| File name: | 1 (1157) |
| Full analysis: | https://app.any.run/tasks/6e40deec-459d-488c-8aa6-6dc4fba8b436 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 08:18:37 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 338671257DE2C4663B590D258EB9B3D0 |
| SHA1: | D3A7D10B579A3E0A8DD2C33B4176839F3202D5D9 |
| SHA256: | 861B9A8114285C044455050374D5C1C891D93E221D2FA5397ABA39007F2B5588 |
| SSDEEP: | 6144:17mgiJWE8DVHA5i+D/eyiKax5tpqWvJGDB/xAewATk/8SwjwpyAvhhGmeAO0/FQa:1ajoVHA5DD23pfhUBJAewAjx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- Unicorn-7933.exe (PID: 300)
- 1 (1157).exe (PID: 7476)
- Unicorn-56584.exe (PID: 7908)
- Unicorn-11462.exe (PID: 6944)
- Unicorn-27519.exe (PID: 7300)
- Unicorn-27519.exe (PID: 7304)
- Unicorn-62421.exe (PID: 6988)
- Unicorn-48686.exe (PID: 4692)
- Unicorn-22335.exe (PID: 4608)
- Unicorn-35333.exe (PID: 4736)
- Unicorn-40809.exe (PID: 1660)
- Unicorn-22335.exe (PID: 4488)
- Unicorn-35333.exe (PID: 5056)
- Unicorn-14860.exe (PID: 6872)
- Unicorn-20725.exe (PID: 1056)
- Unicorn-1613.exe (PID: 7992)
- Unicorn-15614.exe (PID: 780)
- Unicorn-23783.exe (PID: 6268)
- Unicorn-39796.exe (PID: 5740)
- Unicorn-56839.exe (PID: 5680)
- Unicorn-56839.exe (PID: 7884)
- Unicorn-39796.exe (PID: 7784)
- Unicorn-20637.exe (PID: 7472)
- Unicorn-56766.exe (PID: 1328)
- Unicorn-18036.exe (PID: 8084)
- Unicorn-9868.exe (PID: 8092)
- Unicorn-15999.exe (PID: 5212)
- Unicorn-15999.exe (PID: 1128)
- Unicorn-48101.exe (PID: 2268)
- Unicorn-18111.exe (PID: 8124)
- Unicorn-8510.exe (PID: 7232)
- Unicorn-48199.exe (PID: 7220)
- Unicorn-36501.exe (PID: 7244)
- Unicorn-59055.exe (PID: 7712)
- Unicorn-61582.exe (PID: 2096)
- Unicorn-44949.exe (PID: 7516)
- Unicorn-49927.exe (PID: 8008)
- Unicorn-65007.exe (PID: 8108)
- Unicorn-2956.exe (PID: 8100)
- Unicorn-52257.exe (PID: 7976)
- Unicorn-5749.exe (PID: 8020)
- Unicorn-38613.exe (PID: 7932)
- Unicorn-58287.exe (PID: 7988)
- Unicorn-60399.exe (PID: 8156)
- Unicorn-35895.exe (PID: 1196)
- Unicorn-51462.exe (PID: 7812)
- Unicorn-3030.exe (PID: 7500)
- Unicorn-3030.exe (PID: 7860)
- Unicorn-52231.exe (PID: 6876)
- Unicorn-11390.exe (PID: 7808)
- Unicorn-40725.exe (PID: 4244)
- Unicorn-35895.exe (PID: 7888)
- Unicorn-51661.exe (PID: 5024)
- Unicorn-11317.exe (PID: 3896)
- Unicorn-57254.exe (PID: 2040)
- Unicorn-5452.exe (PID: 6248)
- Unicorn-11317.exe (PID: 8152)
- Unicorn-45625.exe (PID: 6044)
- Unicorn-57254.exe (PID: 8184)
- Unicorn-31981.exe (PID: 6560)
- Unicorn-51582.exe (PID: 8132)
- Unicorn-11980.exe (PID: 6744)
- Unicorn-45625.exe (PID: 208)
- Unicorn-52485.exe (PID: 7188)
- Unicorn-28524.exe (PID: 7772)
- Unicorn-61359.exe (PID: 3888)
- Unicorn-56891.exe (PID: 4880)
- Unicorn-33517.exe (PID: 3304)
- Unicorn-4212.exe (PID: 8116)
- Unicorn-59351.exe (PID: 8128)
- Unicorn-1790.exe (PID: 5552)
- Unicorn-9309.exe (PID: 5728)
- Unicorn-26103.exe (PID: 5352)
- Unicorn-63222.exe (PID: 6656)
- Unicorn-34079.exe (PID: 7680)
- Unicorn-50223.exe (PID: 7752)
- Unicorn-39101.exe (PID: 5428)
- Unicorn-3637.exe (PID: 968)
- Unicorn-32853.exe (PID: 6436)
- Unicorn-3710.exe (PID: 7660)
- Unicorn-25453.exe (PID: 8228)
- Unicorn-26413.exe (PID: 5548)
- Unicorn-54639.exe (PID: 4180)
- Unicorn-55909.exe (PID: 8284)
- Unicorn-20815.exe (PID: 8256)
- Unicorn-22927.exe (PID: 8320)
- Unicorn-49853.exe (PID: 8376)
- Unicorn-23838.exe (PID: 8424)
- Unicorn-38830.exe (PID: 8452)
- Unicorn-25378.exe (PID: 8484)
- Unicorn-55510.exe (PID: 8528)
- Unicorn-55934.exe (PID: 8572)
- Unicorn-35876.exe (PID: 8520)
- Unicorn-12955.exe (PID: 8580)
- Unicorn-16630.exe (PID: 8592)
- Unicorn-25378.exe (PID: 8492)
- Unicorn-46157.exe (PID: 8624)
- Unicorn-22494.exe (PID: 8444)
- Unicorn-14901.exe (PID: 8552)
- Unicorn-49878.exe (PID: 8648)
- Unicorn-17206.exe (PID: 8680)
- Unicorn-30012.exe (PID: 8640)
- Unicorn-7507.exe (PID: 8828)
- Unicorn-12773.exe (PID: 8784)
- Unicorn-16054.exe (PID: 8744)
- Unicorn-58237.exe (PID: 8908)
- Unicorn-43172.exe (PID: 8852)
- Unicorn-28371.exe (PID: 8928)
- Unicorn-53687.exe (PID: 8728)
- Unicorn-6908.exe (PID: 8776)
- Unicorn-65062.exe (PID: 8736)
- Unicorn-26334.exe (PID: 8888)
- Unicorn-24606.exe (PID: 8820)
- Unicorn-57278.exe (PID: 8876)
- Unicorn-15862.exe (PID: 8720)
- Unicorn-42862.exe (PID: 8956)
- Unicorn-64221.exe (PID: 8988)
- Unicorn-9619.exe (PID: 8972)
- Unicorn-12419.exe (PID: 8980)
- Unicorn-50844.exe (PID: 9020)
- Unicorn-51606.exe (PID: 9028)
- Unicorn-8196.exe (PID: 9148)
- Unicorn-38756.exe (PID: 9068)
- Unicorn-59006.exe (PID: 9084)
- Unicorn-59006.exe (PID: 9092)
- Unicorn-21931.exe (PID: 9140)
- Unicorn-11533.exe (PID: 9120)
- Unicorn-52758.exe (PID: 9172)
- Unicorn-47012.exe (PID: 8412)
- Unicorn-28254.exe (PID: 9204)
- Unicorn-52758.exe (PID: 9180)
- Unicorn-412.exe (PID: 7380)
- Unicorn-59701.exe (PID: 856)
- Unicorn-10957.exe (PID: 7528)
- Unicorn-64989.exe (PID: 7844)
- Unicorn-11149.exe (PID: 728)
- Unicorn-37727.exe (PID: 6620)
- Unicorn-22140.exe (PID: 9232)
- Unicorn-50366.exe (PID: 9288)
- Unicorn-25213.exe (PID: 6808)
- Unicorn-33838.exe (PID: 9272)
- Unicorn-9525.exe (PID: 9320)
- Unicorn-51252.exe (PID: 9364)
- Unicorn-4481.exe (PID: 9380)
- Unicorn-57958.exe (PID: 9404)
- Unicorn-23676.exe (PID: 9444)
- Unicorn-65123.exe (PID: 9464)
- Unicorn-34995.exe (PID: 9488)
- Unicorn-26054.exe (PID: 9512)
- Unicorn-15124.exe (PID: 9428)
- Unicorn-61532.exe (PID: 9576)
- Unicorn-44590.exe (PID: 9552)
- Unicorn-20574.exe (PID: 9620)
- Unicorn-34414.exe (PID: 9532)
- Unicorn-18851.exe (PID: 9664)
- Unicorn-15670.exe (PID: 8432)
- Unicorn-12083.exe (PID: 9636)
- Unicorn-5773.exe (PID: 9704)
- Unicorn-26172.exe (PID: 9732)
- Unicorn-35862.exe (PID: 9752)
- Unicorn-19526.exe (PID: 9768)
- Unicorn-60750.exe (PID: 9796)
- Unicorn-29155.exe (PID: 9856)
- Unicorn-12435.exe (PID: 9820)
Executable content was dropped or overwritten
- 1 (1157).exe (PID: 7476)
- Unicorn-56584.exe (PID: 7908)
- Unicorn-7933.exe (PID: 300)
- Unicorn-27519.exe (PID: 7304)
- Unicorn-11462.exe (PID: 6944)
- Unicorn-48686.exe (PID: 4692)
- Unicorn-35333.exe (PID: 5056)
- Unicorn-40809.exe (PID: 1660)
- Unicorn-22335.exe (PID: 4608)
- Unicorn-22335.exe (PID: 4488)
- Unicorn-14860.exe (PID: 6872)
- Unicorn-62421.exe (PID: 6988)
- Unicorn-15614.exe (PID: 780)
- Unicorn-1613.exe (PID: 7992)
- Unicorn-23783.exe (PID: 6268)
- Unicorn-39796.exe (PID: 5740)
- Unicorn-56839.exe (PID: 5680)
- Unicorn-56839.exe (PID: 7884)
- Unicorn-27519.exe (PID: 7300)
- Unicorn-39796.exe (PID: 7784)
- Unicorn-15999.exe (PID: 5212)
- Unicorn-18036.exe (PID: 8084)
- Unicorn-15999.exe (PID: 1128)
- Unicorn-35333.exe (PID: 4736)
- Unicorn-48101.exe (PID: 2268)
- Unicorn-65007.exe (PID: 8108)
- Unicorn-11980.exe (PID: 6744)
- Unicorn-8510.exe (PID: 7232)
- Unicorn-48199.exe (PID: 7220)
- Unicorn-36501.exe (PID: 7244)
- Unicorn-59055.exe (PID: 7712)
- Unicorn-44949.exe (PID: 7516)
- Unicorn-61582.exe (PID: 2096)
- Unicorn-2956.exe (PID: 8100)
- Unicorn-49927.exe (PID: 8008)
- Unicorn-52257.exe (PID: 7976)
- Unicorn-5749.exe (PID: 8020)
- Unicorn-38613.exe (PID: 7932)
- Unicorn-58287.exe (PID: 7988)
- Unicorn-60399.exe (PID: 8156)
- Unicorn-35895.exe (PID: 1196)
- Unicorn-51462.exe (PID: 7812)
- Unicorn-52231.exe (PID: 6876)
- Unicorn-3030.exe (PID: 7500)
- Unicorn-3030.exe (PID: 7860)
- Unicorn-35895.exe (PID: 7888)
- Unicorn-11390.exe (PID: 7808)
- Unicorn-20637.exe (PID: 7472)
- Unicorn-56766.exe (PID: 1328)
- Unicorn-40725.exe (PID: 4244)
- Unicorn-51661.exe (PID: 5024)
- Unicorn-11317.exe (PID: 3896)
- Unicorn-57254.exe (PID: 2040)
- Unicorn-57254.exe (PID: 8184)
- Unicorn-9868.exe (PID: 8092)
- Unicorn-5452.exe (PID: 6248)
- Unicorn-11317.exe (PID: 8152)
- Unicorn-31981.exe (PID: 6560)
- Unicorn-45625.exe (PID: 6044)
- Unicorn-18111.exe (PID: 8124)
- Unicorn-45625.exe (PID: 208)
- Unicorn-20725.exe (PID: 1056)
- Unicorn-51582.exe (PID: 8132)
- Unicorn-61359.exe (PID: 3888)
- Unicorn-1790.exe (PID: 5552)
- Unicorn-56891.exe (PID: 4880)
- Unicorn-33517.exe (PID: 3304)
- Unicorn-4212.exe (PID: 8116)
- Unicorn-59351.exe (PID: 8128)
- Unicorn-63222.exe (PID: 6656)
- Unicorn-39101.exe (PID: 5428)
- Unicorn-9309.exe (PID: 5728)
- Unicorn-34079.exe (PID: 7680)
- Unicorn-50223.exe (PID: 7752)
- Unicorn-26103.exe (PID: 5352)
- Unicorn-3710.exe (PID: 7660)
- Unicorn-3637.exe (PID: 968)
- Unicorn-37727.exe (PID: 6620)
- Unicorn-32853.exe (PID: 6436)
- Unicorn-25453.exe (PID: 8228)
- Unicorn-26413.exe (PID: 5548)
- Unicorn-54639.exe (PID: 4180)
- Unicorn-55909.exe (PID: 8284)
- Unicorn-22927.exe (PID: 8320)
- Unicorn-49853.exe (PID: 8376)
- Unicorn-20815.exe (PID: 8256)
- Unicorn-38830.exe (PID: 8452)
- Unicorn-25378.exe (PID: 8484)
- Unicorn-23838.exe (PID: 8424)
- Unicorn-35876.exe (PID: 8520)
- Unicorn-15670.exe (PID: 8432)
- Unicorn-22494.exe (PID: 8444)
- Unicorn-55510.exe (PID: 8528)
- Unicorn-25378.exe (PID: 8492)
- Unicorn-46157.exe (PID: 8624)
- Unicorn-12955.exe (PID: 8580)
- Unicorn-16630.exe (PID: 8592)
- Unicorn-49878.exe (PID: 8648)
- Unicorn-14901.exe (PID: 8552)
- Unicorn-7507.exe (PID: 8828)
- Unicorn-17206.exe (PID: 8680)
- Unicorn-30012.exe (PID: 8640)
- Unicorn-53687.exe (PID: 8728)
- Unicorn-15862.exe (PID: 8720)
- Unicorn-6908.exe (PID: 8776)
- Unicorn-26334.exe (PID: 8888)
- Unicorn-57278.exe (PID: 8876)
- Unicorn-65062.exe (PID: 8736)
- Unicorn-24606.exe (PID: 8820)
- Unicorn-52485.exe (PID: 7188)
- Unicorn-9619.exe (PID: 8972)
- Unicorn-42862.exe (PID: 8956)
- Unicorn-64221.exe (PID: 8988)
- Unicorn-28524.exe (PID: 7772)
- Unicorn-50844.exe (PID: 9020)
- Unicorn-51606.exe (PID: 9028)
- Unicorn-8196.exe (PID: 9148)
- Unicorn-59006.exe (PID: 9084)
- Unicorn-38756.exe (PID: 9068)
- Unicorn-59006.exe (PID: 9092)
- Unicorn-21931.exe (PID: 9140)
- Unicorn-11533.exe (PID: 9120)
- Unicorn-52758.exe (PID: 9172)
- Unicorn-52758.exe (PID: 9180)
- Unicorn-412.exe (PID: 7380)
- Unicorn-47012.exe (PID: 8412)
- Unicorn-28254.exe (PID: 9204)
- Unicorn-64989.exe (PID: 7844)
- Unicorn-11149.exe (PID: 728)
- Unicorn-59701.exe (PID: 856)
- Unicorn-10957.exe (PID: 7528)
- Unicorn-25213.exe (PID: 6808)
- Unicorn-22140.exe (PID: 9232)
- Unicorn-50366.exe (PID: 9288)
- Unicorn-33838.exe (PID: 9272)
- Unicorn-9525.exe (PID: 9320)
- Unicorn-51252.exe (PID: 9364)
- Unicorn-4481.exe (PID: 9380)
- Unicorn-57958.exe (PID: 9404)
- Unicorn-23676.exe (PID: 9444)
- Unicorn-65123.exe (PID: 9464)
- Unicorn-34995.exe (PID: 9488)
- Unicorn-26054.exe (PID: 9512)
- Unicorn-34414.exe (PID: 9532)
- Unicorn-15124.exe (PID: 9428)
- Unicorn-44590.exe (PID: 9552)
- Unicorn-61532.exe (PID: 9576)
- Unicorn-2125.exe (PID: 9584)
- Unicorn-20574.exe (PID: 9620)
- Unicorn-55934.exe (PID: 8572)
- Unicorn-18851.exe (PID: 9664)
- Unicorn-12083.exe (PID: 9636)
- Unicorn-43172.exe (PID: 8852)
- Unicorn-58237.exe (PID: 8908)
- Unicorn-5773.exe (PID: 9704)
- Unicorn-26172.exe (PID: 9732)
- Unicorn-12419.exe (PID: 8980)
- Unicorn-35862.exe (PID: 9752)
- Unicorn-19526.exe (PID: 9768)
- Unicorn-29155.exe (PID: 9856)
- Unicorn-12435.exe (PID: 9820)
- Unicorn-60750.exe (PID: 9796)
- Unicorn-60869.exe (PID: 9952)
- Unicorn-20870.exe (PID: 9916)
- Unicorn-25508.exe (PID: 9896)
- Unicorn-38445.exe (PID: 9972)
- Unicorn-63822.exe (PID: 10012)
- Unicorn-38742.exe (PID: 9988)
- Unicorn-21358.exe (PID: 10228)
- Unicorn-18108.exe (PID: 10040)
- Unicorn-3474.exe (PID: 10088)
- Unicorn-12773.exe (PID: 8784)
- Unicorn-37694.exe (PID: 10208)
- Unicorn-33396.exe (PID: 2064)
- Unicorn-17252.exe (PID: 10252)
- Unicorn-55566.exe (PID: 10300)
- Unicorn-4341.exe (PID: 9876)
- Unicorn-12732.exe (PID: 10584)
- Unicorn-38654.exe (PID: 10452)
- Unicorn-31638.exe (PID: 10400)
- Unicorn-30486.exe (PID: 10460)
- Unicorn-29644.exe (PID: 10712)
- Unicorn-19172.exe (PID: 10520)
- Unicorn-7901.exe (PID: 10552)
- Unicorn-35019.exe (PID: 10680)
- Unicorn-35531.exe (PID: 10604)
- Unicorn-51164.exe (PID: 10640)
- Unicorn-40958.exe (PID: 10628)
- Unicorn-4756.exe (PID: 10672)
- Unicorn-64310.exe (PID: 10356)
- Unicorn-38846.exe (PID: 10472)
- Unicorn-31638.exe (PID: 10392)
- Unicorn-5597.exe (PID: 10384)
- Unicorn-47206.exe (PID: 10544)
- Unicorn-29644.exe (PID: 10716)
- Unicorn-16054.exe (PID: 8744)
- Unicorn-64886.exe (PID: 10788)
- Unicorn-30604.exe (PID: 10912)
- Unicorn-6732.exe (PID: 10816)
- Unicorn-22436.exe (PID: 10868)
- Unicorn-36172.exe (PID: 10852)
- Unicorn-42302.exe (PID: 10860)
- Unicorn-41269.exe (PID: 11168)
- Unicorn-58452.exe (PID: 11064)
- Unicorn-42494.exe (PID: 10952)
- Unicorn-36468.exe (PID: 10744)
- Unicorn-34059.exe (PID: 10772)
- Unicorn-58534.exe (PID: 10808)
- Unicorn-13500.exe (PID: 11176)
- Unicorn-41918.exe (PID: 11368)
- Unicorn-55924.exe (PID: 11248)
- Unicorn-38004.exe (PID: 11212)
- Unicorn-22375.exe (PID: 11292)
- Unicorn-55924.exe (PID: 11240)
- Unicorn-47524.exe (PID: 11232)
- Unicorn-55924.exe (PID: 11256)
- Unicorn-53739.exe (PID: 11156)
- Unicorn-13692.exe (PID: 11276)
- Unicorn-25390.exe (PID: 11328)
- Unicorn-18182.exe (PID: 11076)
- Unicorn-17222.exe (PID: 11356)
- Unicorn-9275.exe (PID: 11684)
- Unicorn-812.exe (PID: 11428)
- Unicorn-17414.exe (PID: 11456)
- Unicorn-60117.exe (PID: 11764)
- Unicorn-58446.exe (PID: 11472)
- Unicorn-51217.exe (PID: 10920)
- Unicorn-22375.exe (PID: 11288)
- Unicorn-41148.exe (PID: 11408)
- Unicorn-7045.exe (PID: 11632)
- Unicorn-28003.exe (PID: 10876)
- Unicorn-33011.exe (PID: 11780)
- Unicorn-60484.exe (PID: 11420)
- Unicorn-6085.exe (PID: 11728)
- Unicorn-55924.exe (PID: 7272)
- Unicorn-22628.exe (PID: 10960)
- Unicorn-38877.exe (PID: 11788)
- Unicorn-10916.exe (PID: 11736)
- Unicorn-33748.exe (PID: 11100)
- Unicorn-40294.exe (PID: 11712)
- Unicorn-14829.exe (PID: 11856)
- Unicorn-14829.exe (PID: 11868)
- Unicorn-28371.exe (PID: 8928)
- Unicorn-44165.exe (PID: 11832)
- Unicorn-8124.exe (PID: 11908)
- Unicorn-39526.exe (PID: 11888)
- Unicorn-55924.exe (PID: 7388)
- Unicorn-44357.exe (PID: 11508)
- Unicorn-38756.exe (PID: 11496)
- Unicorn-14460.exe (PID: 10968)
- Unicorn-60501.exe (PID: 11844)
- Unicorn-24347.exe (PID: 11948)
- Unicorn-33395.exe (PID: 11880)
- Unicorn-54445.exe (PID: 11968)
- Unicorn-52141.exe (PID: 11812)
Executes application which crashes
- Unicorn-62877.exe (PID: 8688)
- Unicorn-62877.exe (PID: 8672)
INFO
Reads the computer name
- 1 (1157).exe (PID: 7476)
- Unicorn-56584.exe (PID: 7908)
- Unicorn-11462.exe (PID: 6944)
- Unicorn-7933.exe (PID: 300)
- Unicorn-27519.exe (PID: 7300)
- Unicorn-48686.exe (PID: 4692)
- Unicorn-27519.exe (PID: 7304)
- Unicorn-62421.exe (PID: 6988)
- Unicorn-22335.exe (PID: 4488)
- Unicorn-35333.exe (PID: 5056)
- Unicorn-22335.exe (PID: 4608)
- Unicorn-35333.exe (PID: 4736)
- Unicorn-20725.exe (PID: 1056)
- Unicorn-40809.exe (PID: 1660)
- Unicorn-14860.exe (PID: 6872)
- Unicorn-1613.exe (PID: 7992)
- Unicorn-23783.exe (PID: 6268)
- Unicorn-15614.exe (PID: 780)
- Unicorn-39796.exe (PID: 5740)
- Unicorn-56839.exe (PID: 5680)
- Unicorn-39796.exe (PID: 7784)
- Unicorn-48101.exe (PID: 2268)
- Unicorn-18036.exe (PID: 8084)
- Unicorn-56766.exe (PID: 1328)
- Unicorn-9868.exe (PID: 8092)
- Unicorn-18111.exe (PID: 8124)
- Unicorn-15999.exe (PID: 1128)
- Unicorn-8510.exe (PID: 7232)
- Unicorn-48199.exe (PID: 7220)
- Unicorn-49927.exe (PID: 8008)
- Unicorn-59055.exe (PID: 7712)
- Unicorn-2956.exe (PID: 8100)
- Unicorn-58287.exe (PID: 7988)
- Unicorn-52257.exe (PID: 7976)
- Unicorn-3030.exe (PID: 7500)
- Unicorn-60399.exe (PID: 8156)
- Unicorn-35895.exe (PID: 1196)
- Unicorn-52231.exe (PID: 6876)
- Unicorn-11317.exe (PID: 3896)
- Unicorn-5452.exe (PID: 6248)
- Unicorn-45625.exe (PID: 6044)
- Unicorn-11390.exe (PID: 7808)
- Unicorn-45625.exe (PID: 208)
- Unicorn-61359.exe (PID: 3888)
- Unicorn-1790.exe (PID: 5552)
- Unicorn-51582.exe (PID: 8132)
- Unicorn-4212.exe (PID: 8116)
- Unicorn-34079.exe (PID: 7680)
- Unicorn-3710.exe (PID: 7660)
- Unicorn-32853.exe (PID: 6436)
- Unicorn-3637.exe (PID: 968)
- Unicorn-55909.exe (PID: 8284)
- Unicorn-22927.exe (PID: 8320)
- Unicorn-49853.exe (PID: 8376)
- Unicorn-23838.exe (PID: 8424)
- Unicorn-35876.exe (PID: 8520)
- Unicorn-55510.exe (PID: 8528)
- Unicorn-25378.exe (PID: 8484)
- Unicorn-49878.exe (PID: 8648)
- Unicorn-17206.exe (PID: 8680)
- Unicorn-62877.exe (PID: 8688)
- Unicorn-12773.exe (PID: 8784)
- Unicorn-6908.exe (PID: 8776)
- Unicorn-16630.exe (PID: 8592)
- Unicorn-25378.exe (PID: 8492)
- Unicorn-14901.exe (PID: 8552)
- Unicorn-26334.exe (PID: 8888)
- Unicorn-53687.exe (PID: 8728)
- Unicorn-65062.exe (PID: 8736)
- Unicorn-12419.exe (PID: 8980)
- Unicorn-38756.exe (PID: 9068)
- Unicorn-8196.exe (PID: 9148)
- Unicorn-412.exe (PID: 7380)
- Unicorn-47012.exe (PID: 8412)
- Unicorn-55659.exe (PID: 11224)
- Unicorn-10957.exe (PID: 7528)
- Unicorn-9525.exe (PID: 9320)
- Unicorn-25213.exe (PID: 6808)
- Unicorn-51252.exe (PID: 9364)
- Unicorn-4481.exe (PID: 9380)
- Unicorn-15124.exe (PID: 9428)
- Unicorn-34995.exe (PID: 9488)
- Unicorn-34414.exe (PID: 9532)
- Unicorn-18851.exe (PID: 9664)
- Unicorn-26172.exe (PID: 9732)
- Unicorn-60750.exe (PID: 9796)
- Unicorn-12435.exe (PID: 9820)
The sample compiled with chinese language support
- 1 (1157).exe (PID: 7476)
- Unicorn-30604.exe (PID: 10912)
- Unicorn-26413.exe (PID: 5548)
- Unicorn-8196.exe (PID: 9148)
- Unicorn-9309.exe (PID: 5728)
- Unicorn-18036.exe (PID: 8084)
- Unicorn-29155.exe (PID: 9856)
- Unicorn-17414.exe (PID: 11456)
- Unicorn-28003.exe (PID: 10876)
- Unicorn-33011.exe (PID: 11780)
- Unicorn-20870.exe (PID: 9916)
- Unicorn-25213.exe (PID: 6808)
- Unicorn-32853.exe (PID: 6436)
- Unicorn-412.exe (PID: 7380)
- Unicorn-50366.exe (PID: 9288)
- Unicorn-5597.exe (PID: 10384)
- Unicorn-58237.exe (PID: 8908)
- Unicorn-56839.exe (PID: 5680)
- Unicorn-60869.exe (PID: 9952)
- Unicorn-55909.exe (PID: 8284)
- Unicorn-42302.exe (PID: 10860)
- Unicorn-38445.exe (PID: 9972)
- Unicorn-9525.exe (PID: 9320)
- Unicorn-35333.exe (PID: 4736)
- Unicorn-33838.exe (PID: 9272)
- Unicorn-47206.exe (PID: 10544)
- Unicorn-57958.exe (PID: 9404)
- Unicorn-22628.exe (PID: 10960)
- Unicorn-49853.exe (PID: 8376)
- Unicorn-60484.exe (PID: 11420)
- Unicorn-48686.exe (PID: 4692)
- Unicorn-45625.exe (PID: 208)
- Unicorn-6085.exe (PID: 11728)
- Unicorn-35531.exe (PID: 10604)
- Unicorn-51217.exe (PID: 10920)
- Unicorn-54445.exe (PID: 11968)
- Unicorn-12435.exe (PID: 9820)
- Unicorn-3637.exe (PID: 968)
- Unicorn-22335.exe (PID: 4608)
- Unicorn-58446.exe (PID: 11472)
- Unicorn-27519.exe (PID: 7304)
- Unicorn-6732.exe (PID: 10816)
- Unicorn-59701.exe (PID: 856)
- Unicorn-8510.exe (PID: 7232)
- Unicorn-44590.exe (PID: 9552)
- Unicorn-49927.exe (PID: 8008)
- Unicorn-22375.exe (PID: 11288)
- Unicorn-41148.exe (PID: 11408)
- Unicorn-37727.exe (PID: 6620)
- Unicorn-11149.exe (PID: 728)
- Unicorn-50844.exe (PID: 9020)
- Unicorn-50223.exe (PID: 7752)
- Unicorn-39101.exe (PID: 5428)
- Unicorn-7045.exe (PID: 11632)
- Unicorn-31638.exe (PID: 10392)
- Unicorn-25508.exe (PID: 9896)
- Unicorn-38654.exe (PID: 10452)
- Unicorn-52141.exe (PID: 11812)
- Unicorn-64989.exe (PID: 7844)
- Unicorn-38846.exe (PID: 10472)
- Unicorn-26172.exe (PID: 9732)
- Unicorn-57278.exe (PID: 8876)
Checks supported languages
- 1 (1157).exe (PID: 7476)
- Unicorn-56584.exe (PID: 7908)
- Unicorn-48686.exe (PID: 4692)
- Unicorn-7933.exe (PID: 300)
- Unicorn-11462.exe (PID: 6944)
- Unicorn-27519.exe (PID: 7304)
- Unicorn-27519.exe (PID: 7300)
- Unicorn-35333.exe (PID: 4736)
- Unicorn-40809.exe (PID: 1660)
- Unicorn-35333.exe (PID: 5056)
- Unicorn-20725.exe (PID: 1056)
- Unicorn-62421.exe (PID: 6988)
- Unicorn-22335.exe (PID: 4608)
- Unicorn-22335.exe (PID: 4488)
- Unicorn-1613.exe (PID: 7992)
- Unicorn-14860.exe (PID: 6872)
- Unicorn-15614.exe (PID: 780)
- Unicorn-56839.exe (PID: 5680)
- Unicorn-56839.exe (PID: 7884)
- Unicorn-18036.exe (PID: 8084)
- Unicorn-15999.exe (PID: 1128)
- Unicorn-20637.exe (PID: 7472)
- Unicorn-65007.exe (PID: 8108)
- Unicorn-48101.exe (PID: 2268)
- Unicorn-56766.exe (PID: 1328)
- Unicorn-9868.exe (PID: 8092)
- Unicorn-18111.exe (PID: 8124)
- Unicorn-61582.exe (PID: 2096)
- Unicorn-8510.exe (PID: 7232)
- Unicorn-48199.exe (PID: 7220)
- Unicorn-59055.exe (PID: 7712)
- Unicorn-44949.exe (PID: 7516)
- Unicorn-49927.exe (PID: 8008)
- Unicorn-2956.exe (PID: 8100)
- Unicorn-11390.exe (PID: 7808)
- Unicorn-60399.exe (PID: 8156)
- Unicorn-35895.exe (PID: 1196)
- Unicorn-3030.exe (PID: 7860)
- Unicorn-38613.exe (PID: 7932)
- Unicorn-40725.exe (PID: 4244)
- Unicorn-57254.exe (PID: 8184)
- Unicorn-11317.exe (PID: 3896)
- Unicorn-5452.exe (PID: 6248)
- Unicorn-45625.exe (PID: 6044)
- Unicorn-45625.exe (PID: 208)
- Unicorn-51582.exe (PID: 8132)
- Unicorn-56891.exe (PID: 4880)
- Unicorn-57254.exe (PID: 2040)
- Unicorn-33517.exe (PID: 3304)
- Unicorn-50223.exe (PID: 7752)
- Unicorn-34079.exe (PID: 7680)
- Unicorn-9309.exe (PID: 5728)
- Unicorn-61359.exe (PID: 3888)
- Unicorn-26103.exe (PID: 5352)
- Unicorn-39101.exe (PID: 5428)
- Unicorn-32853.exe (PID: 6436)
- Unicorn-3710.exe (PID: 7660)
- Unicorn-25453.exe (PID: 8228)
- Unicorn-55909.exe (PID: 8284)
- Unicorn-37727.exe (PID: 6620)
- Unicorn-26413.exe (PID: 5548)
- Unicorn-49853.exe (PID: 8376)
- Unicorn-22927.exe (PID: 8320)
- Unicorn-22494.exe (PID: 8444)
- Unicorn-15670.exe (PID: 8432)
- Unicorn-25378.exe (PID: 8492)
- Unicorn-25378.exe (PID: 8484)
- Unicorn-55510.exe (PID: 8528)
- Unicorn-35876.exe (PID: 8520)
- Unicorn-23838.exe (PID: 8424)
- Unicorn-38830.exe (PID: 8452)
- Unicorn-55934.exe (PID: 8572)
- Unicorn-16630.exe (PID: 8592)
- Unicorn-46157.exe (PID: 8624)
- Unicorn-14901.exe (PID: 8552)
- Unicorn-17206.exe (PID: 8680)
- Unicorn-30012.exe (PID: 8640)
- Unicorn-62877.exe (PID: 8672)
- Unicorn-15862.exe (PID: 8720)
- Unicorn-53687.exe (PID: 8728)
- Unicorn-24606.exe (PID: 8820)
- Unicorn-7507.exe (PID: 8828)
- Unicorn-65062.exe (PID: 8736)
- Unicorn-9619.exe (PID: 8972)
- Unicorn-50844.exe (PID: 9020)
- Unicorn-43172.exe (PID: 8852)
- Unicorn-26334.exe (PID: 8888)
- Unicorn-58237.exe (PID: 8908)
- Unicorn-12419.exe (PID: 8980)
- Unicorn-59006.exe (PID: 9092)
- Unicorn-38756.exe (PID: 9068)
- Unicorn-59006.exe (PID: 9084)
- Unicorn-64989.exe (PID: 7844)
- Unicorn-11149.exe (PID: 728)
- Unicorn-22140.exe (PID: 9232)
- Unicorn-412.exe (PID: 7380)
- Unicorn-59701.exe (PID: 856)
- Unicorn-15124.exe (PID: 9428)
- Unicorn-65123.exe (PID: 9464)
- Unicorn-26054.exe (PID: 9512)
- Unicorn-34414.exe (PID: 9532)
- Unicorn-44590.exe (PID: 9552)
- Unicorn-61532.exe (PID: 9576)
- Unicorn-18851.exe (PID: 9664)
- Unicorn-20574.exe (PID: 9620)
- Unicorn-12083.exe (PID: 9636)
- Unicorn-35862.exe (PID: 9752)
- Unicorn-19526.exe (PID: 9768)
- Unicorn-12435.exe (PID: 9820)
- Unicorn-4341.exe (PID: 9876)
- Unicorn-5773.exe (PID: 9704)
- Unicorn-26172.exe (PID: 9732)
- Unicorn-25508.exe (PID: 9896)
- Unicorn-20870.exe (PID: 9916)
- Unicorn-60869.exe (PID: 9952)
- Unicorn-38742.exe (PID: 9988)
- Unicorn-33396.exe (PID: 2064)
- Unicorn-31638.exe (PID: 10392)
- Unicorn-64310.exe (PID: 10356)
- Unicorn-5597.exe (PID: 10384)
- Unicorn-31638.exe (PID: 10400)
- Unicorn-38846.exe (PID: 10472)
- Unicorn-32523.exe (PID: 10444)
- Unicorn-30486.exe (PID: 10460)
- Unicorn-19172.exe (PID: 10520)
- Unicorn-35019.exe (PID: 10680)
- Unicorn-29644.exe (PID: 10716)
- Unicorn-29644.exe (PID: 10712)
- Unicorn-34059.exe (PID: 10772)
- Unicorn-6732.exe (PID: 10816)
- Unicorn-58534.exe (PID: 10808)
- Unicorn-12732.exe (PID: 10584)
- Unicorn-4756.exe (PID: 10672)
- Unicorn-22436.exe (PID: 10868)
- Unicorn-42494.exe (PID: 10952)
- Unicorn-14460.exe (PID: 10968)
- Unicorn-18182.exe (PID: 11076)
- Unicorn-41269.exe (PID: 11168)
- Unicorn-36172.exe (PID: 10852)
- Unicorn-58452.exe (PID: 11064)
- Unicorn-38004.exe (PID: 11212)
- Unicorn-13500.exe (PID: 11176)
- Unicorn-47524.exe (PID: 11232)
- Unicorn-53739.exe (PID: 11156)
- Unicorn-55924.exe (PID: 11248)
- Unicorn-55924.exe (PID: 11256)
- Unicorn-25390.exe (PID: 11328)
- Unicorn-55924.exe (PID: 11240)
- Unicorn-17222.exe (PID: 11356)
- Unicorn-41918.exe (PID: 11368)
- Unicorn-13692.exe (PID: 11276)
- Unicorn-22375.exe (PID: 11292)
- Unicorn-58446.exe (PID: 11472)
- Unicorn-7045.exe (PID: 11632)
- Unicorn-38756.exe (PID: 11496)
- Unicorn-9275.exe (PID: 11684)
- Unicorn-40294.exe (PID: 11712)
- Unicorn-10916.exe (PID: 11736)
- Unicorn-60117.exe (PID: 11764)
- Unicorn-812.exe (PID: 11428)
- Unicorn-38877.exe (PID: 11788)
- Unicorn-44165.exe (PID: 11832)
- Unicorn-60501.exe (PID: 11844)
- Unicorn-33395.exe (PID: 11880)
- Unicorn-8124.exe (PID: 11908)
- Unicorn-54445.exe (PID: 11968)
- Unicorn-33011.exe (PID: 11780)
- Unicorn-8965.exe (PID: 12016)
- Unicorn-62805.exe (PID: 12008)
- Unicorn-8005.exe (PID: 12080)
- Unicorn-31747.exe (PID: 12044)
- Unicorn-4668.exe (PID: 12088)
- Unicorn-4860.exe (PID: 12132)
- Unicorn-26454.exe (PID: 12176)
- Unicorn-42717.exe (PID: 12208)
- Unicorn-19171.exe (PID: 11980)
- Unicorn-22156.exe (PID: 11108)
- Unicorn-27915.exe (PID: 11820)
- Unicorn-44444.exe (PID: 8040)
- Unicorn-18478.exe (PID: 12232)
- Unicorn-51725.exe (PID: 1600)
- Unicorn-11653.exe (PID: 3396)
- Unicorn-24652.exe (PID: 11308)
- Unicorn-11845.exe (PID: 11136)
- Unicorn-8508.exe (PID: 11600)
- Unicorn-53764.exe (PID: 8676)
- Unicorn-9733.exe (PID: 4212)
- Unicorn-2147.exe (PID: 12336)
- Unicorn-29835.exe (PID: 12380)
- Unicorn-65109.exe (PID: 12368)
- Unicorn-27606.exe (PID: 12356)
- Unicorn-49332.exe (PID: 12408)
- Unicorn-26957.exe (PID: 2968)
- Unicorn-53956.exe (PID: 12316)
- Unicorn-25022.exe (PID: 12520)
- Unicorn-52114.exe (PID: 12632)
- Unicorn-14860.exe (PID: 12708)
- Unicorn-1861.exe (PID: 12700)
- Unicorn-44814.exe (PID: 12804)
- Unicorn-20310.exe (PID: 12784)
- Unicorn-62717.exe (PID: 12544)
- Unicorn-44741.exe (PID: 12840)
- Unicorn-65213.exe (PID: 12920)
- Unicorn-20118.exe (PID: 13000)
- Unicorn-57132.exe (PID: 13080)
- Unicorn-35276.exe (PID: 13132)
- Unicorn-50159.exe (PID: 12848)
- Unicorn-14061.exe (PID: 13088)
- Unicorn-19454.exe (PID: 3156)
- Unicorn-64933.exe (PID: 13260)
- Unicorn-54164.exe (PID: 3176)
- Unicorn-50404.exe (PID: 13316)
- Unicorn-43190.exe (PID: 13340)
- Unicorn-9572.exe (PID: 13168)
- Unicorn-60870.exe (PID: 13440)
- Unicorn-41388.exe (PID: 13536)
- Unicorn-47030.exe (PID: 13628)
- Unicorn-57236.exe (PID: 13636)
- Unicorn-59.exe (PID: 13668)
- Unicorn-13589.exe (PID: 13708)
- Unicorn-26588.exe (PID: 13732)
- Unicorn-59427.exe (PID: 13840)
- Unicorn-4196.exe (PID: 13868)
- Unicorn-12556.exe (PID: 13920)
- Unicorn-4388.exe (PID: 13888)
- Unicorn-443.exe (PID: 13988)
- Unicorn-6573.exe (PID: 13996)
- Unicorn-19572.exe (PID: 14036)
- Unicorn-58004.exe (PID: 14072)
- Unicorn-61733.exe (PID: 14088)
- Unicorn-64061.exe (PID: 14116)
- Unicorn-26780.exe (PID: 13756)
- Unicorn-10444.exe (PID: 13796)
- Unicorn-42052.exe (PID: 14156)
- Unicorn-4108.exe (PID: 14372)
- Unicorn-23323.exe (PID: 14232)
- Unicorn-62245.exe (PID: 14276)
- Unicorn-21596.exe (PID: 6724)
- Unicorn-15731.exe (PID: 7172)
- Unicorn-63780.exe (PID: 14364)
- Unicorn-55612.exe (PID: 14432)
- Unicorn-47444.exe (PID: 14464)
- Unicorn-20331.exe (PID: 14548)
- Unicorn-63622.exe (PID: 14600)
- Unicorn-64548.exe (PID: 14252)
- Unicorn-14083.exe (PID: 14672)
- Unicorn-28036.exe (PID: 14796)
- Unicorn-36012.exe (PID: 14728)
- Unicorn-28036.exe (PID: 14804)
- Unicorn-28036.exe (PID: 14812)
- Unicorn-23133.exe (PID: 14912)
- Unicorn-65124.exe (PID: 15024)
- Unicorn-41772.exe (PID: 14828)
- Unicorn-3532.exe (PID: 14928)
- Unicorn-63205.exe (PID: 15108)
- Unicorn-51389.exe (PID: 15032)
- Unicorn-51773.exe (PID: 15088)
- Unicorn-28036.exe (PID: 14788)
- Unicorn-14467.exe (PID: 14920)
- Unicorn-26587.exe (PID: 15172)
- Unicorn-41964.exe (PID: 15308)
- Unicorn-61093.exe (PID: 15356)
- Unicorn-17866.exe (PID: 15428)
- Unicorn-12852.exe (PID: 15176)
- Unicorn-10443.exe (PID: 15236)
- Unicorn-26971.exe (PID: 15292)
- Unicorn-9291.exe (PID: 15348)
- Unicorn-44565.exe (PID: 15324)
- Unicorn-55229.exe (PID: 15536)
- Unicorn-26086.exe (PID: 15568)
- Unicorn-50709.exe (PID: 15612)
- Unicorn-55805.exe (PID: 15640)
- Unicorn-38124.exe (PID: 15716)
- Unicorn-8411.exe (PID: 15756)
- Unicorn-36212.exe (PID: 15860)
- Unicorn-17625.exe (PID: 15520)
- Unicorn-7564.exe (PID: 15504)
- Unicorn-20339.exe (PID: 15656)
- Unicorn-15164.exe (PID: 15944)
- Unicorn-25635.exe (PID: 15888)
- Unicorn-35444.exe (PID: 16004)
- Unicorn-16891.exe (PID: 16104)
- Unicorn-63862.exe (PID: 16052)
- Unicorn-19684.exe (PID: 16136)
- Unicorn-49181.exe (PID: 16176)
- Unicorn-24371.exe (PID: 16192)
- Unicorn-364.exe (PID: 16224)
- Unicorn-33803.exe (PID: 15880)
- Unicorn-47724.exe (PID: 15964)
- Unicorn-821.exe (PID: 16248)
- Unicorn-4116.exe (PID: 16296)
Create files in a temporary directory
- Unicorn-56584.exe (PID: 7908)
- 1 (1157).exe (PID: 7476)
- Unicorn-27519.exe (PID: 7304)
- Unicorn-11462.exe (PID: 6944)
- Unicorn-48686.exe (PID: 4692)
- Unicorn-35333.exe (PID: 5056)
- Unicorn-14860.exe (PID: 6872)
- Unicorn-7933.exe (PID: 300)
- Unicorn-15614.exe (PID: 780)
- Unicorn-39796.exe (PID: 5740)
- Unicorn-27519.exe (PID: 7300)
- Unicorn-15999.exe (PID: 1128)
- Unicorn-62421.exe (PID: 6988)
- Unicorn-11980.exe (PID: 6744)
- Unicorn-8510.exe (PID: 7232)
- Unicorn-48199.exe (PID: 7220)
- Unicorn-22335.exe (PID: 4488)
- Unicorn-36501.exe (PID: 7244)
- Unicorn-61582.exe (PID: 2096)
- Unicorn-44949.exe (PID: 7516)
- Unicorn-23783.exe (PID: 6268)
- Unicorn-39796.exe (PID: 7784)
- Unicorn-65007.exe (PID: 8108)
- Unicorn-2956.exe (PID: 8100)
- Unicorn-58287.exe (PID: 7988)
- Unicorn-56839.exe (PID: 5680)
- Unicorn-35333.exe (PID: 4736)
- Unicorn-38613.exe (PID: 7932)
- Unicorn-52257.exe (PID: 7976)
- Unicorn-35895.exe (PID: 1196)
- Unicorn-60399.exe (PID: 8156)
- Unicorn-51462.exe (PID: 7812)
- Unicorn-52231.exe (PID: 6876)
- Unicorn-48101.exe (PID: 2268)
- Unicorn-3030.exe (PID: 7500)
- Unicorn-18036.exe (PID: 8084)
- Unicorn-11390.exe (PID: 7808)
- Unicorn-20637.exe (PID: 7472)
- Unicorn-40725.exe (PID: 4244)
- Unicorn-56766.exe (PID: 1328)
- Unicorn-11317.exe (PID: 3896)
- Unicorn-57254.exe (PID: 2040)
- Unicorn-51661.exe (PID: 5024)
- Unicorn-40809.exe (PID: 1660)
- Unicorn-11317.exe (PID: 8152)
- Unicorn-45625.exe (PID: 6044)
- Unicorn-1613.exe (PID: 7992)
- Unicorn-18111.exe (PID: 8124)
- Unicorn-45625.exe (PID: 208)
- Unicorn-56891.exe (PID: 4880)
- Unicorn-63222.exe (PID: 6656)
- Unicorn-22335.exe (PID: 4608)
- Unicorn-4212.exe (PID: 8116)
- Unicorn-9309.exe (PID: 5728)
- Unicorn-59055.exe (PID: 7712)
- Unicorn-26103.exe (PID: 5352)
- Unicorn-3710.exe (PID: 7660)
- Unicorn-3637.exe (PID: 968)
- Unicorn-32853.exe (PID: 6436)
- Unicorn-26413.exe (PID: 5548)
- Unicorn-56839.exe (PID: 7884)
- Unicorn-54639.exe (PID: 4180)
- Unicorn-55909.exe (PID: 8284)
- Unicorn-25453.exe (PID: 8228)
- Unicorn-5749.exe (PID: 8020)
- Unicorn-22927.exe (PID: 8320)
- Unicorn-49853.exe (PID: 8376)
- Unicorn-23838.exe (PID: 8424)
- Unicorn-38830.exe (PID: 8452)
- Unicorn-25378.exe (PID: 8484)
- Unicorn-35876.exe (PID: 8520)
- Unicorn-15670.exe (PID: 8432)
- Unicorn-12955.exe (PID: 8580)
- Unicorn-55510.exe (PID: 8528)
- Unicorn-16630.exe (PID: 8592)
- Unicorn-46157.exe (PID: 8624)
- Unicorn-25378.exe (PID: 8492)
- Unicorn-3030.exe (PID: 7860)
- Unicorn-49878.exe (PID: 8648)
- Unicorn-15999.exe (PID: 5212)
- Unicorn-17206.exe (PID: 8680)
- Unicorn-14901.exe (PID: 8552)
- Unicorn-31981.exe (PID: 6560)
- Unicorn-6908.exe (PID: 8776)
- Unicorn-9868.exe (PID: 8092)
- Unicorn-51582.exe (PID: 8132)
- Unicorn-53687.exe (PID: 8728)
- Unicorn-15862.exe (PID: 8720)
- Unicorn-57278.exe (PID: 8876)
- Unicorn-65062.exe (PID: 8736)
- Unicorn-24606.exe (PID: 8820)
- Unicorn-1790.exe (PID: 5552)
- Unicorn-50844.exe (PID: 9020)
- Unicorn-61359.exe (PID: 3888)
- Unicorn-34079.exe (PID: 7680)
- Unicorn-50223.exe (PID: 7752)
- Unicorn-59351.exe (PID: 8128)
- Unicorn-59006.exe (PID: 9092)
- Unicorn-11533.exe (PID: 9120)
- Unicorn-28254.exe (PID: 9204)
- Unicorn-49927.exe (PID: 8008)
- Unicorn-20725.exe (PID: 1056)
- Unicorn-10957.exe (PID: 7528)
- Unicorn-52485.exe (PID: 7188)
- Unicorn-50366.exe (PID: 9288)
- Unicorn-25213.exe (PID: 6808)
- Unicorn-20815.exe (PID: 8256)
- Unicorn-57958.exe (PID: 9404)
- Unicorn-34995.exe (PID: 9488)
- Unicorn-26054.exe (PID: 9512)
- Unicorn-61532.exe (PID: 9576)
- Unicorn-20574.exe (PID: 9620)
- Unicorn-18851.exe (PID: 9664)
- Unicorn-5452.exe (PID: 6248)
- Unicorn-30012.exe (PID: 8640)
- Unicorn-58237.exe (PID: 8908)
- Unicorn-9619.exe (PID: 8972)
- Unicorn-43172.exe (PID: 8852)
- Unicorn-26172.exe (PID: 9732)
- Unicorn-12419.exe (PID: 8980)
- Unicorn-51606.exe (PID: 9028)
- Unicorn-38756.exe (PID: 9068)
- Unicorn-28524.exe (PID: 7772)
- Unicorn-35895.exe (PID: 7888)
- Unicorn-19526.exe (PID: 9768)
- Unicorn-21931.exe (PID: 9140)
- Unicorn-52758.exe (PID: 9180)
- Unicorn-12435.exe (PID: 9820)
- Unicorn-39101.exe (PID: 5428)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 7804)
- BackgroundTransferHost.exe (PID: 2908)
- BackgroundTransferHost.exe (PID: 4740)
- BackgroundTransferHost.exe (PID: 7924)
- BackgroundTransferHost.exe (PID: 5072)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 2908)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 2908)
- WerFault.exe (PID: 11588)
- WerFault.exe (PID: 11536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:20 00:32:00+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
607
Monitored processes
469
Malicious processes
74
Suspicious processes
61
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\Users\admin\AppData\Local\Temp\Unicorn-45625.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-45625.exe | Unicorn-11980.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 300 | C:\Users\admin\AppData\Local\Temp\Unicorn-7933.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-7933.exe | 1 (1157).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 728 | C:\Users\admin\AppData\Local\Temp\Unicorn-11149.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-11149.exe | Unicorn-59351.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 780 | C:\Users\admin\AppData\Local\Temp\Unicorn-15614.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-15614.exe | Unicorn-22335.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 856 | C:\Users\admin\AppData\Local\Temp\Unicorn-59701.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-59701.exe | Unicorn-22335.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 968 | C:\Users\admin\AppData\Local\Temp\Unicorn-3637.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3637.exe | Unicorn-27519.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1056 | C:\Users\admin\AppData\Local\Temp\Unicorn-20725.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20725.exe | 1 (1157).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1128 | C:\Users\admin\AppData\Local\Temp\Unicorn-15999.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-15999.exe | Unicorn-20725.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1196 | C:\Users\admin\AppData\Local\Temp\Unicorn-35895.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-35895.exe | Unicorn-15999.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1328 | C:\Users\admin\AppData\Local\Temp\Unicorn-56766.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56766.exe | Unicorn-56584.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
14 640
Read events
14 625
Write events
15
Delete events
0
Modification events
| (PID) Process: | (4740) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (4740) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4740) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2908) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2908) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2908) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7804) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7804) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7804) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7924) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
1 206
Suspicious files
11
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2908 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8807afda-18ac-4478-8402-67a2dcbebfbb.down_data | — | |
MD5:— | SHA256:— | |||
| 7476 | 1 (1157).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56584.exe | executable | |
MD5:0199A318122DB4220388FB102B0D44EF | SHA256:E8C7174E1ED50B4622B91D1D49A8AFC2A6D3734334464B08E13E448B4B535466 | |||
| 7476 | 1 (1157).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-62421.exe | executable | |
MD5:7B93B375C0334E255075E20169B33BDB | SHA256:770178C1D6BB9170597250549D551DDC8714A70C9F04F04B077B2A031CE34D74 | |||
| 7908 | Unicorn-56584.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-48686.exe | executable | |
MD5:4A5D90AB1C2DE7ADB89D73F51D9D112B | SHA256:CF87EB76FE5F0EDE2524B727858B4EE5B64BAFB673616CA46E71D3F8FCCA747B | |||
| 300 | Unicorn-7933.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-27519.exe | executable | |
MD5:D2297671D319C3D04D87771417197927 | SHA256:E8EC87DB8364D38D5BE6FC8538FF92C262A925E800E3CE9475AC723ABA89A907 | |||
| 4692 | Unicorn-48686.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-40809.exe | executable | |
MD5:729EAF3B00C3B1020E7A430BD2D63A48 | SHA256:6E37CBE93D7FAFFCCB9B1410E4B38021730F3A42079B8D242FB7F1F57D3998C7 | |||
| 7908 | Unicorn-56584.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-11462.exe | executable | |
MD5:1398C3F1D73328C4A6876789AFB539A1 | SHA256:7CE36EFD4B5FBD1929CAEF69021CAE1E9D48C5DB5A6679322A969D844CB35EC2 | |||
| 4608 | Unicorn-22335.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-15614.exe | executable | |
MD5:078C574BCCD498B270A01E2AB3031AD1 | SHA256:972C6E4D0D3DD658665B414AE00C43B238F39E91AD99095A2AEB5B3EA0BE8FB3 | |||
| 2908 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:6E37AEE61E32C4A73B7231E881AF1D9E | SHA256:C118538370F29EB5D1ABE9A3B241F1C7B51995841741A3FF8305B3A498786507 | |||
| 2908 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8807afda-18ac-4478-8402-67a2dcbebfbb.258a4de0-939b-43fb-a184-eae20c4530ec.down_meta | binary | |
MD5:6C48F1D343899C9A57539E6AC36A9C48 | SHA256:2DB676489DC2AE0584E66D79AA973E3C0BAB0FC6535B5976E7CE380352E73A46 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
14
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
2908 | BackgroundTransferHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
7664 | backgroundTaskHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
2852 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
2852 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 4.231.128.59:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
6476 | RUXIMICS.exe | 4.231.128.59:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 40.126.32.133:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
7664 | backgroundTaskHost.exe | 20.223.35.26:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
7664 | backgroundTaskHost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2908 | BackgroundTransferHost.exe | 2.23.227.215:443 | www.bing.com | Ooredoo Q.S.C. | QA | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |