| File name: | 1 (291) |
| Full analysis: | https://app.any.run/tasks/a6f634d7-dde8-473f-b7a4-696a1fdc9b98 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 18:04:03 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 6AEC74D12E22869CA02A91AB2A1300E0 |
| SHA1: | F6D4D739615A008C8034AF51D0599CC21891DFE1 |
| SHA256: | 1A3FF74A80DF9E756D2111E0AA64D77694F9D688D1125337B54104302C257D75 |
| SSDEEP: | 3072:0q7TLOq/mDjCV9p22k4GW0EPIfVcj+xfpfV4hwoLcBuR:0q7TLOquD8IV4rPdCfpfV4hwoLcBu |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- Unicorn-30351.exe (PID: 7728)
- 1 (291).exe (PID: 7468)
- Unicorn-9629.exe (PID: 7320)
- Unicorn-44243.exe (PID: 7776)
- Unicorn-36895.exe (PID: 4756)
- Unicorn-31991.exe (PID: 8104)
- Unicorn-62463.exe (PID: 8140)
- Unicorn-12125.exe (PID: 7788)
- Unicorn-14009.exe (PID: 8188)
- Unicorn-62655.exe (PID: 7436)
- Unicorn-62655.exe (PID: 2136)
- Unicorn-13608.exe (PID: 7696)
- Unicorn-44273.exe (PID: 5680)
- Unicorn-30537.exe (PID: 2800)
- Unicorn-50138.exe (PID: 6048)
- Unicorn-19843.exe (PID: 7348)
- Unicorn-53262.exe (PID: 8164)
- Unicorn-40455.exe (PID: 4776)
- Unicorn-22840.exe (PID: 4880)
- Unicorn-60958.exe (PID: 5416)
- Unicorn-60958.exe (PID: 6632)
- Unicorn-50330.exe (PID: 3272)
- Unicorn-19656.exe (PID: 4452)
- Unicorn-28322.exe (PID: 1628)
- Unicorn-22456.exe (PID: 5512)
- Unicorn-49775.exe (PID: 4988)
- Unicorn-49775.exe (PID: 2600)
- Unicorn-49775.exe (PID: 2692)
- Unicorn-34591.exe (PID: 900)
- Unicorn-60610.exe (PID: 1760)
- Unicorn-55971.exe (PID: 7252)
- Unicorn-41673.exe (PID: 6324)
- Unicorn-11046.exe (PID: 7304)
- Unicorn-36925.exe (PID: 5556)
- Unicorn-45949.exe (PID: 2656)
- Unicorn-14554.exe (PID: 664)
- Unicorn-39251.exe (PID: 7504)
- Unicorn-19385.exe (PID: 7524)
- Unicorn-19371.exe (PID: 516)
- Unicorn-18565.exe (PID: 6132)
- Unicorn-3034.exe (PID: 7296)
- Unicorn-56319.exe (PID: 7272)
- Unicorn-39983.exe (PID: 1128)
- Unicorn-44067.exe (PID: 7712)
- Unicorn-36453.exe (PID: 7276)
- Unicorn-63718.exe (PID: 6700)
- Unicorn-3781.exe (PID: 8120)
- Unicorn-3781.exe (PID: 1240)
- Unicorn-33852.exe (PID: 6512)
- Unicorn-25684.exe (PID: 2240)
- Unicorn-11435.exe (PID: 4696)
- Unicorn-62515.exe (PID: 8088)
- Unicorn-37819.exe (PID: 4244)
- Unicorn-29821.exe (PID: 8040)
- Unicorn-63070.exe (PID: 208)
- Unicorn-44133.exe (PID: 7960)
- Unicorn-57855.exe (PID: 7720)
- Unicorn-58602.exe (PID: 1276)
- Unicorn-49422.exe (PID: 8016)
- Unicorn-25183.exe (PID: 8052)
- Unicorn-33543.exe (PID: 5936)
- Unicorn-59007.exe (PID: 2340)
- Unicorn-2193.exe (PID: 2516)
- Unicorn-59007.exe (PID: 6404)
- Unicorn-62131.exe (PID: 2088)
- Unicorn-49614.exe (PID: 7392)
- Unicorn-33740.exe (PID: 5544)
- Unicorn-46755.exe (PID: 4844)
- Unicorn-40625.exe (PID: 1228)
- Unicorn-26889.exe (PID: 1188)
- Unicorn-39355.exe (PID: 7664)
- Unicorn-3484.exe (PID: 3140)
- Unicorn-52354.exe (PID: 1168)
- Unicorn-43802.exe (PID: 8336)
- Unicorn-6298.exe (PID: 8296)
- Unicorn-26719.exe (PID: 8252)
- Unicorn-41201.exe (PID: 8380)
- Unicorn-15426.exe (PID: 8396)
- Unicorn-48706.exe (PID: 7288)
- Unicorn-54413.exe (PID: 8436)
- Unicorn-40677.exe (PID: 8428)
- Unicorn-15426.exe (PID: 8400)
- Unicorn-7450.exe (PID: 8468)
- Unicorn-44067.exe (PID: 7948)
- Unicorn-3366.exe (PID: 8476)
- Unicorn-64819.exe (PID: 8492)
- Unicorn-56651.exe (PID: 8520)
- Unicorn-44067.exe (PID: 8100)
- Unicorn-7450.exe (PID: 8460)
- Unicorn-48483.exe (PID: 8568)
- Unicorn-48483.exe (PID: 8584)
- Unicorn-16365.exe (PID: 8636)
- Unicorn-48483.exe (PID: 8576)
- Unicorn-59397.exe (PID: 8796)
- Unicorn-44399.exe (PID: 8600)
- Unicorn-48483.exe (PID: 8592)
- Unicorn-48462.exe (PID: 8772)
- Unicorn-8197.exe (PID: 8668)
- Unicorn-44399.exe (PID: 8608)
- Unicorn-64011.exe (PID: 8756)
- Unicorn-64798.exe (PID: 8680)
- Unicorn-16365.exe (PID: 8644)
- Unicorn-60714.exe (PID: 8700)
- Unicorn-55114.exe (PID: 8692)
- Unicorn-35899.exe (PID: 2268)
- Unicorn-14716.exe (PID: 5260)
- Unicorn-31815.exe (PID: 7756)
- Unicorn-23382.exe (PID: 5400)
- Unicorn-19895.exe (PID: 8992)
- Unicorn-52759.exe (PID: 9012)
- Unicorn-33408.exe (PID: 9068)
- Unicorn-24725.exe (PID: 9020)
- Unicorn-32339.exe (PID: 9044)
- Unicorn-21959.exe (PID: 9108)
- Unicorn-1704.exe (PID: 9088)
- Unicorn-4710.exe (PID: 9124)
- Unicorn-14777.exe (PID: 8716)
- Unicorn-42213.exe (PID: 9144)
- Unicorn-41659.exe (PID: 9196)
- Unicorn-31444.exe (PID: 9204)
- Unicorn-58187.exe (PID: 9224)
- Unicorn-12308.exe (PID: 896)
- Unicorn-17155.exe (PID: 4180)
- Unicorn-41851.exe (PID: 9248)
- Unicorn-797.exe (PID: 9304)
- Unicorn-31636.exe (PID: 9256)
- Unicorn-3564.exe (PID: 9336)
- Unicorn-45914.exe (PID: 9352)
- Unicorn-16579.exe (PID: 9316)
- Unicorn-41275.exe (PID: 9392)
- Unicorn-16505.exe (PID: 9492)
- Unicorn-33107.exe (PID: 9440)
- Unicorn-43313.exe (PID: 9384)
- Unicorn-62442.exe (PID: 9508)
- Unicorn-54274.exe (PID: 9580)
- Unicorn-2472.exe (PID: 9532)
- Unicorn-37191.exe (PID: 9412)
- Unicorn-29023.exe (PID: 9456)
- Unicorn-62442.exe (PID: 9500)
- Unicorn-52758.exe (PID: 9520)
- Unicorn-29023.exe (PID: 9448)
- Unicorn-41275.exe (PID: 9400)
- Unicorn-10595.exe (PID: 9600)
- Unicorn-10595.exe (PID: 9596)
- Unicorn-30139.exe (PID: 9648)
- Unicorn-55447.exe (PID: 9636)
- Unicorn-35846.exe (PID: 9632)
- Unicorn-7672.exe (PID: 9680)
- Unicorn-37923.exe (PID: 9704)
- Unicorn-26417.exe (PID: 9724)
- Unicorn-17695.exe (PID: 9740)
- Unicorn-47243.exe (PID: 9764)
- Unicorn-56158.exe (PID: 9808)
- Unicorn-39267.exe (PID: 9868)
- Unicorn-54762.exe (PID: 9876)
- Unicorn-48011.exe (PID: 9904)
- Unicorn-48483.exe (PID: 8552)
- Unicorn-14777.exe (PID: 8708)
- Unicorn-16085.exe (PID: 9972)
- Unicorn-48483.exe (PID: 8560)
- Unicorn-59879.exe (PID: 9996)
- Unicorn-44067.exe (PID: 7836)
- Unicorn-11617.exe (PID: 10096)
- Unicorn-20191.exe (PID: 10116)
- Unicorn-221.exe (PID: 9060)
- Unicorn-65042.exe (PID: 10132)
- Unicorn-46349.exe (PID: 10152)
- Unicorn-53911.exe (PID: 9164)
- Unicorn-33683.exe (PID: 9284)
- Unicorn-8130.exe (PID: 8240)
Executable content was dropped or overwritten
- Unicorn-30351.exe (PID: 7728)
- 1 (291).exe (PID: 7468)
- Unicorn-36895.exe (PID: 4756)
- Unicorn-9629.exe (PID: 7320)
- Unicorn-44243.exe (PID: 7776)
- Unicorn-13608.exe (PID: 7696)
- Unicorn-62463.exe (PID: 8140)
- Unicorn-12125.exe (PID: 7788)
- Unicorn-62655.exe (PID: 7436)
- Unicorn-31991.exe (PID: 8104)
- Unicorn-30537.exe (PID: 2800)
- Unicorn-14009.exe (PID: 8188)
- Unicorn-19843.exe (PID: 7348)
- Unicorn-53262.exe (PID: 8164)
- Unicorn-36925.exe (PID: 5556)
- Unicorn-40455.exe (PID: 4776)
- Unicorn-22840.exe (PID: 4880)
- Unicorn-60958.exe (PID: 5416)
- Unicorn-60958.exe (PID: 6632)
- Unicorn-50330.exe (PID: 3272)
- Unicorn-62655.exe (PID: 2136)
- Unicorn-49775.exe (PID: 2600)
- Unicorn-28322.exe (PID: 1628)
- Unicorn-22456.exe (PID: 5512)
- Unicorn-50138.exe (PID: 6048)
- Unicorn-19656.exe (PID: 4452)
- Unicorn-34591.exe (PID: 900)
- Unicorn-60610.exe (PID: 1760)
- Unicorn-55971.exe (PID: 7252)
- Unicorn-41673.exe (PID: 6324)
- Unicorn-45949.exe (PID: 2656)
- Unicorn-14554.exe (PID: 664)
- Unicorn-39251.exe (PID: 7504)
- Unicorn-11046.exe (PID: 7304)
- Unicorn-19371.exe (PID: 516)
- Unicorn-18565.exe (PID: 6132)
- Unicorn-3034.exe (PID: 7296)
- Unicorn-48706.exe (PID: 7288)
- Unicorn-56319.exe (PID: 7272)
- Unicorn-44067.exe (PID: 7948)
- Unicorn-44067.exe (PID: 7712)
- Unicorn-39983.exe (PID: 1128)
- Unicorn-33852.exe (PID: 6512)
- Unicorn-63718.exe (PID: 6700)
- Unicorn-3781.exe (PID: 1240)
- Unicorn-11435.exe (PID: 4696)
- Unicorn-14716.exe (PID: 5260)
- Unicorn-49775.exe (PID: 2692)
- Unicorn-44273.exe (PID: 5680)
- Unicorn-37819.exe (PID: 4244)
- Unicorn-62515.exe (PID: 8088)
- Unicorn-57855.exe (PID: 7720)
- Unicorn-29821.exe (PID: 8040)
- Unicorn-63070.exe (PID: 208)
- Unicorn-44133.exe (PID: 7960)
- Unicorn-49422.exe (PID: 8016)
- Unicorn-58602.exe (PID: 1276)
- Unicorn-25183.exe (PID: 8052)
- Unicorn-62131.exe (PID: 2088)
- Unicorn-2193.exe (PID: 2516)
- Unicorn-59007.exe (PID: 6404)
- Unicorn-40625.exe (PID: 1228)
- Unicorn-49614.exe (PID: 7392)
- Unicorn-33543.exe (PID: 5936)
- Unicorn-33740.exe (PID: 5544)
- Unicorn-19385.exe (PID: 7524)
- Unicorn-26889.exe (PID: 1188)
- Unicorn-3484.exe (PID: 3140)
- Unicorn-52354.exe (PID: 1168)
- Unicorn-26719.exe (PID: 8252)
- Unicorn-43802.exe (PID: 8336)
- Unicorn-6298.exe (PID: 8296)
- Unicorn-41201.exe (PID: 8380)
- Unicorn-15426.exe (PID: 8396)
- Unicorn-36453.exe (PID: 7276)
- Unicorn-15426.exe (PID: 8400)
- Unicorn-40677.exe (PID: 8428)
- Unicorn-54413.exe (PID: 8436)
- Unicorn-7450.exe (PID: 8468)
- Unicorn-3366.exe (PID: 8476)
- Unicorn-56651.exe (PID: 8520)
- Unicorn-44067.exe (PID: 8100)
- Unicorn-7450.exe (PID: 8460)
- Unicorn-64819.exe (PID: 8492)
- Unicorn-48483.exe (PID: 8568)
- Unicorn-48483.exe (PID: 8584)
- Unicorn-48483.exe (PID: 8576)
- Unicorn-16365.exe (PID: 8636)
- Unicorn-59397.exe (PID: 8796)
- Unicorn-40315.exe (PID: 8624)
- Unicorn-44399.exe (PID: 8600)
- Unicorn-25684.exe (PID: 2240)
- Unicorn-48483.exe (PID: 8552)
- Unicorn-48483.exe (PID: 8560)
- Unicorn-44399.exe (PID: 8608)
- Unicorn-48462.exe (PID: 8772)
- Unicorn-52546.exe (PID: 8764)
- Unicorn-62197.exe (PID: 8780)
- Unicorn-16365.exe (PID: 8644)
- Unicorn-60714.exe (PID: 8700)
- Unicorn-23382.exe (PID: 5400)
- Unicorn-49775.exe (PID: 4988)
- Unicorn-35899.exe (PID: 2268)
- Unicorn-31815.exe (PID: 7756)
- Unicorn-3781.exe (PID: 8120)
- Unicorn-44067.exe (PID: 7836)
- Unicorn-19895.exe (PID: 8992)
- Unicorn-52759.exe (PID: 9012)
- Unicorn-24725.exe (PID: 9020)
- Unicorn-33408.exe (PID: 9068)
- Unicorn-221.exe (PID: 9060)
- Unicorn-32339.exe (PID: 9044)
- Unicorn-1704.exe (PID: 9088)
- Unicorn-62197.exe (PID: 8788)
- Unicorn-21959.exe (PID: 9108)
- Unicorn-4710.exe (PID: 9124)
- Unicorn-42213.exe (PID: 9144)
- Unicorn-53911.exe (PID: 9164)
- Unicorn-41659.exe (PID: 9196)
- Unicorn-17155.exe (PID: 4180)
- Unicorn-58187.exe (PID: 9224)
- Unicorn-42405.exe (PID: 7380)
- Unicorn-31444.exe (PID: 9204)
- Unicorn-41851.exe (PID: 9248)
- Unicorn-3564.exe (PID: 9336)
- Unicorn-45914.exe (PID: 9352)
- Unicorn-41275.exe (PID: 9392)
- Unicorn-33107.exe (PID: 9440)
- Unicorn-16579.exe (PID: 9316)
- Unicorn-43313.exe (PID: 9384)
- Unicorn-37191.exe (PID: 9412)
- Unicorn-29023.exe (PID: 9456)
- Unicorn-41275.exe (PID: 9400)
- Unicorn-62442.exe (PID: 9508)
- Unicorn-29023.exe (PID: 9448)
- Unicorn-59007.exe (PID: 2340)
- Unicorn-10595.exe (PID: 9596)
- Unicorn-46755.exe (PID: 4844)
- Unicorn-55447.exe (PID: 9636)
- Unicorn-10595.exe (PID: 9600)
- Unicorn-30139.exe (PID: 9648)
- Unicorn-35846.exe (PID: 9632)
- Unicorn-7672.exe (PID: 9680)
- Unicorn-37923.exe (PID: 9704)
- Unicorn-26417.exe (PID: 9724)
- Unicorn-17695.exe (PID: 9740)
- Unicorn-47243.exe (PID: 9764)
- Unicorn-32944.exe (PID: 9784)
- Unicorn-56158.exe (PID: 9808)
- Unicorn-39267.exe (PID: 9868)
- Unicorn-54762.exe (PID: 9876)
- Unicorn-48011.exe (PID: 9904)
- Unicorn-8197.exe (PID: 8668)
- Unicorn-16085.exe (PID: 9972)
- Unicorn-64798.exe (PID: 8680)
- Unicorn-59879.exe (PID: 9996)
- Unicorn-11617.exe (PID: 10096)
- Unicorn-39651.exe (PID: 10080)
- Unicorn-20191.exe (PID: 10116)
- Unicorn-65042.exe (PID: 10132)
- Unicorn-46349.exe (PID: 10152)
- Unicorn-33683.exe (PID: 9284)
- Unicorn-797.exe (PID: 9304)
- Unicorn-62442.exe (PID: 9500)
- Unicorn-8130.exe (PID: 8240)
- Unicorn-33573.exe (PID: 8936)
- Unicorn-9282.exe (PID: 5124)
- Unicorn-54399.exe (PID: 7612)
- Unicorn-62759.exe (PID: 10260)
- Unicorn-54591.exe (PID: 10280)
- Unicorn-22473.exe (PID: 10296)
- Unicorn-6137.exe (PID: 10312)
- Unicorn-48483.exe (PID: 8592)
- Unicorn-64011.exe (PID: 8756)
- Unicorn-1477.exe (PID: 10332)
- Unicorn-14777.exe (PID: 8716)
- Unicorn-16505.exe (PID: 9492)
- Unicorn-54274.exe (PID: 9580)
- Unicorn-39023.exe (PID: 10384)
- Unicorn-26195.exe (PID: 10428)
- Unicorn-57990.exe (PID: 10464)
- Unicorn-1477.exe (PID: 10336)
- Unicorn-22111.exe (PID: 10448)
- Unicorn-63143.exe (PID: 10488)
- Unicorn-30279.exe (PID: 10412)
- Unicorn-54975.exe (PID: 10520)
- Unicorn-38124.exe (PID: 10456)
- Unicorn-22303.exe (PID: 10592)
- Unicorn-46807.exe (PID: 10532)
- Unicorn-22303.exe (PID: 10584)
- Unicorn-55114.exe (PID: 8692)
- Unicorn-10818.exe (PID: 10640)
- Unicorn-22303.exe (PID: 10600)
- Unicorn-46807.exe (PID: 10540)
- Unicorn-29293.exe (PID: 10692)
- Unicorn-34555.exe (PID: 10568)
- Unicorn-10818.exe (PID: 10648)
- Unicorn-29293.exe (PID: 10700)
- Unicorn-35515.exe (PID: 10744)
- Unicorn-57304.exe (PID: 10860)
- Unicorn-6734.exe (PID: 10684)
- Unicorn-31431.exe (PID: 10752)
- Unicorn-6734.exe (PID: 10676)
- Unicorn-56682.exe (PID: 10808)
- Unicorn-21216.exe (PID: 10760)
- Unicorn-8388.exe (PID: 10996)
- Unicorn-46621.exe (PID: 11112)
- Unicorn-36261.exe (PID: 10852)
- Unicorn-47938.exe (PID: 11048)
- Unicorn-38453.exe (PID: 11176)
- Unicorn-20832.exe (PID: 11212)
- Unicorn-2472.exe (PID: 9532)
- Unicorn-12308.exe (PID: 896)
- Unicorn-35685.exe (PID: 11104)
- Unicorn-57589.exe (PID: 11060)
- Unicorn-31636.exe (PID: 9256)
- Unicorn-46406.exe (PID: 11196)
- Unicorn-220.exe (PID: 11016)
- Unicorn-60190.exe (PID: 11004)
- Unicorn-28093.exe (PID: 10868)
- Unicorn-37872.exe (PID: 11024)
- Unicorn-47151.exe (PID: 11120)
- Unicorn-52758.exe (PID: 9520)
- Unicorn-52271.exe (PID: 11188)
- Unicorn-41253.exe (PID: 11168)
- Unicorn-55286.exe (PID: 11128)
- Unicorn-3589.exe (PID: 10952)
- Unicorn-14777.exe (PID: 8708)
- Unicorn-7481.exe (PID: 10768)
- Unicorn-39355.exe (PID: 7664)
Executes application which crashes
- Unicorn-34045.exe (PID: 9172)
- Unicorn-242.exe (PID: 9360)
INFO
Reads the computer name
- Unicorn-36895.exe (PID: 4756)
- Unicorn-30351.exe (PID: 7728)
- 1 (291).exe (PID: 7468)
- Unicorn-9629.exe (PID: 7320)
- Unicorn-31991.exe (PID: 8104)
- Unicorn-44243.exe (PID: 7776)
- Unicorn-12125.exe (PID: 7788)
- Unicorn-62463.exe (PID: 8140)
- Unicorn-30537.exe (PID: 2800)
- Unicorn-14009.exe (PID: 8188)
- Unicorn-62655.exe (PID: 7436)
- Unicorn-44273.exe (PID: 5680)
- Unicorn-19843.exe (PID: 7348)
- Unicorn-53262.exe (PID: 8164)
- Unicorn-36925.exe (PID: 5556)
- Unicorn-11435.exe (PID: 4696)
- Unicorn-60958.exe (PID: 5416)
- Unicorn-60958.exe (PID: 6632)
- Unicorn-50330.exe (PID: 3272)
- Unicorn-49775.exe (PID: 4988)
- Unicorn-49775.exe (PID: 2692)
- Unicorn-28322.exe (PID: 1628)
- Unicorn-19656.exe (PID: 4452)
- Unicorn-22840.exe (PID: 4880)
- Unicorn-34591.exe (PID: 900)
- Unicorn-60610.exe (PID: 1760)
- Unicorn-55971.exe (PID: 7252)
- Unicorn-41673.exe (PID: 6324)
- Unicorn-11046.exe (PID: 7304)
- Unicorn-45949.exe (PID: 2656)
- Unicorn-14554.exe (PID: 664)
- Unicorn-39251.exe (PID: 7504)
- Unicorn-19385.exe (PID: 7524)
- Unicorn-18565.exe (PID: 6132)
- Unicorn-3034.exe (PID: 7296)
- Unicorn-48706.exe (PID: 7288)
- Unicorn-44067.exe (PID: 8100)
- Unicorn-39983.exe (PID: 1128)
- Unicorn-44067.exe (PID: 7712)
- Unicorn-14716.exe (PID: 5260)
- Unicorn-44067.exe (PID: 7836)
- Unicorn-63718.exe (PID: 6700)
- Unicorn-3781.exe (PID: 8120)
- Unicorn-23382.exe (PID: 5400)
- Unicorn-3781.exe (PID: 1240)
- Unicorn-33852.exe (PID: 6512)
- Unicorn-35899.exe (PID: 2268)
- Unicorn-62515.exe (PID: 8088)
- Unicorn-57855.exe (PID: 7720)
- Unicorn-37819.exe (PID: 4244)
- Unicorn-63070.exe (PID: 208)
- Unicorn-486.exe (PID: 7684)
- Unicorn-29821.exe (PID: 8040)
- Unicorn-58602.exe (PID: 1276)
- Unicorn-49614.exe (PID: 7392)
- Unicorn-33543.exe (PID: 5936)
- Unicorn-2193.exe (PID: 2516)
- Unicorn-59007.exe (PID: 2340)
- Unicorn-40625.exe (PID: 1228)
- Unicorn-46755.exe (PID: 4844)
- Unicorn-26889.exe (PID: 1188)
- Unicorn-25183.exe (PID: 8052)
- Unicorn-3484.exe (PID: 3140)
- Unicorn-39355.exe (PID: 7664)
- Unicorn-52354.exe (PID: 1168)
- Unicorn-41201.exe (PID: 8380)
- Unicorn-54413.exe (PID: 8436)
- Unicorn-7450.exe (PID: 8468)
- Unicorn-3366.exe (PID: 8476)
- Unicorn-64819.exe (PID: 8492)
- Unicorn-56651.exe (PID: 8520)
- Unicorn-48483.exe (PID: 8584)
- Unicorn-48483.exe (PID: 8568)
- Unicorn-44399.exe (PID: 8600)
- Unicorn-48483.exe (PID: 8592)
- Unicorn-40315.exe (PID: 8624)
- Unicorn-48483.exe (PID: 8560)
- Unicorn-64011.exe (PID: 8756)
- Unicorn-14777.exe (PID: 8708)
- Unicorn-60714.exe (PID: 8700)
- Unicorn-64798.exe (PID: 8680)
- Unicorn-62197.exe (PID: 8780)
- Unicorn-62197.exe (PID: 8788)
- Unicorn-48483.exe (PID: 8576)
- Unicorn-48483.exe (PID: 8552)
- Unicorn-48462.exe (PID: 8772)
- Unicorn-14777.exe (PID: 8716)
- Unicorn-32339.exe (PID: 9044)
- Unicorn-52759.exe (PID: 9012)
- Unicorn-24725.exe (PID: 9020)
- Unicorn-21959.exe (PID: 9108)
- Unicorn-31444.exe (PID: 9204)
- Unicorn-42213.exe (PID: 9144)
- Unicorn-17155.exe (PID: 4180)
- Unicorn-41659.exe (PID: 9196)
- Unicorn-34045.exe (PID: 9172)
- Unicorn-12308.exe (PID: 896)
- Unicorn-58187.exe (PID: 9224)
- Unicorn-42405.exe (PID: 7380)
- Unicorn-31636.exe (PID: 9256)
- Unicorn-41851.exe (PID: 9248)
- Unicorn-53911.exe (PID: 9164)
- Unicorn-33683.exe (PID: 9284)
- Unicorn-45914.exe (PID: 9352)
- Unicorn-3564.exe (PID: 9336)
- Unicorn-242.exe (PID: 9360)
- Unicorn-16579.exe (PID: 9316)
- Unicorn-41275.exe (PID: 9392)
- Unicorn-16505.exe (PID: 9492)
- Unicorn-33107.exe (PID: 9440)
- Unicorn-37191.exe (PID: 9412)
- Unicorn-29023.exe (PID: 9456)
- Unicorn-43313.exe (PID: 9384)
- Unicorn-62442.exe (PID: 9500)
- Unicorn-10595.exe (PID: 9600)
- Unicorn-41275.exe (PID: 9400)
- Unicorn-52758.exe (PID: 9520)
- Unicorn-10595.exe (PID: 9596)
- Unicorn-35846.exe (PID: 9632)
- Unicorn-62442.exe (PID: 9508)
- Unicorn-2472.exe (PID: 9532)
- Unicorn-7672.exe (PID: 9680)
- Unicorn-56158.exe (PID: 9808)
- Unicorn-39267.exe (PID: 9868)
- Unicorn-54762.exe (PID: 9876)
- Unicorn-48011.exe (PID: 9904)
- Unicorn-16085.exe (PID: 9972)
- Unicorn-59879.exe (PID: 9996)
- Unicorn-65042.exe (PID: 10132)
- Unicorn-46349.exe (PID: 10152)
- Unicorn-8130.exe (PID: 8240)
- Unicorn-33573.exe (PID: 8936)
Checks supported languages
- Unicorn-36895.exe (PID: 4756)
- Unicorn-30351.exe (PID: 7728)
- 1 (291).exe (PID: 7468)
- Unicorn-9629.exe (PID: 7320)
- Unicorn-13608.exe (PID: 7696)
- Unicorn-12125.exe (PID: 7788)
- Unicorn-31991.exe (PID: 8104)
- Unicorn-14009.exe (PID: 8188)
- Unicorn-62463.exe (PID: 8140)
- Unicorn-44243.exe (PID: 7776)
- Unicorn-44273.exe (PID: 5680)
- Unicorn-62655.exe (PID: 2136)
- Unicorn-62655.exe (PID: 7436)
- Unicorn-30537.exe (PID: 2800)
- Unicorn-19843.exe (PID: 7348)
- Unicorn-53262.exe (PID: 8164)
- Unicorn-40455.exe (PID: 4776)
- Unicorn-50330.exe (PID: 3272)
- Unicorn-11435.exe (PID: 4696)
- Unicorn-49775.exe (PID: 4988)
- Unicorn-36925.exe (PID: 5556)
- Unicorn-22840.exe (PID: 4880)
- Unicorn-28322.exe (PID: 1628)
- Unicorn-19656.exe (PID: 4452)
- Unicorn-22456.exe (PID: 5512)
- Unicorn-34591.exe (PID: 900)
- Unicorn-60610.exe (PID: 1760)
- Unicorn-49775.exe (PID: 2692)
- Unicorn-55971.exe (PID: 7252)
- Unicorn-41673.exe (PID: 6324)
- Unicorn-45949.exe (PID: 2656)
- Unicorn-14554.exe (PID: 664)
- Unicorn-19385.exe (PID: 7524)
- Unicorn-18565.exe (PID: 6132)
- Unicorn-36453.exe (PID: 7276)
- Unicorn-48706.exe (PID: 7288)
- Unicorn-3034.exe (PID: 7296)
- Unicorn-39983.exe (PID: 1128)
- Unicorn-44067.exe (PID: 8100)
- Unicorn-25684.exe (PID: 2240)
- Unicorn-44067.exe (PID: 7836)
- Unicorn-44067.exe (PID: 7712)
- Unicorn-44067.exe (PID: 7948)
- Unicorn-33852.exe (PID: 6512)
- Unicorn-31815.exe (PID: 7756)
- Unicorn-23382.exe (PID: 5400)
- Unicorn-63718.exe (PID: 6700)
- Unicorn-37819.exe (PID: 4244)
- Unicorn-3781.exe (PID: 8120)
- Unicorn-62515.exe (PID: 8088)
- Unicorn-14716.exe (PID: 5260)
- Unicorn-3781.exe (PID: 1240)
- Unicorn-44133.exe (PID: 7960)
- Unicorn-486.exe (PID: 7684)
- Unicorn-57855.exe (PID: 7720)
- Unicorn-29821.exe (PID: 8040)
- Unicorn-49422.exe (PID: 8016)
- Unicorn-62131.exe (PID: 2088)
- Unicorn-58602.exe (PID: 1276)
- Unicorn-49614.exe (PID: 7392)
- Unicorn-33543.exe (PID: 5936)
- Unicorn-2193.exe (PID: 2516)
- Unicorn-40625.exe (PID: 1228)
- Unicorn-46755.exe (PID: 4844)
- Unicorn-33740.exe (PID: 5544)
- Unicorn-26889.exe (PID: 1188)
- Unicorn-3484.exe (PID: 3140)
- Unicorn-59007.exe (PID: 6404)
- Unicorn-6298.exe (PID: 8296)
- Unicorn-43802.exe (PID: 8336)
- Unicorn-41201.exe (PID: 8380)
- Unicorn-39355.exe (PID: 7664)
- Unicorn-15426.exe (PID: 8400)
- Unicorn-15426.exe (PID: 8396)
- Unicorn-40677.exe (PID: 8428)
- Unicorn-7450.exe (PID: 8468)
- Unicorn-7450.exe (PID: 8460)
- Unicorn-3366.exe (PID: 8476)
- Unicorn-64819.exe (PID: 8492)
- Unicorn-48483.exe (PID: 8552)
- Unicorn-48483.exe (PID: 8568)
- Unicorn-48483.exe (PID: 8592)
- Unicorn-16365.exe (PID: 8644)
- Unicorn-40315.exe (PID: 8624)
- Unicorn-8197.exe (PID: 8668)
- Unicorn-44399.exe (PID: 8608)
- Unicorn-55114.exe (PID: 8692)
- Unicorn-48483.exe (PID: 8560)
- Unicorn-64798.exe (PID: 8680)
- Unicorn-14777.exe (PID: 8708)
- Unicorn-59397.exe (PID: 8796)
- Unicorn-64011.exe (PID: 8756)
- Unicorn-14777.exe (PID: 8716)
- Unicorn-48483.exe (PID: 8584)
- Unicorn-48483.exe (PID: 8576)
- Unicorn-52759.exe (PID: 9012)
- Unicorn-62197.exe (PID: 8780)
- Unicorn-62197.exe (PID: 8788)
- Unicorn-60714.exe (PID: 8700)
- Unicorn-21959.exe (PID: 9108)
- Unicorn-1704.exe (PID: 9088)
- Unicorn-4710.exe (PID: 9124)
- Unicorn-24725.exe (PID: 9020)
- Unicorn-32339.exe (PID: 9044)
- Unicorn-221.exe (PID: 9060)
- Unicorn-33408.exe (PID: 9068)
- Unicorn-34045.exe (PID: 9172)
- Unicorn-31444.exe (PID: 9204)
- Unicorn-17155.exe (PID: 4180)
- Unicorn-12308.exe (PID: 896)
- Unicorn-42405.exe (PID: 7380)
- Unicorn-58187.exe (PID: 9224)
- Unicorn-53911.exe (PID: 9164)
- Unicorn-3564.exe (PID: 9336)
- Unicorn-797.exe (PID: 9304)
- Unicorn-16579.exe (PID: 9316)
- Unicorn-41851.exe (PID: 9248)
- Unicorn-31636.exe (PID: 9256)
- Unicorn-242.exe (PID: 9360)
- Unicorn-41275.exe (PID: 9392)
- Unicorn-43313.exe (PID: 9384)
- Unicorn-37191.exe (PID: 9412)
- Unicorn-33107.exe (PID: 9440)
- Unicorn-41275.exe (PID: 9400)
- Unicorn-2472.exe (PID: 9532)
- Unicorn-52758.exe (PID: 9520)
- Unicorn-54274.exe (PID: 9580)
- Unicorn-10595.exe (PID: 9600)
- Unicorn-10595.exe (PID: 9596)
- Unicorn-29023.exe (PID: 9448)
- Unicorn-16505.exe (PID: 9492)
- Unicorn-62442.exe (PID: 9508)
- Unicorn-62442.exe (PID: 9500)
- Unicorn-7672.exe (PID: 9680)
- Unicorn-37923.exe (PID: 9704)
- Unicorn-26417.exe (PID: 9724)
- Unicorn-17695.exe (PID: 9740)
- Unicorn-47243.exe (PID: 9764)
- Unicorn-32944.exe (PID: 9784)
- Unicorn-35846.exe (PID: 9632)
- Unicorn-55447.exe (PID: 9636)
- Unicorn-30139.exe (PID: 9648)
- Unicorn-54762.exe (PID: 9876)
- Unicorn-39267.exe (PID: 9868)
- Unicorn-48011.exe (PID: 9904)
- Unicorn-16085.exe (PID: 9972)
- Unicorn-59879.exe (PID: 9996)
- Unicorn-39651.exe (PID: 10080)
- Unicorn-20191.exe (PID: 10116)
- Unicorn-65042.exe (PID: 10132)
- Unicorn-46349.exe (PID: 10152)
- Unicorn-11617.exe (PID: 10096)
- Unicorn-33573.exe (PID: 8936)
- Unicorn-9282.exe (PID: 5124)
- Unicorn-6137.exe (PID: 10312)
- Unicorn-22473.exe (PID: 10296)
- Unicorn-54591.exe (PID: 10280)
- Unicorn-1477.exe (PID: 10336)
- Unicorn-1477.exe (PID: 10332)
- Unicorn-39023.exe (PID: 10384)
- Unicorn-30279.exe (PID: 10412)
- Unicorn-26195.exe (PID: 10428)
- Unicorn-38124.exe (PID: 10456)
- Unicorn-57990.exe (PID: 10464)
- Unicorn-22111.exe (PID: 10448)
- Unicorn-63143.exe (PID: 10488)
- Unicorn-34555.exe (PID: 10568)
- Unicorn-10818.exe (PID: 10640)
- Unicorn-10818.exe (PID: 10648)
- Unicorn-22303.exe (PID: 10592)
- Unicorn-22303.exe (PID: 10584)
- Unicorn-54975.exe (PID: 10520)
- Unicorn-46807.exe (PID: 10532)
- Unicorn-6734.exe (PID: 10676)
- Unicorn-29293.exe (PID: 10692)
- Unicorn-29293.exe (PID: 10700)
- Unicorn-22303.exe (PID: 10600)
- Unicorn-6734.exe (PID: 10684)
- Unicorn-35515.exe (PID: 10744)
- Unicorn-28093.exe (PID: 10868)
- Unicorn-21216.exe (PID: 10760)
- Unicorn-7481.exe (PID: 10768)
- Unicorn-36261.exe (PID: 10852)
- Unicorn-57304.exe (PID: 10860)
- Unicorn-3589.exe (PID: 10952)
- Unicorn-31431.exe (PID: 10752)
- Unicorn-56682.exe (PID: 10808)
- Unicorn-8388.exe (PID: 10996)
- Unicorn-220.exe (PID: 11016)
- Unicorn-47938.exe (PID: 11048)
- Unicorn-46621.exe (PID: 11112)
- Unicorn-47151.exe (PID: 11120)
- Unicorn-55286.exe (PID: 11128)
- Unicorn-35685.exe (PID: 11104)
- Unicorn-38453.exe (PID: 11176)
- Unicorn-41253.exe (PID: 11168)
- Unicorn-46406.exe (PID: 11196)
- Unicorn-60190.exe (PID: 11004)
- Unicorn-57589.exe (PID: 11060)
- Unicorn-36919.exe (PID: 11280)
- Unicorn-20832.exe (PID: 11212)
- Unicorn-52271.exe (PID: 11188)
- Unicorn-49363.exe (PID: 11324)
- Unicorn-16691.exe (PID: 11356)
- Unicorn-61807.exe (PID: 11384)
- Unicorn-57702.exe (PID: 11468)
- Unicorn-29113.exe (PID: 11500)
- Unicorn-5507.exe (PID: 11412)
- Unicorn-9892.exe (PID: 11420)
- Unicorn-59377.exe (PID: 11552)
- Unicorn-57339.exe (PID: 11568)
- Unicorn-50795.exe (PID: 11576)
- Unicorn-23388.exe (PID: 11616)
- Unicorn-58854.exe (PID: 11644)
- Unicorn-58854.exe (PID: 11652)
- Unicorn-42517.exe (PID: 11688)
- Unicorn-546.exe (PID: 11728)
- Unicorn-4822.exe (PID: 11768)
- Unicorn-473.exe (PID: 11776)
- Unicorn-9866.exe (PID: 11812)
- Unicorn-50899.exe (PID: 11832)
- Unicorn-8144.exe (PID: 11748)
- Unicorn-59259.exe (PID: 11912)
- Unicorn-1869.exe (PID: 11944)
- Unicorn-62767.exe (PID: 12004)
- Unicorn-62767.exe (PID: 11996)
- Unicorn-64997.exe (PID: 12044)
- Unicorn-5590.exe (PID: 12084)
- Unicorn-5590.exe (PID: 12076)
- Unicorn-62959.exe (PID: 12108)
- Unicorn-8588.exe (PID: 12208)
- Unicorn-39223.exe (PID: 12172)
- Unicorn-55486.exe (PID: 12232)
- Unicorn-19357.exe (PID: 12148)
- Unicorn-23441.exe (PID: 12140)
- Unicorn-39223.exe (PID: 12156)
- Unicorn-44054.exe (PID: 12224)
- Unicorn-12288.exe (PID: 12284)
- Unicorn-43992.exe (PID: 12280)
- Unicorn-4120.exe (PID: 12296)
- Unicorn-48330.exe (PID: 2332)
- Unicorn-7811.exe (PID: 11908)
- Unicorn-59451.exe (PID: 12328)
- Unicorn-19165.exe (PID: 12372)
- Unicorn-59451.exe (PID: 12336)
- Unicorn-30863.exe (PID: 12404)
- Unicorn-51283.exe (PID: 12356)
- Unicorn-25817.exe (PID: 12344)
- Unicorn-26779.exe (PID: 12412)
- Unicorn-2274.exe (PID: 12472)
- Unicorn-8396.exe (PID: 12448)
- Unicorn-2274.exe (PID: 12480)
- Unicorn-2274.exe (PID: 12464)
- Unicorn-16041.exe (PID: 12524)
- Unicorn-35907.exe (PID: 12532)
- Unicorn-35907.exe (PID: 12540)
- Unicorn-35907.exe (PID: 12548)
- Unicorn-21194.exe (PID: 12560)
- Unicorn-16556.exe (PID: 12612)
- Unicorn-48086.exe (PID: 12628)
- Unicorn-7245.exe (PID: 12732)
- Unicorn-8065.exe (PID: 12688)
- Unicorn-27931.exe (PID: 12672)
- Unicorn-23847.exe (PID: 12740)
- Unicorn-7278.exe (PID: 12776)
- Unicorn-46497.exe (PID: 12788)
- Unicorn-14916.exe (PID: 12756)
- Unicorn-28485.exe (PID: 12644)
- Unicorn-28485.exe (PID: 12636)
- Unicorn-8065.exe (PID: 12680)
- Unicorn-40183.exe (PID: 12652)
- Unicorn-17716.exe (PID: 12748)
- Unicorn-31439.exe (PID: 12920)
- Unicorn-3981.exe (PID: 12768)
- Unicorn-3981.exe (PID: 12712)
- Unicorn-36269.exe (PID: 12972)
- Unicorn-11018.exe (PID: 12956)
- Unicorn-47205.exe (PID: 13012)
- Unicorn-23198.exe (PID: 13040)
- Unicorn-23463.exe (PID: 13048)
- Unicorn-29253.exe (PID: 13096)
- Unicorn-8257.exe (PID: 13152)
- Unicorn-47265.exe (PID: 13116)
- Unicorn-53395.exe (PID: 13124)
- Unicorn-14016.exe (PID: 13212)
- Unicorn-12938.exe (PID: 13300)
- Unicorn-49887.exe (PID: 11988)
- Unicorn-12368.exe (PID: 5020)
- Unicorn-5517.exe (PID: 5988)
- Unicorn-52554.exe (PID: 13180)
- Unicorn-32953.exe (PID: 13172)
- Unicorn-41889.exe (PID: 13348)
- Unicorn-13670.exe (PID: 13404)
- Unicorn-27960.exe (PID: 13384)
- Unicorn-26669.exe (PID: 13428)
- Unicorn-24561.exe (PID: 13456)
- Unicorn-1034.exe (PID: 13480)
- Unicorn-40021.exe (PID: 13496)
- Unicorn-42813.exe (PID: 13548)
- Unicorn-47038.exe (PID: 13624)
- Unicorn-63042.exe (PID: 13448)
- Unicorn-49665.exe (PID: 13556)
- Unicorn-52326.exe (PID: 13952)
- Unicorn-31905.exe (PID: 13976)
- Unicorn-55855.exe (PID: 13968)
- Unicorn-58469.exe (PID: 13928)
- Unicorn-27267.exe (PID: 14008)
- Unicorn-22096.exe (PID: 14084)
- Unicorn-41749.exe (PID: 14060)
- Unicorn-31525.exe (PID: 14100)
- Unicorn-31525.exe (PID: 14108)
- Unicorn-56623.exe (PID: 14220)
- Unicorn-13213.exe (PID: 14268)
- Unicorn-44350.exe (PID: 14028)
- Unicorn-32097.exe (PID: 14052)
- Unicorn-5237.exe (PID: 14304)
- Unicorn-10804.exe (PID: 2416)
- Unicorn-62606.exe (PID: 14320)
- Unicorn-62606.exe (PID: 7048)
- Unicorn-42185.exe (PID: 7340)
- Unicorn-58522.exe (PID: 7488)
- Unicorn-38101.exe (PID: 2148)
- Unicorn-38101.exe (PID: 5232)
- Unicorn-53862.exe (PID: 14392)
- Unicorn-62030.exe (PID: 14384)
- Unicorn-62030.exe (PID: 14408)
- Unicorn-45694.exe (PID: 14428)
- Unicorn-62030.exe (PID: 14376)
- Unicorn-21189.exe (PID: 14520)
- Unicorn-45694.exe (PID: 14484)
- Unicorn-45694.exe (PID: 14424)
- Unicorn-12201.exe (PID: 14600)
- Unicorn-58138.exe (PID: 14584)
- Unicorn-2252.exe (PID: 14592)
- Unicorn-6336.exe (PID: 14568)
- Unicorn-47369.exe (PID: 14648)
- Unicorn-7296.exe (PID: 14716)
- Unicorn-56497.exe (PID: 14772)
- Unicorn-62362.exe (PID: 14764)
- Unicorn-27361.exe (PID: 14748)
- Unicorn-909.exe (PID: 14732)
- Unicorn-41445.exe (PID: 14836)
- Unicorn-20444.exe (PID: 14816)
- Unicorn-44245.exe (PID: 14844)
- Unicorn-37858.exe (PID: 14920)
- Unicorn-25606.exe (PID: 14932)
- Unicorn-37858.exe (PID: 14896)
- Unicorn-29192.exe (PID: 14912)
- Unicorn-42015.exe (PID: 15080)
- Unicorn-14194.exe (PID: 15112)
- Unicorn-34977.exe (PID: 15200)
- Unicorn-59674.exe (PID: 15244)
- Unicorn-35169.exe (PID: 15272)
- Unicorn-46867.exe (PID: 15292)
- Unicorn-7349.exe (PID: 15332)
- Unicorn-7349.exe (PID: 15340)
- Unicorn-15517.exe (PID: 15312)
- Unicorn-41697.exe (PID: 15368)
- Unicorn-29444.exe (PID: 15396)
- Unicorn-19239.exe (PID: 15428)
- Unicorn-60250.exe (PID: 15532)
- Unicorn-20700.exe (PID: 15508)
- Unicorn-30842.exe (PID: 15596)
- Unicorn-20892.exe (PID: 15604)
- Unicorn-24976.exe (PID: 15580)
- Unicorn-24976.exe (PID: 15588)
- Unicorn-18632.exe (PID: 15824)
- Unicorn-2097.exe (PID: 15816)
- Unicorn-681.exe (PID: 15940)
- Unicorn-65066.exe (PID: 15844)
- Unicorn-11973.exe (PID: 15896)
- Unicorn-44838.exe (PID: 15920)
- Unicorn-47281.exe (PID: 15976)
- Unicorn-4957.exe (PID: 15996)
- Unicorn-4957.exe (PID: 16004)
- Unicorn-28066.exe (PID: 16036)
- Unicorn-59149.exe (PID: 16100)
- Unicorn-40510.exe (PID: 16188)
- Unicorn-8465.exe (PID: 16052)
- Unicorn-45414.exe (PID: 16116)
- Unicorn-41329.exe (PID: 16144)
- Unicorn-59149.exe (PID: 16108)
- Unicorn-3256.exe (PID: 16232)
- Unicorn-6056.exe (PID: 16224)
- Unicorn-57858.exe (PID: 16240)
- Unicorn-19268.exe (PID: 16292)
- Unicorn-27628.exe (PID: 6384)
- Unicorn-41662.exe (PID: 16364)
- Unicorn-54139.exe (PID: 16464)
- Unicorn-33494.exe (PID: 5668)
- Unicorn-59010.exe (PID: 16424)
- Unicorn-26337.exe (PID: 16520)
- Unicorn-30421.exe (PID: 16488)
- Unicorn-54350.exe (PID: 16592)
- Unicorn-44157.exe (PID: 16496)
- Unicorn-16581.exe (PID: 16572)
- Unicorn-54350.exe (PID: 16584)
- Unicorn-17593.exe (PID: 16712)
- Unicorn-17593.exe (PID: 16704)
- Unicorn-13509.exe (PID: 16736)
- Unicorn-31328.exe (PID: 16720)
- Unicorn-39689.exe (PID: 16844)
- Unicorn-36888.exe (PID: 16836)
- Unicorn-58071.exe (PID: 16812)
- Unicorn-20036.exe (PID: 16900)
- Unicorn-6301.exe (PID: 16892)
- Unicorn-900.exe (PID: 16976)
- Unicorn-65153.exe (PID: 16984)
- Unicorn-58766.exe (PID: 17044)
- Unicorn-31328.exe (PID: 16728)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 6640)
- BackgroundTransferHost.exe (PID: 6272)
- BackgroundTransferHost.exe (PID: 920)
- BackgroundTransferHost.exe (PID: 7284)
- BackgroundTransferHost.exe (PID: 7932)
Create files in a temporary directory
- 1 (291).exe (PID: 7468)
- Unicorn-9629.exe (PID: 7320)
- Unicorn-44243.exe (PID: 7776)
- Unicorn-36895.exe (PID: 4756)
- Unicorn-30351.exe (PID: 7728)
- Unicorn-62463.exe (PID: 8140)
- Unicorn-13608.exe (PID: 7696)
- Unicorn-19843.exe (PID: 7348)
- Unicorn-36925.exe (PID: 5556)
- Unicorn-40455.exe (PID: 4776)
- Unicorn-14009.exe (PID: 8188)
- Unicorn-22840.exe (PID: 4880)
- Unicorn-62655.exe (PID: 2136)
- Unicorn-49775.exe (PID: 2600)
- Unicorn-31991.exe (PID: 8104)
- Unicorn-22456.exe (PID: 5512)
- Unicorn-34591.exe (PID: 900)
- Unicorn-55971.exe (PID: 7252)
- Unicorn-53262.exe (PID: 8164)
- Unicorn-14554.exe (PID: 664)
- Unicorn-12125.exe (PID: 7788)
- Unicorn-39251.exe (PID: 7504)
- Unicorn-50138.exe (PID: 6048)
- Unicorn-19371.exe (PID: 516)
- Unicorn-48706.exe (PID: 7288)
- Unicorn-60958.exe (PID: 6632)
- Unicorn-60958.exe (PID: 5416)
- Unicorn-44067.exe (PID: 7948)
- Unicorn-39983.exe (PID: 1128)
- Unicorn-33852.exe (PID: 6512)
- Unicorn-14716.exe (PID: 5260)
- Unicorn-63718.exe (PID: 6700)
- Unicorn-49775.exe (PID: 4988)
- Unicorn-19656.exe (PID: 4452)
- Unicorn-11435.exe (PID: 4696)
- Unicorn-49775.exe (PID: 2692)
- Unicorn-37819.exe (PID: 4244)
- Unicorn-62515.exe (PID: 8088)
- Unicorn-57855.exe (PID: 7720)
- Unicorn-41673.exe (PID: 6324)
- Unicorn-63070.exe (PID: 208)
- Unicorn-44133.exe (PID: 7960)
- Unicorn-11046.exe (PID: 7304)
- Unicorn-45949.exe (PID: 2656)
- Unicorn-26889.exe (PID: 1188)
- Unicorn-19385.exe (PID: 7524)
- Unicorn-40625.exe (PID: 1228)
- Unicorn-33740.exe (PID: 5544)
- Unicorn-3484.exe (PID: 3140)
- Unicorn-52354.exe (PID: 1168)
- Unicorn-18565.exe (PID: 6132)
- Unicorn-43802.exe (PID: 8336)
- Unicorn-26719.exe (PID: 8252)
- Unicorn-3034.exe (PID: 7296)
- Unicorn-62655.exe (PID: 7436)
- Unicorn-36453.exe (PID: 7276)
- Unicorn-41201.exe (PID: 8380)
- Unicorn-56319.exe (PID: 7272)
- Unicorn-54413.exe (PID: 8436)
- Unicorn-40677.exe (PID: 8428)
- Unicorn-50330.exe (PID: 3272)
- Unicorn-15426.exe (PID: 8400)
- Unicorn-3366.exe (PID: 8476)
- Unicorn-56651.exe (PID: 8520)
- Unicorn-44067.exe (PID: 8100)
- Unicorn-48483.exe (PID: 8568)
- Unicorn-48483.exe (PID: 8584)
- Unicorn-16365.exe (PID: 8636)
- Unicorn-48483.exe (PID: 8576)
- Unicorn-59397.exe (PID: 8796)
- Unicorn-44399.exe (PID: 8600)
- Unicorn-40315.exe (PID: 8624)
- Unicorn-48483.exe (PID: 8552)
- Unicorn-44399.exe (PID: 8608)
- Unicorn-62197.exe (PID: 8780)
- Unicorn-52546.exe (PID: 8764)
- Unicorn-60714.exe (PID: 8700)
- Unicorn-16365.exe (PID: 8644)
- Unicorn-44067.exe (PID: 7836)
- Unicorn-23382.exe (PID: 5400)
- Unicorn-35899.exe (PID: 2268)
- Unicorn-44273.exe (PID: 5680)
- Unicorn-28322.exe (PID: 1628)
- Unicorn-3781.exe (PID: 8120)
- Unicorn-52759.exe (PID: 9012)
- Unicorn-33408.exe (PID: 9068)
- Unicorn-32339.exe (PID: 9044)
- Unicorn-60610.exe (PID: 1760)
- Unicorn-42213.exe (PID: 9144)
- Unicorn-53911.exe (PID: 9164)
- Unicorn-41659.exe (PID: 9196)
- Unicorn-17155.exe (PID: 4180)
- Unicorn-58187.exe (PID: 9224)
- Unicorn-29821.exe (PID: 8040)
- Unicorn-797.exe (PID: 9304)
- Unicorn-45914.exe (PID: 9352)
- Unicorn-58602.exe (PID: 1276)
- Unicorn-41275.exe (PID: 9392)
- Unicorn-33107.exe (PID: 9440)
- Unicorn-16579.exe (PID: 9316)
- Unicorn-43313.exe (PID: 9384)
- Unicorn-49614.exe (PID: 7392)
- Unicorn-37191.exe (PID: 9412)
- Unicorn-41275.exe (PID: 9400)
- Unicorn-33543.exe (PID: 5936)
- Unicorn-29023.exe (PID: 9448)
- Unicorn-59007.exe (PID: 6404)
- Unicorn-10595.exe (PID: 9596)
- Unicorn-55447.exe (PID: 9636)
- Unicorn-10595.exe (PID: 9600)
- Unicorn-30139.exe (PID: 9648)
- Unicorn-35846.exe (PID: 9632)
- Unicorn-7672.exe (PID: 9680)
- Unicorn-37923.exe (PID: 9704)
- Unicorn-6298.exe (PID: 8296)
- Unicorn-47243.exe (PID: 9764)
- Unicorn-26417.exe (PID: 9724)
- Unicorn-32944.exe (PID: 9784)
- Unicorn-7450.exe (PID: 8468)
- Unicorn-39267.exe (PID: 9868)
- Unicorn-54762.exe (PID: 9876)
- Unicorn-64819.exe (PID: 8492)
- Unicorn-44067.exe (PID: 7712)
- Unicorn-48011.exe (PID: 9904)
- Unicorn-25684.exe (PID: 2240)
- Unicorn-64798.exe (PID: 8680)
- Unicorn-8197.exe (PID: 8668)
- Unicorn-59879.exe (PID: 9996)
- Unicorn-31815.exe (PID: 7756)
- Unicorn-3781.exe (PID: 1240)
- Unicorn-30537.exe (PID: 2800)
- Unicorn-11617.exe (PID: 10096)
- Unicorn-19895.exe (PID: 8992)
- Unicorn-39651.exe (PID: 10080)
- Unicorn-24725.exe (PID: 9020)
- Unicorn-221.exe (PID: 9060)
- Unicorn-65042.exe (PID: 10132)
- Unicorn-1704.exe (PID: 9088)
- Unicorn-21959.exe (PID: 9108)
- Unicorn-62197.exe (PID: 8788)
- Unicorn-4710.exe (PID: 9124)
- Unicorn-46349.exe (PID: 10152)
- Unicorn-3564.exe (PID: 9336)
- Unicorn-33683.exe (PID: 9284)
- Unicorn-25183.exe (PID: 8052)
- Unicorn-42405.exe (PID: 7380)
- Unicorn-62442.exe (PID: 9508)
- Unicorn-2193.exe (PID: 2516)
- Unicorn-62442.exe (PID: 9500)
- Unicorn-8130.exe (PID: 8240)
- Unicorn-46755.exe (PID: 4844)
The sample compiled with chinese language support
- 1 (291).exe (PID: 7468)
- Unicorn-28322.exe (PID: 1628)
- Unicorn-19895.exe (PID: 8992)
- Unicorn-24725.exe (PID: 9020)
- Unicorn-33408.exe (PID: 9068)
- Unicorn-52759.exe (PID: 9012)
- Unicorn-37819.exe (PID: 4244)
- Unicorn-62515.exe (PID: 8088)
- Unicorn-34591.exe (PID: 900)
- Unicorn-221.exe (PID: 9060)
- Unicorn-32339.exe (PID: 9044)
- Unicorn-44133.exe (PID: 7960)
- Unicorn-21959.exe (PID: 9108)
- Unicorn-60610.exe (PID: 1760)
- Unicorn-62197.exe (PID: 8788)
- Unicorn-1704.exe (PID: 9088)
- Unicorn-4710.exe (PID: 9124)
- Unicorn-62463.exe (PID: 8140)
- Unicorn-63070.exe (PID: 208)
- Unicorn-42213.exe (PID: 9144)
- Unicorn-19843.exe (PID: 7348)
- Unicorn-53911.exe (PID: 9164)
- Unicorn-41659.exe (PID: 9196)
- Unicorn-31444.exe (PID: 9204)
- Unicorn-57855.exe (PID: 7720)
- Unicorn-58187.exe (PID: 9224)
- Unicorn-55971.exe (PID: 7252)
- Unicorn-17155.exe (PID: 4180)
- Unicorn-41851.exe (PID: 9248)
- Unicorn-49422.exe (PID: 8016)
- Unicorn-29821.exe (PID: 8040)
- Unicorn-42405.exe (PID: 7380)
- Unicorn-3564.exe (PID: 9336)
- Unicorn-25183.exe (PID: 8052)
- Unicorn-45914.exe (PID: 9352)
- Unicorn-44243.exe (PID: 7776)
- Unicorn-58602.exe (PID: 1276)
- Unicorn-41673.exe (PID: 6324)
- Unicorn-53262.exe (PID: 8164)
- Unicorn-36925.exe (PID: 5556)
- Unicorn-41275.exe (PID: 9392)
- Unicorn-11046.exe (PID: 7304)
- Unicorn-45949.exe (PID: 2656)
- Unicorn-62131.exe (PID: 2088)
- Unicorn-16579.exe (PID: 9316)
- Unicorn-12125.exe (PID: 7788)
- Unicorn-43313.exe (PID: 9384)
- Unicorn-49614.exe (PID: 7392)
- Unicorn-37191.exe (PID: 9412)
- Unicorn-29023.exe (PID: 9456)
- Unicorn-33107.exe (PID: 9440)
- Unicorn-14554.exe (PID: 664)
- Unicorn-62442.exe (PID: 9508)
- Unicorn-2193.exe (PID: 2516)
- Unicorn-41275.exe (PID: 9400)
- Unicorn-33543.exe (PID: 5936)
- Unicorn-29023.exe (PID: 9448)
- Unicorn-40455.exe (PID: 4776)
- Unicorn-59007.exe (PID: 2340)
- Unicorn-10595.exe (PID: 9600)
- Unicorn-40625.exe (PID: 1228)
- Unicorn-10595.exe (PID: 9596)
- Unicorn-46755.exe (PID: 4844)
- Unicorn-14009.exe (PID: 8188)
- Unicorn-39251.exe (PID: 7504)
- Unicorn-55447.exe (PID: 9636)
- Unicorn-18565.exe (PID: 6132)
- Unicorn-30139.exe (PID: 9648)
- Unicorn-22840.exe (PID: 4880)
- Unicorn-36895.exe (PID: 4756)
- Unicorn-3484.exe (PID: 3140)
- Unicorn-50138.exe (PID: 6048)
- Unicorn-35846.exe (PID: 9632)
- Unicorn-52354.exe (PID: 1168)
- Unicorn-19371.exe (PID: 516)
- Unicorn-7672.exe (PID: 9680)
- Unicorn-60958.exe (PID: 5416)
- Unicorn-3034.exe (PID: 7296)
- Unicorn-37923.exe (PID: 9704)
- Unicorn-43802.exe (PID: 8336)
- Unicorn-6298.exe (PID: 8296)
- Unicorn-60958.exe (PID: 6632)
- Unicorn-26719.exe (PID: 8252)
- Unicorn-48706.exe (PID: 7288)
- Unicorn-26417.exe (PID: 9724)
- Unicorn-17695.exe (PID: 9740)
- Unicorn-41201.exe (PID: 8380)
- Unicorn-62655.exe (PID: 7436)
- Unicorn-15426.exe (PID: 8396)
- Unicorn-32944.exe (PID: 9784)
- Unicorn-15426.exe (PID: 8400)
- Unicorn-56319.exe (PID: 7272)
- Unicorn-54413.exe (PID: 8436)
- Unicorn-47243.exe (PID: 9764)
- Unicorn-36453.exe (PID: 7276)
- Unicorn-40677.exe (PID: 8428)
- Unicorn-62655.exe (PID: 2136)
- Unicorn-7450.exe (PID: 8468)
- Unicorn-56158.exe (PID: 9808)
- Unicorn-50330.exe (PID: 3272)
- Unicorn-7450.exe (PID: 8460)
- Unicorn-39267.exe (PID: 9868)
- Unicorn-54762.exe (PID: 9876)
- Unicorn-44067.exe (PID: 7948)
- Unicorn-3366.exe (PID: 8476)
- Unicorn-39983.exe (PID: 1128)
- Unicorn-44067.exe (PID: 7712)
- Unicorn-48011.exe (PID: 9904)
- Unicorn-48483.exe (PID: 8568)
- Unicorn-64819.exe (PID: 8492)
- Unicorn-56651.exe (PID: 8520)
- Unicorn-44067.exe (PID: 8100)
- Unicorn-25684.exe (PID: 2240)
- Unicorn-48483.exe (PID: 8576)
- Unicorn-59397.exe (PID: 8796)
- Unicorn-44399.exe (PID: 8600)
- Unicorn-40315.exe (PID: 8624)
- Unicorn-48483.exe (PID: 8584)
- Unicorn-48462.exe (PID: 8772)
- Unicorn-52546.exe (PID: 8764)
- Unicorn-64798.exe (PID: 8680)
- Unicorn-16085.exe (PID: 9972)
- Unicorn-16365.exe (PID: 8644)
- Unicorn-8197.exe (PID: 8668)
- Unicorn-23382.exe (PID: 5400)
- Unicorn-49775.exe (PID: 4988)
- Unicorn-60714.exe (PID: 8700)
- Unicorn-35899.exe (PID: 2268)
- Unicorn-14716.exe (PID: 5260)
- Unicorn-9629.exe (PID: 7320)
- Unicorn-59879.exe (PID: 9996)
- Unicorn-63718.exe (PID: 6700)
- Unicorn-31815.exe (PID: 7756)
- Unicorn-49775.exe (PID: 2692)
- Unicorn-3781.exe (PID: 8120)
- Unicorn-3781.exe (PID: 1240)
- Unicorn-44067.exe (PID: 7836)
- Unicorn-44273.exe (PID: 5680)
- Unicorn-19656.exe (PID: 4452)
- Unicorn-13608.exe (PID: 7696)
- Unicorn-30351.exe (PID: 7728)
- Unicorn-31991.exe (PID: 8104)
- Unicorn-30537.exe (PID: 2800)
- Unicorn-49775.exe (PID: 2600)
- Unicorn-11617.exe (PID: 10096)
- Unicorn-39651.exe (PID: 10080)
- Unicorn-20191.exe (PID: 10116)
- Unicorn-65042.exe (PID: 10132)
- Unicorn-46349.exe (PID: 10152)
- Unicorn-33683.exe (PID: 9284)
- Unicorn-797.exe (PID: 9304)
- Unicorn-62442.exe (PID: 9500)
- Unicorn-8130.exe (PID: 8240)
- Unicorn-19385.exe (PID: 7524)
- Unicorn-26889.exe (PID: 1188)
- Unicorn-33573.exe (PID: 8936)
- Unicorn-9282.exe (PID: 5124)
- Unicorn-54399.exe (PID: 7612)
- Unicorn-33852.exe (PID: 6512)
- Unicorn-62759.exe (PID: 10260)
- Unicorn-54591.exe (PID: 10280)
- Unicorn-6137.exe (PID: 10312)
- Unicorn-22473.exe (PID: 10296)
- Unicorn-48483.exe (PID: 8552)
- Unicorn-48483.exe (PID: 8592)
- Unicorn-64011.exe (PID: 8756)
- Unicorn-44399.exe (PID: 8608)
- Unicorn-1477.exe (PID: 10336)
- Unicorn-22456.exe (PID: 5512)
- Unicorn-11435.exe (PID: 4696)
- Unicorn-1477.exe (PID: 10332)
- Unicorn-48483.exe (PID: 8560)
- Unicorn-14777.exe (PID: 8716)
- Unicorn-54274.exe (PID: 9580)
- Unicorn-16505.exe (PID: 9492)
- Unicorn-33740.exe (PID: 5544)
- Unicorn-39023.exe (PID: 10384)
- Unicorn-26195.exe (PID: 10428)
- Unicorn-22111.exe (PID: 10448)
- Unicorn-63143.exe (PID: 10488)
- Unicorn-30279.exe (PID: 10412)
- Unicorn-54975.exe (PID: 10520)
- Unicorn-46807.exe (PID: 10532)
- Unicorn-38124.exe (PID: 10456)
- Unicorn-22303.exe (PID: 10592)
- Unicorn-16365.exe (PID: 8636)
- Unicorn-22303.exe (PID: 10584)
- Unicorn-57990.exe (PID: 10464)
- Unicorn-46807.exe (PID: 10540)
- Unicorn-55114.exe (PID: 8692)
- Unicorn-62197.exe (PID: 8780)
- Unicorn-10818.exe (PID: 10640)
- Unicorn-22303.exe (PID: 10600)
- Unicorn-34555.exe (PID: 10568)
- Unicorn-29293.exe (PID: 10692)
- Unicorn-10818.exe (PID: 10648)
- Unicorn-29293.exe (PID: 10700)
- Unicorn-35515.exe (PID: 10744)
- Unicorn-31431.exe (PID: 10752)
- Unicorn-6734.exe (PID: 10684)
- Unicorn-21216.exe (PID: 10760)
- Unicorn-56682.exe (PID: 10808)
- Unicorn-46621.exe (PID: 11112)
- Unicorn-36261.exe (PID: 10852)
- Unicorn-8388.exe (PID: 10996)
- Unicorn-47938.exe (PID: 11048)
- Unicorn-57304.exe (PID: 10860)
- Unicorn-6734.exe (PID: 10676)
- Unicorn-12308.exe (PID: 896)
- Unicorn-31636.exe (PID: 9256)
- Unicorn-2472.exe (PID: 9532)
- Unicorn-35685.exe (PID: 11104)
- Unicorn-59007.exe (PID: 6404)
- Unicorn-46406.exe (PID: 11196)
- Unicorn-220.exe (PID: 11016)
- Unicorn-38453.exe (PID: 11176)
- Unicorn-20832.exe (PID: 11212)
- Unicorn-57589.exe (PID: 11060)
- Unicorn-28093.exe (PID: 10868)
- Unicorn-60190.exe (PID: 11004)
- Unicorn-37872.exe (PID: 11024)
- Unicorn-47151.exe (PID: 11120)
- Unicorn-52758.exe (PID: 9520)
- Unicorn-52271.exe (PID: 11188)
- Unicorn-55286.exe (PID: 11128)
- Unicorn-3589.exe (PID: 10952)
- Unicorn-7481.exe (PID: 10768)
- Unicorn-39355.exe (PID: 7664)
- Unicorn-41253.exe (PID: 11168)
- Unicorn-14777.exe (PID: 8708)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 6272)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 6272)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 6272)
- WerFault.exe (PID: 11976)
- WerFault.exe (PID: 812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:04:26 10:28:09+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 8192 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13b0 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | aaaa |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicon |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
645
Monitored processes
506
Malicious processes
76
Suspicious processes
70
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\Users\admin\AppData\Local\Temp\Unicorn-63070.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63070.exe | Unicorn-19843.exe | ||||||||||||
User: admin Company: aaaa Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 516 | C:\Users\admin\AppData\Local\Temp\Unicorn-19371.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-19371.exe | Unicorn-60958.exe | ||||||||||||
User: admin Company: aaaa Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 664 | C:\Users\admin\AppData\Local\Temp\Unicorn-14554.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-14554.exe | Unicorn-40455.exe | ||||||||||||
User: admin Company: aaaa Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 812 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 9360 -s 576 | C:\Windows\SysWOW64\WerFault.exe | — | Unicorn-242.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 896 | C:\Users\admin\AppData\Local\Temp\Unicorn-12308.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-12308.exe | Unicorn-44243.exe | ||||||||||||
User: admin Company: aaaa Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 900 | C:\Users\admin\AppData\Local\Temp\Unicorn-34591.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-34591.exe | Unicorn-19843.exe | ||||||||||||
User: admin Company: aaaa Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 920 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1128 | C:\Users\admin\AppData\Local\Temp\Unicorn-39983.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-39983.exe | Unicorn-19656.exe | ||||||||||||
User: admin Company: aaaa Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1168 | C:\Users\admin\AppData\Local\Temp\Unicorn-52354.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-52354.exe | Unicorn-60958.exe | ||||||||||||
User: admin Company: aaaa Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1188 | C:\Users\admin\AppData\Local\Temp\Unicorn-26889.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-26889.exe | Unicorn-22840.exe | ||||||||||||
User: admin Company: aaaa Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
15 193
Read events
15 178
Write events
15
Delete events
0
Modification events
| (PID) Process: | (6640) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6640) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6640) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (920) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (920) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (920) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6272) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6272) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6272) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7284) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
1 160
Suspicious files
9
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6272 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\5fccc8e6-ed7f-4f43-832f-45656796d162.down_data | — | |
MD5:— | SHA256:— | |||
| 7468 | 1 (291).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9629.exe | executable | |
MD5:55EE2547BB4C60489F85D4FA0AA492DE | SHA256:DA6CFEFD0F3259670DE805F72CAD6BE1E3BAAA6562DE7044F7D1921DF00DAF0F | |||
| 4756 | Unicorn-36895.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-14009.exe | executable | |
MD5:FF8C6BFA73CE57402A74EFEF89D71065 | SHA256:E2FACBABD8A2D872123F512046D39B943D2A28EE3AE677C4C5F7B2EFC0C82EB6 | |||
| 7320 | Unicorn-9629.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-31991.exe | executable | |
MD5:ABD07D853A7B0D875C0BAEDE6B30AD53 | SHA256:BB0A5BFF6941F43F8DD15B5E695859CA3348181C00F029F81E9C78BBF5BA6D92 | |||
| 7728 | Unicorn-30351.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-12125.exe | executable | |
MD5:987BCF90DED4630A97A15EDD8BD82C4A | SHA256:C19B8B842CD0C99EF58E039C5D9EC90BDF69D844B1AB1946712A62257A9D796B | |||
| 7776 | Unicorn-44243.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-62463.exe | executable | |
MD5:FB2E4B689FCF8F8FE02F667CB073FA36 | SHA256:C6DD1C9927660DD789ED19C206A09296EFB41C237087FDE78E46768261782DD2 | |||
| 7468 | 1 (291).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13608.exe | executable | |
MD5:83EDC21DB86A8497A1CB415F947951C8 | SHA256:008841BE05C41D6881E433C5A6411F9AAABE8F59B489326C49F06B274FA7FF2E | |||
| 7468 | 1 (291).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-50138.exe | executable | |
MD5:C79B95013D8F23661EF38B7E507B0FBB | SHA256:C770DA6677645117AFDBBD9B84671CD9F144BC70F0237CE05E7BE3AE45B24B02 | |||
| 6272 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\e1e096d6-7aac-4807-8ab3-c78f2e743a39.up_meta_secure | binary | |
MD5:FD0623735D822B47BA613C75441AB1A0 | SHA256:741E6A8316E69558D98924878E6C0A8E274B7943795821D050B34EBC529A3535 | |||
| 7696 | Unicorn-13608.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-62655.exe | executable | |
MD5:BA497166B4407B21E5EAB192708DAC2A | SHA256:E5F2B64F054CE7DEEDEA32974FD9F3DE536D1AA9A2E8BD22B601768720891356 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
26
DNS requests
18
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.141:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 23.63.118.230:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7664 | backgroundTaskHost.exe | GET | 200 | 23.63.118.230:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
6272 | BackgroundTransferHost.exe | GET | 200 | 23.63.118.230:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
8208 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
8208 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
6652 | RUXIMICS.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.48.23.141:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
2104 | svchost.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.159.131:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 23.63.118.230:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2112 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |