| File name: | 1 (1355) |
| Full analysis: | https://app.any.run/tasks/8ce6f9dd-b2f3-48e8-879f-563ba0b36b12 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 11:58:58 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | C69BF560298457F49B2207DFFC217DB0 |
| SHA1: | F6A23966D1D8DD5BD41771E73C84C80BCCF59243 |
| SHA256: | D83A6171145136780A34773457E50B9300150EB0A7BAF18A8ED62697B600F93B |
| SSDEEP: | 6144:j7K8v7IJeDLHA5DzBMePuAfx/tBQlvJGBH/WOeOiFk/8SwjwpyAvEh1fsPn+sv7a:j+qMoHA5/BvzBmhaHOOeOiqx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- Unicorn-42050.exe (PID: 1228)
- Unicorn-20923.exe (PID: 4120)
- 1 (1355).exe (PID: 2284)
- Unicorn-56082.exe (PID: 1532)
- Unicorn-8054.exe (PID: 6068)
- Unicorn-65423.exe (PID: 6148)
- Unicorn-21467.exe (PID: 896)
- Unicorn-7732.exe (PID: 3176)
- Unicorn-54214.exe (PID: 4988)
- Unicorn-13373.exe (PID: 5728)
- Unicorn-54961.exe (PID: 2384)
- Unicorn-31858.exe (PID: 1128)
- Unicorn-12671.exe (PID: 2772)
- Unicorn-32123.exe (PID: 6512)
- Unicorn-63726.exe (PID: 2800)
- Unicorn-5760.exe (PID: 5640)
- Unicorn-53550.exe (PID: 5964)
- Unicorn-25516.exe (PID: 2984)
- Unicorn-46342.exe (PID: 4188)
- Unicorn-35521.exe (PID: 7184)
- Unicorn-12907.exe (PID: 6572)
- Unicorn-20878.exe (PID: 4464)
- Unicorn-4157.exe (PID: 1452)
- Unicorn-6195.exe (PID: 2516)
- Unicorn-49257.exe (PID: 7176)
- Unicorn-20494.exe (PID: 1852)
- Unicorn-3726.exe (PID: 7208)
- Unicorn-47219.exe (PID: 7192)
- Unicorn-14738.exe (PID: 856)
- Unicorn-31520.exe (PID: 7752)
- Unicorn-49340.exe (PID: 7736)
- Unicorn-36887.exe (PID: 7864)
- Unicorn-43218.exe (PID: 7724)
- Unicorn-15397.exe (PID: 7880)
- Unicorn-58459.exe (PID: 7908)
- Unicorn-4489.exe (PID: 7896)
- Unicorn-38816.exe (PID: 7948)
- Unicorn-26393.exe (PID: 680)
- Unicorn-46762.exe (PID: 7920)
- Unicorn-24718.exe (PID: 7932)
- Unicorn-44946.exe (PID: 7956)
- Unicorn-64597.exe (PID: 7980)
- Unicorn-18395.exe (PID: 7988)
- Unicorn-6196.exe (PID: 7396)
- Unicorn-15433.exe (PID: 672)
- Unicorn-37546.exe (PID: 8076)
- Unicorn-53617.exe (PID: 8088)
- Unicorn-58713.exe (PID: 8104)
- Unicorn-27131.exe (PID: 7340)
- Unicorn-7333.exe (PID: 7668)
- Unicorn-52657.exe (PID: 8008)
- Unicorn-25294.exe (PID: 8120)
- Unicorn-7141.exe (PID: 7688)
- Unicorn-47406.exe (PID: 7564)
- Unicorn-33056.exe (PID: 8016)
- Unicorn-819.exe (PID: 7720)
- Unicorn-35538.exe (PID: 7696)
- Unicorn-25294.exe (PID: 8112)
- Unicorn-44785.exe (PID: 7760)
- Unicorn-23779.exe (PID: 7572)
- Unicorn-13233.exe (PID: 8048)
- Unicorn-6911.exe (PID: 8096)
- Unicorn-56513.exe (PID: 7556)
- Unicorn-58521.exe (PID: 8172)
- Unicorn-23456.exe (PID: 7568)
- Unicorn-44156.exe (PID: 8296)
- Unicorn-26336.exe (PID: 8304)
- Unicorn-2673.exe (PID: 7540)
- Unicorn-63424.exe (PID: 7296)
- Unicorn-28906.exe (PID: 8236)
- Unicorn-28906.exe (PID: 8232)
- Unicorn-21000.exe (PID: 5256)
- Unicorn-55055.exe (PID: 5392)
- Unicorn-25797.exe (PID: 7404)
- Unicorn-48174.exe (PID: 7652)
- Unicorn-44562.exe (PID: 7360)
- Unicorn-49606.exe (PID: 8148)
- Unicorn-60597.exe (PID: 7548)
- Unicorn-21100.exe (PID: 7744)
- Unicorn-21838.exe (PID: 3096)
- Unicorn-10125.exe (PID: 9028)
- Unicorn-21572.exe (PID: 5608)
- Unicorn-43483.exe (PID: 9060)
- Unicorn-35590.exe (PID: 9100)
- Unicorn-46586.exe (PID: 8288)
- Unicorn-54650.exe (PID: 4996)
- Unicorn-13337.exe (PID: 8328)
- Unicorn-41245.exe (PID: 7704)
- Unicorn-46482.exe (PID: 7336)
- Unicorn-48921.exe (PID: 7036)
- Unicorn-5236.exe (PID: 8188)
- Unicorn-34526.exe (PID: 8392)
- Unicorn-3986.exe (PID: 9116)
- Unicorn-26231.exe (PID: 8532)
- Unicorn-21708.exe (PID: 8064)
- Unicorn-7784.exe (PID: 8500)
- Unicorn-43276.exe (PID: 8452)
- Unicorn-1919.exe (PID: 8508)
- Unicorn-9850.exe (PID: 8616)
- Unicorn-21203.exe (PID: 9896)
- Unicorn-16151.exe (PID: 9932)
- Unicorn-17915.exe (PID: 8220)
- Unicorn-12496.exe (PID: 8524)
- Unicorn-40582.exe (PID: 2644)
- Unicorn-3773.exe (PID: 8544)
- Unicorn-42907.exe (PID: 8880)
- Unicorn-7577.exe (PID: 900)
- Unicorn-55713.exe (PID: 9776)
- Unicorn-56757.exe (PID: 9124)
- Unicorn-7473.exe (PID: 8604)
- Unicorn-24308.exe (PID: 8580)
- Unicorn-23425.exe (PID: 8832)
- Unicorn-24926.exe (PID: 8636)
- Unicorn-23530.exe (PID: 9220)
- Unicorn-23156.exe (PID: 8348)
- Unicorn-46031.exe (PID: 8808)
- Unicorn-39517.exe (PID: 9352)
- Unicorn-60841.exe (PID: 9132)
- Unicorn-58261.exe (PID: 8424)
- Unicorn-20697.exe (PID: 8204)
- Unicorn-39705.exe (PID: 9828)
- Unicorn-753.exe (PID: 9432)
- Unicorn-59611.exe (PID: 5436)
- Unicorn-26135.exe (PID: 9480)
- Unicorn-34526.exe (PID: 8384)
- Unicorn-16444.exe (PID: 8320)
- Unicorn-17644.exe (PID: 9448)
- Unicorn-9031.exe (PID: 10184)
- Unicorn-10265.exe (PID: 7636)
- Unicorn-11853.exe (PID: 8276)
- Unicorn-36793.exe (PID: 11268)
- Unicorn-36793.exe (PID: 2968)
- Unicorn-45661.exe (PID: 9532)
- Unicorn-4754.exe (PID: 5936)
- Unicorn-9288.exe (PID: 7584)
- Unicorn-2533.exe (PID: 7264)
- Unicorn-44915.exe (PID: 8464)
- Unicorn-40250.exe (PID: 6632)
- Unicorn-16876.exe (PID: 9304)
- Unicorn-13358.exe (PID: 8820)
- Unicorn-1838.exe (PID: 11000)
- Unicorn-41520.exe (PID: 5972)
- Unicorn-36431.exe (PID: 3240)
- Unicorn-4313.exe (PID: 8796)
- Unicorn-5065.exe (PID: 8056)
- Unicorn-11300.exe (PID: 9764)
- Unicorn-40809.exe (PID: 9704)
- Unicorn-60789.exe (PID: 7152)
- Unicorn-7058.exe (PID: 9500)
- Unicorn-46961.exe (PID: 11104)
- Unicorn-41240.exe (PID: 9736)
- Unicorn-26360.exe (PID: 12748)
- Unicorn-37844.exe (PID: 12632)
- Unicorn-37844.exe (PID: 12624)
- Unicorn-56114.exe (PID: 9912)
- Unicorn-52673.exe (PID: 9144)
- Unicorn-62201.exe (PID: 10764)
- Unicorn-62995.exe (PID: 10156)
- Unicorn-42753.exe (PID: 12316)
- Unicorn-59134.exe (PID: 11764)
- Unicorn-6897.exe (PID: 8668)
- Unicorn-16648.exe (PID: 10652)
- Unicorn-41977.exe (PID: 9788)
- Unicorn-55692.exe (PID: 9236)
- Unicorn-32832.exe (PID: 9364)
- Unicorn-36793.exe (PID: 11284)
- Unicorn-30546.exe (PID: 9004)
- Unicorn-13580.exe (PID: 10900)
- Unicorn-12045.exe (PID: 9336)
- Unicorn-9039.exe (PID: 9152)
- Unicorn-37821.exe (PID: 9596)
- Unicorn-56467.exe (PID: 11024)
- Unicorn-15589.exe (PID: 9520)
- Unicorn-51319.exe (PID: 5020)
- Unicorn-34511.exe (PID: 10976)
- Unicorn-42990.exe (PID: 8972)
- Unicorn-51194.exe (PID: 9248)
- Unicorn-27614.exe (PID: 5280)
- Unicorn-24636.exe (PID: 13896)
- Unicorn-23634.exe (PID: 9812)
- Unicorn-24636.exe (PID: 13884)
- Unicorn-64783.exe (PID: 13944)
- Unicorn-36793.exe (PID: 4572)
- Unicorn-44550.exe (PID: 14032)
- Unicorn-49039.exe (PID: 15416)
- Unicorn-58338.exe (PID: 15372)
- Unicorn-7321.exe (PID: 15392)
- Unicorn-36793.exe (PID: 11276)
- Unicorn-30611.exe (PID: 9280)
- Unicorn-63192.exe (PID: 9312)
- Unicorn-23966.exe (PID: 10540)
- Unicorn-41536.exe (PID: 11872)
- Unicorn-15470.exe (PID: 8992)
- Unicorn-18220.exe (PID: 9584)
- Unicorn-51402.exe (PID: 10280)
- Unicorn-36477.exe (PID: 9292)
- Unicorn-28656.exe (PID: 9796)
- Unicorn-52869.exe (PID: 9456)
- Unicorn-28088.exe (PID: 13128)
- Unicorn-46548.exe (PID: 10248)
- Unicorn-31955.exe (PID: 9604)
- Unicorn-6984.exe (PID: 9328)
- Unicorn-64443.exe (PID: 11052)
- Unicorn-58286.exe (PID: 12820)
- Unicorn-15962.exe (PID: 14072)
- Unicorn-40250.exe (PID: 7520)
- Unicorn-46441.exe (PID: 10968)
- Unicorn-43154.exe (PID: 4200)
- Unicorn-23967.exe (PID: 1280)
- Unicorn-22688.exe (PID: 9540)
- Unicorn-65226.exe (PID: 8556)
- Unicorn-33338.exe (PID: 10116)
- Unicorn-46674.exe (PID: 9388)
- Unicorn-23421.exe (PID: 11608)
- Unicorn-59745.exe (PID: 10620)
- Unicorn-60124.exe (PID: 11980)
- Unicorn-13550.exe (PID: 8788)
- Unicorn-38086.exe (PID: 9612)
- Unicorn-22895.exe (PID: 13560)
- Unicorn-38996.exe (PID: 14492)
- Unicorn-48115.exe (PID: 12192)
- Unicorn-21691.exe (PID: 14548)
- Unicorn-6833.exe (PID: 13840)
- Unicorn-13008.exe (PID: 14508)
- Unicorn-35891.exe (PID: 8964)
- Unicorn-42753.exe (PID: 12300)
- Unicorn-38804.exe (PID: 14608)
- Unicorn-28143.exe (PID: 7708)
- Unicorn-55870.exe (PID: 10476)
- Unicorn-7647.exe (PID: 8680)
- Unicorn-56848.exe (PID: 8948)
- Unicorn-36793.exe (PID: 11292)
- Unicorn-56848.exe (PID: 8944)
- Unicorn-1101.exe (PID: 11912)
- Unicorn-3316.exe (PID: 10772)
- Unicorn-44991.exe (PID: 11788)
- Unicorn-54864.exe (PID: 7244)
- Unicorn-18922.exe (PID: 10464)
- Unicorn-46221.exe (PID: 7460)
- Unicorn-5280.exe (PID: 13684)
- Unicorn-789.exe (PID: 13632)
- Unicorn-65382.exe (PID: 6264)
- Unicorn-4403.exe (PID: 14016)
- Unicorn-64600.exe (PID: 12868)
- Unicorn-21211.exe (PID: 13212)
- Unicorn-15385.exe (PID: 7848)
- Unicorn-57946.exe (PID: 10716)
- Unicorn-9357.exe (PID: 10752)
- Unicorn-4431.exe (PID: 12788)
- Unicorn-38770.exe (PID: 11032)
- Unicorn-17555.exe (PID: 11616)
- Unicorn-54246.exe (PID: 10932)
Starts itself from another location
- Unicorn-20923.exe (PID: 4120)
- 1 (1355).exe (PID: 2284)
- Unicorn-56082.exe (PID: 1532)
- Unicorn-42050.exe (PID: 1228)
- Unicorn-65423.exe (PID: 6148)
- Unicorn-21467.exe (PID: 896)
- Unicorn-8054.exe (PID: 6068)
- Unicorn-7732.exe (PID: 3176)
- Unicorn-31858.exe (PID: 1128)
- Unicorn-13373.exe (PID: 5728)
- Unicorn-54961.exe (PID: 2384)
- Unicorn-54214.exe (PID: 4988)
- Unicorn-12671.exe (PID: 2772)
- Unicorn-63726.exe (PID: 2800)
- Unicorn-5760.exe (PID: 5640)
- Unicorn-32123.exe (PID: 6512)
- Unicorn-53550.exe (PID: 5964)
- Unicorn-25516.exe (PID: 2984)
- Unicorn-46342.exe (PID: 4188)
- Unicorn-12907.exe (PID: 6572)
- Unicorn-20878.exe (PID: 4464)
- Unicorn-26393.exe (PID: 680)
- Unicorn-6195.exe (PID: 2516)
- Unicorn-21572.exe (PID: 5608)
- Unicorn-20494.exe (PID: 1852)
- Unicorn-3726.exe (PID: 7208)
- Unicorn-4157.exe (PID: 1452)
- Unicorn-47219.exe (PID: 7192)
- Unicorn-14738.exe (PID: 856)
- Unicorn-49340.exe (PID: 7736)
- Unicorn-28143.exe (PID: 7708)
- Unicorn-21838.exe (PID: 3096)
- Unicorn-36887.exe (PID: 7864)
- Unicorn-35521.exe (PID: 7184)
- Unicorn-15397.exe (PID: 7880)
- Unicorn-43218.exe (PID: 7724)
- Unicorn-58459.exe (PID: 7908)
- Unicorn-4489.exe (PID: 7896)
- Unicorn-49257.exe (PID: 7176)
- Unicorn-44946.exe (PID: 7956)
- Unicorn-24718.exe (PID: 7932)
- Unicorn-25797.exe (PID: 7404)
- Unicorn-18395.exe (PID: 7988)
- Unicorn-6196.exe (PID: 7396)
- Unicorn-15433.exe (PID: 672)
- Unicorn-31520.exe (PID: 7752)
- Unicorn-64597.exe (PID: 7980)
- Unicorn-53617.exe (PID: 8088)
- Unicorn-58713.exe (PID: 8104)
- Unicorn-21708.exe (PID: 8064)
- Unicorn-37546.exe (PID: 8076)
- Unicorn-27131.exe (PID: 7340)
- Unicorn-7333.exe (PID: 7668)
- Unicorn-52657.exe (PID: 8008)
- Unicorn-7141.exe (PID: 7688)
- Unicorn-47406.exe (PID: 7564)
- Unicorn-819.exe (PID: 7720)
- Unicorn-23779.exe (PID: 7572)
- Unicorn-35538.exe (PID: 7696)
- Unicorn-25294.exe (PID: 8112)
- Unicorn-44785.exe (PID: 7760)
- Unicorn-46762.exe (PID: 7920)
- Unicorn-23456.exe (PID: 7568)
- Unicorn-13233.exe (PID: 8048)
- Unicorn-6911.exe (PID: 8096)
- Unicorn-56513.exe (PID: 7556)
- Unicorn-58521.exe (PID: 8172)
- Unicorn-44156.exe (PID: 8296)
- Unicorn-2673.exe (PID: 7540)
- Unicorn-38816.exe (PID: 7948)
- Unicorn-26336.exe (PID: 8304)
- Unicorn-63424.exe (PID: 7296)
- Unicorn-28906.exe (PID: 8236)
- Unicorn-5065.exe (PID: 8056)
- Unicorn-55055.exe (PID: 5392)
- Unicorn-44562.exe (PID: 7360)
- Unicorn-49606.exe (PID: 8148)
- Unicorn-60597.exe (PID: 7548)
- Unicorn-21100.exe (PID: 7744)
- Unicorn-10125.exe (PID: 9028)
- Unicorn-28906.exe (PID: 8232)
- Unicorn-43483.exe (PID: 9060)
- Unicorn-46586.exe (PID: 8288)
- Unicorn-13337.exe (PID: 8328)
- Unicorn-5236.exe (PID: 8188)
- Unicorn-41245.exe (PID: 7704)
- Unicorn-48921.exe (PID: 7036)
- Unicorn-34526.exe (PID: 8392)
- Unicorn-46482.exe (PID: 7336)
- Unicorn-54650.exe (PID: 4996)
- Unicorn-3986.exe (PID: 9116)
- Unicorn-26231.exe (PID: 8532)
- Unicorn-7784.exe (PID: 8500)
- Unicorn-43276.exe (PID: 8452)
- Unicorn-1919.exe (PID: 8508)
- Unicorn-56114.exe (PID: 9912)
- Unicorn-16151.exe (PID: 9932)
- Unicorn-12496.exe (PID: 8524)
- Unicorn-40582.exe (PID: 2644)
- Unicorn-21203.exe (PID: 9896)
- Unicorn-7577.exe (PID: 900)
- Unicorn-13550.exe (PID: 8788)
- Unicorn-55713.exe (PID: 9776)
- Unicorn-3773.exe (PID: 8544)
- Unicorn-56757.exe (PID: 9124)
- Unicorn-23425.exe (PID: 8832)
- Unicorn-7473.exe (PID: 8604)
- Unicorn-24308.exe (PID: 8580)
- Unicorn-23530.exe (PID: 9220)
- Unicorn-46031.exe (PID: 8808)
- Unicorn-24926.exe (PID: 8636)
- Unicorn-42907.exe (PID: 8880)
- Unicorn-58261.exe (PID: 8424)
- Unicorn-20697.exe (PID: 8204)
- Unicorn-42990.exe (PID: 8972)
- Unicorn-60841.exe (PID: 9132)
- Unicorn-39705.exe (PID: 9828)
- Unicorn-33056.exe (PID: 8016)
- Unicorn-753.exe (PID: 9432)
- Unicorn-59611.exe (PID: 5436)
- Unicorn-26135.exe (PID: 9480)
- Unicorn-35590.exe (PID: 9100)
- Unicorn-16444.exe (PID: 8320)
- Unicorn-39517.exe (PID: 9352)
- Unicorn-34526.exe (PID: 8384)
- Unicorn-10265.exe (PID: 7636)
- Unicorn-17644.exe (PID: 9448)
- Unicorn-9031.exe (PID: 10184)
- Unicorn-4754.exe (PID: 5936)
- Unicorn-45661.exe (PID: 9532)
- Unicorn-36793.exe (PID: 11268)
- Unicorn-36793.exe (PID: 11276)
- Unicorn-36793.exe (PID: 2968)
- Unicorn-11853.exe (PID: 8276)
- Unicorn-1838.exe (PID: 11000)
- Unicorn-9288.exe (PID: 7584)
- Unicorn-44915.exe (PID: 8464)
- Unicorn-16876.exe (PID: 9304)
- Unicorn-40250.exe (PID: 6632)
- Unicorn-36431.exe (PID: 3240)
- Unicorn-63633.exe (PID: 10192)
- Unicorn-41520.exe (PID: 5972)
- Unicorn-13358.exe (PID: 8820)
- Unicorn-7058.exe (PID: 9500)
- Unicorn-11300.exe (PID: 9764)
- Unicorn-2533.exe (PID: 7264)
- Unicorn-46961.exe (PID: 11104)
- Unicorn-40809.exe (PID: 9704)
- Unicorn-60789.exe (PID: 7152)
- Unicorn-4313.exe (PID: 8796)
- Unicorn-37844.exe (PID: 12632)
- Unicorn-37844.exe (PID: 12624)
- Unicorn-41240.exe (PID: 9736)
- Unicorn-52673.exe (PID: 9144)
- Unicorn-62995.exe (PID: 10156)
- Unicorn-42753.exe (PID: 12316)
- Unicorn-59134.exe (PID: 11764)
- Unicorn-26360.exe (PID: 12748)
- Unicorn-62201.exe (PID: 10764)
- Unicorn-41977.exe (PID: 9788)
- Unicorn-55692.exe (PID: 9236)
- Unicorn-6897.exe (PID: 8668)
- Unicorn-16648.exe (PID: 10652)
- Unicorn-9039.exe (PID: 9152)
- Unicorn-36793.exe (PID: 11284)
- Unicorn-32832.exe (PID: 9364)
- Unicorn-30546.exe (PID: 9004)
- Unicorn-13580.exe (PID: 10900)
- Unicorn-56467.exe (PID: 11024)
- Unicorn-15589.exe (PID: 9520)
- Unicorn-37821.exe (PID: 9596)
- Unicorn-51319.exe (PID: 5020)
- Unicorn-17915.exe (PID: 8220)
- Unicorn-34511.exe (PID: 10976)
- Unicorn-27614.exe (PID: 5280)
- Unicorn-25294.exe (PID: 8120)
- Unicorn-51194.exe (PID: 9248)
- Unicorn-24636.exe (PID: 13896)
- Unicorn-64783.exe (PID: 13944)
- Unicorn-36793.exe (PID: 4572)
- Unicorn-49039.exe (PID: 15416)
- Unicorn-58338.exe (PID: 15372)
- Unicorn-7321.exe (PID: 15392)
- Unicorn-30611.exe (PID: 9280)
- Unicorn-38086.exe (PID: 9612)
- Unicorn-24636.exe (PID: 13884)
- Unicorn-12045.exe (PID: 9336)
- Unicorn-23966.exe (PID: 10540)
- Unicorn-51402.exe (PID: 10280)
- Unicorn-15470.exe (PID: 8992)
- Unicorn-63192.exe (PID: 9312)
- Unicorn-28656.exe (PID: 9796)
- Unicorn-57946.exe (PID: 10716)
- Unicorn-52869.exe (PID: 9456)
- Unicorn-46548.exe (PID: 10248)
- Unicorn-28088.exe (PID: 13128)
- Unicorn-36477.exe (PID: 9292)
- Unicorn-6984.exe (PID: 9328)
- Unicorn-58286.exe (PID: 12820)
- Unicorn-15962.exe (PID: 14072)
- Unicorn-40250.exe (PID: 7520)
- Unicorn-31955.exe (PID: 9604)
- Unicorn-46441.exe (PID: 10968)
- Unicorn-23967.exe (PID: 1280)
- Unicorn-43154.exe (PID: 4200)
- Unicorn-22688.exe (PID: 9540)
- Unicorn-65226.exe (PID: 8556)
- Unicorn-18220.exe (PID: 9584)
- Unicorn-33338.exe (PID: 10116)
- Unicorn-46674.exe (PID: 9388)
- Unicorn-44550.exe (PID: 14032)
- Unicorn-21000.exe (PID: 5256)
- Unicorn-48174.exe (PID: 7652)
- Unicorn-64443.exe (PID: 11052)
- Unicorn-23421.exe (PID: 11608)
- Unicorn-41536.exe (PID: 11872)
Executes application which crashes
- Unicorn-63337.exe (PID: 9636)
- Unicorn-63633.exe (PID: 10192)
INFO
Reads the computer name
- 1 (1355).exe (PID: 2284)
- Unicorn-56082.exe (PID: 1532)
- Unicorn-42050.exe (PID: 1228)
- Unicorn-20923.exe (PID: 4120)
- Unicorn-7732.exe (PID: 3176)
- Unicorn-21467.exe (PID: 896)
- Unicorn-65423.exe (PID: 6148)
- Unicorn-8054.exe (PID: 6068)
- Unicorn-32123.exe (PID: 6512)
- Unicorn-5760.exe (PID: 5640)
- Unicorn-54214.exe (PID: 4988)
- Unicorn-63726.exe (PID: 2800)
- Unicorn-13373.exe (PID: 5728)
- Unicorn-12671.exe (PID: 2772)
- Unicorn-53550.exe (PID: 5964)
- Unicorn-25516.exe (PID: 2984)
- Unicorn-46342.exe (PID: 4188)
- Unicorn-12907.exe (PID: 6572)
- Unicorn-26393.exe (PID: 680)
- Unicorn-21572.exe (PID: 5608)
- Unicorn-20494.exe (PID: 1852)
- Unicorn-3726.exe (PID: 7208)
- Unicorn-21838.exe (PID: 3096)
- Unicorn-47219.exe (PID: 7192)
- Unicorn-6195.exe (PID: 2516)
- Unicorn-49340.exe (PID: 7736)
- Unicorn-36887.exe (PID: 7864)
- Unicorn-15397.exe (PID: 7880)
- Unicorn-28143.exe (PID: 7708)
- Unicorn-58459.exe (PID: 7908)
- Unicorn-38816.exe (PID: 7948)
- Unicorn-24718.exe (PID: 7932)
- Unicorn-18395.exe (PID: 7988)
- Unicorn-37546.exe (PID: 8076)
- Unicorn-25797.exe (PID: 7404)
- Unicorn-53617.exe (PID: 8088)
- Unicorn-21708.exe (PID: 8064)
- Unicorn-27131.exe (PID: 7340)
- Unicorn-52657.exe (PID: 8008)
- Unicorn-25294.exe (PID: 8120)
- Unicorn-7141.exe (PID: 7688)
- Unicorn-25294.exe (PID: 8112)
- Unicorn-23456.exe (PID: 7568)
- Unicorn-56513.exe (PID: 7556)
- Unicorn-58521.exe (PID: 8172)
- Unicorn-44156.exe (PID: 8296)
- Unicorn-44785.exe (PID: 7760)
- Unicorn-26336.exe (PID: 8304)
- Unicorn-2673.exe (PID: 7540)
- Unicorn-5065.exe (PID: 8056)
- Unicorn-63424.exe (PID: 7296)
- Unicorn-28906.exe (PID: 8236)
- Unicorn-21000.exe (PID: 5256)
- Unicorn-21100.exe (PID: 7744)
- Unicorn-60597.exe (PID: 7548)
- Unicorn-48921.exe (PID: 7036)
- Unicorn-43483.exe (PID: 9060)
- Unicorn-10125.exe (PID: 9028)
- Unicorn-46586.exe (PID: 8288)
- Unicorn-13337.exe (PID: 8328)
- Unicorn-41245.exe (PID: 7704)
- Unicorn-46482.exe (PID: 7336)
- Unicorn-43276.exe (PID: 8452)
- Unicorn-7784.exe (PID: 8500)
- Unicorn-26231.exe (PID: 8532)
- Unicorn-23156.exe (PID: 8348)
- Unicorn-5236.exe (PID: 8188)
- Unicorn-9850.exe (PID: 8616)
- Unicorn-12496.exe (PID: 8524)
- Unicorn-13550.exe (PID: 8788)
- Unicorn-3773.exe (PID: 8544)
- Unicorn-7577.exe (PID: 900)
- Unicorn-55713.exe (PID: 9776)
- Unicorn-16151.exe (PID: 9932)
- Unicorn-7473.exe (PID: 8604)
- Unicorn-24308.exe (PID: 8580)
- Unicorn-56757.exe (PID: 9124)
- Unicorn-23425.exe (PID: 8832)
- Unicorn-46031.exe (PID: 8808)
- Unicorn-16444.exe (PID: 8320)
- Unicorn-58261.exe (PID: 8424)
- Unicorn-42990.exe (PID: 8972)
- Unicorn-20697.exe (PID: 8204)
- Unicorn-24926.exe (PID: 8636)
- Unicorn-2533.exe (PID: 7264)
- Unicorn-39517.exe (PID: 9352)
- Unicorn-26135.exe (PID: 9480)
- Unicorn-52673.exe (PID: 9144)
- Unicorn-63337.exe (PID: 9636)
- Unicorn-36793.exe (PID: 11268)
- Unicorn-45661.exe (PID: 9532)
- Unicorn-36431.exe (PID: 3240)
- Unicorn-9039.exe (PID: 9152)
- Unicorn-40809.exe (PID: 9704)
- Unicorn-26360.exe (PID: 12748)
- Unicorn-23421.exe (PID: 11608)
- Unicorn-62995.exe (PID: 10156)
- Unicorn-42753.exe (PID: 12316)
- Unicorn-1116.exe (PID: 8848)
- Unicorn-12045.exe (PID: 9336)
- Unicorn-15589.exe (PID: 9520)
- Unicorn-37821.exe (PID: 9596)
- Unicorn-59745.exe (PID: 10620)
- Unicorn-44550.exe (PID: 14032)
- Unicorn-39534.exe (PID: 10436)
- Unicorn-43794.exe (PID: 9576)
- Unicorn-58338.exe (PID: 15372)
- Unicorn-7321.exe (PID: 15392)
- Unicorn-49835.exe (PID: 11864)
- Unicorn-36793.exe (PID: 11292)
- Unicorn-35891.exe (PID: 8964)
- Unicorn-3316.exe (PID: 10772)
- Unicorn-62044.exe (PID: 9684)
- Unicorn-40250.exe (PID: 7520)
- Unicorn-39133.exe (PID: 9468)
- Unicorn-15470.exe (PID: 8992)
- Unicorn-63192.exe (PID: 9312)
- Unicorn-15962.exe (PID: 14072)
- Unicorn-65226.exe (PID: 8556)
- Unicorn-36632.exe (PID: 9856)
- Unicorn-51402.exe (PID: 10280)
- Unicorn-31955.exe (PID: 9604)
- Unicorn-41536.exe (PID: 11880)
- Unicorn-43154.exe (PID: 4200)
- Unicorn-26322.exe (PID: 10320)
- Unicorn-58231.exe (PID: 9272)
- Unicorn-39905.exe (PID: 13352)
- Unicorn-36793.exe (PID: 11300)
- Unicorn-21211.exe (PID: 13212)
- Unicorn-17752.exe (PID: 12800)
- Unicorn-64600.exe (PID: 12852)
- Unicorn-64878.exe (PID: 12560)
- Unicorn-24670.exe (PID: 13400)
- Unicorn-13008.exe (PID: 14532)
- Unicorn-63653.exe (PID: 10372)
- Unicorn-11576.exe (PID: 15504)
- Unicorn-15197.exe (PID: 13220)
- Unicorn-35936.exe (PID: 11848)
- Unicorn-15696.exe (PID: 14064)
- Unicorn-18736.exe (PID: 11960)
- Unicorn-64600.exe (PID: 12828)
- Unicorn-11441.exe (PID: 11252)
- Unicorn-42753.exe (PID: 12292)
- Unicorn-42753.exe (PID: 12348)
- Unicorn-40192.exe (PID: 2568)
- Unicorn-9357.exe (PID: 10752)
- Unicorn-44308.exe (PID: 9624)
- Unicorn-473.exe (PID: 10164)
- Unicorn-789.exe (PID: 13632)
- Unicorn-13008.exe (PID: 14508)
- Unicorn-64600.exe (PID: 12868)
Checks supported languages
- 1 (1355).exe (PID: 2284)
- Unicorn-56082.exe (PID: 1532)
- Unicorn-42050.exe (PID: 1228)
- Unicorn-20923.exe (PID: 4120)
- Unicorn-8054.exe (PID: 6068)
- Unicorn-21467.exe (PID: 896)
- Unicorn-65423.exe (PID: 6148)
- Unicorn-7732.exe (PID: 3176)
- Unicorn-63726.exe (PID: 2800)
- Unicorn-32123.exe (PID: 6512)
- Unicorn-12671.exe (PID: 2772)
- Unicorn-31858.exe (PID: 1128)
- Unicorn-53550.exe (PID: 5964)
- Unicorn-20878.exe (PID: 4464)
- Unicorn-25516.exe (PID: 2984)
- Unicorn-46342.exe (PID: 4188)
- Unicorn-14738.exe (PID: 856)
- Unicorn-21572.exe (PID: 5608)
- Unicorn-49257.exe (PID: 7176)
- Unicorn-12907.exe (PID: 6572)
- Unicorn-35521.exe (PID: 7184)
- Unicorn-3726.exe (PID: 7208)
- Unicorn-47219.exe (PID: 7192)
- Unicorn-28143.exe (PID: 7708)
- Unicorn-31520.exe (PID: 7752)
- Unicorn-49340.exe (PID: 7736)
- Unicorn-15397.exe (PID: 7880)
- Unicorn-4489.exe (PID: 7896)
- Unicorn-46762.exe (PID: 7920)
- Unicorn-38816.exe (PID: 7948)
- Unicorn-44946.exe (PID: 7956)
- Unicorn-64597.exe (PID: 7980)
- Unicorn-33056.exe (PID: 8016)
- Unicorn-24718.exe (PID: 7932)
- Unicorn-53617.exe (PID: 8088)
- Unicorn-37546.exe (PID: 8076)
- Unicorn-5065.exe (PID: 8056)
- Unicorn-21708.exe (PID: 8064)
- Unicorn-49606.exe (PID: 8148)
- Unicorn-6911.exe (PID: 8096)
- Unicorn-25294.exe (PID: 8120)
- Unicorn-58521.exe (PID: 8172)
- Unicorn-15433.exe (PID: 672)
- Unicorn-5236.exe (PID: 8188)
- Unicorn-25797.exe (PID: 7404)
- Unicorn-54650.exe (PID: 4996)
- Unicorn-46482.exe (PID: 7336)
- Unicorn-21000.exe (PID: 5256)
- Unicorn-60597.exe (PID: 7548)
- Unicorn-47406.exe (PID: 7564)
- Unicorn-27131.exe (PID: 7340)
- Unicorn-2673.exe (PID: 7540)
- Unicorn-23779.exe (PID: 7572)
- Unicorn-48174.exe (PID: 7652)
- Unicorn-44562.exe (PID: 7360)
- Unicorn-9288.exe (PID: 7584)
- Unicorn-7141.exe (PID: 7688)
- Unicorn-21100.exe (PID: 7744)
- Unicorn-35538.exe (PID: 7696)
- Unicorn-41245.exe (PID: 7704)
- Unicorn-819.exe (PID: 7720)
- Unicorn-63424.exe (PID: 7296)
- Unicorn-41520.exe (PID: 5972)
- Unicorn-59611.exe (PID: 5436)
- Unicorn-44785.exe (PID: 7760)
- Unicorn-55055.exe (PID: 5392)
- Unicorn-20697.exe (PID: 8204)
- Unicorn-28906.exe (PID: 8232)
- Unicorn-46586.exe (PID: 8288)
- Unicorn-28906.exe (PID: 8236)
- Unicorn-44156.exe (PID: 8296)
- Unicorn-13337.exe (PID: 8328)
- Unicorn-26336.exe (PID: 8304)
- Unicorn-16444.exe (PID: 8320)
- Unicorn-58261.exe (PID: 8424)
- Unicorn-65226.exe (PID: 8556)
- Unicorn-7784.exe (PID: 8500)
- Unicorn-26231.exe (PID: 8532)
- Unicorn-9850.exe (PID: 8616)
- Unicorn-1919.exe (PID: 8508)
- Unicorn-12496.exe (PID: 8524)
- Unicorn-24926.exe (PID: 8636)
- Unicorn-24308.exe (PID: 8580)
- Unicorn-4313.exe (PID: 8796)
- Unicorn-10125.exe (PID: 9028)
- Unicorn-13358.exe (PID: 8820)
- Unicorn-23425.exe (PID: 8832)
- Unicorn-46031.exe (PID: 8808)
- Unicorn-43483.exe (PID: 9060)
- Unicorn-15470.exe (PID: 8992)
- Unicorn-784.exe (PID: 8752)
- Unicorn-35590.exe (PID: 9100)
- Unicorn-42990.exe (PID: 8972)
- Unicorn-30546.exe (PID: 9004)
- Unicorn-40250.exe (PID: 7520)
- Unicorn-11853.exe (PID: 8276)
- Unicorn-40250.exe (PID: 6632)
- Unicorn-32832.exe (PID: 9364)
- Unicorn-63529.exe (PID: 7220)
- Unicorn-60789.exe (PID: 7152)
- Unicorn-54864.exe (PID: 7244)
- Unicorn-7577.exe (PID: 900)
- Unicorn-48973.exe (PID: 6540)
- Unicorn-27614.exe (PID: 5280)
- Unicorn-6984.exe (PID: 9328)
- Unicorn-9039.exe (PID: 9152)
- Unicorn-30611.exe (PID: 9280)
- Unicorn-55692.exe (PID: 9236)
- Unicorn-51194.exe (PID: 9248)
- Unicorn-39133.exe (PID: 9468)
- Unicorn-7058.exe (PID: 9500)
- Unicorn-52869.exe (PID: 9456)
- Unicorn-60841.exe (PID: 9132)
- Unicorn-45661.exe (PID: 9532)
- Unicorn-56114.exe (PID: 9912)
- Unicorn-55845.exe (PID: 9724)
- Unicorn-2590.exe (PID: 9552)
- Unicorn-62044.exe (PID: 9684)
- Unicorn-63337.exe (PID: 9636)
- Unicorn-31955.exe (PID: 9604)
- Unicorn-18220.exe (PID: 9584)
- Unicorn-37821.exe (PID: 9596)
- Unicorn-11300.exe (PID: 9764)
- Unicorn-55713.exe (PID: 9776)
- Unicorn-23634.exe (PID: 9812)
- Unicorn-56498.exe (PID: 9848)
- Unicorn-44308.exe (PID: 9624)
- Unicorn-33338.exe (PID: 10116)
- Unicorn-473.exe (PID: 10164)
- Unicorn-9031.exe (PID: 10184)
- Unicorn-62995.exe (PID: 10156)
- Unicorn-63633.exe (PID: 10192)
- Unicorn-51319.exe (PID: 5020)
- Unicorn-19393.exe (PID: 10224)
- Unicorn-46548.exe (PID: 10248)
- Unicorn-26898.exe (PID: 1088)
- Unicorn-30141.exe (PID: 10328)
- Unicorn-27666.exe (PID: 10364)
- Unicorn-23582.exe (PID: 10380)
- Unicorn-7053.exe (PID: 10424)
- Unicorn-18922.exe (PID: 10464)
- Unicorn-55870.exe (PID: 10476)
- Unicorn-914.exe (PID: 10516)
- Unicorn-6669.exe (PID: 10484)
- Unicorn-59745.exe (PID: 10620)
- Unicorn-60457.exe (PID: 10628)
- Unicorn-40856.exe (PID: 10676)
- Unicorn-34511.exe (PID: 10976)
- Unicorn-1838.exe (PID: 11000)
- Unicorn-40856.exe (PID: 10644)
- Unicorn-17856.exe (PID: 904)
- Unicorn-40856.exe (PID: 10684)
- Unicorn-9357.exe (PID: 10752)
- Unicorn-62201.exe (PID: 10764)
- Unicorn-52392.exe (PID: 10884)
- Unicorn-36431.exe (PID: 3240)
- Unicorn-36793.exe (PID: 4572)
- Unicorn-36793.exe (PID: 11284)
- Unicorn-36793.exe (PID: 11292)
- Unicorn-64443.exe (PID: 11052)
- Unicorn-23421.exe (PID: 11608)
- Unicorn-17555.exe (PID: 11616)
- Unicorn-50006.exe (PID: 11636)
- Unicorn-14755.exe (PID: 11732)
- Unicorn-56851.exe (PID: 5740)
- Unicorn-3316.exe (PID: 10772)
- Unicorn-752.exe (PID: 11096)
- Unicorn-1101.exe (PID: 11912)
- Unicorn-18736.exe (PID: 11960)
- Unicorn-60124.exe (PID: 11980)
- Unicorn-53426.exe (PID: 11756)
- Unicorn-15116.exe (PID: 11832)
- Unicorn-59674.exe (PID: 11324)
- Unicorn-44991.exe (PID: 11788)
- Unicorn-42753.exe (PID: 12300)
- Unicorn-35855.exe (PID: 11012)
- Unicorn-48618.exe (PID: 12396)
- Unicorn-42753.exe (PID: 12348)
- Unicorn-29017.exe (PID: 12404)
- Unicorn-42753.exe (PID: 12324)
- Unicorn-30937.exe (PID: 12604)
- Unicorn-17752.exe (PID: 12800)
- Unicorn-1217.exe (PID: 12780)
- Unicorn-64600.exe (PID: 12836)
- Unicorn-6272.exe (PID: 12912)
- Unicorn-24636.exe (PID: 13884)
- Unicorn-64600.exe (PID: 12852)
- Unicorn-21211.exe (PID: 13212)
- Unicorn-34532.exe (PID: 13236)
- Unicorn-48115.exe (PID: 12188)
- Unicorn-49070.exe (PID: 13460)
- Unicorn-26766.exe (PID: 12984)
- Unicorn-64600.exe (PID: 12868)
- Unicorn-34096.exe (PID: 14052)
- Unicorn-15962.exe (PID: 14072)
- Unicorn-42931.exe (PID: 13604)
- Unicorn-47568.exe (PID: 13392)
- Unicorn-9533.exe (PID: 13800)
- Unicorn-34389.exe (PID: 13704)
- Unicorn-38996.exe (PID: 14492)
- Unicorn-4403.exe (PID: 14016)
- Unicorn-6833.exe (PID: 13840)
- Unicorn-57679.exe (PID: 14088)
- Unicorn-13008.exe (PID: 14524)
- Unicorn-64878.exe (PID: 12560)
- Unicorn-48390.exe (PID: 12280)
- Unicorn-13008.exe (PID: 14508)
- Unicorn-25068.exe (PID: 14632)
- Unicorn-25068.exe (PID: 14616)
- Unicorn-4592.exe (PID: 14564)
- Unicorn-39905.exe (PID: 13352)
- Unicorn-37761.exe (PID: 13716)
- Unicorn-5280.exe (PID: 13684)
- Unicorn-53403.exe (PID: 14108)
- Unicorn-23611.exe (PID: 12224)
- Unicorn-19003.exe (PID: 13784)
- Unicorn-43315.exe (PID: 13544)
- Unicorn-15473.exe (PID: 13100)
- Unicorn-64600.exe (PID: 12860)
- Unicorn-268.exe (PID: 6824)
- Unicorn-25172.exe (PID: 15512)
- Unicorn-3045.exe (PID: 15448)
- Unicorn-51292.exe (PID: 15532)
- Unicorn-13008.exe (PID: 14540)
- Unicorn-789.exe (PID: 13632)
- Unicorn-7408.exe (PID: 14464)
- Unicorn-53901.exe (PID: 13484)
- Unicorn-21368.exe (PID: 14408)
- Unicorn-23967.exe (PID: 1280)
- Unicorn-43154.exe (PID: 4200)
- Unicorn-29802.exe (PID: 5228)
- Unicorn-29138.exe (PID: 7500)
- Unicorn-29138.exe (PID: 7292)
- Unicorn-56848.exe (PID: 8944)
- Unicorn-56848.exe (PID: 8948)
- Unicorn-29802.exe (PID: 16412)
- Unicorn-10201.exe (PID: 16428)
- Unicorn-10201.exe (PID: 7348)
- Unicorn-2962.exe (PID: 16420)
The sample compiled with chinese language support
- 1 (1355).exe (PID: 2284)
- Unicorn-42050.exe (PID: 1228)
- Unicorn-20923.exe (PID: 4120)
- Unicorn-56082.exe (PID: 1532)
- Unicorn-65423.exe (PID: 6148)
- Unicorn-8054.exe (PID: 6068)
- Unicorn-21467.exe (PID: 896)
- Unicorn-7732.exe (PID: 3176)
- Unicorn-54214.exe (PID: 4988)
- Unicorn-13373.exe (PID: 5728)
- Unicorn-54961.exe (PID: 2384)
- Unicorn-12671.exe (PID: 2772)
- Unicorn-63726.exe (PID: 2800)
- Unicorn-5760.exe (PID: 5640)
- Unicorn-32123.exe (PID: 6512)
- Unicorn-15589.exe (PID: 9520)
- Unicorn-64600.exe (PID: 12868)
Create files in a temporary directory
- Unicorn-56082.exe (PID: 1532)
- 1 (1355).exe (PID: 2284)
- Unicorn-20923.exe (PID: 4120)
- Unicorn-7732.exe (PID: 3176)
- Unicorn-54214.exe (PID: 4988)
- Unicorn-8054.exe (PID: 6068)
- Unicorn-54961.exe (PID: 2384)
- Unicorn-31858.exe (PID: 1128)
- Unicorn-12671.exe (PID: 2772)
- Unicorn-63726.exe (PID: 2800)
- Unicorn-5760.exe (PID: 5640)
- Unicorn-32123.exe (PID: 6512)
- Unicorn-6195.exe (PID: 2516)
- Unicorn-42050.exe (PID: 1228)
- Unicorn-20494.exe (PID: 1852)
- Unicorn-49257.exe (PID: 7176)
- Unicorn-3726.exe (PID: 7208)
- Unicorn-49340.exe (PID: 7736)
- Unicorn-65423.exe (PID: 6148)
- Unicorn-36887.exe (PID: 7864)
- Unicorn-15397.exe (PID: 7880)
- Unicorn-12907.exe (PID: 6572)
- Unicorn-43218.exe (PID: 7724)
- Unicorn-20878.exe (PID: 4464)
- Unicorn-44946.exe (PID: 7956)
- Unicorn-26393.exe (PID: 680)
- Unicorn-13373.exe (PID: 5728)
- Unicorn-24718.exe (PID: 7932)
- Unicorn-64597.exe (PID: 7980)
- Unicorn-18395.exe (PID: 7988)
- Unicorn-37546.exe (PID: 8076)
- Unicorn-25516.exe (PID: 2984)
- Unicorn-58713.exe (PID: 8104)
- Unicorn-53550.exe (PID: 5964)
- Unicorn-21467.exe (PID: 896)
- Unicorn-7333.exe (PID: 7668)
- Unicorn-33056.exe (PID: 8016)
- Unicorn-25294.exe (PID: 8120)
- Unicorn-7141.exe (PID: 7688)
- Unicorn-35538.exe (PID: 7696)
- Unicorn-25294.exe (PID: 8112)
- Unicorn-46762.exe (PID: 7920)
- Unicorn-819.exe (PID: 7720)
- Unicorn-13233.exe (PID: 8048)
- Unicorn-56513.exe (PID: 7556)
- Unicorn-58521.exe (PID: 8172)
- Unicorn-2673.exe (PID: 7540)
- Unicorn-38816.exe (PID: 7948)
- Unicorn-47219.exe (PID: 7192)
- Unicorn-63424.exe (PID: 7296)
- Unicorn-28906.exe (PID: 8236)
- Unicorn-28906.exe (PID: 8232)
- Unicorn-21000.exe (PID: 5256)
- Unicorn-55055.exe (PID: 5392)
- Unicorn-48174.exe (PID: 7652)
- Unicorn-60597.exe (PID: 7548)
- Unicorn-21100.exe (PID: 7744)
- Unicorn-4157.exe (PID: 1452)
- Unicorn-44562.exe (PID: 7360)
- Unicorn-21572.exe (PID: 5608)
- Unicorn-35521.exe (PID: 7184)
- Unicorn-43483.exe (PID: 9060)
- Unicorn-4489.exe (PID: 7896)
- Unicorn-44156.exe (PID: 8296)
- Unicorn-46586.exe (PID: 8288)
- Unicorn-13337.exe (PID: 8328)
- Unicorn-48921.exe (PID: 7036)
- Unicorn-21838.exe (PID: 3096)
- Unicorn-54650.exe (PID: 4996)
- Unicorn-5236.exe (PID: 8188)
- Unicorn-41245.exe (PID: 7704)
- Unicorn-46482.exe (PID: 7336)
- Unicorn-34526.exe (PID: 8392)
- Unicorn-3986.exe (PID: 9116)
- Unicorn-21708.exe (PID: 8064)
- Unicorn-7784.exe (PID: 8500)
- Unicorn-26231.exe (PID: 8532)
- Unicorn-1919.exe (PID: 8508)
- Unicorn-23156.exe (PID: 8348)
- Unicorn-43276.exe (PID: 8452)
- Unicorn-16151.exe (PID: 9932)
- Unicorn-17915.exe (PID: 8220)
- Unicorn-40582.exe (PID: 2644)
- Unicorn-14738.exe (PID: 856)
- Unicorn-12496.exe (PID: 8524)
- Unicorn-3773.exe (PID: 8544)
- Unicorn-55713.exe (PID: 9776)
- Unicorn-56757.exe (PID: 9124)
- Unicorn-24308.exe (PID: 8580)
- Unicorn-24926.exe (PID: 8636)
- Unicorn-60841.exe (PID: 9132)
- Unicorn-23530.exe (PID: 9220)
- Unicorn-42907.exe (PID: 8880)
- Unicorn-46031.exe (PID: 8808)
- Unicorn-58261.exe (PID: 8424)
- Unicorn-25797.exe (PID: 7404)
- Unicorn-39517.exe (PID: 9352)
- Unicorn-59611.exe (PID: 5436)
- Unicorn-39705.exe (PID: 9828)
- Unicorn-52657.exe (PID: 8008)
- Unicorn-23779.exe (PID: 7572)
- Unicorn-753.exe (PID: 9432)
- Unicorn-58459.exe (PID: 7908)
- Unicorn-34526.exe (PID: 8384)
- Unicorn-35590.exe (PID: 9100)
- Unicorn-16444.exe (PID: 8320)
- Unicorn-46342.exe (PID: 4188)
- Unicorn-17644.exe (PID: 9448)
- Unicorn-9031.exe (PID: 10184)
- Unicorn-11853.exe (PID: 8276)
- Unicorn-36793.exe (PID: 11268)
- Unicorn-6911.exe (PID: 8096)
- Unicorn-45661.exe (PID: 9532)
- Unicorn-1838.exe (PID: 11000)
- Unicorn-2533.exe (PID: 7264)
- Unicorn-9288.exe (PID: 7584)
- Unicorn-13358.exe (PID: 8820)
- Unicorn-44915.exe (PID: 8464)
- Unicorn-47406.exe (PID: 7564)
- Unicorn-36431.exe (PID: 3240)
- Unicorn-21203.exe (PID: 9896)
- Unicorn-26135.exe (PID: 9480)
- Unicorn-15433.exe (PID: 672)
- Unicorn-41240.exe (PID: 9736)
- Unicorn-52673.exe (PID: 9144)
- Unicorn-42753.exe (PID: 12316)
- Unicorn-26360.exe (PID: 12748)
- Unicorn-62201.exe (PID: 10764)
- Unicorn-55692.exe (PID: 9236)
- Unicorn-6897.exe (PID: 8668)
- Unicorn-16648.exe (PID: 10652)
- Unicorn-12045.exe (PID: 9336)
- Unicorn-10125.exe (PID: 9028)
- Unicorn-9039.exe (PID: 9152)
- Unicorn-36793.exe (PID: 11284)
- Unicorn-32832.exe (PID: 9364)
- Unicorn-30546.exe (PID: 9004)
- Unicorn-53617.exe (PID: 8088)
- Unicorn-15589.exe (PID: 9520)
- Unicorn-37821.exe (PID: 9596)
- Unicorn-31520.exe (PID: 7752)
- Unicorn-34511.exe (PID: 10976)
- Unicorn-51319.exe (PID: 5020)
- Unicorn-27614.exe (PID: 5280)
- Unicorn-51194.exe (PID: 9248)
- Unicorn-26336.exe (PID: 8304)
- Unicorn-24636.exe (PID: 13896)
- Unicorn-10265.exe (PID: 7636)
- Unicorn-23634.exe (PID: 9812)
- Unicorn-64783.exe (PID: 13944)
- Unicorn-37844.exe (PID: 12632)
- Unicorn-58338.exe (PID: 15372)
- Unicorn-36793.exe (PID: 2968)
- Unicorn-6196.exe (PID: 7396)
- Unicorn-7321.exe (PID: 15392)
- Unicorn-4313.exe (PID: 8796)
- Unicorn-52869.exe (PID: 9456)
- Unicorn-56467.exe (PID: 11024)
- Unicorn-15962.exe (PID: 14072)
- Unicorn-36793.exe (PID: 11276)
- Unicorn-36793.exe (PID: 4572)
- Unicorn-65226.exe (PID: 8556)
- Unicorn-18220.exe (PID: 9584)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 5608)
- BackgroundTransferHost.exe (PID: 4300)
- BackgroundTransferHost.exe (PID: 7360)
- BackgroundTransferHost.exe (PID: 7604)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 5608)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 5608)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 5608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
765
Monitored processes
629
Malicious processes
94
Suspicious processes
69
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 660 | C:\Users\admin\AppData\Local\Temp\Unicorn-41390.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-41390.exe | — | Unicorn-63192.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 672 | C:\Users\admin\AppData\Local\Temp\Unicorn-15433.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-15433.exe | Unicorn-25516.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 680 | C:\Users\admin\AppData\Local\Temp\Unicorn-26393.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-26393.exe | Unicorn-8054.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 856 | C:\Users\admin\AppData\Local\Temp\Unicorn-14738.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-14738.exe | Unicorn-63726.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 896 | C:\Users\admin\AppData\Local\Temp\Unicorn-21467.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-21467.exe | 1 (1355).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 900 | C:\Users\admin\AppData\Local\Temp\Unicorn-7577.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-7577.exe | Unicorn-21000.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 904 | C:\Users\admin\AppData\Local\Temp\Unicorn-17856.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-17856.exe | — | Unicorn-46482.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 976 | C:\Users\admin\AppData\Local\Temp\Unicorn-61851.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-61851.exe | — | Unicorn-37844.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1088 | C:\Users\admin\AppData\Local\Temp\Unicorn-26898.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-26898.exe | — | Unicorn-1919.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1128 | C:\Users\admin\AppData\Local\Temp\Unicorn-31858.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-31858.exe | 1 (1355).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
16 012
Read events
15 997
Write events
15
Delete events
0
Modification events
| (PID) Process: | (2552) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2552) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2552) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (5608) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (5608) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (5608) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (4300) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4300) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4300) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7360) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
679
Suspicious files
11
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5608 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8e14ab19-32e4-4c2b-bd54-1b9dcba4c7a4.down_data | — | |
MD5:— | SHA256:— | |||
| 1228 | Unicorn-42050.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8054.exe | executable | |
MD5:54D9E1C77629921A4D7D5366F5101224 | SHA256:442F600106E6035E35DED0C34A54A3A98C0CD82E4A990AF88EBD2884FEF7B984 | |||
| 1532 | Unicorn-56082.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-42050.exe | executable | |
MD5:FDED6E3580F8481159F4EABA34BB61AD | SHA256:D0FAD06AD9D134CD23E482240A6C83FA86D6841914A40B1E75C272ED760A3CD0 | |||
| 6068 | Unicorn-8054.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13373.exe | executable | |
MD5:6F5DEA35D36D5C5F18DE44EC2FCBF647 | SHA256:626D0EA266852B3E231749DEBCE337DF1DE4212191CAF04D6CAD19CF3B371B8B | |||
| 2284 | 1 (1355).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-21467.exe | executable | |
MD5:0A033CD6AD848F55CF1C2320FA0632FB | SHA256:0D5B98842F39DD755C0385AF0D5DB7A6B2FF74EAF6DCA246157BBCFE7378F020 | |||
| 1532 | Unicorn-56082.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-7732.exe | executable | |
MD5:0B5570A004055D55D4EC27E20033EBBB | SHA256:4B66E33EC0D56DCDB5CF70961A1DEBCB7270F5FC6EF8E100DA910A3D33D029E4 | |||
| 2284 | 1 (1355).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56082.exe | executable | |
MD5:8F54FDBA1C008D192B0AE920C50C2307 | SHA256:4F0F1C40E3E3B298AC8E6DB7C126A6BF0D82999A96E888CDE4DE7DAB941E1BDC | |||
| 2284 | 1 (1355).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20923.exe | executable | |
MD5:84617BB7BB9505B469815D26BC9433D7 | SHA256:54FE39D3D0A8815607AD8F46EE89DC9E0973B062C7CF4792038CF8597FCD4421 | |||
| 4120 | Unicorn-20923.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-65423.exe | executable | |
MD5:4CD453DC425166A0647C60A2991C4E28 | SHA256:47AAB351F9267C3C5FBFF65D74676D9C26CA1C7B64A1B80CDE8001A56AE844BB | |||
| 4988 | Unicorn-54214.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53550.exe | executable | |
MD5:48A360A8A602B588B35B1646AF1EAE42 | SHA256:6896DBAAC1479B7DB30803912A1A75874FD4CB52D7906232E43DD27B5FED24AB | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
23
DNS requests
15
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6032 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | unknown |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
5608 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | unknown |
6632 | SIHClient.exe | GET | 200 | 23.215.121.133:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | unknown |
6632 | SIHClient.exe | GET | 200 | 23.215.121.133:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
2104 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | unknown |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
6544 | svchost.exe | 40.126.32.140:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | unknown |
2112 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
6032 | backgroundTaskHost.exe | 20.223.35.26:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
6032 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | unknown |
5608 | BackgroundTransferHost.exe | 2.23.227.208:443 | www.bing.com | Ooredoo Q.S.C. | QA | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| unknown |
client.wns.windows.com |
| unknown |
login.live.com |
| unknown |
ocsp.digicert.com |
| unknown |
settings-win.data.microsoft.com |
| unknown |
arc.msn.com |
| unknown |
www.bing.com |
| unknown |
slscr.update.microsoft.com |
| unknown |
www.microsoft.com |
| unknown |
fe3cr.delivery.mp.microsoft.com |
| unknown |