn-38440.exe (PID: 11372)
- Unicorn-43989.exe (PID: 8496)
- Unicorn-33396.exe (PID: 11436)
- Unicorn-37523.exe (PID: 8248)
- Unicorn-42716.exe (PID: 11392)
- Unicorn-27234.exe (PID: 9264)
- Unicorn-2265.exe (PID: 9548)
- Unicorn-43573.exe (PID: 9592)
- Unicorn-19194.exe (PID: 11624)
- Unicorn-63460.exe (PID: 1040)
- Unicorn-52900.exe (PID: 2420)
- Unicorn-20051.exe (PID: 9180)
- Unicorn-19007.exe (PID: 11872)
- Unicorn-58680.exe (PID: 9528)
- Unicorn-52044.exe (PID: 9236)
- Unicorn-52044.exe (PID: 9228)
- Unicorn-45412.exe (PID: 8452)
- Unicorn-11632.exe (PID: 12424)
- Unicorn-55456.exe (PID: 12916)
- Unicorn-49889.exe (PID: 12884)
- Unicorn-49889.exe (PID: 12892)
- Unicorn-24392.exe (PID: 9500)
- Unicorn-41660.exe (PID: 8608)
- Unicorn-10071.exe (PID: 11584)
- Unicorn-21232.exe (PID: 10980)
- Unicorn-11290.exe (PID: 13128)
- Unicorn-60698.exe (PID: 11148)
- Unicorn-33786.exe (PID: 9188)
- Unicorn-17567.exe (PID: 10528)
- Unicorn-56183.exe (PID: 11068)
- Unicorn-65292.exe (PID: 8240)
- Unicorn-15308.exe (PID: 8504)
- Unicorn-61321.exe (PID: 12924)
- Unicorn-4319.exe (PID: 11500)
- Unicorn-36667.exe (PID: 7616)
- Unicorn-21823.exe (PID: 14084)
- Unicorn-28167.exe (PID: 10648)
- Unicorn-37626.exe (PID: 9584)
- Unicorn-42781.exe (PID: 7308)
- Unicorn-3832.exe (PID: 10548)
- Unicorn-15914.exe (PID: 10444)
- Unicorn-53608.exe (PID: 11032)
- Unicorn-14767.exe (PID: 10392)
- Unicorn-54656.exe (PID: 9516)
- Unicorn-11689.exe (PID: 11160)
- Unicorn-49901.exe (PID: 8540)
- Unicorn-2680.exe (PID: 14376)
- Unicorn-41379.exe (PID: 9384)
- Unicorn-61985.exe (PID: 11444)
- Unicorn-36874.exe (PID: 11756)
- Unicorn-18352.exe (PID: 11532)
- Unicorn-11311.exe (PID: 11204)
- Unicorn-44377.exe (PID: 9844)
- Unicorn-26741.exe (PID: 9100)
- Unicorn-36231.exe (PID: 14892)
- Unicorn-32722.exe (PID: 8300)
- Unicorn-57745.exe (PID: 11212)
- Unicorn-10553.exe (PID: 5164)
- Unicorn-41992.exe (PID: 13860)
- Unicorn-21611.exe (PID: 11660)
- Unicorn-49776.exe (PID: 14028)
- Unicorn-2967.exe (PID: 12432)
- Unicorn-3832.exe (PID: 10536)
- Unicorn-21320.exe (PID: 6208)
- Unicorn-50657.exe (PID: 13992)
- Unicorn-31690.exe (PID: 12592)
- Unicorn-53314.exe (PID: 12444)
- Unicorn-51232.exe (PID: 14052)
- Unicorn-21823.exe (PID: 14092)
- Unicorn-28467.exe (PID: 10072)
- Unicorn-60697.exe (PID: 9960)
- Unicorn-59043.exe (PID: 8212)
- Unicorn-27408.exe (PID: 13668)
- Unicorn-36858.exe (PID: 9636)
- Unicorn-15810.exe (PID: 9784)
- Unicorn-13639.exe (PID: 11880)
- Unicorn-24287.exe (PID: 9664)
- Unicorn-2607.exe (PID: 15268)
- Unicorn-23433.exe (PID: 10400)
- Unicorn-42693.exe (PID: 9084)
- Unicorn-54688.exe (PID: 14128)
- Unicorn-50922.exe (PID: 13828)
- Unicorn-53121.exe (PID: 9764)
- Unicorn-30626.exe (PID: 10720)
- Unicorn-28331.exe (PID: 10920)
- Unicorn-61280.exe (PID: 10032)
- Unicorn-3345.exe (PID: 10820)
- Unicorn-49385.exe (PID: 1056)
- Unicorn-55498.exe (PID: 9696)
- Unicorn-35193.exe (PID: 14752)
- Unicorn-31056.exe (PID: 13868)
- Unicorn-50834.exe (PID: 14824)
- Unicorn-49889.exe (PID: 12868)
- Unicorn-43181.exe (PID: 9284)
- Unicorn-22931.exe (PID: 7672)
- Unicorn-42280.exe (PID: 12536)
- Unicorn-63445.exe (PID: 4336)
- Unicorn-17128.exe (PID: 14916)
- Unicorn-8560.exe (PID: 13552)
- Unicorn-43890.exe (PID: 11644)
- Unicorn-12872.exe (PID: 10904)
- Unicorn-10863.exe (PID: 13608)
- Unicorn-58084.exe (PID: 2240)
- Unicorn-35193.exe (PID: 15632)
- Unicorn-7081.exe (PID: 10736)
- Unicorn-41939.exe (PID: 1272)
- Unicorn-7436.exe (PID: 9208)
- Unicorn-3945.exe (PID: 15516)
- Unicorn-35969.exe (PID: 15316)
- Unicorn-17711.exe (PID: 16456)
- Unicorn-12369.exe (PID: 11776)
- Unicorn-40536.exe (PID: 16560)
- Unicorn-1320.exe (PID: 11524)
- Unicorn-28824.exe (PID: 15288)
- Unicorn-63625.exe (PID: 13496)
- Unicorn-2577.exe (PID: 1812)
- Unicorn-3487.exe (PID: 16528)
- Unicorn-29874.exe (PID: 12784)
- Unicorn-4591.exe (PID: 11936)
Executes application which crashes
- Unicorn-29133.exe (PID: 5260)
- Unicorn-10120.exe (PID: 15336)
INFO
Reads the computer name
- 1 (1158).exe (PID: 2148)
- Unicorn-16997.exe (PID: 5956)
- Unicorn-58805.exe (PID: 6132)
- Unicorn-6267.exe (PID: 6828)
- Unicorn-14404.exe (PID: 7332)
- Unicorn-315.exe (PID: 7348)
- Unicorn-34662.exe (PID: 7364)
- Unicorn-40793.exe (PID: 7372)
- Unicorn-57845.exe (PID: 7408)
- Unicorn-5307.exe (PID: 7440)
- Unicorn-8644.exe (PID: 7420)
- Unicorn-19234.exe (PID: 7452)
- Unicorn-20491.exe (PID: 7484)
- Unicorn-45868.exe (PID: 7676)
- Unicorn-5110.exe (PID: 7608)
- Unicorn-41229.exe (PID: 7664)
- Unicorn-56340.exe (PID: 7776)
- Unicorn-51435.exe (PID: 7688)
- Unicorn-51701.exe (PID: 7784)
- Unicorn-15691.exe (PID: 7848)
- Unicorn-13090.exe (PID: 7828)
- Unicorn-51893.exe (PID: 7816)
- Unicorn-9028.exe (PID: 7468)
- Unicorn-24021.exe (PID: 7476)
- Unicorn-13683.exe (PID: 664)
- Unicorn-40092.exe (PID: 7492)
- Unicorn-35277.exe (PID: 7404)
- Unicorn-2604.exe (PID: 5228)
- Unicorn-803.exe (PID: 7700)
- Unicorn-50580.exe (PID: 7560)
- Unicorn-61131.exe (PID: 7732)
- Unicorn-40683.exe (PID: 6512)
- Unicorn-23683.exe (PID: 4208)
- Unicorn-34347.exe (PID: 5864)
- Unicorn-13372.exe (PID: 4452)
- Unicorn-20698.exe (PID: 7996)
- Unicorn-41643.exe (PID: 1184)
- Unicorn-58084.exe (PID: 2240)
- Unicorn-57508.exe (PID: 3956)
- Unicorn-13076.exe (PID: 7600)
- Unicorn-60860.exe (PID: 5280)
- Unicorn-46429.exe (PID: 5960)
- Unicorn-18085.exe (PID: 7176)
- Unicorn-1556.exe (PID: 7948)
- Unicorn-42781.exe (PID: 7308)
- Unicorn-62002.exe (PID: 6436)
- Unicorn-29626.exe (PID: 1128)
- Unicorn-51068.exe (PID: 8164)
- Unicorn-55396.exe (PID: 8156)
- Unicorn-62883.exe (PID: 4920)
- Unicorn-18744.exe (PID: 1228)
- Unicorn-2811.exe (PID: 4448)
- Unicorn-65187.exe (PID: 6800)
- Unicorn-10035.exe (PID: 8080)
- Unicorn-39251.exe (PID: 1188)
- Unicorn-37021.exe (PID: 1324)
- Unicorn-5426.exe (PID: 7260)
- Unicorn-51629.exe (PID: 8928)
- Unicorn-29133.exe (PID: 5260)
- Unicorn-38971.exe (PID: 9036)
- Unicorn-58275.exe (PID: 3332)
- Unicorn-50700.exe (PID: 8328)
- Unicorn-1276.exe (PID: 8680)
- Unicorn-30571.exe (PID: 9144)
- Unicorn-59693.exe (PID: 7984)
- Unicorn-24333.exe (PID: 8224)
- Unicorn-47301.exe (PID: 5968)
- Unicorn-39023.exe (PID: 8396)
- Unicorn-41939.exe (PID: 1272)
- Unicorn-17997.exe (PID: 9068)
- Unicorn-48517.exe (PID: 8436)
- Unicorn-26125.exe (PID: 9048)
- Unicorn-53653.exe (PID: 9328)
- Unicorn-9688.exe (PID: 8376)
- Unicorn-43949.exe (PID: 2136)
- Unicorn-32443.exe (PID: 9244)
- Unicorn-35795.exe (PID: 8616)
- Unicorn-57330.exe (PID: 7188)
- Unicorn-65313.exe (PID: 8916)
- Unicorn-30227.exe (PID: 8580)
- Unicorn-38440.exe (PID: 11372)
- Unicorn-33396.exe (PID: 11436)
- Unicorn-37523.exe (PID: 8248)
- Unicorn-19194.exe (PID: 11624)
- Unicorn-52044.exe (PID: 9228)
- Unicorn-52900.exe (PID: 2420)
- Unicorn-20051.exe (PID: 9180)
- Unicorn-33786.exe (PID: 9188)
- Unicorn-60314.exe (PID: 11916)
- Unicorn-56183.exe (PID: 11068)
- Unicorn-21232.exe (PID: 10980)
- Unicorn-7436.exe (PID: 9208)
- Unicorn-36667.exe (PID: 7616)
- Unicorn-21823.exe (PID: 14084)
- Unicorn-41379.exe (PID: 9384)
- Unicorn-2680.exe (PID: 14376)
- Unicorn-18352.exe (PID: 11532)
- Unicorn-41992.exe (PID: 13860)
- Unicorn-10553.exe (PID: 5164)
- Unicorn-57745.exe (PID: 11212)
- Unicorn-17711.exe (PID: 16456)
The sample compiled with chinese language support
- 1 (1158).exe (PID: 2148)
Checks supported languages
- 1 (1158).exe (PID: 2148)
- Unicorn-6267.exe (PID: 6828)
- Unicorn-58805.exe (PID: 6132)
- Unicorn-14404.exe (PID: 7332)
- Unicorn-315.exe (PID: 7348)
- Unicorn-40793.exe (PID: 7372)
- Unicorn-34662.exe (PID: 7364)
- Unicorn-57845.exe (PID: 7408)
- Unicorn-8644.exe (PID: 7420)
- Unicorn-5307.exe (PID: 7440)
- Unicorn-19234.exe (PID: 7452)
- Unicorn-24021.exe (PID: 7476)
- Unicorn-20491.exe (PID: 7484)
- Unicorn-9028.exe (PID: 7468)
- Unicorn-40092.exe (PID: 7492)
- Unicorn-25853.exe (PID: 7592)
- Unicorn-5110.exe (PID: 7608)
- Unicorn-57373.exe (PID: 7644)
- Unicorn-41229.exe (PID: 7664)
- Unicorn-63761.exe (PID: 7760)
- Unicorn-45868.exe (PID: 7676)
- Unicorn-51435.exe (PID: 7688)
- Unicorn-51701.exe (PID: 7784)
- Unicorn-56340.exe (PID: 7776)
- Unicorn-13090.exe (PID: 7828)
- Unicorn-51893.exe (PID: 7816)
- Unicorn-15691.exe (PID: 7848)
- Unicorn-10290.exe (PID: 7836)
- Unicorn-16997.exe (PID: 5956)
- Unicorn-40683.exe (PID: 6512)
- Unicorn-8852.exe (PID: 7204)
- Unicorn-13683.exe (PID: 664)
- Unicorn-40683.exe (PID: 2268)
- Unicorn-38275.exe (PID: 7396)
- Unicorn-45090.exe (PID: 1760)
- Unicorn-2604.exe (PID: 5228)
- Unicorn-803.exe (PID: 7700)
- Unicorn-61893.exe (PID: 7772)
- Unicorn-13076.exe (PID: 7600)
- Unicorn-50580.exe (PID: 7560)
- Unicorn-56147.exe (PID: 2560)
- Unicorn-62002.exe (PID: 6436)
- Unicorn-5794.exe (PID: 3268)
- Unicorn-28645.exe (PID: 6268)
- Unicorn-60860.exe (PID: 5280)
- Unicorn-41643.exe (PID: 1184)
- Unicorn-39251.exe (PID: 1188)
- Unicorn-18085.exe (PID: 7176)
- Unicorn-55780.exe (PID: 2616)
- Unicorn-42781.exe (PID: 7308)
- Unicorn-10108.exe (PID: 8064)
- Unicorn-10035.exe (PID: 8080)
- Unicorn-20698.exe (PID: 7996)
- Unicorn-59693.exe (PID: 7984)
- Unicorn-50564.exe (PID: 7972)
- Unicorn-1556.exe (PID: 7948)
- Unicorn-55396.exe (PID: 8156)
- Unicorn-23683.exe (PID: 4208)
- Unicorn-57508.exe (PID: 3956)
- Unicorn-34347.exe (PID: 5864)
- Unicorn-18853.exe (PID: 5364)
- Unicorn-13372.exe (PID: 4452)
- Unicorn-62883.exe (PID: 4920)
- Unicorn-58084.exe (PID: 2240)
- Unicorn-18744.exe (PID: 1228)
- Unicorn-29133.exe (PID: 5260)
- Unicorn-47227.exe (PID: 7756)
- Unicorn-37021.exe (PID: 1324)
- Unicorn-5426.exe (PID: 7260)
- Unicorn-63460.exe (PID: 1040)
- Unicorn-31245.exe (PID: 6080)
- Unicorn-65187.exe (PID: 6800)
- Unicorn-38645.exe (PID: 7292)
- Unicorn-20965.exe (PID: 4188)
- Unicorn-51795.exe (PID: 2088)
- Unicorn-64331.exe (PID: 7576)
- Unicorn-63445.exe (PID: 4336)
- Unicorn-8380.exe (PID: 6988)
- Unicorn-58275.exe (PID: 3332)
- Unicorn-596.exe (PID: 5576)
- Unicorn-59043.exe (PID: 8212)
- Unicorn-7996.exe (PID: 8232)
- Unicorn-65292.exe (PID: 8240)
- Unicorn-57389.exe (PID: 8256)
- Unicorn-52900.exe (PID: 2420)
- Unicorn-32722.exe (PID: 8300)
- Unicorn-60020.exe (PID: 8284)
- Unicorn-37523.exe (PID: 8248)
- Unicorn-39023.exe (PID: 8396)
- Unicorn-9688.exe (PID: 8376)
- Unicorn-22818.exe (PID: 8384)
- Unicorn-30227.exe (PID: 8580)
- Unicorn-50093.exe (PID: 8568)
- Unicorn-1276.exe (PID: 8680)
- Unicorn-48517.exe (PID: 8436)
- Unicorn-64893.exe (PID: 8424)
- Unicorn-37893.exe (PID: 8348)
- Unicorn-45952.exe (PID: 8276)
- Unicorn-39237.exe (PID: 8336)
- Unicorn-35795.exe (PID: 8616)
- Unicorn-51629.exe (PID: 8928)
- Unicorn-41660.exe (PID: 8608)
- Unicorn-43989.exe (PID: 8496)
- Unicorn-45412.exe (PID: 8452)
- Unicorn-38971.exe (PID: 9036)
- Unicorn-50700.exe (PID: 8328)
- Unicorn-41925.exe (PID: 8624)
- Unicorn-16653.exe (PID: 8868)
- Unicorn-65313.exe (PID: 8916)
- Unicorn-15308.exe (PID: 8504)
- Unicorn-42693.exe (PID: 9084)
- Unicorn-26741.exe (PID: 9100)
- Unicorn-57597.exe (PID: 9168)
- Unicorn-26125.exe (PID: 9048)
- Unicorn-17997.exe (PID: 9068)
- Unicorn-33786.exe (PID: 9188)
- Unicorn-22635.exe (PID: 9076)
- Unicorn-32325.exe (PID: 7908)
- Unicorn-30571.exe (PID: 9144)
- Unicorn-20051.exe (PID: 9180)
- Unicorn-36667.exe (PID: 7616)
- Unicorn-42532.exe (PID: 6632)
- Unicorn-43949.exe (PID: 2136)
- Unicorn-52044.exe (PID: 9228)
- Unicorn-52044.exe (PID: 9236)
- Unicorn-25885.exe (PID: 920)
- Unicorn-53653.exe (PID: 9328)
- Unicorn-16683.exe (PID: 9376)
- Unicorn-35514.exe (PID: 9404)
- Unicorn-38128.exe (PID: 9492)
- Unicorn-27922.exe (PID: 9484)
- Unicorn-54656.exe (PID: 9516)
- Unicorn-10522.exe (PID: 8876)
- Unicorn-2265.exe (PID: 9548)
- Unicorn-41379.exe (PID: 9384)
- Unicorn-43573.exe (PID: 9592)
- Unicorn-12088.exe (PID: 9644)
- Unicorn-39472.exe (PID: 9572)
- Unicorn-37626.exe (PID: 9584)
- Unicorn-57330.exe (PID: 7188)
- Unicorn-20434.exe (PID: 9924)
- Unicorn-24287.exe (PID: 9664)
- Unicorn-6297.exe (PID: 9704)
- Unicorn-21320.exe (PID: 3032)
- Unicorn-53121.exe (PID: 9764)
- Unicorn-7449.exe (PID: 9776)
- Unicorn-44377.exe (PID: 9844)
- Unicorn-4097.exe (PID: 9932)
- Unicorn-15810.exe (PID: 9784)
- Unicorn-55498.exe (PID: 9696)
- Unicorn-61280.exe (PID: 10032)
- Unicorn-3832.exe (PID: 10536)
- Unicorn-17567.exe (PID: 10528)
- Unicorn-28467.exe (PID: 10308)
- Unicorn-21320.exe (PID: 6208)
- Unicorn-32250.exe (PID: 10428)
- Unicorn-28467.exe (PID: 10072)
- Unicorn-2127.exe (PID: 10420)
- Unicorn-17567.exe (PID: 10556)
- Unicorn-36858.exe (PID: 9636)
- Unicorn-41378.exe (PID: 10604)
- Unicorn-28167.exe (PID: 10648)
- Unicorn-55026.exe (PID: 10112)
- Unicorn-13728.exe (PID: 10696)
- Unicorn-17287.exe (PID: 10704)
- Unicorn-14767.exe (PID: 10392)
- Unicorn-7081.exe (PID: 10736)
- Unicorn-39178.exe (PID: 10760)
- Unicorn-31970.exe (PID: 10728)
- Unicorn-40138.exe (PID: 10900)
- Unicorn-42067.exe (PID: 10968)
- Unicorn-47932.exe (PID: 10992)
- Unicorn-31778.exe (PID: 11100)
- Unicorn-42716.exe (PID: 11392)
- Unicorn-52914.exe (PID: 11180)
- Unicorn-14111.exe (PID: 11196)
- Unicorn-8913.exe (PID: 11332)
- Unicorn-19976.exe (PID: 11244)
- Unicorn-61009.exe (PID: 5892)
- Unicorn-376.exe (PID: 4244)
- Unicorn-60698.exe (PID: 11148)
- Unicorn-4319.exe (PID: 11500)
- Unicorn-1320.exe (PID: 11524)
- Unicorn-43049.exe (PID: 11540)
- Unicorn-64097.exe (PID: 11708)
- Unicorn-10071.exe (PID: 11584)
- Unicorn-36495.exe (PID: 11800)
- Unicorn-19007.exe (PID: 11872)
- Unicorn-12369.exe (PID: 11776)
- Unicorn-4319.exe (PID: 12032)
- Unicorn-4319.exe (PID: 12040)
- Unicorn-47464.exe (PID: 11824)
- Unicorn-3345.exe (PID: 10820)
- Unicorn-64096.exe (PID: 10088)
- Unicorn-52546.exe (PID: 11328)
- Unicorn-10553.exe (PID: 5164)
- Unicorn-21498.exe (PID: 12268)
- Unicorn-48616.exe (PID: 11996)
- Unicorn-55824.exe (PID: 12220)
- Unicorn-11632.exe (PID: 12424)
- Unicorn-45264.exe (PID: 11484)
- Unicorn-49889.exe (PID: 12892)
- Unicorn-2577.exe (PID: 1812)
- Unicorn-42280.exe (PID: 12536)
- Unicorn-41704.exe (PID: 12600)
- Unicorn-46834.exe (PID: 12476)
- Unicorn-52656.exe (PID: 12836)
- Unicorn-63624.exe (PID: 12860)
- Unicorn-36120.exe (PID: 12852)
- Unicorn-49889.exe (PID: 12868)
- Unicorn-63624.exe (PID: 12876)
- Unicorn-48898.exe (PID: 13160)
- Unicorn-11290.exe (PID: 13128)
- Unicorn-54954.exe (PID: 13112)
- Unicorn-10944.exe (PID: 12804)
- Unicorn-19328.exe (PID: 13056)
- Unicorn-58025.exe (PID: 13464)
- Unicorn-51232.exe (PID: 14052)
- Unicorn-41026.exe (PID: 13816)
- Unicorn-63625.exe (PID: 13496)
- Unicorn-20671.exe (PID: 13984)
- Unicorn-31056.exe (PID: 13868)
- Unicorn-54688.exe (PID: 14128)
- Unicorn-41992.exe (PID: 13860)
- Unicorn-14231.exe (PID: 14280)
- Unicorn-60050.exe (PID: 14344)
- Unicorn-3184.exe (PID: 5504)
- Unicorn-21823.exe (PID: 14084)
- Unicorn-2970.exe (PID: 13524)
- Unicorn-31056.exe (PID: 13900)
- Unicorn-953.exe (PID: 14020)
- Unicorn-53152.exe (PID: 13952)
- Unicorn-31056.exe (PID: 13844)
- Unicorn-49776.exe (PID: 14028)
- Unicorn-50657.exe (PID: 13976)
- Unicorn-25456.exe (PID: 13912)
- Unicorn-10863.exe (PID: 13608)
- Unicorn-10863.exe (PID: 13600)
- Unicorn-63625.exe (PID: 13480)
- Unicorn-51233.exe (PID: 14004)
- Unicorn-52296.exe (PID: 14368)
- Unicorn-19047.exe (PID: 14452)
- Unicorn-21823.exe (PID: 6620)
- Unicorn-39520.exe (PID: 14856)
- Unicorn-36729.exe (PID: 14944)
- Unicorn-26527.exe (PID: 14776)
- Unicorn-26527.exe (PID: 14760)
- Unicorn-54793.exe (PID: 15100)
- Unicorn-46128.exe (PID: 15108)
- Unicorn-38457.exe (PID: 15148)
- Unicorn-3487.exe (PID: 16528)
- Unicorn-54290.exe (PID: 15216)
- Unicorn-23655.exe (PID: 15240)
- Unicorn-63625.exe (PID: 13488)
- Unicorn-51153.exe (PID: 15440)
- Unicorn-34319.exe (PID: 15616)
- Unicorn-12985.exe (PID: 16052)
- Unicorn-48120.exe (PID: 15756)
- Unicorn-46749.exe (PID: 15880)
- Unicorn-17711.exe (PID: 16456)
- Unicorn-28824.exe (PID: 15288)
- Unicorn-25760.exe (PID: 15328)
- Unicorn-13256.exe (PID: 15140)
- Unicorn-46618.exe (PID: 16284)
- Unicorn-872.exe (PID: 16608)
- Unicorn-297.exe (PID: 7344)
- Unicorn-28063.exe (PID: 15920)
- Unicorn-4240.exe (PID: 16116)
- Unicorn-23281.exe (PID: 15976)
- Unicorn-53250.exe (PID: 16256)
Create files in a temporary directory
- 1 (1158).exe (PID: 2148)
- Unicorn-14404.exe (PID: 7332)
- Unicorn-40793.exe (PID: 7372)
- Unicorn-8644.exe (PID: 7420)
- Unicorn-58805.exe (PID: 6132)
- Unicorn-19234.exe (PID: 7452)
- Unicorn-16997.exe (PID: 5956)
- Unicorn-20491.exe (PID: 7484)
- Unicorn-6267.exe (PID: 6828)
- Unicorn-25853.exe (PID: 7592)
- Unicorn-57845.exe (PID: 7408)
- Unicorn-34662.exe (PID: 7364)
- Unicorn-24021.exe (PID: 7476)
- Unicorn-5307.exe (PID: 7440)
- Unicorn-9028.exe (PID: 7468)
- Unicorn-51893.exe (PID: 7816)
- Unicorn-13090.exe (PID: 7828)
- Unicorn-51701.exe (PID: 7784)
- Unicorn-8852.exe (PID: 7204)
- Unicorn-13683.exe (PID: 664)
- Unicorn-45868.exe (PID: 7676)
- Unicorn-5110.exe (PID: 7608)
- Unicorn-41229.exe (PID: 7664)
- Unicorn-2604.exe (PID: 5228)
- Unicorn-40683.exe (PID: 2268)
- Unicorn-51628.exe (PID: 7808)
- Unicorn-315.exe (PID: 7348)
- Unicorn-50580.exe (PID: 7560)
- Unicorn-38275.exe (PID: 7396)
- Unicorn-40683.exe (PID: 6512)
- Unicorn-61131.exe (PID: 7732)
- Unicorn-23683.exe (PID: 4208)
- Unicorn-35277.exe (PID: 7404)
- Unicorn-20698.exe (PID: 7996)
- Unicorn-57508.exe (PID: 3956)
- Unicorn-13076.exe (PID: 7600)
- Unicorn-34347.exe (PID: 5864)
- Unicorn-57373.exe (PID: 7644)
- Unicorn-61893.exe (PID: 7772)
- Unicorn-40092.exe (PID: 7492)
- Unicorn-56147.exe (PID: 2560)
- Unicorn-15691.exe (PID: 7848)
- Unicorn-29626.exe (PID: 1128)
- Unicorn-62002.exe (PID: 6436)
- Unicorn-60860.exe (PID: 5280)
- Unicorn-10108.exe (PID: 8064)
- Unicorn-63761.exe (PID: 7760)
- Unicorn-20965.exe (PID: 4188)
- Unicorn-55396.exe (PID: 8156)
- Unicorn-1556.exe (PID: 7948)
- Unicorn-18744.exe (PID: 1228)
- Unicorn-45090.exe (PID: 1760)
- Unicorn-31245.exe (PID: 6080)
- Unicorn-10035.exe (PID: 8080)
- Unicorn-37021.exe (PID: 1324)
- Unicorn-50564.exe (PID: 7972)
- Unicorn-47877.exe (PID: 8136)
- Unicorn-5426.exe (PID: 7260)
- Unicorn-37893.exe (PID: 8348)
- Unicorn-64331.exe (PID: 7576)
- Unicorn-10290.exe (PID: 7836)
- Unicorn-65187.exe (PID: 6800)
- Unicorn-50700.exe (PID: 8328)
- Unicorn-1276.exe (PID: 8680)
- Unicorn-46429.exe (PID: 5960)
- Unicorn-59693.exe (PID: 7984)
- Unicorn-60020.exe (PID: 8284)
- Unicorn-39023.exe (PID: 8396)
- Unicorn-32443.exe (PID: 9244)
- Unicorn-56237.exe (PID: 7284)
- Unicorn-18987.exe (PID: 8292)
- Unicorn-56340.exe (PID: 7776)
- Unicorn-17997.exe (PID: 9068)
- Unicorn-5794.exe (PID: 3268)
- Unicorn-22635.exe (PID: 9076)
- Unicorn-16683.exe (PID: 9376)
- Unicorn-16653.exe (PID: 8868)
- Unicorn-22818.exe (PID: 8384)
- Unicorn-53653.exe (PID: 9328)
- Unicorn-48517.exe (PID: 8436)
- Unicorn-39472.exe (PID: 9572)
- Unicorn-39237.exe (PID: 8336)
- Unicorn-30571.exe (PID: 9144)
- Unicorn-51435.exe (PID: 7688)
- Unicorn-40802.exe (PID: 10236)
- Unicorn-57330.exe (PID: 7188)
- Unicorn-51068.exe (PID: 8164)
- Unicorn-2811.exe (PID: 4448)
- Unicorn-47524.exe (PID: 9092)
- Unicorn-18853.exe (PID: 5364)
- Unicorn-21320.exe (PID: 3032)
- Unicorn-38645.exe (PID: 7292)
- Unicorn-40483.exe (PID: 976)
- Unicorn-49605.exe (PID: 6760)
- Unicorn-35028.exe (PID: 9008)
- Unicorn-65313.exe (PID: 8916)
- Unicorn-25885.exe (PID: 920)
- Unicorn-32325.exe (PID: 7908)
- Unicorn-53876.exe (PID: 9152)
- Unicorn-47628.exe (PID: 9272)
- Unicorn-28645.exe (PID: 6268)
- Unicorn-42716.exe (PID: 11392)
- Unicorn-43989.exe (PID: 8496)
- Unicorn-33396.exe (PID: 11436)
- Unicorn-2265.exe (PID: 9548)
- Unicorn-22059.exe (PID: 8632)
- Unicorn-24333.exe (PID: 8224)
- Unicorn-63460.exe (PID: 1040)
- Unicorn-19007.exe (PID: 11872)
- Unicorn-52900.exe (PID: 2420)
- Unicorn-20051.exe (PID: 9180)
- Unicorn-58680.exe (PID: 9528)
- Unicorn-52044.exe (PID: 9228)
- Unicorn-50093.exe (PID: 8568)
- Unicorn-43949.exe (PID: 2136)
- Unicorn-49889.exe (PID: 12892)
- Unicorn-803.exe (PID: 7700)
- Unicorn-38971.exe (PID: 9036)
- Unicorn-11290.exe (PID: 13128)
- Unicorn-51232.exe (PID: 14052)
- Unicorn-21823.exe (PID: 14092)
- Unicorn-4319.exe (PID: 11500)
- Unicorn-13372.exe (PID: 4452)
- Unicorn-42781.exe (PID: 7308)
- Unicorn-37626.exe (PID: 9584)
- Unicorn-28167.exe (PID: 10648)
- Unicorn-27234.exe (PID: 9264)
- Unicorn-54656.exe (PID: 9516)
- Unicorn-41379.exe (PID: 9384)
- Unicorn-11689.exe (PID: 11160)
- Unicorn-10553.exe (PID: 5164)
- Unicorn-49776.exe (PID: 14028)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 7556)
- BackgroundTransferHost.exe (PID: 7964)
- BackgroundTransferHost.exe (PID: 8180)
- BackgroundTransferHost.exe (PID: 7872)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 7964)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 7964)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 7964)
- WerFault.exe (PID: 11308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
715
Monitored processes
577
Malicious processes
83
Suspicious processes
67
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 660 | C:\Users\admin\AppData\Local\Temp\Unicorn-25015.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-25015.exe | — | Unicorn-13372.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 | |||||||||||||||
| 664 | C:\Users\admin\AppData\Local\Temp\Unicorn-13683.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13683.exe | Unicorn-57845.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 684 | C:\Users\admin\AppData\Local\Temp\Unicorn-61344.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-61344.exe | — | Unicorn-43989.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 | |||||||||||||||
| 720 | C:\Users\admin\AppData\Local\Temp\Unicorn-6268.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-6268.exe | Unicorn-57508.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 920 | C:\Users\admin\AppData\Local\Temp\Unicorn-25885.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-25885.exe | Unicorn-5426.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 976 | C:\Users\admin\AppData\Local\Temp\Unicorn-40483.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-40483.exe | Unicorn-58805.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1040 | C:\Users\admin\AppData\Local\Temp\Unicorn-63460.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63460.exe | Unicorn-315.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1056 | C:\Users\admin\AppData\Local\Temp\Unicorn-49385.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49385.exe | Unicorn-18853.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1128 | C:\Users\admin\AppData\Local\Temp\Unicorn-29626.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-29626.exe | Unicorn-40683.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1184 | C:\Users\admin\AppData\Local\Temp\Unicorn-41643.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-41643.exe | Unicorn-9028.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
17 075
Read events
17 060
Write events
15
Delete events
0
Modification events
| (PID) Process: | (7556) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7556) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7556) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7964) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7964) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7964) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (4400) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4400) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4400) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (8180) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
758
Suspicious files
11
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2148 | 1 (1158).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-40092.exe | executable | |
MD5:B65DF5E106D9A66DA5CC5E91CECE1150 | SHA256:B3FD46B31F2948F33A0BDF4C4707C5FE9A440BF09F5538ACA95F1E73111A582D | |||
| 6828 | Unicorn-6267.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20491.exe | executable | |
MD5:4DEA8C7FB7DA6E61DDE1ECCEAF281872 | SHA256:4DEC239D6A6D9EACB0448C3E9C42A564B8A1C8025EBB591B7C1CF02CC2364616 | |||
| 7348 | Unicorn-315.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-45868.exe | executable | |
MD5:FA73D13C6B8CDE8AC7D39E4A6A40659D | SHA256:61E1CF3E8F26A1E6699E484A151F1D263DE81F17D0C738E396425AB895F6C646 | |||
| 5956 | Unicorn-16997.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-19234.exe | executable | |
MD5:277AD7D5B897FFB190C81FF7696580AB | SHA256:7E3D1D1A0C2E25067EFD7EDE079FB5F91440B008FAEE6E620E232748138D66DC | |||
| 7348 | Unicorn-315.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8644.exe | executable | |
MD5:5B7F7BD133A8DA540EDE78AD1660D71B | SHA256:26359BCCE60DC1BDBAF526DAE17D1F8185B599C264D75A64E896E045B6B14AD6 | |||
| 2148 | 1 (1158).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-6267.exe | executable | |
MD5:E03BFB7B1B7417B6C15EBFBCA2019DEA | SHA256:B54D66F6C97FABBBA413152174DA4114D4EAAFA96BEAEFEA679095496A47CD80 | |||
| 7332 | Unicorn-14404.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5110.exe | executable | |
MD5:6C9E61CAA410B2660CFBA25F2F1CE09A | SHA256:20BB9307E8E4C3C1ADAC37C74C575C6E4E3B88798372E5AEB49BBEAB11F29702 | |||
| 7420 | Unicorn-8644.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-57373.exe | executable | |
MD5:5EB8B13372D767FAB7FA4533CD600BCD | SHA256:116017B09059EBBDCE8E062B0059250449D645BC7BECE4382F352461BFC58F36 | |||
| 7408 | Unicorn-57845.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-25853.exe | executable | |
MD5:949B0586D723052BD814786422DA02AF | SHA256:595E6C6F89427A4E352F959CE29CEEFA112DC29CEF01178B5E37B1ED5C19B211 | |||
| 2148 | 1 (1158).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-16997.exe | executable | |
MD5:B53AED042FC64386AF6378730E4D97E1 | SHA256:6BA7492E8218D88F454B23E2AE280B852CDAC230CED12A585F3B88D279284320 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
25
DNS requests
16
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.169:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
7084 | SIHClient.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7964 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
6668 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
7084 | SIHClient.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.48.23.169:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.48.23.169:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 23.48.23.169:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.159.4:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
6668 | backgroundTaskHost.exe | 20.223.36.55:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6668 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |