File name:

1 (158)

Full analysis: https://app.any.run/tasks/8a7cf835-204b-4c73-b77c-d495728a0371
Verdict: Malicious activity
Analysis date: March 24, 2025, 17:02:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

3D1355FA91E39F3ED9E279E8088E5CF0

SHA1:

539670C598DAA2DE2C2BF494576C3D6D9A74D3FC

SHA256:

14800998D00C4D4E4D6313FCE0901E0819027391ED1D8976BB49A1400681C60D

SSDEEP:

6144:9778ng9PQDce65LjLGeEzBjx5wPq5p8GBf/WF1OdHk/8SwjwpyAvEhB1LTd6sKSa:9POmFe65/LZhP0+afOF1OdXx4DxmDsR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Starts itself from another location

      • 1 (158).exe (PID: 3888)
      • Unicorn-61578.exe (PID: 4172)
      • Unicorn-37396.exe (PID: 2088)
      • Unicorn-9435.exe (PID: 6676)
      • Unicorn-6097.exe (PID: 1040)
      • Unicorn-32325.exe (PID: 2320)
      • Unicorn-33717.exe (PID: 5400)
      • Unicorn-33717.exe (PID: 4980)
      • Unicorn-36296.exe (PID: 1168)
      • Unicorn-4378.exe (PID: 6040)
      • Unicorn-32254.exe (PID: 6004)
      • Unicorn-53652.exe (PID: 2268)
      • Unicorn-53823.exe (PID: 1300)
      • Unicorn-60211.exe (PID: 4560)
      • Unicorn-51580.exe (PID: 6816)
      • Unicorn-65338.exe (PID: 5124)
      • Unicorn-34934.exe (PID: 2692)
      • Unicorn-60398.exe (PID: 660)
      • Unicorn-12573.exe (PID: 5352)
      • Unicorn-41924.exe (PID: 6736)
      • Unicorn-57362.exe (PID: 1072)
      • Unicorn-63998.exe (PID: 4244)
      • Unicorn-60398.exe (PID: 6240)
      • Unicorn-45562.exe (PID: 7336)
      • Unicorn-11690.exe (PID: 5408)
      • Unicorn-11425.exe (PID: 2192)
      • Unicorn-58452.exe (PID: 6228)
      • Unicorn-57362.exe (PID: 976)
      • Unicorn-25041.exe (PID: 7304)
      • Unicorn-38385.exe (PID: 5436)
      • Unicorn-398.exe (PID: 7260)
      • Unicorn-58674.exe (PID: 7432)
      • Unicorn-36024.exe (PID: 7424)
      • Unicorn-55027.exe (PID: 7356)
      • Unicorn-44939.exe (PID: 7464)
      • Unicorn-21669.exe (PID: 7640)
      • Unicorn-14337.exe (PID: 7796)
      • Unicorn-10829.exe (PID: 7760)
      • Unicorn-47176.exe (PID: 7964)
      • Unicorn-49895.exe (PID: 7820)
      • Unicorn-46771.exe (PID: 7860)
      • Unicorn-24149.exe (PID: 7980)
      • Unicorn-13242.exe (PID: 7924)
      • Unicorn-29369.exe (PID: 8044)
      • Unicorn-60004.exe (PID: 8036)
      • Unicorn-54966.exe (PID: 8132)
      • Unicorn-63896.exe (PID: 8060)
      • Unicorn-34623.exe (PID: 8092)
      • Unicorn-46792.exe (PID: 8160)
      • Unicorn-44415.exe (PID: 8084)
      • Unicorn-57958.exe (PID: 8152)
      • Unicorn-64088.exe (PID: 8028)
      • Unicorn-57435.exe (PID: 8108)
      • Unicorn-51452.exe (PID: 8124)
      • Unicorn-16402.exe (PID: 8116)
      • Unicorn-47560.exe (PID: 8100)
      • Unicorn-55297.exe (PID: 8176)
      • Unicorn-7414.exe (PID: 4652)
      • Unicorn-27716.exe (PID: 7204)
      • Unicorn-23632.exe (PID: 7220)
      • Unicorn-45567.exe (PID: 4724)
      • Unicorn-23715.exe (PID: 7700)
      • Unicorn-63661.exe (PID: 3968)
      • Unicorn-17384.exe (PID: 7244)
      • Unicorn-14784.exe (PID: 5212)
      • Unicorn-21276.exe (PID: 5960)
      • Unicorn-6776.exe (PID: 668)
      • Unicorn-62287.exe (PID: 7708)
      • Unicorn-57072.exe (PID: 7724)
      • Unicorn-44555.exe (PID: 7740)
      • Unicorn-21276.exe (PID: 4868)
      • Unicorn-10538.exe (PID: 5232)
      • Unicorn-38742.exe (PID: 4628)
      • Unicorn-5323.exe (PID: 7312)
      • Unicorn-58608.exe (PID: 6264)
      • Unicorn-32057.exe (PID: 8212)
      • Unicorn-32057.exe (PID: 8220)
      • Unicorn-16699.exe (PID: 5036)
      • Unicorn-48219.exe (PID: 8260)
      • Unicorn-60663.exe (PID: 8276)
      • Unicorn-2507.exe (PID: 8284)
      • Unicorn-15323.exe (PID: 8504)
      • Unicorn-30404.exe (PID: 2288)
      • Unicorn-53372.exe (PID: 7692)
      • Unicorn-30761.exe (PID: 8592)
      • Unicorn-18461.exe (PID: 7856)
      • Unicorn-31551.exe (PID: 8640)
      • Unicorn-12500.exe (PID: 8660)
      • Unicorn-16824.exe (PID: 8828)
      • Unicorn-16824.exe (PID: 8812)
      • Unicorn-7539.exe (PID: 8724)
      • Unicorn-56548.exe (PID: 8668)
      • Unicorn-34128.exe (PID: 8804)
      • Unicorn-16824.exe (PID: 8820)
      • Unicorn-19022.exe (PID: 8784)
      • Unicorn-37244.exe (PID: 8796)
      • Unicorn-36860.exe (PID: 8992)
      • Unicorn-31960.exe (PID: 8916)
      • Unicorn-118.exe (PID: 8740)
      • Unicorn-49496.exe (PID: 8756)
      • Unicorn-52931.exe (PID: 9044)
      • Unicorn-19984.exe (PID: 8748)
      • Unicorn-51342.exe (PID: 9136)
      • Unicorn-47066.exe (PID: 9028)
      • Unicorn-41498.exe (PID: 9000)
      • Unicorn-28692.exe (PID: 9080)
      • Unicorn-6308.exe (PID: 8320)
      • Unicorn-38758.exe (PID: 8448)
      • Unicorn-22230.exe (PID: 8312)
      • Unicorn-33165.exe (PID: 9192)
      • Unicorn-28692.exe (PID: 9072)
      • Unicorn-57094.exe (PID: 8908)

    • Executable content was dropped or overwritten

      • 1 (158).exe (PID: 3888)
      • Unicorn-9435.exe (PID: 6676)
      • Unicorn-61578.exe (PID: 4172)
      • Unicorn-6097.exe (PID: 1040)
      • Unicorn-32325.exe (PID: 2320)
      • Unicorn-33717.exe (PID: 5400)
      • Unicorn-37396.exe (PID: 2088)
      • Unicorn-36296.exe (PID: 1168)
      • Unicorn-4378.exe (PID: 6040)
      • Unicorn-32254.exe (PID: 6004)
      • Unicorn-38385.exe (PID: 5436)
      • Unicorn-33717.exe (PID: 4980)
      • Unicorn-53652.exe (PID: 2268)
      • Unicorn-60211.exe (PID: 4560)
      • Unicorn-51580.exe (PID: 6816)
      • Unicorn-65338.exe (PID: 5124)
      • Unicorn-60398.exe (PID: 660)
      • Unicorn-34934.exe (PID: 2692)
      • Unicorn-53823.exe (PID: 1300)
      • Unicorn-12573.exe (PID: 5352)
      • Unicorn-41924.exe (PID: 6736)
      • Unicorn-57362.exe (PID: 1072)
      • Unicorn-60398.exe (PID: 6240)
      • Unicorn-63998.exe (PID: 4244)
      • Unicorn-11425.exe (PID: 2192)
      • Unicorn-45562.exe (PID: 7336)
      • Unicorn-11690.exe (PID: 5408)
      • Unicorn-58452.exe (PID: 6228)
      • Unicorn-25041.exe (PID: 7304)
      • Unicorn-57362.exe (PID: 976)
      • Unicorn-398.exe (PID: 7260)
      • Unicorn-58674.exe (PID: 7432)
      • Unicorn-36024.exe (PID: 7424)
      • Unicorn-55027.exe (PID: 7356)
      • Unicorn-21669.exe (PID: 7640)
      • Unicorn-14337.exe (PID: 7796)
      • Unicorn-44939.exe (PID: 7464)
      • Unicorn-49895.exe (PID: 7820)
      • Unicorn-46771.exe (PID: 7860)
      • Unicorn-47176.exe (PID: 7964)
      • Unicorn-13242.exe (PID: 7924)
      • Unicorn-24149.exe (PID: 7980)
      • Unicorn-63896.exe (PID: 8060)
      • Unicorn-60004.exe (PID: 8036)
      • Unicorn-29369.exe (PID: 8044)
      • Unicorn-54966.exe (PID: 8132)
      • Unicorn-10730.exe (PID: 8076)
      • Unicorn-34623.exe (PID: 8092)
      • Unicorn-46792.exe (PID: 8160)
      • Unicorn-51452.exe (PID: 8124)
      • Unicorn-44415.exe (PID: 8084)
      • Unicorn-57435.exe (PID: 8108)
      • Unicorn-7414.exe (PID: 4652)
      • Unicorn-16402.exe (PID: 8116)
      • Unicorn-47560.exe (PID: 8100)
      • Unicorn-43284.exe (PID: 8068)
      • Unicorn-23632.exe (PID: 7220)
      • Unicorn-18461.exe (PID: 7856)
      • Unicorn-63661.exe (PID: 3968)
      • Unicorn-53372.exe (PID: 7692)
      • Unicorn-57072.exe (PID: 7724)
      • Unicorn-17384.exe (PID: 7244)
      • Unicorn-14784.exe (PID: 5212)
      • Unicorn-44555.exe (PID: 7740)
      • Unicorn-62287.exe (PID: 7708)
      • Unicorn-21276.exe (PID: 5960)
      • Unicorn-30404.exe (PID: 2288)
      • Unicorn-38742.exe (PID: 4628)
      • Unicorn-21276.exe (PID: 4868)
      • Unicorn-10538.exe (PID: 5232)
      • Unicorn-58608.exe (PID: 6264)
      • Unicorn-32057.exe (PID: 8212)
      • Unicorn-5323.exe (PID: 7312)
      • Unicorn-16699.exe (PID: 5036)
      • Unicorn-48219.exe (PID: 8260)
      • Unicorn-32057.exe (PID: 8220)
      • Unicorn-2507.exe (PID: 8284)
      • Unicorn-57958.exe (PID: 8152)
      • Unicorn-27716.exe (PID: 7204)
      • Unicorn-64088.exe (PID: 8028)
      • Unicorn-15323.exe (PID: 8504)
      • Unicorn-45567.exe (PID: 4724)
      • Unicorn-30761.exe (PID: 8592)
      • Unicorn-6776.exe (PID: 668)
      • Unicorn-10829.exe (PID: 7760)
      • Unicorn-56548.exe (PID: 8668)
      • Unicorn-12500.exe (PID: 8660)
      • Unicorn-16824.exe (PID: 8828)
      • Unicorn-16824.exe (PID: 8812)
      • Unicorn-7539.exe (PID: 8724)
      • Unicorn-35863.exe (PID: 8708)
      • Unicorn-31551.exe (PID: 8640)
      • Unicorn-34128.exe (PID: 8804)
      • Unicorn-37244.exe (PID: 8796)
      • Unicorn-19792.exe (PID: 8692)
      • Unicorn-31960.exe (PID: 8916)
      • Unicorn-118.exe (PID: 8740)
      • Unicorn-49496.exe (PID: 8756)
      • Unicorn-52931.exe (PID: 9044)
      • Unicorn-60663.exe (PID: 8276)
      • Unicorn-16824.exe (PID: 8820)
      • Unicorn-47066.exe (PID: 9028)
      • Unicorn-41498.exe (PID: 9000)
      • Unicorn-51342.exe (PID: 9136)
      • Unicorn-28692.exe (PID: 9072)
      • Unicorn-57094.exe (PID: 8908)
      • Unicorn-19984.exe (PID: 8748)
      • Unicorn-28692.exe (PID: 9080)
      • Unicorn-22230.exe (PID: 8312)
      • Unicorn-33165.exe (PID: 9192)
      • Unicorn-9018.exe (PID: 9180)
      • Unicorn-38758.exe (PID: 8448)
      • Unicorn-6308.exe (PID: 8320)
      • Unicorn-51826.exe (PID: 8928)
      • Unicorn-55297.exe (PID: 8176)
      • Unicorn-28884.exe (PID: 9172)
      • Unicorn-63092.exe (PID: 9260)
      • Unicorn-9807.exe (PID: 8328)
      • Unicorn-24534.exe (PID: 9516)
      • Unicorn-26144.exe (PID: 8896)
      • Unicorn-5915.exe (PID: 9292)
      • Unicorn-27296.exe (PID: 9368)
      • Unicorn-51800.exe (PID: 9316)
      • Unicorn-23715.exe (PID: 7700)
      • Unicorn-7067.exe (PID: 9432)
      • Unicorn-22060.exe (PID: 9244)
      • Unicorn-61364.exe (PID: 9020)
      • Unicorn-33330.exe (PID: 9036)
      • Unicorn-25162.exe (PID: 8976)
      • Unicorn-47716.exe (PID: 9340)
      • Unicorn-46845.exe (PID: 9548)
      • Unicorn-18936.exe (PID: 9468)
      • Unicorn-39740.exe (PID: 9380)
      • Unicorn-23715.exe (PID: 9572)
      • Unicorn-29141.exe (PID: 9484)
      • Unicorn-15406.exe (PID: 9492)
      • Unicorn-28064.exe (PID: 9580)
      • Unicorn-23715.exe (PID: 9564)
      • Unicorn-36402.exe (PID: 9704)
      • Unicorn-35909.exe (PID: 9556)
      • Unicorn-58498.exe (PID: 9760)
      • Unicorn-58681.exe (PID: 9820)
      • Unicorn-60051.exe (PID: 9672)
      • Unicorn-31825.exe (PID: 9624)
      • Unicorn-31572.exe (PID: 9448)
      • Unicorn-39740.exe (PID: 9388)
      • Unicorn-17849.exe (PID: 9604)
      • Unicorn-19022.exe (PID: 8784)
      • Unicorn-45936.exe (PID: 10008)
      • Unicorn-57207.exe (PID: 9776)
      • Unicorn-23596.exe (PID: 9744)
      • Unicorn-4882.exe (PID: 9812)
      • Unicorn-47233.exe (PID: 9876)
      • Unicorn-37192.exe (PID: 9884)
      • Unicorn-36402.exe (PID: 9696)
      • Unicorn-45936.exe (PID: 10016)
      • Unicorn-39806.exe (PID: 10000)
      • Unicorn-21741.exe (PID: 9796)
      • Unicorn-45531.exe (PID: 9956)
      • Unicorn-65183.exe (PID: 9712)
      • Unicorn-36860.exe (PID: 8992)
      • Unicorn-49999.exe (PID: 9836)
      • Unicorn-49999.exe (PID: 9828)
      • Unicorn-64051.exe (PID: 9592)
      • Unicorn-36860.exe (PID: 9008)
      • Unicorn-30677.exe (PID: 9976)
      • Unicorn-47498.exe (PID: 9860)
      • Unicorn-40700.exe (PID: 9908)
      • Unicorn-47233.exe (PID: 9868)
      • Unicorn-16005.exe (PID: 9992)
      • Unicorn-63092.exe (PID: 9252)

  • INFO

    • Checks supported languages

      • 1 (158).exe (PID: 3888)
      • Unicorn-9435.exe (PID: 6676)
      • Unicorn-61578.exe (PID: 4172)
      • Unicorn-32325.exe (PID: 2320)
      • Unicorn-33717.exe (PID: 4980)
      • Unicorn-37396.exe (PID: 2088)
      • Unicorn-6097.exe (PID: 1040)
      • Unicorn-36296.exe (PID: 1168)
      • Unicorn-53652.exe (PID: 2268)
      • Unicorn-33717.exe (PID: 5400)
      • Unicorn-53823.exe (PID: 1300)
      • Unicorn-38385.exe (PID: 5436)
      • Unicorn-60211.exe (PID: 4560)
      • Unicorn-4378.exe (PID: 6040)
      • Unicorn-32254.exe (PID: 6004)
      • Unicorn-34934.exe (PID: 2692)
      • Unicorn-65338.exe (PID: 5124)
      • Unicorn-51580.exe (PID: 6816)
      • Unicorn-60398.exe (PID: 6240)
      • Unicorn-12573.exe (PID: 5352)
      • Unicorn-58452.exe (PID: 6228)
      • Unicorn-63998.exe (PID: 4244)
      • Unicorn-11425.exe (PID: 2192)
      • Unicorn-11690.exe (PID: 5408)
      • Unicorn-41924.exe (PID: 6736)
      • Unicorn-57362.exe (PID: 1072)
      • Unicorn-398.exe (PID: 7260)
      • Unicorn-45562.exe (PID: 7336)
      • Unicorn-25041.exe (PID: 7304)
      • Unicorn-55027.exe (PID: 7356)
      • Unicorn-36024.exe (PID: 7424)
      • Unicorn-58674.exe (PID: 7432)
      • Unicorn-44939.exe (PID: 7464)
      • Unicorn-10829.exe (PID: 7760)
      • Unicorn-21669.exe (PID: 7640)
      • Unicorn-14337.exe (PID: 7796)
      • Unicorn-49895.exe (PID: 7820)
      • Unicorn-46771.exe (PID: 7860)
      • Unicorn-13242.exe (PID: 7924)
      • Unicorn-47176.exe (PID: 7964)
      • Unicorn-24149.exe (PID: 7980)
      • Unicorn-60004.exe (PID: 8036)
      • Unicorn-63896.exe (PID: 8060)
      • Unicorn-64088.exe (PID: 8028)
      • Unicorn-16402.exe (PID: 8116)
      • Unicorn-51452.exe (PID: 8124)
      • Unicorn-55297.exe (PID: 8176)
      • Unicorn-10730.exe (PID: 8076)
      • Unicorn-29369.exe (PID: 8044)
      • Unicorn-57435.exe (PID: 8108)
      • Unicorn-23632.exe (PID: 7220)
      • Unicorn-27716.exe (PID: 7204)
      • Unicorn-53372.exe (PID: 7692)
      • Unicorn-44555.exe (PID: 7740)
      • Unicorn-14784.exe (PID: 5212)
      • Unicorn-62287.exe (PID: 7708)
      • Unicorn-23715.exe (PID: 7700)
      • Unicorn-18461.exe (PID: 7856)
      • Unicorn-45567.exe (PID: 4724)
      • Unicorn-17384.exe (PID: 7244)
      • Unicorn-63661.exe (PID: 3968)
      • Unicorn-21276.exe (PID: 4868)
      • Unicorn-6776.exe (PID: 668)
      • Unicorn-10538.exe (PID: 5232)
      • Unicorn-30404.exe (PID: 2288)
      • Unicorn-38742.exe (PID: 4628)
      • Unicorn-21276.exe (PID: 5960)
      • Unicorn-48219.exe (PID: 8260)
      • Unicorn-32057.exe (PID: 8220)
      • Unicorn-16699.exe (PID: 5036)
      • Unicorn-58608.exe (PID: 6264)
      • Unicorn-5323.exe (PID: 7312)
      • Unicorn-60663.exe (PID: 8276)
      • Unicorn-2507.exe (PID: 8284)
      • Unicorn-15323.exe (PID: 8504)
      • Unicorn-30761.exe (PID: 8592)
      • Unicorn-31551.exe (PID: 8640)
      • Unicorn-56548.exe (PID: 8668)
      • Unicorn-35863.exe (PID: 8708)
      • Unicorn-7539.exe (PID: 8724)
      • Unicorn-12500.exe (PID: 8660)
      • Unicorn-19792.exe (PID: 8692)
      • Unicorn-19022.exe (PID: 8784)
      • Unicorn-49496.exe (PID: 8756)
      • Unicorn-37244.exe (PID: 8796)
      • Unicorn-118.exe (PID: 8740)
      • Unicorn-19984.exe (PID: 8748)
      • Unicorn-34128.exe (PID: 8804)
      • Unicorn-51826.exe (PID: 8928)
      • Unicorn-57094.exe (PID: 8908)
      • Unicorn-31960.exe (PID: 8916)
      • Unicorn-16824.exe (PID: 8820)
      • Unicorn-16824.exe (PID: 8812)
      • Unicorn-16824.exe (PID: 8828)
      • Unicorn-52931.exe (PID: 9044)
      • Unicorn-47066.exe (PID: 9028)
      • Unicorn-36860.exe (PID: 8992)
      • Unicorn-36860.exe (PID: 9008)
      • Unicorn-41498.exe (PID: 9000)
      • Unicorn-61364.exe (PID: 9020)
      • Unicorn-28692.exe (PID: 9080)
      • Unicorn-51342.exe (PID: 9136)
      • Unicorn-25162.exe (PID: 8976)
      • Unicorn-28884.exe (PID: 9172)
      • Unicorn-63263.exe (PID: 8252)
      • Unicorn-33165.exe (PID: 9192)
      • Unicorn-22230.exe (PID: 8312)
      • Unicorn-9018.exe (PID: 9180)
      • Unicorn-6308.exe (PID: 8320)
      • Unicorn-38758.exe (PID: 8448)
      • Unicorn-26144.exe (PID: 8896)
      • Unicorn-22060.exe (PID: 9244)
      • Unicorn-63092.exe (PID: 9252)
      • Unicorn-51800.exe (PID: 9316)
      • Unicorn-27296.exe (PID: 9368)
      • Unicorn-39740.exe (PID: 9380)
      • Unicorn-5915.exe (PID: 9292)
      • Unicorn-47716.exe (PID: 9340)
      • Unicorn-15406.exe (PID: 9492)
      • Unicorn-24534.exe (PID: 9516)
      • Unicorn-23715.exe (PID: 9564)
      • Unicorn-23715.exe (PID: 9572)
      • Unicorn-28064.exe (PID: 9580)
      • Unicorn-31572.exe (PID: 9448)
      • Unicorn-31825.exe (PID: 9624)
      • Unicorn-60051.exe (PID: 9672)
      • Unicorn-36402.exe (PID: 9704)
      • Unicorn-36402.exe (PID: 9696)
      • Unicorn-65183.exe (PID: 9712)
      • Unicorn-23596.exe (PID: 9744)
      • Unicorn-57207.exe (PID: 9776)
      • Unicorn-46845.exe (PID: 9548)
      • Unicorn-64051.exe (PID: 9592)
      • Unicorn-35909.exe (PID: 9556)
      • Unicorn-4882.exe (PID: 9812)
      • Unicorn-49999.exe (PID: 9828)
      • Unicorn-49999.exe (PID: 9836)
      • Unicorn-47233.exe (PID: 9876)
      • Unicorn-47233.exe (PID: 9868)
      • Unicorn-16005.exe (PID: 9992)
      • Unicorn-45936.exe (PID: 10016)
      • Unicorn-41934.exe (PID: 7632)
      • Unicorn-31056.exe (PID: 7684)
      • Unicorn-64275.exe (PID: 6488)
      • Unicorn-54790.exe (PID: 10260)
      • Unicorn-36594.exe (PID: 10288)
      • Unicorn-55723.exe (PID: 10316)
      • Unicorn-45531.exe (PID: 9956)
      • Unicorn-30677.exe (PID: 9976)
      • Unicorn-43470.exe (PID: 10416)
      • Unicorn-33661.exe (PID: 10468)
      • Unicorn-19926.exe (PID: 10460)
      • Unicorn-62442.exe (PID: 10548)
      • Unicorn-52791.exe (PID: 10528)
      • Unicorn-11758.exe (PID: 10572)
      • Unicorn-31359.exe (PID: 10556)
      • Unicorn-10441.exe (PID: 10592)
      • Unicorn-48707.exe (PID: 10540)
      • Unicorn-47555.exe (PID: 10328)
      • Unicorn-58483.exe (PID: 10444)
      • Unicorn-37554.exe (PID: 10820)
      • Unicorn-35878.exe (PID: 10740)
      • Unicorn-50891.exe (PID: 10772)
      • Unicorn-35251.exe (PID: 10836)
      • Unicorn-61181.exe (PID: 10888)
      • Unicorn-57498.exe (PID: 10996)
      • Unicorn-25493.exe (PID: 10564)
      • Unicorn-40538.exe (PID: 10660)
      • Unicorn-40538.exe (PID: 10652)
      • Unicorn-49330.exe (PID: 11076)
      • Unicorn-16958.exe (PID: 11096)
      • Unicorn-49330.exe (PID: 11056)
      • Unicorn-49823.exe (PID: 11136)
      • Unicorn-8790.exe (PID: 11108)
      • Unicorn-45931.exe (PID: 11188)
      • Unicorn-21648.exe (PID: 11180)
      • Unicorn-45931.exe (PID: 11196)
      • Unicorn-45931.exe (PID: 11204)
      • Unicorn-38722.exe (PID: 11248)
      • Unicorn-14026.exe (PID: 11256)
      • Unicorn-21618.exe (PID: 11028)
      • Unicorn-66.exe (PID: 11324)
      • Unicorn-7149.exe (PID: 11360)
      • Unicorn-4879.exe (PID: 11352)
      • Unicorn-13014.exe (PID: 11384)
      • Unicorn-7149.exe (PID: 11344)
      • Unicorn-58951.exe (PID: 11368)
      • Unicorn-58951.exe (PID: 11376)
      • Unicorn-4349.exe (PID: 11400)
      • Unicorn-49142.exe (PID: 11516)
      • Unicorn-47851.exe (PID: 11552)
      • Unicorn-59283.exe (PID: 11560)
      • Unicorn-32229.exe (PID: 11584)
      • Unicorn-9558.exe (PID: 5984)
      • Unicorn-56158.exe (PID: 11296)
      • Unicorn-8109.exe (PID: 11480)
      • Unicorn-59362.exe (PID: 11760)
      • Unicorn-31898.exe (PID: 11728)
      • Unicorn-12001.exe (PID: 11680)
      • Unicorn-46918.exe (PID: 11720)
      • Unicorn-23730.exe (PID: 11740)
      • Unicorn-20745.exe (PID: 11824)
      • Unicorn-48978.exe (PID: 11840)
      • Unicorn-18442.exe (PID: 11848)
      • Unicorn-29818.exe (PID: 11872)
      • Unicorn-54431.exe (PID: 11596)
      • Unicorn-36506.exe (PID: 11640)
      • Unicorn-20820.exe (PID: 11964)
      • Unicorn-15.exe (PID: 11984)
      • Unicorn-33648.exe (PID: 12000)
      • Unicorn-13227.exe (PID: 12052)
      • Unicorn-1167.exe (PID: 12068)
      • Unicorn-46668.exe (PID: 12152)
      • Unicorn-44622.exe (PID: 12128)
      • Unicorn-46860.exe (PID: 12180)
      • Unicorn-37540.exe (PID: 12116)
      • Unicorn-13611.exe (PID: 12260)
      • Unicorn-50368.exe (PID: 12208)
      • Unicorn-38308.exe (PID: 12268)
      • Unicorn-46476.exe (PID: 3800)
      • Unicorn-39424.exe (PID: 5892)
      • Unicorn-63544.exe (PID: 8228)
      • Unicorn-21972.exe (PID: 2656)

    • The sample compiled with chinese language support

      • 1 (158).exe (PID: 3888)
      • Unicorn-6097.exe (PID: 1040)
      • Unicorn-32325.exe (PID: 2320)
      • Unicorn-37396.exe (PID: 2088)
      • Unicorn-33717.exe (PID: 5400)
      • Unicorn-9435.exe (PID: 6676)
      • Unicorn-4378.exe (PID: 6040)
      • Unicorn-36296.exe (PID: 1168)
      • Unicorn-32254.exe (PID: 6004)
      • Unicorn-61578.exe (PID: 4172)
      • Unicorn-33717.exe (PID: 4980)
      • Unicorn-38385.exe (PID: 5436)
      • Unicorn-53652.exe (PID: 2268)
      • Unicorn-60211.exe (PID: 4560)
      • Unicorn-51580.exe (PID: 6816)
      • Unicorn-65338.exe (PID: 5124)
      • Unicorn-60398.exe (PID: 660)
      • Unicorn-34934.exe (PID: 2692)
      • Unicorn-53823.exe (PID: 1300)
      • Unicorn-12573.exe (PID: 5352)
      • Unicorn-41924.exe (PID: 6736)
      • Unicorn-63998.exe (PID: 4244)
      • Unicorn-57362.exe (PID: 1072)
      • Unicorn-11425.exe (PID: 2192)
      • Unicorn-11690.exe (PID: 5408)
      • Unicorn-45562.exe (PID: 7336)
      • Unicorn-25041.exe (PID: 7304)
      • Unicorn-60398.exe (PID: 6240)
      • Unicorn-58452.exe (PID: 6228)
      • Unicorn-57362.exe (PID: 976)
      • Unicorn-398.exe (PID: 7260)
      • Unicorn-58674.exe (PID: 7432)
      • Unicorn-36024.exe (PID: 7424)
      • Unicorn-55027.exe (PID: 7356)
      • Unicorn-21669.exe (PID: 7640)
      • Unicorn-14337.exe (PID: 7796)
      • Unicorn-44939.exe (PID: 7464)
      • Unicorn-49895.exe (PID: 7820)
      • Unicorn-47176.exe (PID: 7964)
      • Unicorn-46771.exe (PID: 7860)
      • Unicorn-24149.exe (PID: 7980)
      • Unicorn-13242.exe (PID: 7924)

    • Reads the computer name

      • 1 (158).exe (PID: 3888)
      • Unicorn-9435.exe (PID: 6676)
      • Unicorn-37396.exe (PID: 2088)
      • Unicorn-61578.exe (PID: 4172)
      • Unicorn-33717.exe (PID: 5400)
      • Unicorn-6097.exe (PID: 1040)
      • Unicorn-32325.exe (PID: 2320)
      • Unicorn-33717.exe (PID: 4980)
      • Unicorn-4378.exe (PID: 6040)
      • Unicorn-36296.exe (PID: 1168)
      • Unicorn-53652.exe (PID: 2268)
      • Unicorn-32254.exe (PID: 6004)
      • Unicorn-51580.exe (PID: 6816)
      • Unicorn-34934.exe (PID: 2692)
      • Unicorn-65338.exe (PID: 5124)
      • Unicorn-60211.exe (PID: 4560)
      • Unicorn-57362.exe (PID: 1072)
      • Unicorn-57362.exe (PID: 976)
      • Unicorn-63998.exe (PID: 4244)
      • Unicorn-58452.exe (PID: 6228)
      • Unicorn-60398.exe (PID: 660)
      • Unicorn-41924.exe (PID: 6736)
      • Unicorn-12573.exe (PID: 5352)
      • Unicorn-25041.exe (PID: 7304)
      • Unicorn-55027.exe (PID: 7356)
      • Unicorn-58674.exe (PID: 7432)
      • Unicorn-11690.exe (PID: 5408)
      • Unicorn-45562.exe (PID: 7336)
      • Unicorn-49895.exe (PID: 7820)
      • Unicorn-14337.exe (PID: 7796)
      • Unicorn-10829.exe (PID: 7760)
      • Unicorn-36024.exe (PID: 7424)
      • Unicorn-44939.exe (PID: 7464)
      • Unicorn-46771.exe (PID: 7860)
      • Unicorn-47176.exe (PID: 7964)
      • Unicorn-13242.exe (PID: 7924)
      • Unicorn-16402.exe (PID: 8116)
      • Unicorn-60004.exe (PID: 8036)
      • Unicorn-46792.exe (PID: 8160)
      • Unicorn-63896.exe (PID: 8060)
      • Unicorn-44415.exe (PID: 8084)
      • Unicorn-34623.exe (PID: 8092)
      • Unicorn-57958.exe (PID: 8152)
      • Unicorn-51452.exe (PID: 8124)
      • Unicorn-55297.exe (PID: 8176)
      • Unicorn-27716.exe (PID: 7204)
      • Unicorn-43284.exe (PID: 8068)
      • Unicorn-17384.exe (PID: 7244)
      • Unicorn-14784.exe (PID: 5212)
      • Unicorn-63661.exe (PID: 3968)
      • Unicorn-45567.exe (PID: 4724)
      • Unicorn-21276.exe (PID: 5960)
      • Unicorn-53372.exe (PID: 7692)
      • Unicorn-23715.exe (PID: 7700)
      • Unicorn-62287.exe (PID: 7708)
      • Unicorn-21276.exe (PID: 4868)
      • Unicorn-58608.exe (PID: 6264)
      • Unicorn-32057.exe (PID: 8212)
      • Unicorn-32057.exe (PID: 8220)
      • Unicorn-10538.exe (PID: 5232)
      • Unicorn-15323.exe (PID: 8504)
      • Unicorn-31551.exe (PID: 8640)
      • Unicorn-12500.exe (PID: 8660)
      • Unicorn-35863.exe (PID: 8708)
      • Unicorn-19792.exe (PID: 8692)
      • Unicorn-19022.exe (PID: 8784)
      • Unicorn-49496.exe (PID: 8756)
      • Unicorn-118.exe (PID: 8740)
      • Unicorn-57094.exe (PID: 8908)
      • Unicorn-28692.exe (PID: 9080)
      • Unicorn-6308.exe (PID: 8320)
      • Unicorn-9018.exe (PID: 9180)
      • Unicorn-33165.exe (PID: 9192)
      • Unicorn-61364.exe (PID: 9020)
      • Unicorn-36860.exe (PID: 9008)

    • Create files in a temporary directory

      • 1 (158).exe (PID: 3888)
      • Unicorn-61578.exe (PID: 4172)
      • Unicorn-9435.exe (PID: 6676)
      • Unicorn-6097.exe (PID: 1040)
      • Unicorn-37396.exe (PID: 2088)
      • Unicorn-4378.exe (PID: 6040)
      • Unicorn-53652.exe (PID: 2268)
      • Unicorn-32254.exe (PID: 6004)
      • Unicorn-51580.exe (PID: 6816)
      • Unicorn-60211.exe (PID: 4560)
      • Unicorn-65338.exe (PID: 5124)
      • Unicorn-34934.exe (PID: 2692)
      • Unicorn-60398.exe (PID: 660)
      • Unicorn-53823.exe (PID: 1300)
      • Unicorn-12573.exe (PID: 5352)
      • Unicorn-57362.exe (PID: 1072)
      • Unicorn-25041.exe (PID: 7304)
      • Unicorn-33717.exe (PID: 4980)
      • Unicorn-60398.exe (PID: 6240)
      • Unicorn-63998.exe (PID: 4244)
      • Unicorn-32325.exe (PID: 2320)
      • Unicorn-45562.exe (PID: 7336)
      • Unicorn-38385.exe (PID: 5436)
      • Unicorn-33717.exe (PID: 5400)
      • Unicorn-398.exe (PID: 7260)
      • Unicorn-58674.exe (PID: 7432)
      • Unicorn-36296.exe (PID: 1168)
      • Unicorn-49895.exe (PID: 7820)
      • Unicorn-14337.exe (PID: 7796)
      • Unicorn-46771.exe (PID: 7860)
      • Unicorn-13242.exe (PID: 7924)
      • Unicorn-47176.exe (PID: 7964)
      • Unicorn-60004.exe (PID: 8036)
      • Unicorn-54966.exe (PID: 8132)
      • Unicorn-10730.exe (PID: 8076)
      • Unicorn-34623.exe (PID: 8092)
      • Unicorn-51452.exe (PID: 8124)
      • Unicorn-57435.exe (PID: 8108)
      • Unicorn-57362.exe (PID: 976)
      • Unicorn-58452.exe (PID: 6228)
      • Unicorn-16402.exe (PID: 8116)
      • Unicorn-55027.exe (PID: 7356)
      • Unicorn-43284.exe (PID: 8068)
      • Unicorn-11690.exe (PID: 5408)
      • Unicorn-53372.exe (PID: 7692)
      • Unicorn-57072.exe (PID: 7724)
      • Unicorn-14784.exe (PID: 5212)
      • Unicorn-21276.exe (PID: 5960)
      • Unicorn-10538.exe (PID: 5232)
      • Unicorn-44555.exe (PID: 7740)
      • Unicorn-38742.exe (PID: 4628)
      • Unicorn-36024.exe (PID: 7424)
      • Unicorn-21276.exe (PID: 4868)
      • Unicorn-21669.exe (PID: 7640)
      • Unicorn-58608.exe (PID: 6264)
      • Unicorn-32057.exe (PID: 8212)
      • Unicorn-5323.exe (PID: 7312)
      • Unicorn-32057.exe (PID: 8220)
      • Unicorn-16699.exe (PID: 5036)
      • Unicorn-48219.exe (PID: 8260)
      • Unicorn-18461.exe (PID: 7856)
      • Unicorn-41924.exe (PID: 6736)
      • Unicorn-24149.exe (PID: 7980)
      • Unicorn-63896.exe (PID: 8060)
      • Unicorn-29369.exe (PID: 8044)
      • Unicorn-46792.exe (PID: 8160)
      • Unicorn-2507.exe (PID: 8284)
      • Unicorn-11425.exe (PID: 2192)
      • Unicorn-47560.exe (PID: 8100)
      • Unicorn-7414.exe (PID: 4652)
      • Unicorn-57958.exe (PID: 8152)
      • Unicorn-23632.exe (PID: 7220)
      • Unicorn-15323.exe (PID: 8504)
      • Unicorn-17384.exe (PID: 7244)
      • Unicorn-30761.exe (PID: 8592)
      • Unicorn-63661.exe (PID: 3968)
      • Unicorn-30404.exe (PID: 2288)
      • Unicorn-6776.exe (PID: 668)
      • Unicorn-56548.exe (PID: 8668)
      • Unicorn-12500.exe (PID: 8660)
      • Unicorn-16824.exe (PID: 8828)
      • Unicorn-35863.exe (PID: 8708)
      • Unicorn-31551.exe (PID: 8640)
      • Unicorn-52931.exe (PID: 9044)
      • Unicorn-49496.exe (PID: 8756)
      • Unicorn-31960.exe (PID: 8916)
      • Unicorn-19984.exe (PID: 8748)
      • Unicorn-47066.exe (PID: 9028)
      • Unicorn-41498.exe (PID: 9000)
      • Unicorn-51342.exe (PID: 9136)
      • Unicorn-57094.exe (PID: 8908)
      • Unicorn-6308.exe (PID: 8320)
      • Unicorn-28692.exe (PID: 9080)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 2192)
      • BackgroundTransferHost.exe (PID: 976)
      • BackgroundTransferHost.exe (PID: 208)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 976)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 976)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 976)
      • slui.exe (PID: 4024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (90.6)
.exe | Win32 Executable (generic) (4.9)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:01:19 13:34:56+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 176128
InitializedDataSize: 299008
UninitializedDataSize: -
EntryPoint: 0x13d4
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
CompanyName: UEFI
ProductName: Kawaii-Unicorn
FileVersion: 1
ProductVersion: 1
InternalName: Kawaii-Unicorn
OriginalFileName: Kawaii-Unicorn.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
430
Monitored processes
298
Malicious processes
42
Suspicious processes
45

Behavior graph

Click at the process to see the details
start 1 (158).exe sppextcomobj.exe no specs slui.exe unicorn-9435.exe unicorn-37396.exe unicorn-61578.exe unicorn-6097.exe unicorn-32325.exe unicorn-33717.exe unicorn-33717.exe backgroundtransferhost.exe no specs unicorn-36296.exe unicorn-53652.exe unicorn-4378.exe unicorn-32254.exe unicorn-38385.exe unicorn-53823.exe backgroundtransferhost.exe unicorn-60211.exe unicorn-51580.exe unicorn-34934.exe unicorn-65338.exe unicorn-41924.exe unicorn-60398.exe unicorn-60398.exe unicorn-12573.exe unicorn-58452.exe unicorn-63998.exe unicorn-11425.exe unicorn-11690.exe unicorn-57362.exe unicorn-57362.exe backgroundtransferhost.exe no specs unicorn-398.exe unicorn-25041.exe unicorn-45562.exe unicorn-55027.exe unicorn-36024.exe unicorn-58674.exe unicorn-44939.exe unicorn-21669.exe unicorn-10829.exe unicorn-14337.exe unicorn-49895.exe unicorn-46771.exe unicorn-13242.exe unicorn-47176.exe unicorn-24149.exe unicorn-64088.exe unicorn-60004.exe unicorn-29369.exe unicorn-63896.exe unicorn-43284.exe unicorn-10730.exe unicorn-44415.exe unicorn-34623.exe unicorn-47560.exe unicorn-57435.exe unicorn-16402.exe unicorn-51452.exe unicorn-54966.exe unicorn-57958.exe unicorn-46792.exe unicorn-55297.exe unicorn-7414.exe unicorn-27716.exe unicorn-23632.exe backgroundtransferhost.exe no specs unicorn-53372.exe unicorn-14784.exe unicorn-23715.exe unicorn-62287.exe unicorn-57072.exe unicorn-44555.exe unicorn-45567.exe unicorn-18461.exe unicorn-17384.exe unicorn-63661.exe unicorn-21276.exe unicorn-21276.exe unicorn-6776.exe unicorn-10538.exe unicorn-30404.exe unicorn-38742.exe unicorn-58608.exe unicorn-16699.exe unicorn-5323.exe unicorn-32057.exe unicorn-32057.exe unicorn-48219.exe unicorn-60663.exe unicorn-2507.exe unicorn-15323.exe unicorn-30761.exe unicorn-31551.exe unicorn-12500.exe unicorn-56548.exe unicorn-19792.exe unicorn-35863.exe unicorn-7539.exe unicorn-118.exe unicorn-19984.exe unicorn-49496.exe unicorn-19022.exe unicorn-37244.exe unicorn-34128.exe unicorn-16824.exe unicorn-16824.exe unicorn-16824.exe unicorn-57094.exe unicorn-31960.exe unicorn-51826.exe unicorn-25162.exe unicorn-36860.exe unicorn-41498.exe unicorn-36860.exe unicorn-61364.exe unicorn-47066.exe unicorn-33330.exe unicorn-52931.exe unicorn-28692.exe unicorn-28692.exe unicorn-51342.exe unicorn-28884.exe unicorn-9018.exe unicorn-33165.exe unicorn-63263.exe no specs unicorn-22230.exe unicorn-6308.exe unicorn-38758.exe backgroundtransferhost.exe no specs unicorn-9807.exe unicorn-26144.exe unicorn-22060.exe unicorn-63092.exe unicorn-63092.exe unicorn-5915.exe unicorn-51800.exe unicorn-47716.exe unicorn-27296.exe unicorn-39740.exe unicorn-39740.exe unicorn-7067.exe unicorn-31572.exe unicorn-18936.exe unicorn-29141.exe unicorn-15406.exe unicorn-24534.exe unicorn-46845.exe unicorn-35909.exe unicorn-23715.exe unicorn-23715.exe unicorn-28064.exe unicorn-64051.exe unicorn-17849.exe unicorn-31825.exe unicorn-60051.exe unicorn-36402.exe unicorn-36402.exe unicorn-65183.exe unicorn-23596.exe unicorn-58498.exe unicorn-57207.exe unicorn-21741.exe unicorn-4882.exe unicorn-58681.exe unicorn-49999.exe unicorn-49999.exe unicorn-47498.exe unicorn-47233.exe unicorn-47233.exe unicorn-37192.exe unicorn-40700.exe unicorn-45531.exe unicorn-30677.exe unicorn-16005.exe unicorn-39806.exe unicorn-45936.exe unicorn-45936.exe unicorn-41934.exe no specs unicorn-31056.exe no specs unicorn-59231.exe no specs unicorn-60191.exe no specs unicorn-56107.exe no specs unicorn-64275.exe no specs unicorn-54790.exe no specs unicorn-36594.exe no specs unicorn-59807.exe no specs unicorn-55723.exe no specs unicorn-47555.exe no specs unicorn-1618.exe no specs unicorn-59020.exe no specs unicorn-2438.exe no specs unicorn-63891.exe no specs unicorn-43470.exe no specs unicorn-58483.exe no specs unicorn-19926.exe no specs unicorn-33661.exe no specs unicorn-9157.exe no specs unicorn-52791.exe no specs unicorn-48707.exe no specs unicorn-62442.exe no specs unicorn-31359.exe no specs unicorn-25493.exe no specs unicorn-11758.exe no specs unicorn-10441.exe no specs unicorn-40538.exe no specs unicorn-40538.exe no specs unicorn-31551.exe no specs unicorn-35878.exe no specs unicorn-50891.exe no specs unicorn-4689.exe no specs unicorn-37554.exe no specs unicorn-37554.exe no specs unicorn-35251.exe no specs unicorn-61181.exe no specs unicorn-57498.exe no specs unicorn-5282.exe no specs unicorn-53736.exe no specs unicorn-21618.exe no specs unicorn-44691.exe no specs unicorn-49330.exe no specs unicorn-49330.exe no specs unicorn-16958.exe no specs unicorn-8790.exe no specs unicorn-49823.exe no specs unicorn-21648.exe no specs unicorn-45931.exe no specs unicorn-45931.exe no specs unicorn-45931.exe no specs unicorn-38722.exe no specs unicorn-14026.exe no specs unicorn-9558.exe no specs unicorn-53663.exe no specs unicorn-47798.exe no specs unicorn-56158.exe no specs unicorn-66.exe no specs unicorn-7149.exe no specs unicorn-4879.exe no specs unicorn-7149.exe no specs unicorn-58951.exe no specs unicorn-58951.exe no specs unicorn-13014.exe no specs unicorn-4349.exe no specs unicorn-4349.exe no specs unicorn-8109.exe no specs unicorn-32805.exe no specs unicorn-49142.exe no specs unicorn-47851.exe no specs unicorn-59283.exe no specs unicorn-32229.exe no specs unicorn-54431.exe no specs unicorn-36506.exe no specs slui.exe no specs unicorn-2350.exe no specs unicorn-16085.exe no specs unicorn-12001.exe no specs unicorn-46918.exe no specs unicorn-31898.exe no specs unicorn-23730.exe no specs unicorn-59362.exe no specs unicorn-60679.exe no specs unicorn-20745.exe no specs unicorn-48978.exe no specs unicorn-18442.exe no specs unicorn-29818.exe no specs unicorn-10217.exe no specs unicorn-5578.exe no specs unicorn-64592.exe no specs unicorn-23643.exe no specs unicorn-20820.exe no specs unicorn-15.exe no specs unicorn-33648.exe no specs unicorn-39770.exe no specs unicorn-45900.exe no specs unicorn-13227.exe no specs unicorn-1167.exe no specs unicorn-25672.exe no specs unicorn-1167.exe no specs unicorn-37540.exe no specs unicorn-44622.exe no specs unicorn-46668.exe no specs unicorn-46860.exe no specs unicorn-14187.exe no specs unicorn-50368.exe no specs unicorn-13611.exe no specs unicorn-38308.exe no specs unicorn-34224.exe no specs unicorn-46476.exe no specs unicorn-55760.exe no specs unicorn-21972.exe no specs unicorn-39424.exe no specs unicorn-63544.exe no specs unicorn-51292.exe no specs unicorn-31832.exe no specs unicorn-40000.exe no specs unicorn-40000.exe no specs unicorn-10342.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
660C:\Users\admin\AppData\Local\Temp\Unicorn-60398.exeC:\Users\admin\AppData\Local\Temp\Unicorn-60398.exe
Unicorn-53823.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-60398.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
668C:\Users\admin\AppData\Local\Temp\Unicorn-6776.exeC:\Users\admin\AppData\Local\Temp\Unicorn-6776.exe
Unicorn-49895.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-6776.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
976"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
976C:\Users\admin\AppData\Local\Temp\Unicorn-57362.exeC:\Users\admin\AppData\Local\Temp\Unicorn-57362.exe
Unicorn-32325.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-57362.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1040C:\Users\admin\AppData\Local\Temp\Unicorn-6097.exeC:\Users\admin\AppData\Local\Temp\Unicorn-6097.exe
1 (158).exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-6097.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1072C:\Users\admin\AppData\Local\Temp\Unicorn-57362.exeC:\Users\admin\AppData\Local\Temp\Unicorn-57362.exe
Unicorn-33717.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-57362.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1168C:\Users\admin\AppData\Local\Temp\Unicorn-36296.exeC:\Users\admin\AppData\Local\Temp\Unicorn-36296.exe
Unicorn-6097.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-36296.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1300C:\Users\admin\AppData\Local\Temp\Unicorn-53823.exeC:\Users\admin\AppData\Local\Temp\Unicorn-53823.exe
Unicorn-61578.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-53823.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1672C:\Users\admin\AppData\Local\Temp\Unicorn-60191.exeC:\Users\admin\AppData\Local\Temp\Unicorn-60191.exe—Unicorn-60004.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-60191.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
Total events
8 153
Read events
8 138
Write events
15
Delete events
0

Modification events

(PID) Process:(2192) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2192) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2192) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(976) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(976) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(976) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7240) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7240) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7240) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(208) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
714
Suspicious files
5
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
976BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\4e3d734e-3c99-4ec2-86b0-f1e1251ca593.down_data —
MD5:—
SHA256:—
38881 (158).exeC:\Users\admin\AppData\Local\Temp\Unicorn-9435.exeexecutable
MD5:BF9D2C75898D1D75066F6A5FB5ABA2F8
SHA256:B31808AB49F2BC037C2C7D5D195C655CC7CF88160208B37A5B753CD46293DA68
6676Unicorn-9435.exeC:\Users\admin\AppData\Local\Temp\Unicorn-37396.exeexecutable
MD5:4515B41DC54052C88173768BF9FE2A06
SHA256:A6966336B261B6CC54BACA8DD35EFB72DE5087CE97FE17348BB2DDAE1C9066C1
6676Unicorn-9435.exeC:\Users\admin\AppData\Local\Temp\Unicorn-32254.exeexecutable
MD5:6D224ACBCC480DE58B2BD9AC0EDADEA1
SHA256:EE428624629518FFDA7E34BFA45C6D6CCF07969DE7F8F091054D6EE1A0EAA8FB
38881 (158).exeC:\Users\admin\AppData\Local\Temp\Unicorn-61578.exeexecutable
MD5:2C1D3B5F5D552EDFD121642290036EA3
SHA256:97806F6B6D5FD05ACEDFCE95B5505A4E54528834CD7D95F4D1E12A357ED2B93F
2320Unicorn-32325.exeC:\Users\admin\AppData\Local\Temp\Unicorn-53652.exeexecutable
MD5:A61CFC8E4443BAEBCCFA407A221C2A39
SHA256:4C184E87D47E3205B4A2AECD4DCCA37B5089D62CC312CA8793D717C4F93CEEB4
38881 (158).exeC:\Users\admin\AppData\Local\Temp\Unicorn-4378.exeexecutable
MD5:9772CC1DC780F28121FA89BDAA398505
SHA256:5CF720C699627836A15E5AF2F12D36A8F2A149145BC4DBA3BD51E1A9E78868FC
38881 (158).exeC:\Users\admin\AppData\Local\Temp\Unicorn-6097.exeexecutable
MD5:6B283548764E80C6A53296C22F1419C6
SHA256:5B9905751721A2F0E01DA4623689A13D068203746E07609BA43F5970A584D067
5400Unicorn-33717.exeC:\Users\admin\AppData\Local\Temp\Unicorn-38385.exeexecutable
MD5:C1FF9A82CFA1720383C4EA38603E3B3C
SHA256:91C9AD43B1AABA8F000656CCB00576A8CDC7E0AAB06EFC86C7EF59B3FE0B111F
1040Unicorn-6097.exeC:\Users\admin\AppData\Local\Temp\Unicorn-36296.exeexecutable
MD5:5D9C9408F33DBBF7776610686C1F6E3F
SHA256:93DD073338D70E237D6FBB2C60871485EBC88ECA945CF5BEC49CDB0AC3C66D74
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
26
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.184:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6800
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7184
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7184
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
976
BackgroundTransferHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2616
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5496
MoUsoCoreWorker.exe
23.48.23.184:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2112
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3216
svchost.exe
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
20.190.159.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
6800
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 23.48.23.184
  • 23.48.23.161
  • 23.48.23.176
  • 23.48.23.164
  • 23.48.23.179
  • 23.48.23.159
  • 23.48.23.175
  • 23.48.23.163
  • 23.48.23.177
whitelisted
client.wns.windows.com
  • 20.198.162.78
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.159.129
  • 20.190.159.0
  • 20.190.159.23
  • 20.190.159.130
  • 20.190.159.2
  • 40.126.31.3
  • 40.126.31.129
  • 40.126.31.2
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 104.126.37.155
  • 104.126.37.154
  • 104.126.37.163
  • 104.126.37.160
  • 104.126.37.137
  • 104.126.37.145
  • 104.126.37.170
  • 104.126.37.162
  • 104.126.37.153
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (158)