File name:

1 (1285)

Full analysis: https://app.any.run/tasks/155a7e20-052d-47e9-957a-3846b1b20ef3
Verdict: Malicious activity
Analysis date: March 24, 2025, 13:22:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

B88DF284262BD79DC2B8B9DA6969F9B0

SHA1:

9827794EAC2BBF58B0C2464C2AC366E037BD4698

SHA256:

432A3F8A7803394157E5FA9BF42134D4963B0B3B37F0499AFECB2C7FBCA5939C

SSDEEP:

6144:aEkBS7IJvDsZA5iHx0eYnAUx5tB2nvJGBC/xyeHimk/8SwjwpyAvEhRpJXprs0Ia:aLcMeZA5mx3uBuhaCJyeHiZx4DxmDsR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Starts itself from another location

      • Unicorn-963.exe (PID: 7204)
      • 1 (1285).exe (PID: 7152)
      • Unicorn-36458.exe (PID: 7856)
      • Unicorn-64492.exe (PID: 7864)
      • Unicorn-50268.exe (PID: 8128)
      • Unicorn-43252.exe (PID: 8152)
      • Unicorn-33037.exe (PID: 8188)
      • Unicorn-19302.exe (PID: 8160)
      • Unicorn-53688.exe (PID: 6808)
      • Unicorn-12463.exe (PID: 7384)
      • Unicorn-17102.exe (PID: 7664)
      • Unicorn-12463.exe (PID: 7644)
      • Unicorn-49967.exe (PID: 7412)
      • Unicorn-57315.exe (PID: 7464)
      • Unicorn-4295.exe (PID: 7796)
      • Unicorn-55534.exe (PID: 7788)
      • Unicorn-52401.exe (PID: 4188)
      • Unicorn-43911.exe (PID: 2552)
      • Unicorn-65120.exe (PID: 5964)
      • Unicorn-38570.exe (PID: 2040)
      • Unicorn-27788.exe (PID: 8004)
      • Unicorn-15535.exe (PID: 8016)
      • Unicorn-12520.exe (PID: 6068)
      • Unicorn-64736.exe (PID: 8068)
      • Unicorn-46354.exe (PID: 3300)
      • Unicorn-44051.exe (PID: 6516)
      • Unicorn-35385.exe (PID: 8096)
      • Unicorn-3283.exe (PID: 8060)
      • Unicorn-58192.exe (PID: 7820)
      • Unicorn-24450.exe (PID: 6392)
      • Unicorn-57912.exe (PID: 7988)
      • Unicorn-53589.exe (PID: 7952)
      • Unicorn-1887.exe (PID: 7940)
      • Unicorn-22478.exe (PID: 7396)
      • Unicorn-50896.exe (PID: 7356)
      • Unicorn-34176.exe (PID: 7720)
      • Unicorn-53126.exe (PID: 6132)
      • Unicorn-21658.exe (PID: 7908)
      • Unicorn-26932.exe (PID: 5072)
      • Unicorn-52183.exe (PID: 5024)
      • Unicorn-52588.exe (PID: 6740)
      • Unicorn-40336.exe (PID: 4784)
      • Unicorn-36252.exe (PID: 3888)
      • Unicorn-36252.exe (PID: 5324)
      • Unicorn-48955.exe (PID: 8052)
      • Unicorn-11451.exe (PID: 8024)
      • Unicorn-11363.exe (PID: 5376)
      • Unicorn-57035.exe (PID: 516)
      • Unicorn-14678.exe (PID: 6272)
      • Unicorn-3195.exe (PID: 2284)
      • Unicorn-11363.exe (PID: 7084)
      • Unicorn-3195.exe (PID: 6112)
      • Unicorn-44783.exe (PID: 672)
      • Unicorn-27243.exe (PID: 4896)
      • Unicorn-50350.exe (PID: 4620)
      • Unicorn-3195.exe (PID: 680)
      • Unicorn-18577.exe (PID: 5892)
      • Unicorn-21377.exe (PID: 7568)
      • Unicorn-11363.exe (PID: 1312)
      • Unicorn-24362.exe (PID: 6640)
      • Unicorn-24362.exe (PID: 7324)
      • Unicorn-37020.exe (PID: 5936)
      • Unicorn-49635.exe (PID: 7572)
      • Unicorn-32360.exe (PID: 7372)
      • Unicorn-36444.exe (PID: 616)
      • Unicorn-20278.exe (PID: 7336)
      • Unicorn-54679.exe (PID: 7904)
      • Unicorn-38098.exe (PID: 7580)
      • Unicorn-29428.exe (PID: 7848)
      • Unicorn-8742.exe (PID: 5384)
      • Unicorn-12899.exe (PID: 2772)
      • Unicorn-58016.exe (PID: 7828)
      • Unicorn-38150.exe (PID: 7448)
      • Unicorn-39634.exe (PID: 7836)
      • Unicorn-12899.exe (PID: 5984)
      • Unicorn-45764.exe (PID: 7444)
      • Unicorn-16029.exe (PID: 2392)
      • Unicorn-32936.exe (PID: 4696)
      • Unicorn-20684.exe (PID: 1056)
      • Unicorn-63754.exe (PID: 1012)
      • Unicorn-13262.exe (PID: 2092)
      • Unicorn-6459.exe (PID: 5772)
      • Unicorn-47492.exe (PID: 6816)
      • Unicorn-62271.exe (PID: 5260)
      • Unicorn-39686.exe (PID: 8220)
      • Unicorn-56672.exe (PID: 5164)
      • Unicorn-64191.exe (PID: 8200)
      • Unicorn-6651.exe (PID: 8372)
      • Unicorn-45499.exe (PID: 8416)
      • Unicorn-45499.exe (PID: 8408)
      • Unicorn-20994.exe (PID: 8428)
      • Unicorn-47876.exe (PID: 8352)
      • Unicorn-51960.exe (PID: 8316)
      • Unicorn-53556.exe (PID: 8560)
      • Unicorn-25330.exe (PID: 8600)
      • Unicorn-49088.exe (PID: 8616)
      • Unicorn-45004.exe (PID: 8624)
      • Unicorn-5809.exe (PID: 7480)
      • Unicorn-17760.exe (PID: 8708)
      • Unicorn-8247.exe (PID: 8656)
      • Unicorn-42072.exe (PID: 8780)
      • Unicorn-12331.exe (PID: 8648)
      • Unicorn-56746.exe (PID: 8736)
      • Unicorn-42264.exe (PID: 8684)
      • Unicorn-19221.exe (PID: 8964)
      • Unicorn-42072.exe (PID: 8788)
      • Unicorn-50240.exe (PID: 8748)
      • Unicorn-42072.exe (PID: 8772)
      • Unicorn-55071.exe (PID: 8852)
      • Unicorn-9399.exe (PID: 8860)
      • Unicorn-17930.exe (PID: 8928)
      • Unicorn-51179.exe (PID: 8716)
      • Unicorn-42072.exe (PID: 8796)
      • Unicorn-50048.exe (PID: 8900)
      • Unicorn-25087.exe (PID: 8956)
      • Unicorn-24457.exe (PID: 9036)
      • Unicorn-24457.exe (PID: 9028)
      • Unicorn-1615.exe (PID: 9180)
      • Unicorn-26696.exe (PID: 8988)
      • Unicorn-30323.exe (PID: 9020)
      • Unicorn-43586.exe (PID: 9088)
      • Unicorn-47884.exe (PID: 9188)
      • Unicorn-37986.exe (PID: 9080)

    • Executable content was dropped or overwritten

      • Unicorn-36458.exe (PID: 7856)
      • Unicorn-64492.exe (PID: 7864)
      • 1 (1285).exe (PID: 7152)
      • Unicorn-963.exe (PID: 7204)
      • Unicorn-50268.exe (PID: 8128)
      • Unicorn-33037.exe (PID: 8188)
      • Unicorn-17102.exe (PID: 7664)
      • Unicorn-53688.exe (PID: 6808)
      • Unicorn-12463.exe (PID: 7384)
      • Unicorn-12463.exe (PID: 7644)
      • Unicorn-49967.exe (PID: 7412)
      • Unicorn-55534.exe (PID: 7788)
      • Unicorn-43252.exe (PID: 8152)
      • Unicorn-19302.exe (PID: 8160)
      • Unicorn-4295.exe (PID: 7796)
      • Unicorn-52401.exe (PID: 4188)
      • Unicorn-43911.exe (PID: 2552)
      • Unicorn-65120.exe (PID: 5964)
      • Unicorn-38570.exe (PID: 2040)
      • Unicorn-27788.exe (PID: 8004)
      • Unicorn-57315.exe (PID: 7464)
      • Unicorn-64736.exe (PID: 8068)
      • Unicorn-12520.exe (PID: 6068)
      • Unicorn-24450.exe (PID: 6392)
      • Unicorn-15535.exe (PID: 8016)
      • Unicorn-58192.exe (PID: 7820)
      • Unicorn-1887.exe (PID: 7940)
      • Unicorn-57912.exe (PID: 7988)
      • Unicorn-53126.exe (PID: 6132)
      • Unicorn-50896.exe (PID: 7356)
      • Unicorn-53589.exe (PID: 7952)
      • Unicorn-34176.exe (PID: 7720)
      • Unicorn-21658.exe (PID: 7908)
      • Unicorn-26932.exe (PID: 5072)
      • Unicorn-52183.exe (PID: 5024)
      • Unicorn-52588.exe (PID: 6740)
      • Unicorn-56672.exe (PID: 5164)
      • Unicorn-40336.exe (PID: 4784)
      • Unicorn-36252.exe (PID: 3888)
      • Unicorn-36252.exe (PID: 5324)
      • Unicorn-11363.exe (PID: 5376)
      • Unicorn-11451.exe (PID: 8024)
      • Unicorn-3283.exe (PID: 8060)
      • Unicorn-57035.exe (PID: 516)
      • Unicorn-3195.exe (PID: 2284)
      • Unicorn-11363.exe (PID: 7084)
      • Unicorn-14678.exe (PID: 6272)
      • Unicorn-3195.exe (PID: 6112)
      • Unicorn-20278.exe (PID: 7336)
      • Unicorn-27243.exe (PID: 4896)
      • Unicorn-50350.exe (PID: 4620)
      • Unicorn-18577.exe (PID: 5892)
      • Unicorn-35385.exe (PID: 8096)
      • Unicorn-11363.exe (PID: 1312)
      • Unicorn-44051.exe (PID: 6516)
      • Unicorn-46354.exe (PID: 3300)
      • Unicorn-49635.exe (PID: 7572)
      • Unicorn-37020.exe (PID: 5936)
      • Unicorn-32360.exe (PID: 7372)
      • Unicorn-24362.exe (PID: 7324)
      • Unicorn-5809.exe (PID: 7480)
      • Unicorn-36444.exe (PID: 616)
      • Unicorn-54679.exe (PID: 7904)
      • Unicorn-8742.exe (PID: 5384)
      • Unicorn-12899.exe (PID: 5984)
      • Unicorn-12899.exe (PID: 2772)
      • Unicorn-39634.exe (PID: 7836)
      • Unicorn-58016.exe (PID: 7828)
      • Unicorn-38150.exe (PID: 7448)
      • Unicorn-29428.exe (PID: 7848)
      • Unicorn-22478.exe (PID: 7396)
      • Unicorn-16029.exe (PID: 2392)
      • Unicorn-13262.exe (PID: 2092)
      • Unicorn-20684.exe (PID: 1056)
      • Unicorn-63754.exe (PID: 1012)
      • Unicorn-45764.exe (PID: 7444)
      • Unicorn-62271.exe (PID: 5260)
      • Unicorn-47492.exe (PID: 6816)
      • Unicorn-6459.exe (PID: 5772)
      • Unicorn-64191.exe (PID: 8200)
      • Unicorn-39686.exe (PID: 8220)
      • Unicorn-6651.exe (PID: 8372)
      • Unicorn-45499.exe (PID: 8408)
      • Unicorn-20994.exe (PID: 8428)
      • Unicorn-47876.exe (PID: 8352)
      • Unicorn-51960.exe (PID: 8316)
      • Unicorn-45499.exe (PID: 8416)
      • Unicorn-44783.exe (PID: 672)
      • Unicorn-21377.exe (PID: 7568)
      • Unicorn-24362.exe (PID: 6640)
      • Unicorn-53556.exe (PID: 8560)
      • Unicorn-25330.exe (PID: 8600)
      • Unicorn-49088.exe (PID: 8616)
      • Unicorn-12331.exe (PID: 8648)
      • Unicorn-45004.exe (PID: 8624)
      • Unicorn-38098.exe (PID: 7580)
      • Unicorn-8247.exe (PID: 8656)
      • Unicorn-42072.exe (PID: 8780)
      • Unicorn-17760.exe (PID: 8708)
      • Unicorn-42264.exe (PID: 8684)
      • Unicorn-56746.exe (PID: 8736)
      • Unicorn-42072.exe (PID: 8788)
      • Unicorn-42072.exe (PID: 8772)
      • Unicorn-50240.exe (PID: 8748)
      • Unicorn-55071.exe (PID: 8852)
      • Unicorn-9399.exe (PID: 8860)
      • Unicorn-17930.exe (PID: 8928)
      • Unicorn-51179.exe (PID: 8716)
      • Unicorn-50048.exe (PID: 8900)
      • Unicorn-42072.exe (PID: 8796)
      • Unicorn-45732.exe (PID: 8892)
      • Unicorn-25087.exe (PID: 8956)
      • Unicorn-24457.exe (PID: 9036)
      • Unicorn-37986.exe (PID: 9080)
      • Unicorn-24457.exe (PID: 9028)
      • Unicorn-26696.exe (PID: 8988)
      • Unicorn-47884.exe (PID: 9188)
      • Unicorn-30323.exe (PID: 9020)
      • Unicorn-43586.exe (PID: 9088)
      • Unicorn-1615.exe (PID: 9180)
      • Unicorn-30323.exe (PID: 9012)
      • Unicorn-52662.exe (PID: 9144)
      • Unicorn-7043.exe (PID: 9208)
      • Unicorn-18698.exe (PID: 9116)
      • Unicorn-60136.exe (PID: 9168)
      • Unicorn-41886.exe (PID: 9096)
      • Unicorn-64775.exe (PID: 8476)
      • Unicorn-49730.exe (PID: 1300)
      • Unicorn-48955.exe (PID: 8052)
      • Unicorn-59487.exe (PID: 8588)
      • Unicorn-40846.exe (PID: 9264)
      • Unicorn-3195.exe (PID: 680)
      • Unicorn-15574.exe (PID: 5404)
      • Unicorn-57567.exe (PID: 9244)
      • Unicorn-57567.exe (PID: 9252)
      • Unicorn-22804.exe (PID: 9224)
      • Unicorn-56436.exe (PID: 9320)
      • Unicorn-20064.exe (PID: 9236)
      • Unicorn-48658.exe (PID: 9404)
      • Unicorn-12066.exe (PID: 9360)
      • Unicorn-62750.exe (PID: 9376)
      • Unicorn-19221.exe (PID: 8964)
      • Unicorn-44568.exe (PID: 9308)
      • Unicorn-32936.exe (PID: 4696)
      • Unicorn-44760.exe (PID: 9676)
      • Unicorn-41252.exe (PID: 9444)
      • Unicorn-57588.exe (PID: 9412)
      • Unicorn-49975.exe (PID: 9516)
      • Unicorn-41422.exe (PID: 9536)
      • Unicorn-10233.exe (PID: 9596)
      • Unicorn-4303.exe (PID: 9524)
      • Unicorn-3025.exe (PID: 9784)
      • Unicorn-24340.exe (PID: 9696)
      • Unicorn-4666.exe (PID: 9656)
      • Unicorn-32892.exe (PID: 9504)
      • Unicorn-28616.exe (PID: 9584)
      • Unicorn-39367.exe (PID: 9744)
      • Unicorn-57515.exe (PID: 9832)
      • Unicorn-28616.exe (PID: 9576)
      • Unicorn-15906.exe (PID: 9704)
      • Unicorn-14893.exe (PID: 9852)
      • Unicorn-45912.exe (PID: 9736)
      • Unicorn-44952.exe (PID: 9556)
      • Unicorn-42944.exe (PID: 9928)
      • Unicorn-58911.exe (PID: 9768)
      • Unicorn-53311.exe (PID: 9760)
      • Unicorn-50743.exe (PID: 9776)
      • Unicorn-15123.exe (PID: 10048)
      • Unicorn-44843.exe (PID: 9972)
      • Unicorn-60795.exe (PID: 10040)
      • Unicorn-3618.exe (PID: 9996)
      • Unicorn-11594.exe (PID: 10016)
      • Unicorn-1593.exe (PID: 10116)
      • Unicorn-38542.exe (PID: 10108)
      • Unicorn-6379.exe (PID: 9908)
      • Unicorn-32612.exe (PID: 10100)

  • INFO

    • Checks supported languages

      • 1 (1285).exe (PID: 7152)
      • Unicorn-963.exe (PID: 7204)
      • Unicorn-64492.exe (PID: 7864)
      • Unicorn-50268.exe (PID: 8128)
      • Unicorn-36458.exe (PID: 7856)
      • Unicorn-43252.exe (PID: 8152)
      • Unicorn-33037.exe (PID: 8188)
      • Unicorn-19302.exe (PID: 8160)
      • Unicorn-17102.exe (PID: 7664)
      • Unicorn-12463.exe (PID: 7384)
      • Unicorn-52401.exe (PID: 4188)
      • Unicorn-49967.exe (PID: 7412)
      • Unicorn-43911.exe (PID: 2552)
      • Unicorn-3283.exe (PID: 8060)
      • Unicorn-48955.exe (PID: 8052)
      • Unicorn-24450.exe (PID: 6392)
      • Unicorn-53589.exe (PID: 7952)
      • Unicorn-57912.exe (PID: 7988)
      • Unicorn-53126.exe (PID: 6132)
      • Unicorn-22478.exe (PID: 7396)
      • Unicorn-11363.exe (PID: 1312)
      • Unicorn-3195.exe (PID: 6112)
      • Unicorn-57035.exe (PID: 516)
      • Unicorn-27243.exe (PID: 4896)
      • Unicorn-50350.exe (PID: 4620)
      • Unicorn-38098.exe (PID: 7580)
      • Unicorn-49635.exe (PID: 7572)
      • Unicorn-32360.exe (PID: 7372)
      • Unicorn-54679.exe (PID: 7904)
      • Unicorn-29428.exe (PID: 7848)
      • Unicorn-38150.exe (PID: 7448)
      • Unicorn-13262.exe (PID: 2092)
      • Unicorn-58016.exe (PID: 7828)
      • Unicorn-20684.exe (PID: 1056)
      • Unicorn-62271.exe (PID: 5260)
      • Unicorn-47492.exe (PID: 6816)
      • Unicorn-51960.exe (PID: 8316)
      • Unicorn-25330.exe (PID: 8600)
      • Unicorn-20994.exe (PID: 8428)
      • Unicorn-44783.exe (PID: 672)
      • Unicorn-42264.exe (PID: 8684)
      • Unicorn-17760.exe (PID: 8708)
      • Unicorn-42072.exe (PID: 8788)
      • Unicorn-42072.exe (PID: 8772)
      • Unicorn-55071.exe (PID: 8852)
      • Unicorn-42072.exe (PID: 8796)
      • Unicorn-50048.exe (PID: 8900)
      • Unicorn-45732.exe (PID: 8892)
      • Unicorn-30323.exe (PID: 9012)
      • Unicorn-24457.exe (PID: 9028)
      • Unicorn-30323.exe (PID: 9020)
      • Unicorn-52662.exe (PID: 9144)
      • Unicorn-37986.exe (PID: 9080)
      • Unicorn-7043.exe (PID: 9208)
      • Unicorn-15574.exe (PID: 5404)
      • Unicorn-59487.exe (PID: 8588)
      • Unicorn-22804.exe (PID: 9224)
      • Unicorn-56436.exe (PID: 9320)
      • Unicorn-44568.exe (PID: 9308)
      • Unicorn-48658.exe (PID: 9404)
      • Unicorn-45499.exe (PID: 8408)
      • Unicorn-41422.exe (PID: 9536)
      • Unicorn-28616.exe (PID: 9584)
      • Unicorn-44952.exe (PID: 9556)
      • Unicorn-50743.exe (PID: 9776)
      • Unicorn-39367.exe (PID: 9744)
      • Unicorn-57515.exe (PID: 9832)
      • Unicorn-44760.exe (PID: 9676)
      • Unicorn-53311.exe (PID: 9760)
      • Unicorn-11594.exe (PID: 10016)
      • Unicorn-1593.exe (PID: 10116)
      • Unicorn-28912.exe (PID: 7340)
      • Unicorn-56606.exe (PID: 10252)
      • Unicorn-39886.exe (PID: 10280)
      • Unicorn-47168.exe (PID: 10360)
      • Unicorn-14666.exe (PID: 10412)
      • Unicorn-22472.exe (PID: 10392)
      • Unicorn-31770.exe (PID: 10592)
      • Unicorn-39119.exe (PID: 10604)
      • Unicorn-56467.exe (PID: 10668)
      • Unicorn-52383.exe (PID: 10676)
      • Unicorn-24392.exe (PID: 10756)
      • Unicorn-4526.exe (PID: 10748)
      • Unicorn-50934.exe (PID: 10692)
      • Unicorn-6009.exe (PID: 10784)
      • Unicorn-64827.exe (PID: 10552)
      • Unicorn-7266.exe (PID: 10620)
      • Unicorn-58159.exe (PID: 11180)
      • Unicorn-40690.exe (PID: 11048)
      • Unicorn-4471.exe (PID: 11008)
      • Unicorn-24361.exe (PID: 10988)
      • Unicorn-12606.exe (PID: 11024)
      • Unicorn-57967.exe (PID: 11232)
      • Unicorn-12030.exe (PID: 11244)
      • Unicorn-12877.exe (PID: 4976)
      • Unicorn-40182.exe (PID: 3968)
      • Unicorn-13255.exe (PID: 2968)
      • Unicorn-23269.exe (PID: 11284)
      • Unicorn-23269.exe (PID: 11300)
      • Unicorn-58180.exe (PID: 11352)
      • Unicorn-18034.exe (PID: 11460)
      • Unicorn-24421.exe (PID: 11448)
      • Unicorn-3566.exe (PID: 10476)
      • Unicorn-5663.exe (PID: 11584)
      • Unicorn-51164.exe (PID: 11492)
      • Unicorn-55611.exe (PID: 11536)
      • Unicorn-25381.exe (PID: 11652)
      • Unicorn-11646.exe (PID: 11664)
      • Unicorn-52679.exe (PID: 11704)
      • Unicorn-23706.exe (PID: 11740)
      • Unicorn-29465.exe (PID: 11636)
      • Unicorn-31055.exe (PID: 11776)
      • Unicorn-35766.exe (PID: 11992)
      • Unicorn-9945.exe (PID: 11896)
      • Unicorn-42486.exe (PID: 12000)
      • Unicorn-12295.exe (PID: 11252)
      • Unicorn-34370.exe (PID: 12428)
      • Unicorn-61126.exe (PID: 12548)
      • Unicorn-53150.exe (PID: 12528)
      • Unicorn-40322.exe (PID: 12564)
      • Unicorn-41600.exe (PID: 12420)
      • Unicorn-38476.exe (PID: 12540)
      • Unicorn-32066.exe (PID: 11844)

    • Reads the computer name

      • 1 (1285).exe (PID: 7152)
      • Unicorn-36458.exe (PID: 7856)
      • Unicorn-64492.exe (PID: 7864)
      • Unicorn-50268.exe (PID: 8128)
      • Unicorn-43252.exe (PID: 8152)
      • Unicorn-963.exe (PID: 7204)
      • Unicorn-12463.exe (PID: 7644)
      • Unicorn-49967.exe (PID: 7412)
      • Unicorn-55534.exe (PID: 7788)
      • Unicorn-57315.exe (PID: 7464)
      • Unicorn-65120.exe (PID: 5964)
      • Unicorn-19302.exe (PID: 8160)
      • Unicorn-11451.exe (PID: 8024)
      • Unicorn-48955.exe (PID: 8052)
      • Unicorn-3283.exe (PID: 8060)
      • Unicorn-27788.exe (PID: 8004)
      • Unicorn-1887.exe (PID: 7940)
      • Unicorn-53126.exe (PID: 6132)
      • Unicorn-22478.exe (PID: 7396)
      • Unicorn-52183.exe (PID: 5024)
      • Unicorn-11363.exe (PID: 7084)
      • Unicorn-14678.exe (PID: 6272)
      • Unicorn-18577.exe (PID: 5892)
      • Unicorn-11363.exe (PID: 5376)
      • Unicorn-32360.exe (PID: 7372)
      • Unicorn-36444.exe (PID: 616)
      • Unicorn-54679.exe (PID: 7904)
      • Unicorn-38150.exe (PID: 7448)
      • Unicorn-58016.exe (PID: 7828)
      • Unicorn-13262.exe (PID: 2092)
      • Unicorn-63754.exe (PID: 1012)
      • Unicorn-20684.exe (PID: 1056)
      • Unicorn-47492.exe (PID: 6816)
      • Unicorn-64191.exe (PID: 8200)
      • Unicorn-8579.exe (PID: 9496)
      • Unicorn-6651.exe (PID: 8372)
      • Unicorn-45499.exe (PID: 8408)
      • Unicorn-20994.exe (PID: 8428)
      • Unicorn-53556.exe (PID: 8560)
      • Unicorn-9399.exe (PID: 8860)
      • Unicorn-42072.exe (PID: 8796)
      • Unicorn-25087.exe (PID: 8956)
      • Unicorn-37986.exe (PID: 9080)
      • Unicorn-26696.exe (PID: 8988)
      • Unicorn-41886.exe (PID: 9096)
      • Unicorn-7043.exe (PID: 9208)
      • Unicorn-24457.exe (PID: 9028)
      • Unicorn-49730.exe (PID: 1300)

    • The sample compiled with chinese language support

      • 1 (1285).exe (PID: 7152)
      • Unicorn-43252.exe (PID: 8152)
      • Unicorn-55534.exe (PID: 7788)
      • Unicorn-12520.exe (PID: 6068)
      • Unicorn-32360.exe (PID: 7372)
      • Unicorn-37020.exe (PID: 5936)
      • Unicorn-4295.exe (PID: 7796)
      • Unicorn-49088.exe (PID: 8616)
      • Unicorn-52401.exe (PID: 4188)
      • Unicorn-57912.exe (PID: 7988)
      • Unicorn-12331.exe (PID: 8648)
      • Unicorn-5809.exe (PID: 7480)
      • Unicorn-36444.exe (PID: 616)
      • Unicorn-17760.exe (PID: 8708)
      • Unicorn-54679.exe (PID: 7904)
      • Unicorn-8247.exe (PID: 8656)
      • Unicorn-38098.exe (PID: 7580)
      • Unicorn-42072.exe (PID: 8780)
      • Unicorn-29428.exe (PID: 7848)
      • Unicorn-42264.exe (PID: 8684)
      • Unicorn-8742.exe (PID: 5384)
      • Unicorn-43911.exe (PID: 2552)
      • Unicorn-53126.exe (PID: 6132)
      • Unicorn-56746.exe (PID: 8736)
      • Unicorn-42072.exe (PID: 8788)
      • Unicorn-50240.exe (PID: 8748)
      • Unicorn-42072.exe (PID: 8772)
      • Unicorn-12899.exe (PID: 5984)
      • Unicorn-50268.exe (PID: 8128)
      • Unicorn-9399.exe (PID: 8860)
      • Unicorn-45764.exe (PID: 7444)
      • Unicorn-39634.exe (PID: 7836)
      • Unicorn-50896.exe (PID: 7356)
      • Unicorn-22478.exe (PID: 7396)
      • Unicorn-55071.exe (PID: 8852)
      • Unicorn-16029.exe (PID: 2392)
      • Unicorn-13262.exe (PID: 2092)
      • Unicorn-65120.exe (PID: 5964)
      • Unicorn-17930.exe (PID: 8928)
      • Unicorn-34176.exe (PID: 7720)
      • Unicorn-20684.exe (PID: 1056)
      • Unicorn-42072.exe (PID: 8796)
      • Unicorn-51179.exe (PID: 8716)
      • Unicorn-17102.exe (PID: 7664)
      • Unicorn-62271.exe (PID: 5260)
      • Unicorn-21658.exe (PID: 7908)
      • Unicorn-26932.exe (PID: 5072)
      • Unicorn-64492.exe (PID: 7864)
      • Unicorn-52183.exe (PID: 5024)
      • Unicorn-12463.exe (PID: 7384)
      • Unicorn-27788.exe (PID: 8004)
      • Unicorn-1887.exe (PID: 7940)
      • Unicorn-50048.exe (PID: 8900)
      • Unicorn-63754.exe (PID: 1012)
      • Unicorn-25087.exe (PID: 8956)
      • Unicorn-24457.exe (PID: 9036)
      • Unicorn-6459.exe (PID: 5772)
      • Unicorn-47492.exe (PID: 6816)
      • Unicorn-45732.exe (PID: 8892)
      • Unicorn-58016.exe (PID: 7828)
      • Unicorn-38150.exe (PID: 7448)
      • Unicorn-24457.exe (PID: 9028)
      • Unicorn-64191.exe (PID: 8200)
      • Unicorn-56672.exe (PID: 5164)
      • Unicorn-52588.exe (PID: 6740)
      • Unicorn-37986.exe (PID: 9080)
      • Unicorn-1615.exe (PID: 9180)
      • Unicorn-26696.exe (PID: 8988)
      • Unicorn-30323.exe (PID: 9020)
      • Unicorn-43586.exe (PID: 9088)
      • Unicorn-47884.exe (PID: 9188)
      • Unicorn-11451.exe (PID: 8024)
      • Unicorn-15535.exe (PID: 8016)
      • Unicorn-39686.exe (PID: 8220)
      • Unicorn-6651.exe (PID: 8372)
      • Unicorn-7043.exe (PID: 9208)
      • Unicorn-18698.exe (PID: 9116)
      • Unicorn-52662.exe (PID: 9144)
      • Unicorn-36252.exe (PID: 3888)
      • Unicorn-40336.exe (PID: 4784)
      • Unicorn-41886.exe (PID: 9096)
      • Unicorn-30323.exe (PID: 9012)
      • Unicorn-64775.exe (PID: 8476)
      • Unicorn-48955.exe (PID: 8052)
      • Unicorn-47876.exe (PID: 8352)
      • Unicorn-49730.exe (PID: 1300)
      • Unicorn-64736.exe (PID: 8068)
      • Unicorn-51960.exe (PID: 8316)
      • Unicorn-45499.exe (PID: 8408)
      • Unicorn-45499.exe (PID: 8416)
      • Unicorn-20994.exe (PID: 8428)
      • Unicorn-59487.exe (PID: 8588)
      • Unicorn-60136.exe (PID: 9168)
      • Unicorn-36252.exe (PID: 5324)
      • Unicorn-57035.exe (PID: 516)
      • Unicorn-12463.exe (PID: 7644)
      • Unicorn-3195.exe (PID: 2284)
      • Unicorn-14678.exe (PID: 6272)
      • Unicorn-3195.exe (PID: 6112)
      • Unicorn-40846.exe (PID: 9264)
      • Unicorn-24450.exe (PID: 6392)
      • Unicorn-44783.exe (PID: 672)
      • Unicorn-3195.exe (PID: 680)
      • Unicorn-27243.exe (PID: 4896)
      • Unicorn-11363.exe (PID: 5376)
      • Unicorn-15574.exe (PID: 5404)
      • Unicorn-3283.exe (PID: 8060)
      • Unicorn-11363.exe (PID: 1312)
      • Unicorn-53556.exe (PID: 8560)
      • Unicorn-44051.exe (PID: 6516)
      • Unicorn-19302.exe (PID: 8160)
      • Unicorn-57567.exe (PID: 9244)
      • Unicorn-49967.exe (PID: 7412)
      • Unicorn-24362.exe (PID: 7324)
      • Unicorn-57315.exe (PID: 7464)
      • Unicorn-33037.exe (PID: 8188)
      • Unicorn-57567.exe (PID: 9252)
      • Unicorn-22804.exe (PID: 9224)
      • Unicorn-963.exe (PID: 7204)
      • Unicorn-24362.exe (PID: 6640)
      • Unicorn-35385.exe (PID: 8096)
      • Unicorn-18577.exe (PID: 5892)
      • Unicorn-56436.exe (PID: 9320)
      • Unicorn-25330.exe (PID: 8600)
      • Unicorn-50350.exe (PID: 4620)
      • Unicorn-49635.exe (PID: 7572)
      • Unicorn-20064.exe (PID: 9236)
      • Unicorn-48658.exe (PID: 9404)
      • Unicorn-53688.exe (PID: 6808)
      • Unicorn-12066.exe (PID: 9360)
      • Unicorn-20278.exe (PID: 7336)
      • Unicorn-62750.exe (PID: 9376)
      • Unicorn-44568.exe (PID: 9308)
      • Unicorn-36458.exe (PID: 7856)
      • Unicorn-53589.exe (PID: 7952)
      • Unicorn-19221.exe (PID: 8964)
      • Unicorn-38570.exe (PID: 2040)
      • Unicorn-41252.exe (PID: 9444)
      • Unicorn-44760.exe (PID: 9676)
      • Unicorn-57588.exe (PID: 9412)
      • Unicorn-49975.exe (PID: 9516)
      • Unicorn-10233.exe (PID: 9596)
      • Unicorn-4303.exe (PID: 9524)
      • Unicorn-41422.exe (PID: 9536)
      • Unicorn-32936.exe (PID: 4696)
      • Unicorn-24340.exe (PID: 9696)
      • Unicorn-4666.exe (PID: 9656)
      • Unicorn-28616.exe (PID: 9584)
      • Unicorn-32892.exe (PID: 9504)
      • Unicorn-58192.exe (PID: 7820)
      • Unicorn-39367.exe (PID: 9744)
      • Unicorn-15906.exe (PID: 9704)
      • Unicorn-57515.exe (PID: 9832)
      • Unicorn-28616.exe (PID: 9576)
      • Unicorn-3025.exe (PID: 9784)
      • Unicorn-11363.exe (PID: 7084)
      • Unicorn-53311.exe (PID: 9760)
      • Unicorn-50743.exe (PID: 9776)
      • Unicorn-44952.exe (PID: 9556)
      • Unicorn-14893.exe (PID: 9852)
      • Unicorn-45912.exe (PID: 9736)
      • Unicorn-12899.exe (PID: 2772)
      • Unicorn-46354.exe (PID: 3300)
      • Unicorn-45004.exe (PID: 8624)
      • Unicorn-42944.exe (PID: 9928)
      • Unicorn-58911.exe (PID: 9768)
      • Unicorn-44843.exe (PID: 9972)
      • Unicorn-3618.exe (PID: 9996)
      • Unicorn-21377.exe (PID: 7568)
      • Unicorn-11594.exe (PID: 10016)
      • Unicorn-32612.exe (PID: 10100)
      • Unicorn-1593.exe (PID: 10116)
      • Unicorn-6379.exe (PID: 9908)
      • Unicorn-15123.exe (PID: 10048)
      • Unicorn-60795.exe (PID: 10040)
      • Unicorn-38542.exe (PID: 10108)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 6800)
      • BackgroundTransferHost.exe (PID: 1760)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 6800)

    • Create files in a temporary directory

      • Unicorn-963.exe (PID: 7204)
      • 1 (1285).exe (PID: 7152)
      • Unicorn-33037.exe (PID: 8188)
      • Unicorn-36458.exe (PID: 7856)
      • Unicorn-50268.exe (PID: 8128)
      • Unicorn-64492.exe (PID: 7864)
      • Unicorn-49967.exe (PID: 7412)
      • Unicorn-57315.exe (PID: 7464)
      • Unicorn-53688.exe (PID: 6808)
      • Unicorn-65120.exe (PID: 5964)
      • Unicorn-17102.exe (PID: 7664)
      • Unicorn-38570.exe (PID: 2040)
      • Unicorn-12463.exe (PID: 7384)
      • Unicorn-19302.exe (PID: 8160)
      • Unicorn-55534.exe (PID: 7788)
      • Unicorn-15535.exe (PID: 8016)
      • Unicorn-43252.exe (PID: 8152)
      • Unicorn-57912.exe (PID: 7988)
      • Unicorn-53126.exe (PID: 6132)
      • Unicorn-34176.exe (PID: 7720)
      • Unicorn-21658.exe (PID: 7908)
      • Unicorn-52183.exe (PID: 5024)
      • Unicorn-27788.exe (PID: 8004)
      • Unicorn-64736.exe (PID: 8068)
      • Unicorn-3283.exe (PID: 8060)
      • Unicorn-3195.exe (PID: 2284)
      • Unicorn-11363.exe (PID: 7084)
      • Unicorn-14678.exe (PID: 6272)
      • Unicorn-3195.exe (PID: 6112)
      • Unicorn-24450.exe (PID: 6392)
      • Unicorn-18577.exe (PID: 5892)
      • Unicorn-44051.exe (PID: 6516)
      • Unicorn-27243.exe (PID: 4896)
      • Unicorn-50350.exe (PID: 4620)
      • Unicorn-49635.exe (PID: 7572)
      • Unicorn-32360.exe (PID: 7372)
      • Unicorn-53589.exe (PID: 7952)
      • Unicorn-36444.exe (PID: 616)
      • Unicorn-29428.exe (PID: 7848)
      • Unicorn-1887.exe (PID: 7940)
      • Unicorn-8742.exe (PID: 5384)
      • Unicorn-13262.exe (PID: 2092)
      • Unicorn-50896.exe (PID: 7356)
      • Unicorn-26932.exe (PID: 5072)
      • Unicorn-58016.exe (PID: 7828)
      • Unicorn-62271.exe (PID: 5260)
      • Unicorn-40336.exe (PID: 4784)
      • Unicorn-56672.exe (PID: 5164)
      • Unicorn-52588.exe (PID: 6740)
      • Unicorn-20994.exe (PID: 8428)
      • Unicorn-47876.exe (PID: 8352)
      • Unicorn-51960.exe (PID: 8316)
      • Unicorn-24362.exe (PID: 6640)
      • Unicorn-21377.exe (PID: 7568)
      • Unicorn-46354.exe (PID: 3300)
      • Unicorn-12520.exe (PID: 6068)
      • Unicorn-25330.exe (PID: 8600)
      • Unicorn-45004.exe (PID: 8624)
      • Unicorn-49088.exe (PID: 8616)
      • Unicorn-43911.exe (PID: 2552)
      • Unicorn-42072.exe (PID: 8788)
      • Unicorn-39634.exe (PID: 7836)
      • Unicorn-42072.exe (PID: 8796)
      • Unicorn-6459.exe (PID: 5772)
      • Unicorn-25087.exe (PID: 8956)
      • Unicorn-24457.exe (PID: 9036)
      • Unicorn-24457.exe (PID: 9028)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 6800)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 6800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (90.6)
.exe | Win32 Executable (generic) (4.9)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:01:19 13:34:56+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 176128
InitializedDataSize: 299008
UninitializedDataSize: -
EntryPoint: 0x13d4
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
CompanyName: UEFI
ProductName: Kawaii-Unicorn
FileVersion: 1
ProductVersion: 1
InternalName: Kawaii-Unicorn
OriginalFileName: Kawaii-Unicorn.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
441
Monitored processes
306
Malicious processes
42
Suspicious processes
46

Behavior graph

Click at the process to see the details
start 1 (1285).exe unicorn-963.exe sppextcomobj.exe no specs slui.exe no specs unicorn-36458.exe unicorn-64492.exe backgroundtransferhost.exe no specs unicorn-50268.exe unicorn-43252.exe unicorn-19302.exe unicorn-33037.exe backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs unicorn-53688.exe unicorn-17102.exe unicorn-12463.exe unicorn-12463.exe unicorn-49967.exe unicorn-4295.exe unicorn-55534.exe unicorn-57315.exe backgroundtransferhost.exe no specs unicorn-52401.exe unicorn-43911.exe unicorn-65120.exe unicorn-38570.exe unicorn-27788.exe unicorn-15535.exe unicorn-11451.exe unicorn-48955.exe unicorn-3283.exe unicorn-64736.exe unicorn-58192.exe unicorn-12520.exe unicorn-46354.exe unicorn-24450.exe unicorn-35385.exe unicorn-44051.exe unicorn-57912.exe unicorn-53589.exe unicorn-1887.exe unicorn-53126.exe unicorn-50896.exe unicorn-22478.exe unicorn-34176.exe unicorn-21658.exe unicorn-26932.exe unicorn-52183.exe unicorn-56672.exe unicorn-52588.exe unicorn-40336.exe unicorn-36252.exe unicorn-36252.exe unicorn-57035.exe unicorn-11363.exe unicorn-11363.exe unicorn-3195.exe unicorn-3195.exe unicorn-44783.exe unicorn-11363.exe unicorn-3195.exe unicorn-50350.exe unicorn-24362.exe unicorn-20278.exe unicorn-14678.exe unicorn-27243.exe unicorn-18577.exe unicorn-24362.exe unicorn-38098.exe unicorn-21377.exe unicorn-37020.exe unicorn-49635.exe unicorn-32360.exe unicorn-5809.exe unicorn-36444.exe unicorn-29428.exe unicorn-54679.exe unicorn-8742.exe unicorn-12899.exe unicorn-12899.exe unicorn-38150.exe unicorn-58016.exe unicorn-39634.exe unicorn-45764.exe unicorn-13262.exe unicorn-16029.exe unicorn-32936.exe unicorn-20684.exe unicorn-62271.exe unicorn-63754.exe unicorn-6459.exe unicorn-47492.exe unicorn-64191.exe unicorn-39686.exe unicorn-51960.exe unicorn-47876.exe unicorn-6651.exe unicorn-45499.exe unicorn-45499.exe unicorn-20994.exe unicorn-53556.exe unicorn-25330.exe unicorn-49088.exe unicorn-45004.exe unicorn-12331.exe unicorn-8247.exe unicorn-42264.exe unicorn-17760.exe unicorn-51179.exe unicorn-56746.exe unicorn-50240.exe unicorn-42072.exe unicorn-42072.exe unicorn-42072.exe unicorn-42072.exe unicorn-55071.exe unicorn-9399.exe unicorn-45732.exe unicorn-50048.exe unicorn-17930.exe unicorn-25087.exe unicorn-19221.exe unicorn-26696.exe unicorn-30323.exe unicorn-30323.exe unicorn-24457.exe unicorn-24457.exe unicorn-37986.exe unicorn-43586.exe unicorn-41886.exe unicorn-18698.exe unicorn-52662.exe unicorn-60136.exe unicorn-1615.exe unicorn-47884.exe unicorn-7043.exe unicorn-49730.exe unicorn-15574.exe unicorn-64775.exe unicorn-59487.exe unicorn-22804.exe unicorn-20064.exe unicorn-57567.exe unicorn-57567.exe unicorn-40846.exe unicorn-44568.exe unicorn-56436.exe unicorn-12066.exe unicorn-62750.exe unicorn-48658.exe unicorn-57588.exe unicorn-41252.exe unicorn-12663.exe no specs unicorn-8579.exe no specs unicorn-32892.exe unicorn-49975.exe unicorn-4303.exe unicorn-41422.exe unicorn-44952.exe unicorn-28616.exe unicorn-28616.exe unicorn-10233.exe unicorn-4666.exe unicorn-44760.exe unicorn-24340.exe unicorn-15906.exe unicorn-45912.exe unicorn-39367.exe unicorn-53311.exe unicorn-58911.exe unicorn-50743.exe unicorn-3025.exe unicorn-57515.exe unicorn-14893.exe unicorn-6379.exe unicorn-42944.exe unicorn-44843.exe unicorn-3618.exe unicorn-11594.exe unicorn-60795.exe unicorn-15123.exe unicorn-32612.exe unicorn-38542.exe unicorn-1593.exe unicorn-28912.exe no specs unicorn-22450.exe no specs unicorn-2030.exe no specs unicorn-51231.exe no specs unicorn-42124.exe no specs unicorn-56606.exe no specs unicorn-56606.exe no specs unicorn-58652.exe no specs unicorn-39886.exe no specs unicorn-10603.exe no specs unicorn-47168.exe no specs unicorn-22472.exe no specs unicorn-14666.exe no specs unicorn-17493.exe no specs unicorn-7650.exe no specs unicorn-3566.exe no specs unicorn-44599.exe no specs unicorn-36046.exe no specs unicorn-64827.exe no specs unicorn-41422.exe no specs unicorn-31770.exe no specs unicorn-39119.exe no specs unicorn-7266.exe no specs unicorn-56467.exe no specs unicorn-56467.exe no specs unicorn-56467.exe no specs unicorn-52383.exe no specs unicorn-50934.exe no specs unicorn-37198.exe no specs unicorn-2629.exe no specs unicorn-4526.exe no specs unicorn-24392.exe no specs unicorn-6009.exe no specs unicorn-60386.exe no specs unicorn-40079.exe no specs unicorn-49259.exe no specs unicorn-24361.exe no specs unicorn-12606.exe no specs unicorn-4471.exe no specs unicorn-3941.exe no specs unicorn-12606.exe no specs unicorn-64110.exe no specs unicorn-12871.exe no specs unicorn-40690.exe no specs unicorn-28751.exe no specs unicorn-60026.exe no specs unicorn-58159.exe no specs unicorn-16934.exe no specs unicorn-8766.exe no specs unicorn-57967.exe no specs unicorn-12030.exe no specs unicorn-12295.exe no specs unicorn-57412.exe no specs unicorn-40182.exe no specs unicorn-23845.exe no specs unicorn-12877.exe no specs unicorn-9363.exe no specs unicorn-21978.exe no specs unicorn-13255.exe no specs unicorn-17702.exe no specs unicorn-23269.exe no specs unicorn-29400.exe no specs unicorn-23269.exe no specs unicorn-56134.exe no specs unicorn-58180.exe no specs unicorn-2710.exe no specs unicorn-22576.exe no specs unicorn-43742.exe no specs unicorn-24421.exe no specs unicorn-18034.exe no specs unicorn-51164.exe no specs unicorn-55611.exe no specs unicorn-50011.exe no specs unicorn-55611.exe no specs unicorn-5663.exe no specs unicorn-5663.exe no specs unicorn-58948.exe no specs unicorn-54864.exe no specs unicorn-43764.exe no specs unicorn-29465.exe no specs unicorn-15730.exe no specs unicorn-25381.exe no specs unicorn-11646.exe no specs unicorn-31512.exe no specs unicorn-52679.exe no specs unicorn-23706.exe no specs unicorn-23706.exe no specs unicorn-31055.exe no specs unicorn-2731.exe no specs unicorn-64184.exe no specs unicorn-49886.exe no specs unicorn-56016.exe no specs unicorn-32066.exe no specs unicorn-31128.exe no specs unicorn-9945.exe no specs unicorn-64547.exe no specs unicorn-35766.exe no specs unicorn-42486.exe no specs unicorn-63098.exe no specs unicorn-60795.exe no specs unicorn-52660.exe no specs unicorn-54930.exe no specs unicorn-2737.exe no specs unicorn-35715.exe no specs unicorn-15367.exe no specs unicorn-36748.exe no specs unicorn-41600.exe no specs unicorn-34370.exe no specs unicorn-5398.exe no specs unicorn-16201.exe no specs unicorn-53150.exe no specs unicorn-38476.exe no specs unicorn-61126.exe no specs unicorn-40322.exe no specs unicorn-26586.exe no specs unicorn-62980.exe no specs unicorn-29924.exe no specs unicorn-54620.exe no specs unicorn-2643.exe no specs unicorn-39208.exe no specs unicorn-14703.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516C:\Users\admin\AppData\Local\Temp\Unicorn-57035.exeC:\Users\admin\AppData\Local\Temp\Unicorn-57035.exe
Unicorn-12463.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-57035.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
616C:\Users\admin\AppData\Local\Temp\Unicorn-36444.exeC:\Users\admin\AppData\Local\Temp\Unicorn-36444.exe
Unicorn-1887.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-36444.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
672C:\Users\admin\AppData\Local\Temp\Unicorn-44783.exeC:\Users\admin\AppData\Local\Temp\Unicorn-44783.exe
Unicorn-49967.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-44783.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
680C:\Users\admin\AppData\Local\Temp\Unicorn-3195.exeC:\Users\admin\AppData\Local\Temp\Unicorn-3195.exe
Unicorn-46354.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-3195.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1012C:\Users\admin\AppData\Local\Temp\Unicorn-63754.exeC:\Users\admin\AppData\Local\Temp\Unicorn-63754.exe
Unicorn-12463.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-63754.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1056C:\Users\admin\AppData\Local\Temp\Unicorn-20684.exeC:\Users\admin\AppData\Local\Temp\Unicorn-20684.exe
Unicorn-52183.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-20684.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1300C:\Users\admin\AppData\Local\Temp\Unicorn-49730.exeC:\Users\admin\AppData\Local\Temp\Unicorn-49730.exe
Unicorn-52401.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-49730.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1312C:\Users\admin\AppData\Local\Temp\Unicorn-11363.exeC:\Users\admin\AppData\Local\Temp\Unicorn-11363.exe
Unicorn-12520.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-11363.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1748C:\Users\admin\AppData\Local\Temp\Unicorn-51231.exeC:\Users\admin\AppData\Local\Temp\Unicorn-51231.exe—Unicorn-36252.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-51231.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1760"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
8 008
Read events
7 993
Write events
15
Delete events
0

Modification events

(PID) Process:(6800) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6800) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6800) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7952) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7952) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7952) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4896) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4896) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4896) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1760) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
984
Suspicious files
5
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6800BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ddbbcdee-f433-40c1-9757-afc65fd07e65.down_data —
MD5:—
SHA256:—
71521 (1285).exeC:\Users\admin\AppData\Local\Temp\Unicorn-33037.exeexecutable
MD5:505689FAD770556BEA9CBD472EEC1EC6
SHA256:7414D9E4E3FA8B50B618F3859A0F5704DAD1F4374A9AB3CF30EB89384E2E4A80
8188Unicorn-33037.exeC:\Users\admin\AppData\Local\Temp\Unicorn-4295.exeexecutable
MD5:E180D1E96E54123AC9027524039A74EE
SHA256:C7C903908CDB6CF2347B764D43895A18B435113E8620C261D086C25C7E3FA9C9
7864Unicorn-64492.exeC:\Users\admin\AppData\Local\Temp\Unicorn-50268.exeexecutable
MD5:EFBB320AE9E7182C5852A7FD6280BA52
SHA256:E6D65F692D782D58F6D812854078287FE82CEE0C56D767377E451D681B24D4CD
6800BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4872BABAF39AA62B8D32695EBB7E9173
SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999
7204Unicorn-963.exeC:\Users\admin\AppData\Local\Temp\Unicorn-64492.exeexecutable
MD5:954232A98D28276B39B0F784600748B3
SHA256:215714C37A0F05A462422EF2E9F7A928608DCC4FD84D26727F041D6BCE5269E8
7864Unicorn-64492.exeC:\Users\admin\AppData\Local\Temp\Unicorn-17102.exeexecutable
MD5:BED60754293DA8688251F6DF83636D73
SHA256:9A19B869C1E779A33EBE8A4F424FFB4BD8972687A0D5F9A3D8DC2D17A8AA1CF3
8128Unicorn-50268.exeC:\Users\admin\AppData\Local\Temp\Unicorn-53688.exeexecutable
MD5:CAE99B0F0FC5DEC5D9CE2D1D0925070C
SHA256:732A83316DC5FB64A3FB11F0059F45BF05E527642F627F73473A1E9A417FD874
7204Unicorn-963.exeC:\Users\admin\AppData\Local\Temp\Unicorn-19302.exeexecutable
MD5:F5D4920B3E3523EDDAF403EC72A7E2CA
SHA256:D9BD6393E39E750BAE7F20FD5F3B92CC7316DB74CC5A6284AA6FE519F3FF42BD
71521 (1285).exeC:\Users\admin\AppData\Local\Temp\Unicorn-963.exeexecutable
MD5:1A7B87324FDAF07A1B1B7878CD6F059F
SHA256:0A0449DE25CEE1473CA16F4F94044C882326D2A181999FAC614F4B2762FC52A4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6800
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
8360
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6632
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
8360
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.159:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.159:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6708
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
20.190.159.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
6632
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.159
  • 23.48.23.194
  • 23.48.23.164
  • 23.48.23.167
  • 23.48.23.166
  • 23.48.23.156
  • 23.48.23.173
  • 23.48.23.169
  • 23.48.23.145
whitelisted
client.wns.windows.com
  • 20.198.162.78
whitelisted
login.live.com
  • 20.190.159.128
  • 20.190.159.23
  • 20.190.159.2
  • 40.126.31.69
  • 40.126.31.130
  • 40.126.31.2
  • 20.190.159.73
  • 40.126.31.128
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 104.126.37.146
  • 104.126.37.139
  • 104.126.37.144
  • 104.126.37.131
  • 104.126.37.153
  • 104.126.37.129
  • 104.126.37.155
  • 104.126.37.138
  • 104.126.37.154
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (1285)