| File name: | 1 (43) |
| Full analysis: | https://app.any.run/tasks/c541cbd6-698c-40ae-8e16-a0af228b756f |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 22:44:30 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | 0F9AC8E68945C6C17FE471C48EDE1FA0 |
| SHA1: | 148317D00CFED2D445F04B58DD0412A9B5CED536 |
| SHA256: | 642B1BE3680BE92923EEF6B4BE796B29EE6FB9EDA9AA487C6A7ECBCF04B0874E |
| SSDEEP: | 6144:o71TngqPQDmeA5CKs5eZ3vjxkwzq5P8GBf/WymOdEk/8SwjwpyAvEh51Fut6s1Ya:oZ7VXeA5fs4Rz0EafOymOd+x4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- 1 (43).exe (PID: 7268)
- Unicorn-64815.exe (PID: 7364)
- Unicorn-14628.exe (PID: 7968)
- Unicorn-21405.exe (PID: 7976)
- Unicorn-49221.exe (PID: 496)
- Unicorn-30838.exe (PID: 5072)
- Unicorn-36969.exe (PID: 2136)
- Unicorn-21187.exe (PID: 7148)
- Unicorn-61198.exe (PID: 7796)
- Unicorn-58505.exe (PID: 7808)
- Unicorn-23594.exe (PID: 7800)
- Unicorn-37893.exe (PID: 7776)
- Unicorn-25376.exe (PID: 7884)
- Unicorn-44115.exe (PID: 7896)
- Unicorn-45822.exe (PID: 8096)
- Unicorn-26793.exe (PID: 8176)
- Unicorn-2843.exe (PID: 8184)
- Unicorn-23285.exe (PID: 300)
- Unicorn-4902.exe (PID: 7052)
- Unicorn-24249.exe (PID: 7820)
- Unicorn-60041.exe (PID: 6708)
- Unicorn-20881.exe (PID: 7200)
- Unicorn-55857.exe (PID: 8080)
- Unicorn-21147.exe (PID: 7196)
- Unicorn-61987.exe (PID: 8160)
- Unicorn-39429.exe (PID: 5868)
- Unicorn-58650.exe (PID: 7180)
- Unicorn-29891.exe (PID: 8136)
- Unicorn-42335.exe (PID: 8140)
- Unicorn-24415.exe (PID: 8048)
- Unicorn-42911.exe (PID: 6516)
- Unicorn-53117.exe (PID: 5156)
- Unicorn-40581.exe (PID: 5164)
- Unicorn-3227.exe (PID: 8132)
- Unicorn-16631.exe (PID: 1512)
- Unicorn-61001.exe (PID: 6644)
- Unicorn-41327.exe (PID: 6700)
- Unicorn-56917.exe (PID: 4120)
- Unicorn-53057.exe (PID: 7264)
- Unicorn-13938.exe (PID: 5892)
- Unicorn-47379.exe (PID: 6324)
- Unicorn-55355.exe (PID: 4400)
- Unicorn-24058.exe (PID: 1180)
- Unicorn-57493.exe (PID: 6540)
- Unicorn-27751.exe (PID: 6240)
- Unicorn-51826.exe (PID: 4336)
- Unicorn-28448.exe (PID: 2236)
- Unicorn-8027.exe (PID: 2692)
- Unicorn-34642.exe (PID: 8056)
- Unicorn-49880.exe (PID: 3240)
- Unicorn-8847.exe (PID: 7156)
- Unicorn-60518.exe (PID: 7380)
- Unicorn-59392.exe (PID: 7544)
- Unicorn-21889.exe (PID: 7356)
- Unicorn-24389.exe (PID: 7736)
- Unicorn-56678.exe (PID: 1240)
- Unicorn-53601.exe (PID: 1012)
- Unicorn-39595.exe (PID: 2552)
- Unicorn-43195.exe (PID: 1804)
- Unicorn-38779.exe (PID: 7596)
- Unicorn-18909.exe (PID: 6576)
- Unicorn-5744.exe (PID: 660)
- Unicorn-29481.exe (PID: 5436)
- Unicorn-18961.exe (PID: 6640)
- Unicorn-45817.exe (PID: 5116)
- Unicorn-36449.exe (PID: 5400)
- Unicorn-63331.exe (PID: 8044)
- Unicorn-61385.exe (PID: 2108)
- Unicorn-47087.exe (PID: 6964)
- Unicorn-17704.exe (PID: 7600)
- Unicorn-3222.exe (PID: 7536)
- Unicorn-22172.exe (PID: 6392)
- Unicorn-65251.exe (PID: 1132)
- Unicorn-53554.exe (PID: 2908)
- Unicorn-42785.exe (PID: 7752)
- Unicorn-42671.exe (PID: 208)
- Unicorn-52184.exe (PID: 6712)
- Unicorn-35293.exe (PID: 7620)
- Unicorn-48339.exe (PID: 4944)
- Unicorn-20457.exe (PID: 8744)
- Unicorn-25916.exe (PID: 8780)
- Unicorn-41431.exe (PID: 8808)
- Unicorn-3030.exe (PID: 7340)
- Unicorn-21443.exe (PID: 8500)
- Unicorn-10767.exe (PID: 7912)
- Unicorn-29040.exe (PID: 8480)
- Unicorn-58989.exe (PID: 7948)
- Unicorn-11520.exe (PID: 8420)
- Unicorn-53191.exe (PID: 7920)
- Unicorn-11612.exe (PID: 8720)
- Unicorn-39569.exe (PID: 8272)
- Unicorn-60181.exe (PID: 8204)
- Unicorn-50507.exe (PID: 8664)
- Unicorn-18381.exe (PID: 8016)
- Unicorn-24603.exe (PID: 7668)
- Unicorn-63781.exe (PID: 6668)
- Unicorn-16051.exe (PID: 7804)
- Unicorn-54499.exe (PID: 8392)
- Unicorn-37623.exe (PID: 4112)
- Unicorn-33263.exe (PID: 8864)
- Unicorn-64613.exe (PID: 8440)
- Unicorn-382.exe (PID: 7512)
- Unicorn-63143.exe (PID: 8584)
- Unicorn-44338.exe (PID: 9152)
- Unicorn-16440.exe (PID: 8220)
- Unicorn-55167.exe (PID: 8832)
- Unicorn-26990.exe (PID: 9188)
- Unicorn-58775.exe (PID: 8608)
- Unicorn-58073.exe (PID: 9160)
- Unicorn-10026.exe (PID: 6228)
- Unicorn-60290.exe (PID: 9040)
- Unicorn-44385.exe (PID: 8692)
- Unicorn-8488.exe (PID: 9056)
- Unicorn-32709.exe (PID: 8712)
- Unicorn-24519.exe (PID: 8684)
- Unicorn-64052.exe (PID: 7932)
- Unicorn-63497.exe (PID: 7504)
- Unicorn-56804.exe (PID: 9896)
- Unicorn-58702.exe (PID: 9916)
- Unicorn-53102.exe (PID: 9924)
- Unicorn-55137.exe (PID: 8104)
- Unicorn-16435.exe (PID: 7660)
- Unicorn-55525.exe (PID: 9636)
- Unicorn-7384.exe (PID: 10064)
- Unicorn-34655.exe (PID: 8932)
- Unicorn-35205.exe (PID: 9724)
- Unicorn-11281.exe (PID: 6476)
- Unicorn-10959.exe (PID: 7568)
- Unicorn-25627.exe (PID: 9992)
- Unicorn-15797.exe (PID: 8640)
- Unicorn-34437.exe (PID: 9424)
- Unicorn-58173.exe (PID: 9248)
- Unicorn-61032.exe (PID: 8816)
- Unicorn-63414.exe (PID: 8672)
- Unicorn-18105.exe (PID: 8488)
- Unicorn-16464.exe (PID: 11084)
- Unicorn-45628.exe (PID: 11128)
- Unicorn-50607.exe (PID: 8632)
- Unicorn-14353.exe (PID: 9048)
- Unicorn-42247.exe (PID: 8428)
- Unicorn-49691.exe (PID: 11056)
- Unicorn-25069.exe (PID: 9376)
- Unicorn-55307.exe (PID: 10492)
- Unicorn-26679.exe (PID: 9104)
- Unicorn-60404.exe (PID: 10004)
- Unicorn-22159.exe (PID: 10212)
- Unicorn-12838.exe (PID: 9700)
- Unicorn-8873.exe (PID: 9856)
- Unicorn-6299.exe (PID: 7688)
- Unicorn-52885.exe (PID: 10228)
- Unicorn-12983.exe (PID: 10344)
- Unicorn-55307.exe (PID: 10500)
- Unicorn-11058.exe (PID: 10804)
- Unicorn-2433.exe (PID: 10824)
- Unicorn-48316.exe (PID: 12648)
- Unicorn-61172.exe (PID: 10408)
- Unicorn-49520.exe (PID: 11260)
- Unicorn-19627.exe (PID: 12692)
- Unicorn-55167.exe (PID: 8840)
- Unicorn-48871.exe (PID: 12720)
- Unicorn-61172.exe (PID: 10416)
- Unicorn-41252.exe (PID: 11012)
- Unicorn-19881.exe (PID: 8616)
- Unicorn-38993.exe (PID: 7644)
- Unicorn-54016.exe (PID: 10368)
- Unicorn-43198.exe (PID: 10944)
- Unicorn-11207.exe (PID: 12048)
- Unicorn-29060.exe (PID: 11244)
- Unicorn-11390.exe (PID: 7748)
- Unicorn-38547.exe (PID: 8572)
- Unicorn-49447.exe (PID: 11164)
- Unicorn-45869.exe (PID: 10796)
- Unicorn-52507.exe (PID: 10400)
- Unicorn-58793.exe (PID: 12508)
- Unicorn-41902.exe (PID: 12952)
- Unicorn-35013.exe (PID: 9648)
- Unicorn-11058.exe (PID: 10812)
- Unicorn-44769.exe (PID: 8968)
- Unicorn-40109.exe (PID: 8880)
- Unicorn-5630.exe (PID: 10316)
- Unicorn-61865.exe (PID: 14512)
- Unicorn-65394.exe (PID: 14488)
- Unicorn-6764.exe (PID: 14536)
- Unicorn-51337.exe (PID: 7740)
- Unicorn-43783.exe (PID: 9176)
- Unicorn-51850.exe (PID: 11192)
- Unicorn-50365.exe (PID: 15824)
- Unicorn-55307.exe (PID: 10484)
- Unicorn-4163.exe (PID: 15816)
- Unicorn-55965.exe (PID: 15808)
- Unicorn-47545.exe (PID: 1616)
Executable content was dropped or overwritten
- 1 (43).exe (PID: 7268)
- Unicorn-64815.exe (PID: 7364)
- Unicorn-14628.exe (PID: 7968)
- Unicorn-21405.exe (PID: 7976)
- Unicorn-21187.exe (PID: 7148)
- Unicorn-36969.exe (PID: 2136)
- Unicorn-58505.exe (PID: 7808)
- Unicorn-49221.exe (PID: 496)
- Unicorn-61198.exe (PID: 7796)
- Unicorn-23594.exe (PID: 7800)
- Unicorn-37893.exe (PID: 7776)
- Unicorn-30838.exe (PID: 5072)
- Unicorn-24249.exe (PID: 7820)
- Unicorn-44115.exe (PID: 7896)
- Unicorn-45822.exe (PID: 8096)
- Unicorn-26793.exe (PID: 8176)
- Unicorn-2843.exe (PID: 8184)
- Unicorn-23285.exe (PID: 300)
- Unicorn-4902.exe (PID: 7052)
- Unicorn-60041.exe (PID: 6708)
- Unicorn-20881.exe (PID: 7200)
- Unicorn-55857.exe (PID: 8080)
- Unicorn-3227.exe (PID: 8132)
- Unicorn-21147.exe (PID: 7196)
- Unicorn-39429.exe (PID: 5868)
- Unicorn-25376.exe (PID: 7884)
- Unicorn-53057.exe (PID: 7264)
- Unicorn-29891.exe (PID: 8136)
- Unicorn-42335.exe (PID: 8140)
- Unicorn-42911.exe (PID: 6516)
- Unicorn-53117.exe (PID: 5156)
- Unicorn-40581.exe (PID: 5164)
- Unicorn-16631.exe (PID: 1512)
- Unicorn-61001.exe (PID: 6644)
- Unicorn-41327.exe (PID: 6700)
- Unicorn-63331.exe (PID: 8044)
- Unicorn-56917.exe (PID: 4120)
- Unicorn-13938.exe (PID: 5892)
- Unicorn-47379.exe (PID: 6324)
- Unicorn-55355.exe (PID: 4400)
- Unicorn-24058.exe (PID: 1180)
- Unicorn-57493.exe (PID: 6540)
- Unicorn-27751.exe (PID: 6240)
- Unicorn-51826.exe (PID: 4336)
- Unicorn-28448.exe (PID: 2236)
- Unicorn-8027.exe (PID: 2692)
- Unicorn-34642.exe (PID: 8056)
- Unicorn-49880.exe (PID: 3240)
- Unicorn-61987.exe (PID: 8160)
- Unicorn-8847.exe (PID: 7156)
- Unicorn-60518.exe (PID: 7380)
- Unicorn-21889.exe (PID: 7356)
- Unicorn-59392.exe (PID: 7544)
- Unicorn-24389.exe (PID: 7736)
- Unicorn-53601.exe (PID: 1012)
- Unicorn-43195.exe (PID: 1804)
- Unicorn-39595.exe (PID: 2552)
- Unicorn-56678.exe (PID: 1240)
- Unicorn-18909.exe (PID: 6576)
- Unicorn-5744.exe (PID: 660)
- Unicorn-29481.exe (PID: 5436)
- Unicorn-18961.exe (PID: 6640)
- Unicorn-24415.exe (PID: 8048)
- Unicorn-38779.exe (PID: 7596)
- Unicorn-45817.exe (PID: 5116)
- Unicorn-36449.exe (PID: 5400)
- Unicorn-58650.exe (PID: 7180)
- Unicorn-42671.exe (PID: 208)
- Unicorn-47087.exe (PID: 6964)
- Unicorn-17704.exe (PID: 7600)
- Unicorn-3222.exe (PID: 7536)
- Unicorn-22172.exe (PID: 6392)
- Unicorn-65251.exe (PID: 1132)
- Unicorn-53554.exe (PID: 2908)
- Unicorn-3030.exe (PID: 7340)
- Unicorn-52184.exe (PID: 6712)
- Unicorn-35293.exe (PID: 7620)
- Unicorn-48339.exe (PID: 4944)
- Unicorn-20457.exe (PID: 8744)
- Unicorn-25916.exe (PID: 8780)
- Unicorn-41431.exe (PID: 8808)
- Unicorn-29040.exe (PID: 8480)
- Unicorn-21443.exe (PID: 8500)
- Unicorn-10767.exe (PID: 7912)
- Unicorn-58989.exe (PID: 7948)
- Unicorn-11520.exe (PID: 8420)
- Unicorn-53191.exe (PID: 7920)
- Unicorn-11612.exe (PID: 8720)
- Unicorn-39569.exe (PID: 8272)
- Unicorn-63781.exe (PID: 6668)
- Unicorn-50507.exe (PID: 8664)
- Unicorn-60181.exe (PID: 8204)
- Unicorn-18381.exe (PID: 8016)
- Unicorn-24603.exe (PID: 7668)
- Unicorn-55167.exe (PID: 8840)
- Unicorn-54499.exe (PID: 8392)
- Unicorn-10026.exe (PID: 6228)
- Unicorn-16051.exe (PID: 7804)
- Unicorn-11390.exe (PID: 7748)
- Unicorn-37623.exe (PID: 4112)
- Unicorn-50607.exe (PID: 8632)
- Unicorn-63497.exe (PID: 7504)
- Unicorn-33263.exe (PID: 8864)
- Unicorn-63143.exe (PID: 8584)
- Unicorn-44338.exe (PID: 9152)
- Unicorn-382.exe (PID: 7512)
- Unicorn-55167.exe (PID: 8832)
- Unicorn-26990.exe (PID: 9188)
- Unicorn-44769.exe (PID: 8968)
- Unicorn-16440.exe (PID: 8220)
- Unicorn-58073.exe (PID: 9160)
- Unicorn-60290.exe (PID: 9040)
- Unicorn-58775.exe (PID: 8608)
- Unicorn-44385.exe (PID: 8692)
- Unicorn-64052.exe (PID: 7932)
- Unicorn-8488.exe (PID: 9056)
- Unicorn-32709.exe (PID: 8712)
- Unicorn-24519.exe (PID: 8684)
- Unicorn-56804.exe (PID: 9896)
- Unicorn-58702.exe (PID: 9916)
- Unicorn-55137.exe (PID: 8104)
- Unicorn-16435.exe (PID: 7660)
- Unicorn-55525.exe (PID: 9636)
- Unicorn-7384.exe (PID: 10064)
- Unicorn-34655.exe (PID: 8932)
- Unicorn-35205.exe (PID: 9724)
- Unicorn-11281.exe (PID: 6476)
- Unicorn-10959.exe (PID: 7568)
- Unicorn-61385.exe (PID: 2108)
- Unicorn-15797.exe (PID: 8640)
- Unicorn-58173.exe (PID: 9248)
- Unicorn-34437.exe (PID: 9424)
- Unicorn-61032.exe (PID: 8816)
- Unicorn-25627.exe (PID: 9992)
- Unicorn-18105.exe (PID: 8488)
- Unicorn-63414.exe (PID: 8672)
- Unicorn-49691.exe (PID: 11056)
- Unicorn-16464.exe (PID: 11084)
- Unicorn-42785.exe (PID: 7752)
- Unicorn-45628.exe (PID: 11128)
- Unicorn-42247.exe (PID: 8428)
- Unicorn-14353.exe (PID: 9048)
- Unicorn-26679.exe (PID: 9104)
- Unicorn-12838.exe (PID: 9700)
- Unicorn-55307.exe (PID: 10492)
- Unicorn-8873.exe (PID: 9856)
- Unicorn-22159.exe (PID: 10212)
- Unicorn-6299.exe (PID: 7688)
- Unicorn-52885.exe (PID: 10228)
- Unicorn-12983.exe (PID: 10344)
- Unicorn-55307.exe (PID: 10500)
- Unicorn-11058.exe (PID: 10804)
- Unicorn-2433.exe (PID: 10824)
- Unicorn-61172.exe (PID: 10408)
- Unicorn-48316.exe (PID: 12648)
- Unicorn-49520.exe (PID: 11260)
- Unicorn-19627.exe (PID: 12692)
- Unicorn-53102.exe (PID: 9924)
- Unicorn-48871.exe (PID: 12720)
- Unicorn-45869.exe (PID: 10796)
- Unicorn-19881.exe (PID: 8616)
- Unicorn-38993.exe (PID: 7644)
- Unicorn-54016.exe (PID: 10368)
- Unicorn-43198.exe (PID: 10944)
- Unicorn-29060.exe (PID: 11244)
- Unicorn-11207.exe (PID: 12048)
- Unicorn-51850.exe (PID: 11192)
- Unicorn-58793.exe (PID: 12508)
- Unicorn-38547.exe (PID: 8572)
- Unicorn-49447.exe (PID: 11164)
- Unicorn-52507.exe (PID: 10400)
- Unicorn-11058.exe (PID: 10812)
- Unicorn-35013.exe (PID: 9648)
- Unicorn-41902.exe (PID: 12952)
- Unicorn-40109.exe (PID: 8880)
- Unicorn-5630.exe (PID: 10316)
- Unicorn-51337.exe (PID: 7740)
- Unicorn-17542.exe (PID: 13716)
- Unicorn-43783.exe (PID: 9176)
- Unicorn-15918.exe (PID: 15032)
- Unicorn-47545.exe (PID: 1616)
- Unicorn-31190.exe (PID: 12276)
- Unicorn-18655.exe (PID: 9512)
- Unicorn-29986.exe (PID: 13472)
- Unicorn-49477.exe (PID: 11616)
- Unicorn-32107.exe (PID: 9288)
- Unicorn-10482.exe (PID: 10708)
- Unicorn-55307.exe (PID: 10484)
- Unicorn-41571.exe (PID: 10448)
- Unicorn-53487.exe (PID: 9620)
- Unicorn-64876.exe (PID: 12260)
- Unicorn-44643.exe (PID: 9476)
- Unicorn-18693.exe (PID: 11032)
- Unicorn-29653.exe (PID: 15020)
- Unicorn-36771.exe (PID: 8652)
- Unicorn-33350.exe (PID: 12552)
- Unicorn-6621.exe (PID: 8824)
- Unicorn-49447.exe (PID: 11156)
- Unicorn-65394.exe (PID: 14488)
- Unicorn-61865.exe (PID: 14512)
- Unicorn-6764.exe (PID: 14536)
- Unicorn-35269.exe (PID: 15208)
- Unicorn-7768.exe (PID: 10244)
- Unicorn-57178.exe (PID: 11796)
- Unicorn-2462.exe (PID: 15096)
- Unicorn-18101.exe (PID: 9440)
- Unicorn-3225.exe (PID: 12016)
- Unicorn-56398.exe (PID: 3332)
- Unicorn-760.exe (PID: 14588)
- Unicorn-64673.exe (PID: 14600)
- Unicorn-48399.exe (PID: 15200)
- Unicorn-16272.exe (PID: 8848)
- Unicorn-60380.exe (PID: 14996)
- Unicorn-26823.exe (PID: 9492)
- Unicorn-61172.exe (PID: 10416)
- Unicorn-48399.exe (PID: 15140)
- Unicorn-39190.exe (PID: 10600)
- Unicorn-16241.exe (PID: 14916)
- Unicorn-30722.exe (PID: 14976)
- Unicorn-60404.exe (PID: 10004)
- Unicorn-62134.exe (PID: 15252)
- Unicorn-29868.exe (PID: 12008)
- Unicorn-44120.exe (PID: 8700)
- Unicorn-58797.exe (PID: 13400)
- Unicorn-46483.exe (PID: 14876)
- Unicorn-64662.exe (PID: 13416)
- Unicorn-47776.exe (PID: 13764)
- Unicorn-10573.exe (PID: 15056)
- Unicorn-25460.exe (PID: 15988)
- Unicorn-40922.exe (PID: 13464)
- Unicorn-35397.exe (PID: 9656)
- Unicorn-55307.exe (PID: 10516)
- Unicorn-25069.exe (PID: 9376)
- Unicorn-14015.exe (PID: 14476)
- Unicorn-18336.exe (PID: 10956)
- Unicorn-50365.exe (PID: 15824)
- Unicorn-55965.exe (PID: 15808)
- Unicorn-42798.exe (PID: 15216)
- Unicorn-49137.exe (PID: 8736)
- Unicorn-30828.exe (PID: 12244)
- Unicorn-27019.exe (PID: 12588)
- Unicorn-11110.exe (PID: 9264)
- Unicorn-1546.exe (PID: 7940)
- Unicorn-2122.exe (PID: 10332)
- Unicorn-57161.exe (PID: 10548)
- Unicorn-25976.exe (PID: 11872)
- Unicorn-8055.exe (PID: 15980)
- Unicorn-53836.exe (PID: 13640)
- Unicorn-55791.exe (PID: 10584)
- Unicorn-47649.exe (PID: 9708)
- Unicorn-319.exe (PID: 7256)
- Unicorn-64662.exe (PID: 13408)
- Unicorn-54813.exe (PID: 13704)
- Unicorn-64613.exe (PID: 8440)
- Unicorn-24775.exe (PID: 16252)
- Unicorn-8177.exe (PID: 9820)
- Unicorn-2457.exe (PID: 924)
- Unicorn-64906.exe (PID: 13360)
- Unicorn-7192.exe (PID: 9804)
- Unicorn-59802.exe (PID: 10856)
- Unicorn-27922.exe (PID: 14968)
- Unicorn-48902.exe (PID: 13824)
- Unicorn-34066.exe (PID: 14668)
- Unicorn-41571.exe (PID: 10432)
- Unicorn-62213.exe (PID: 14580)
- Unicorn-53941.exe (PID: 12252)
Reads security settings of Internet Explorer
- ShellExperienceHost.exe (PID: 12812)
Executes application which crashes
- Unicorn-63414.exe (PID: 8672)
INFO
Checks supported languages
- 1 (43).exe (PID: 7268)
- Unicorn-14628.exe (PID: 7968)
- Unicorn-21405.exe (PID: 7976)
- Unicorn-64815.exe (PID: 7364)
- Unicorn-49221.exe (PID: 496)
- Unicorn-21187.exe (PID: 7148)
- Unicorn-30838.exe (PID: 5072)
- Unicorn-36969.exe (PID: 2136)
- Unicorn-58505.exe (PID: 7808)
- Unicorn-37893.exe (PID: 7776)
- Unicorn-23594.exe (PID: 7800)
- Unicorn-24249.exe (PID: 7820)
- Unicorn-25376.exe (PID: 7884)
- Unicorn-44115.exe (PID: 7896)
- Unicorn-61198.exe (PID: 7796)
- Unicorn-45822.exe (PID: 8096)
- Unicorn-26793.exe (PID: 8176)
- Unicorn-2843.exe (PID: 8184)
- Unicorn-23285.exe (PID: 300)
- Unicorn-4902.exe (PID: 7052)
- Unicorn-20881.exe (PID: 7200)
- Unicorn-60041.exe (PID: 6708)
- Unicorn-21147.exe (PID: 7196)
- Unicorn-39429.exe (PID: 5868)
- Unicorn-58650.exe (PID: 7180)
- Unicorn-53057.exe (PID: 7264)
- Unicorn-55857.exe (PID: 8080)
- Unicorn-3227.exe (PID: 8132)
- Unicorn-61987.exe (PID: 8160)
- Unicorn-42335.exe (PID: 8140)
- Unicorn-29891.exe (PID: 8136)
- Unicorn-34642.exe (PID: 8056)
- Unicorn-24415.exe (PID: 8048)
- Unicorn-63331.exe (PID: 8044)
- Unicorn-53117.exe (PID: 5156)
- Unicorn-42911.exe (PID: 6516)
- Unicorn-41327.exe (PID: 6700)
- Unicorn-40581.exe (PID: 5164)
- Unicorn-61001.exe (PID: 6644)
- Unicorn-16631.exe (PID: 1512)
- Unicorn-56917.exe (PID: 4120)
- Unicorn-13938.exe (PID: 5892)
- Unicorn-47379.exe (PID: 6324)
- Unicorn-49880.exe (PID: 3240)
- Unicorn-57493.exe (PID: 6540)
- Unicorn-43195.exe (PID: 1804)
- Unicorn-24058.exe (PID: 1180)
- Unicorn-8027.exe (PID: 2692)
- Unicorn-28448.exe (PID: 2236)
- Unicorn-8847.exe (PID: 7156)
- Unicorn-18961.exe (PID: 6640)
- Unicorn-61385.exe (PID: 2108)
- Unicorn-47087.exe (PID: 6964)
- Unicorn-27751.exe (PID: 6240)
- Unicorn-3030.exe (PID: 7340)
- Unicorn-51826.exe (PID: 4336)
- Unicorn-55355.exe (PID: 4400)
- Unicorn-36449.exe (PID: 5400)
- Unicorn-60518.exe (PID: 7380)
- Unicorn-21889.exe (PID: 7356)
- Unicorn-53601.exe (PID: 1012)
- Unicorn-59392.exe (PID: 7544)
- Unicorn-29481.exe (PID: 5436)
- Unicorn-39595.exe (PID: 2552)
- Unicorn-45817.exe (PID: 5116)
- Unicorn-56678.exe (PID: 1240)
- Unicorn-3222.exe (PID: 7536)
- Unicorn-18909.exe (PID: 6576)
- Unicorn-48339.exe (PID: 4944)
- Unicorn-24389.exe (PID: 7736)
- Unicorn-42671.exe (PID: 208)
- Unicorn-38779.exe (PID: 7596)
- Unicorn-17704.exe (PID: 7600)
- Unicorn-53554.exe (PID: 2908)
- Unicorn-65251.exe (PID: 1132)
- Unicorn-42785.exe (PID: 7752)
- Unicorn-5744.exe (PID: 660)
- Unicorn-22172.exe (PID: 6392)
- Unicorn-8437.exe (PID: 1532)
- Unicorn-16051.exe (PID: 7804)
- Unicorn-6299.exe (PID: 7688)
- Unicorn-11390.exe (PID: 7748)
- Unicorn-51337.exe (PID: 7740)
- Unicorn-63497.exe (PID: 7504)
- Unicorn-24603.exe (PID: 7668)
- Unicorn-16435.exe (PID: 7660)
- Unicorn-10767.exe (PID: 7912)
- Unicorn-53191.exe (PID: 7920)
- Unicorn-38993.exe (PID: 7644)
- Unicorn-10959.exe (PID: 7568)
- Unicorn-64052.exe (PID: 7932)
- Unicorn-50092.exe (PID: 7944)
- Unicorn-58989.exe (PID: 7948)
- Unicorn-35293.exe (PID: 7620)
- Unicorn-10026.exe (PID: 6228)
- Unicorn-46476.exe (PID: 3132)
- Unicorn-52184.exe (PID: 6712)
- Unicorn-382.exe (PID: 7512)
- Unicorn-47545.exe (PID: 1616)
- Unicorn-63781.exe (PID: 6668)
- Unicorn-18381.exe (PID: 8016)
- Unicorn-55137.exe (PID: 8104)
- Unicorn-37623.exe (PID: 4112)
- Unicorn-39569.exe (PID: 8272)
- Unicorn-54499.exe (PID: 8392)
- Unicorn-11520.exe (PID: 8420)
- Unicorn-42247.exe (PID: 8428)
- Unicorn-20457.exe (PID: 8744)
- Unicorn-25916.exe (PID: 8780)
- Unicorn-64613.exe (PID: 8440)
- Unicorn-41431.exe (PID: 8808)
- Unicorn-60181.exe (PID: 8204)
- Unicorn-18105.exe (PID: 8488)
- Unicorn-38547.exe (PID: 8572)
- Unicorn-19881.exe (PID: 8616)
- Unicorn-63143.exe (PID: 8584)
- Unicorn-58775.exe (PID: 8608)
- Unicorn-50607.exe (PID: 8632)
- Unicorn-15797.exe (PID: 8640)
- Unicorn-16440.exe (PID: 8220)
- Unicorn-29040.exe (PID: 8480)
- Unicorn-50507.exe (PID: 8664)
- Unicorn-63414.exe (PID: 8672)
- Unicorn-24519.exe (PID: 8684)
- Unicorn-32709.exe (PID: 8712)
- Unicorn-44120.exe (PID: 8700)
- Unicorn-44385.exe (PID: 8692)
- Unicorn-11612.exe (PID: 8720)
- Unicorn-49137.exe (PID: 8736)
- Unicorn-55167.exe (PID: 8832)
- Unicorn-6621.exe (PID: 8824)
- Unicorn-61032.exe (PID: 8816)
- Unicorn-55167.exe (PID: 8840)
- Unicorn-36771.exe (PID: 8652)
- Unicorn-16272.exe (PID: 8848)
- Unicorn-21443.exe (PID: 8500)
- Unicorn-40109.exe (PID: 8880)
- Unicorn-44769.exe (PID: 8968)
- Unicorn-34655.exe (PID: 8932)
- Unicorn-33263.exe (PID: 8864)
- Unicorn-8588.exe (PID: 9008)
- Unicorn-60290.exe (PID: 9040)
- Unicorn-14353.exe (PID: 9048)
- Unicorn-8488.exe (PID: 9056)
- Unicorn-8396.exe (PID: 9092)
- Unicorn-44338.exe (PID: 9152)
- Unicorn-26679.exe (PID: 9104)
- Unicorn-26990.exe (PID: 9188)
- Unicorn-11281.exe (PID: 6476)
- Unicorn-58073.exe (PID: 9160)
- Unicorn-59854.exe (PID: 9168)
- Unicorn-43783.exe (PID: 9176)
- Unicorn-56398.exe (PID: 3332)
- Unicorn-44167.exe (PID: 7604)
- Unicorn-16155.exe (PID: 9400)
- Unicorn-34437.exe (PID: 9424)
- Unicorn-18101.exe (PID: 9440)
- Unicorn-44643.exe (PID: 9476)
- Unicorn-50773.exe (PID: 9484)
- Unicorn-26823.exe (PID: 9492)
- Unicorn-4841.exe (PID: 9596)
- Unicorn-56804.exe (PID: 9896)
- Unicorn-33429.exe (PID: 9604)
- Unicorn-53102.exe (PID: 9924)
- Unicorn-53487.exe (PID: 9620)
- Unicorn-58702.exe (PID: 9916)
- Unicorn-58556.exe (PID: 9612)
- Unicorn-35397.exe (PID: 9656)
- Unicorn-5463.exe (PID: 9628)
- Unicorn-55525.exe (PID: 9636)
- Unicorn-18655.exe (PID: 9512)
- Unicorn-12838.exe (PID: 9700)
- Unicorn-41619.exe (PID: 9668)
- Unicorn-17669.exe (PID: 9680)
- Unicorn-8754.exe (PID: 9716)
- Unicorn-47649.exe (PID: 9708)
- Unicorn-35205.exe (PID: 9724)
- Unicorn-35013.exe (PID: 9648)
- Unicorn-31697.exe (PID: 9772)
- Unicorn-7192.exe (PID: 9804)
- Unicorn-8177.exe (PID: 9820)
- Unicorn-8873.exe (PID: 9856)
- Unicorn-7555.exe (PID: 9864)
- Unicorn-6616.exe (PID: 9744)
- Unicorn-31121.exe (PID: 9736)
- Unicorn-51541.exe (PID: 9760)
- Unicorn-7000.exe (PID: 9884)
- Unicorn-1089.exe (PID: 9948)
- Unicorn-16299.exe (PID: 9956)
- Unicorn-25627.exe (PID: 9992)
- Unicorn-11494.exe (PID: 9344)
- Unicorn-58173.exe (PID: 9248)
- Unicorn-34629.exe (PID: 9356)
- Unicorn-60404.exe (PID: 10004)
- Unicorn-7384.exe (PID: 10064)
- Unicorn-32107.exe (PID: 9288)
- Unicorn-7118.exe (PID: 9232)
- Unicorn-11110.exe (PID: 9264)
- Unicorn-25069.exe (PID: 9376)
- Unicorn-64561.exe (PID: 10076)
- Unicorn-48225.exe (PID: 10108)
- Unicorn-27421.exe (PID: 7876)
- Unicorn-9138.exe (PID: 9848)
- Unicorn-28935.exe (PID: 10236)
- Unicorn-52885.exe (PID: 10228)
- Unicorn-1546.exe (PID: 7940)
- Unicorn-7768.exe (PID: 10244)
- Unicorn-42771.exe (PID: 10168)
- Unicorn-22159.exe (PID: 10212)
- Unicorn-2122.exe (PID: 10332)
- Unicorn-28765.exe (PID: 10356)
- Unicorn-12983.exe (PID: 10344)
- Unicorn-54016.exe (PID: 10368)
- Unicorn-5630.exe (PID: 10316)
- Unicorn-61172.exe (PID: 10408)
- Unicorn-41571.exe (PID: 10440)
- Unicorn-61172.exe (PID: 10416)
- Unicorn-41571.exe (PID: 10424)
- Unicorn-41571.exe (PID: 10448)
- Unicorn-41571.exe (PID: 10432)
- Unicorn-41571.exe (PID: 10456)
- Unicorn-55307.exe (PID: 10476)
- Unicorn-55307.exe (PID: 10492)
- Unicorn-55307.exe (PID: 10484)
- Unicorn-55307.exe (PID: 10500)
- Unicorn-55307.exe (PID: 10508)
- Unicorn-55307.exe (PID: 10516)
- Unicorn-49740.exe (PID: 10376)
- Unicorn-49740.exe (PID: 10384)
- Unicorn-52507.exe (PID: 10400)
- Unicorn-49691.exe (PID: 11056)
- Unicorn-40825.exe (PID: 10556)
- Unicorn-16464.exe (PID: 11084)
- Unicorn-59683.exe (PID: 10656)
- Unicorn-39190.exe (PID: 10600)
- Unicorn-50124.exe (PID: 10608)
- Unicorn-18651.exe (PID: 10696)
- Unicorn-45628.exe (PID: 11128)
- Unicorn-11037.exe (PID: 10688)
- Unicorn-57161.exe (PID: 10548)
- Unicorn-27102.exe (PID: 10568)
- Unicorn-55791.exe (PID: 10584)
- Unicorn-51991.exe (PID: 10780)
- Unicorn-45869.exe (PID: 10796)
- Unicorn-11058.exe (PID: 10804)
- Unicorn-10482.exe (PID: 10708)
- Unicorn-11058.exe (PID: 10812)
- Unicorn-24801.exe (PID: 10864)
- Unicorn-59802.exe (PID: 10856)
- Unicorn-40201.exe (PID: 10880)
- Unicorn-43198.exe (PID: 10944)
- Unicorn-18336.exe (PID: 10956)
- Unicorn-2433.exe (PID: 10824)
- Unicorn-48370.exe (PID: 10840)
- Unicorn-41252.exe (PID: 11012)
- Unicorn-46620.exe (PID: 11024)
- Unicorn-18693.exe (PID: 11032)
- Unicorn-51850.exe (PID: 11192)
- Unicorn-49447.exe (PID: 11156)
- Unicorn-49447.exe (PID: 11164)
- Unicorn-37195.exe (PID: 11236)
- Unicorn-31329.exe (PID: 11228)
- Unicorn-29060.exe (PID: 11244)
- Unicorn-49520.exe (PID: 11260)
- Unicorn-319.exe (PID: 7256)
- Unicorn-23454.exe (PID: 11340)
- Unicorn-13047.exe (PID: 11744)
- Unicorn-5726.exe (PID: 11544)
- Unicorn-13047.exe (PID: 11728)
- Unicorn-64849.exe (PID: 11668)
- Unicorn-54783.exe (PID: 11660)
- Unicorn-14331.exe (PID: 11680)
- Unicorn-46488.exe (PID: 11864)
- Unicorn-3396.exe (PID: 11704)
- Unicorn-18912.exe (PID: 11716)
- Unicorn-13047.exe (PID: 11752)
- Unicorn-13047.exe (PID: 11760)
- Unicorn-14331.exe (PID: 11776)
- Unicorn-2841.exe (PID: 11804)
- Unicorn-32752.exe (PID: 11856)
- Unicorn-5391.exe (PID: 10872)
- Unicorn-45820.exe (PID: 11624)
- Unicorn-25976.exe (PID: 11872)
- Unicorn-62013.exe (PID: 10900)
- Unicorn-32560.exe (PID: 11980)
- Unicorn-29868.exe (PID: 12008)
- Unicorn-3225.exe (PID: 12016)
- Unicorn-11207.exe (PID: 12048)
- Unicorn-57086.exe (PID: 12076)
- Unicorn-53557.exe (PID: 12088)
- Unicorn-2457.exe (PID: 924)
- Unicorn-30806.exe (PID: 12112)
- Unicorn-48316.exe (PID: 12648)
- Unicorn-19627.exe (PID: 12692)
- Unicorn-37657.exe (PID: 12104)
- Unicorn-16438.exe (PID: 12156)
- Unicorn-16438.exe (PID: 12164)
- Unicorn-48871.exe (PID: 12720)
- ShellExperienceHost.exe (PID: 12812)
- Unicorn-53941.exe (PID: 12252)
- Unicorn-63500.exe (PID: 12188)
- Unicorn-55887.exe (PID: 12212)
- Unicorn-45026.exe (PID: 12220)
- Unicorn-49302.exe (PID: 12228)
- Unicorn-31190.exe (PID: 12276)
- Unicorn-64876.exe (PID: 12260)
- Unicorn-27106.exe (PID: 12268)
- Unicorn-21215.exe (PID: 11688)
- Unicorn-25976.exe (PID: 12324)
- Unicorn-39088.exe (PID: 5232)
- Unicorn-40869.exe (PID: 5772)
- Unicorn-25352.exe (PID: 12296)
- Unicorn-12637.exe (PID: 12304)
- Unicorn-5508.exe (PID: 12380)
- Unicorn-54378.exe (PID: 11836)
- Unicorn-57178.exe (PID: 11796)
- Unicorn-56510.exe (PID: 11996)
- Unicorn-4953.exe (PID: 12488)
- Unicorn-33350.exe (PID: 12552)
- Unicorn-58793.exe (PID: 12508)
- Unicorn-14835.exe (PID: 12596)
- Unicorn-4761.exe (PID: 12628)
- Unicorn-2815.exe (PID: 12404)
- Unicorn-38102.exe (PID: 12856)
- Unicorn-1153.exe (PID: 12744)
- Unicorn-53577.exe (PID: 12868)
- Unicorn-52763.exe (PID: 12940)
- Unicorn-41902.exe (PID: 12952)
- Unicorn-23620.exe (PID: 12992)
- Unicorn-3583.exe (PID: 13180)
- Unicorn-18336.exe (PID: 11792)
- Unicorn-16804.exe (PID: 12672)
- Unicorn-27019.exe (PID: 12588)
- Unicorn-52214.exe (PID: 13332)
- Unicorn-64906.exe (PID: 13360)
- Unicorn-47776.exe (PID: 13780)
- Unicorn-43630.exe (PID: 13496)
- Unicorn-29986.exe (PID: 13472)
- Unicorn-47776.exe (PID: 13772)
- Unicorn-48902.exe (PID: 13824)
- Unicorn-137.exe (PID: 13744)
- Unicorn-47776.exe (PID: 13764)
- Unicorn-41278.exe (PID: 13324)
- Unicorn-64662.exe (PID: 13416)
- Unicorn-40922.exe (PID: 13464)
- Unicorn-30828.exe (PID: 12244)
- Unicorn-45062.exe (PID: 13392)
- Unicorn-58797.exe (PID: 13400)
- Unicorn-64662.exe (PID: 13408)
- Unicorn-49477.exe (PID: 11616)
- Unicorn-137.exe (PID: 13692)
- Unicorn-48269.exe (PID: 13664)
- Unicorn-7750.exe (PID: 13656)
- Unicorn-53836.exe (PID: 13640)
- Unicorn-47482.exe (PID: 13620)
- Unicorn-52675.exe (PID: 13592)
- Unicorn-137.exe (PID: 13724)
- Unicorn-137.exe (PID: 13736)
- Unicorn-17542.exe (PID: 13716)
- Unicorn-51990.exe (PID: 13508)
- Unicorn-65394.exe (PID: 14488)
- Unicorn-61865.exe (PID: 14512)
- Unicorn-6764.exe (PID: 14536)
- Unicorn-43307.exe (PID: 13544)
- Unicorn-12965.exe (PID: 13752)
- Unicorn-61419.exe (PID: 13856)
- Unicorn-19318.exe (PID: 14212)
- Unicorn-19318.exe (PID: 14204)
- Unicorn-42452.exe (PID: 14324)
- Unicorn-63749.exe (PID: 14400)
- Unicorn-62680.exe (PID: 14340)
- Unicorn-45275.exe (PID: 5024)
- Unicorn-47912.exe (PID: 14316)
- Unicorn-21766.exe (PID: 14308)
- Unicorn-48269.exe (PID: 13672)
- Unicorn-52911.exe (PID: 13836)
- Unicorn-26399.exe (PID: 14428)
- Unicorn-38477.exe (PID: 13628)
- Unicorn-54813.exe (PID: 13704)
- Unicorn-61590.exe (PID: 13648)
- Unicorn-137.exe (PID: 13700)
- Unicorn-137.exe (PID: 13680)
- Unicorn-41005.exe (PID: 14444)
- Unicorn-12664.exe (PID: 14436)
- Unicorn-39306.exe (PID: 14416)
- Unicorn-49835.exe (PID: 14560)
- Unicorn-50896.exe (PID: 14572)
- Unicorn-62213.exe (PID: 14580)
- Unicorn-64673.exe (PID: 14600)
- Unicorn-760.exe (PID: 14588)
- Unicorn-6427.exe (PID: 14608)
- Unicorn-45322.exe (PID: 14616)
- Unicorn-22307.exe (PID: 14684)
- Unicorn-15948.exe (PID: 14676)
- Unicorn-34066.exe (PID: 14668)
- Unicorn-57937.exe (PID: 14628)
- Unicorn-1082.exe (PID: 14648)
- Unicorn-46318.exe (PID: 14716)
- Unicorn-26254.exe (PID: 14700)
- Unicorn-63723.exe (PID: 14748)
- Unicorn-8435.exe (PID: 15356)
- Unicorn-14015.exe (PID: 14476)
- Unicorn-28584.exe (PID: 14884)
- Unicorn-42845.exe (PID: 14240)
- Unicorn-36230.exe (PID: 14296)
- Unicorn-46483.exe (PID: 14876)
- Unicorn-56789.exe (PID: 7280)
- Unicorn-6410.exe (PID: 15276)
- Unicorn-42798.exe (PID: 15216)
- Unicorn-35269.exe (PID: 15208)
- Unicorn-48399.exe (PID: 15200)
- Unicorn-48399.exe (PID: 15192)
- Unicorn-41549.exe (PID: 15176)
- Unicorn-267.exe (PID: 15164)
- Unicorn-9504.exe (PID: 15076)
- Unicorn-8627.exe (PID: 15148)
- Unicorn-48399.exe (PID: 15120)
- Unicorn-59334.exe (PID: 15112)
- Unicorn-49005.exe (PID: 15128)
- Unicorn-59334.exe (PID: 15104)
- Unicorn-62134.exe (PID: 15252)
- Unicorn-44564.exe (PID: 15232)
- Unicorn-62134.exe (PID: 15244)
- Unicorn-46205.exe (PID: 15224)
- Unicorn-33753.exe (PID: 15184)
- Unicorn-10573.exe (PID: 15048)
- Unicorn-10573.exe (PID: 15056)
- Unicorn-29653.exe (PID: 15020)
- Unicorn-9745.exe (PID: 15040)
- Unicorn-15918.exe (PID: 15032)
- Unicorn-35519.exe (PID: 15012)
- Unicorn-48399.exe (PID: 15140)
- Unicorn-49005.exe (PID: 15156)
- Unicorn-2462.exe (PID: 15096)
- Unicorn-32668.exe (PID: 14892)
- Unicorn-16241.exe (PID: 14916)
- Unicorn-20325.exe (PID: 14928)
- Unicorn-55965.exe (PID: 15808)
- Unicorn-4163.exe (PID: 15816)
- Unicorn-50365.exe (PID: 15824)
- Unicorn-60380.exe (PID: 14996)
- Unicorn-30722.exe (PID: 14976)
- Unicorn-16987.exe (PID: 14960)
- Unicorn-27922.exe (PID: 14968)
- Unicorn-30722.exe (PID: 14984)
- Unicorn-53281.exe (PID: 14940)
- Unicorn-57584.exe (PID: 15616)
- Unicorn-63495.exe (PID: 14948)
- Unicorn-7886.exe (PID: 15664)
- Unicorn-2618.exe (PID: 15708)
- Unicorn-10028.exe (PID: 15836)
- Unicorn-10028.exe (PID: 15860)
- Unicorn-50365.exe (PID: 15892)
- Unicorn-10028.exe (PID: 15852)
The sample compiled with chinese language support
- 1 (43).exe (PID: 7268)
Reads the computer name
- Unicorn-64815.exe (PID: 7364)
- 1 (43).exe (PID: 7268)
- Unicorn-14628.exe (PID: 7968)
- Unicorn-21405.exe (PID: 7976)
- Unicorn-49221.exe (PID: 496)
- Unicorn-21187.exe (PID: 7148)
- Unicorn-30838.exe (PID: 5072)
- Unicorn-36969.exe (PID: 2136)
- Unicorn-58505.exe (PID: 7808)
- Unicorn-61198.exe (PID: 7796)
- Unicorn-23594.exe (PID: 7800)
- Unicorn-37893.exe (PID: 7776)
- Unicorn-24249.exe (PID: 7820)
- Unicorn-25376.exe (PID: 7884)
- Unicorn-44115.exe (PID: 7896)
- Unicorn-45822.exe (PID: 8096)
- Unicorn-26793.exe (PID: 8176)
- Unicorn-2843.exe (PID: 8184)
- Unicorn-23285.exe (PID: 300)
- Unicorn-60041.exe (PID: 6708)
- Unicorn-4902.exe (PID: 7052)
- Unicorn-21147.exe (PID: 7196)
- Unicorn-20881.exe (PID: 7200)
- Unicorn-3227.exe (PID: 8132)
- Unicorn-55857.exe (PID: 8080)
- Unicorn-61987.exe (PID: 8160)
- Unicorn-39429.exe (PID: 5868)
- Unicorn-58650.exe (PID: 7180)
- Unicorn-53057.exe (PID: 7264)
- Unicorn-42335.exe (PID: 8140)
- Unicorn-29891.exe (PID: 8136)
- Unicorn-34642.exe (PID: 8056)
- Unicorn-24415.exe (PID: 8048)
- Unicorn-42911.exe (PID: 6516)
- Unicorn-40581.exe (PID: 5164)
- Unicorn-53117.exe (PID: 5156)
- Unicorn-61001.exe (PID: 6644)
- Unicorn-13938.exe (PID: 5892)
- Unicorn-41327.exe (PID: 6700)
- Unicorn-63331.exe (PID: 8044)
- Unicorn-16631.exe (PID: 1512)
- Unicorn-56917.exe (PID: 4120)
- Unicorn-47379.exe (PID: 6324)
- Unicorn-51826.exe (PID: 4336)
- Unicorn-28448.exe (PID: 2236)
- Unicorn-8027.exe (PID: 2692)
- Unicorn-55355.exe (PID: 4400)
- Unicorn-24058.exe (PID: 1180)
- Unicorn-57493.exe (PID: 6540)
- Unicorn-27751.exe (PID: 6240)
- Unicorn-49880.exe (PID: 3240)
- Unicorn-8847.exe (PID: 7156)
- Unicorn-60518.exe (PID: 7380)
- Unicorn-59392.exe (PID: 7544)
- Unicorn-21889.exe (PID: 7356)
- Unicorn-56678.exe (PID: 1240)
- Unicorn-24389.exe (PID: 7736)
- Unicorn-53601.exe (PID: 1012)
- Unicorn-39595.exe (PID: 2552)
- Unicorn-47087.exe (PID: 6964)
- Unicorn-38779.exe (PID: 7596)
- Unicorn-43195.exe (PID: 1804)
- Unicorn-5744.exe (PID: 660)
- Unicorn-18909.exe (PID: 6576)
- Unicorn-18961.exe (PID: 6640)
- Unicorn-29481.exe (PID: 5436)
- Unicorn-42671.exe (PID: 208)
- Unicorn-61385.exe (PID: 2108)
- Unicorn-45817.exe (PID: 5116)
- Unicorn-36449.exe (PID: 5400)
- Unicorn-3222.exe (PID: 7536)
- Unicorn-17704.exe (PID: 7600)
- Unicorn-22172.exe (PID: 6392)
- Unicorn-65251.exe (PID: 1132)
- Unicorn-53554.exe (PID: 2908)
- Unicorn-3030.exe (PID: 7340)
- Unicorn-42785.exe (PID: 7752)
- Unicorn-35293.exe (PID: 7620)
- Unicorn-52184.exe (PID: 6712)
- Unicorn-48339.exe (PID: 4944)
- Unicorn-20457.exe (PID: 8744)
- Unicorn-41431.exe (PID: 8808)
- Unicorn-60181.exe (PID: 8204)
- Unicorn-21443.exe (PID: 8500)
- Unicorn-29040.exe (PID: 8480)
- Unicorn-10767.exe (PID: 7912)
- Unicorn-58989.exe (PID: 7948)
- Unicorn-25916.exe (PID: 8780)
- Unicorn-53191.exe (PID: 7920)
- Unicorn-11520.exe (PID: 8420)
- Unicorn-11612.exe (PID: 8720)
- Unicorn-39569.exe (PID: 8272)
- Unicorn-50507.exe (PID: 8664)
- Unicorn-55167.exe (PID: 8840)
- Unicorn-24603.exe (PID: 7668)
- Unicorn-18381.exe (PID: 8016)
- Unicorn-16051.exe (PID: 7804)
- Unicorn-54499.exe (PID: 8392)
- Unicorn-40109.exe (PID: 8880)
- Unicorn-10026.exe (PID: 6228)
- Unicorn-63781.exe (PID: 6668)
- Unicorn-37623.exe (PID: 4112)
- Unicorn-382.exe (PID: 7512)
- Unicorn-16440.exe (PID: 8220)
- Unicorn-55167.exe (PID: 8832)
- Unicorn-50607.exe (PID: 8632)
- Unicorn-64613.exe (PID: 8440)
- Unicorn-63497.exe (PID: 7504)
- Unicorn-33263.exe (PID: 8864)
- Unicorn-8588.exe (PID: 9008)
- Unicorn-63143.exe (PID: 8584)
- Unicorn-44338.exe (PID: 9152)
- Unicorn-26990.exe (PID: 9188)
- Unicorn-11390.exe (PID: 7748)
- Unicorn-44769.exe (PID: 8968)
- Unicorn-58775.exe (PID: 8608)
- Unicorn-58073.exe (PID: 9160)
- Unicorn-8488.exe (PID: 9056)
- Unicorn-44385.exe (PID: 8692)
- Unicorn-60290.exe (PID: 9040)
- Unicorn-64052.exe (PID: 7932)
- Unicorn-24519.exe (PID: 8684)
- Unicorn-56804.exe (PID: 9896)
- Unicorn-32709.exe (PID: 8712)
- Unicorn-53102.exe (PID: 9924)
- Unicorn-58702.exe (PID: 9916)
- Unicorn-55137.exe (PID: 8104)
- Unicorn-16435.exe (PID: 7660)
- Unicorn-55525.exe (PID: 9636)
- Unicorn-7384.exe (PID: 10064)
- Unicorn-58173.exe (PID: 9248)
- Unicorn-34655.exe (PID: 8932)
- Unicorn-10959.exe (PID: 7568)
- Unicorn-11281.exe (PID: 6476)
- Unicorn-35205.exe (PID: 9724)
- Unicorn-25627.exe (PID: 9992)
- Unicorn-15797.exe (PID: 8640)
- Unicorn-61032.exe (PID: 8816)
- Unicorn-34437.exe (PID: 9424)
- Unicorn-60404.exe (PID: 10004)
- Unicorn-18105.exe (PID: 8488)
- Unicorn-12838.exe (PID: 9700)
- Unicorn-63414.exe (PID: 8672)
- Unicorn-14353.exe (PID: 9048)
- Unicorn-42247.exe (PID: 8428)
- Unicorn-25069.exe (PID: 9376)
- Unicorn-49691.exe (PID: 11056)
- Unicorn-12983.exe (PID: 10344)
- Unicorn-16464.exe (PID: 11084)
- Unicorn-45628.exe (PID: 11128)
- Unicorn-55307.exe (PID: 10492)
- Unicorn-26679.exe (PID: 9104)
- Unicorn-8873.exe (PID: 9856)
- Unicorn-6299.exe (PID: 7688)
- Unicorn-52507.exe (PID: 10400)
- Unicorn-52885.exe (PID: 10228)
- Unicorn-55307.exe (PID: 10500)
- Unicorn-61172.exe (PID: 10408)
- Unicorn-49520.exe (PID: 11260)
- ShellExperienceHost.exe (PID: 12812)
- Unicorn-38547.exe (PID: 8572)
- Unicorn-22159.exe (PID: 10212)
- Unicorn-11058.exe (PID: 10804)
- Unicorn-2433.exe (PID: 10824)
- Unicorn-48316.exe (PID: 12648)
- Unicorn-19627.exe (PID: 12692)
- Unicorn-45869.exe (PID: 10796)
- Unicorn-61172.exe (PID: 10416)
- Unicorn-38993.exe (PID: 7644)
- Unicorn-19881.exe (PID: 8616)
- Unicorn-54016.exe (PID: 10368)
- Unicorn-41252.exe (PID: 11012)
- Unicorn-49447.exe (PID: 11164)
- Unicorn-35013.exe (PID: 9648)
- Unicorn-43198.exe (PID: 10944)
- Unicorn-11207.exe (PID: 12048)
- Unicorn-58793.exe (PID: 12508)
- Unicorn-48871.exe (PID: 12720)
- Unicorn-29060.exe (PID: 11244)
- Unicorn-51850.exe (PID: 11192)
- Unicorn-41902.exe (PID: 12952)
- Unicorn-11058.exe (PID: 10812)
- Unicorn-5630.exe (PID: 10316)
- Unicorn-51337.exe (PID: 7740)
- Unicorn-18655.exe (PID: 9512)
- Unicorn-65394.exe (PID: 14488)
- Unicorn-6764.exe (PID: 14536)
- Unicorn-61865.exe (PID: 14512)
- Unicorn-43783.exe (PID: 9176)
- Unicorn-17542.exe (PID: 13716)
- Unicorn-4163.exe (PID: 15816)
- Unicorn-50365.exe (PID: 15824)
- Unicorn-55307.exe (PID: 10484)
- Unicorn-47545.exe (PID: 1616)
- Unicorn-46476.exe (PID: 3132)
- Unicorn-60380.exe (PID: 14996)
- Unicorn-29653.exe (PID: 15020)
- Unicorn-55965.exe (PID: 15808)
- Unicorn-31190.exe (PID: 12276)
- Unicorn-15918.exe (PID: 15032)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 8056)
- BackgroundTransferHost.exe (PID: 4040)
- BackgroundTransferHost.exe (PID: 1512)
- BackgroundTransferHost.exe (PID: 6808)
- BackgroundTransferHost.exe (PID: 7504)
Create files in a temporary directory
- Unicorn-64815.exe (PID: 7364)
- 1 (43).exe (PID: 7268)
- Unicorn-14628.exe (PID: 7968)
- Unicorn-49221.exe (PID: 496)
- Unicorn-36969.exe (PID: 2136)
- Unicorn-21405.exe (PID: 7976)
- Unicorn-21187.exe (PID: 7148)
- Unicorn-58505.exe (PID: 7808)
- Unicorn-61198.exe (PID: 7796)
- Unicorn-23594.exe (PID: 7800)
- Unicorn-37893.exe (PID: 7776)
- Unicorn-30838.exe (PID: 5072)
- Unicorn-24249.exe (PID: 7820)
- Unicorn-44115.exe (PID: 7896)
- Unicorn-45822.exe (PID: 8096)
- Unicorn-26793.exe (PID: 8176)
- Unicorn-2843.exe (PID: 8184)
- Unicorn-21147.exe (PID: 7196)
- Unicorn-23285.exe (PID: 300)
- Unicorn-4902.exe (PID: 7052)
- Unicorn-60041.exe (PID: 6708)
- Unicorn-20881.exe (PID: 7200)
- Unicorn-55857.exe (PID: 8080)
- Unicorn-3227.exe (PID: 8132)
- Unicorn-25376.exe (PID: 7884)
- Unicorn-39429.exe (PID: 5868)
- Unicorn-53057.exe (PID: 7264)
- Unicorn-29891.exe (PID: 8136)
- Unicorn-42335.exe (PID: 8140)
- Unicorn-34642.exe (PID: 8056)
- Unicorn-42911.exe (PID: 6516)
- Unicorn-53117.exe (PID: 5156)
- Unicorn-40581.exe (PID: 5164)
- Unicorn-16631.exe (PID: 1512)
- Unicorn-61001.exe (PID: 6644)
- Unicorn-13938.exe (PID: 5892)
- Unicorn-41327.exe (PID: 6700)
- Unicorn-63331.exe (PID: 8044)
- Unicorn-56917.exe (PID: 4120)
- Unicorn-24058.exe (PID: 1180)
- Unicorn-55355.exe (PID: 4400)
- Unicorn-57493.exe (PID: 6540)
- Unicorn-47379.exe (PID: 6324)
- Unicorn-27751.exe (PID: 6240)
- Unicorn-28448.exe (PID: 2236)
- Unicorn-8027.exe (PID: 2692)
- Unicorn-51826.exe (PID: 4336)
- Unicorn-49880.exe (PID: 3240)
- Unicorn-8847.exe (PID: 7156)
- Unicorn-61987.exe (PID: 8160)
- Unicorn-60518.exe (PID: 7380)
- Unicorn-21889.exe (PID: 7356)
- Unicorn-59392.exe (PID: 7544)
- Unicorn-24389.exe (PID: 7736)
- Unicorn-56678.exe (PID: 1240)
- Unicorn-39595.exe (PID: 2552)
- Unicorn-43195.exe (PID: 1804)
- Unicorn-53601.exe (PID: 1012)
- Unicorn-38779.exe (PID: 7596)
- Unicorn-18909.exe (PID: 6576)
- Unicorn-5744.exe (PID: 660)
- Unicorn-29481.exe (PID: 5436)
- Unicorn-18961.exe (PID: 6640)
- Unicorn-24415.exe (PID: 8048)
- Unicorn-42671.exe (PID: 208)
- Unicorn-36449.exe (PID: 5400)
- Unicorn-45817.exe (PID: 5116)
- Unicorn-58650.exe (PID: 7180)
- Unicorn-47087.exe (PID: 6964)
- Unicorn-17704.exe (PID: 7600)
- Unicorn-3222.exe (PID: 7536)
- Unicorn-22172.exe (PID: 6392)
- Unicorn-65251.exe (PID: 1132)
- Unicorn-53554.exe (PID: 2908)
- Unicorn-3030.exe (PID: 7340)
- Unicorn-35293.exe (PID: 7620)
- Unicorn-48339.exe (PID: 4944)
- Unicorn-20457.exe (PID: 8744)
- Unicorn-52184.exe (PID: 6712)
- Unicorn-25916.exe (PID: 8780)
- Unicorn-41431.exe (PID: 8808)
- Unicorn-29040.exe (PID: 8480)
- Unicorn-10767.exe (PID: 7912)
- Unicorn-58989.exe (PID: 7948)
- Unicorn-21443.exe (PID: 8500)
- Unicorn-53191.exe (PID: 7920)
- Unicorn-11520.exe (PID: 8420)
- Unicorn-11612.exe (PID: 8720)
- Unicorn-39569.exe (PID: 8272)
- Unicorn-63781.exe (PID: 6668)
- Unicorn-18381.exe (PID: 8016)
- Unicorn-50507.exe (PID: 8664)
- Unicorn-24603.exe (PID: 7668)
- Unicorn-60181.exe (PID: 8204)
- Unicorn-55167.exe (PID: 8840)
- Unicorn-16051.exe (PID: 7804)
- Unicorn-54499.exe (PID: 8392)
- Unicorn-10026.exe (PID: 6228)
- Unicorn-11390.exe (PID: 7748)
- Unicorn-37623.exe (PID: 4112)
- Unicorn-50607.exe (PID: 8632)
- Unicorn-63497.exe (PID: 7504)
- Unicorn-33263.exe (PID: 8864)
- Unicorn-382.exe (PID: 7512)
- Unicorn-63143.exe (PID: 8584)
- Unicorn-44338.exe (PID: 9152)
- Unicorn-16440.exe (PID: 8220)
- Unicorn-55167.exe (PID: 8832)
- Unicorn-26990.exe (PID: 9188)
- Unicorn-44769.exe (PID: 8968)
- Unicorn-58073.exe (PID: 9160)
- Unicorn-8488.exe (PID: 9056)
- Unicorn-58775.exe (PID: 8608)
- Unicorn-44385.exe (PID: 8692)
- Unicorn-64052.exe (PID: 7932)
- Unicorn-60290.exe (PID: 9040)
- Unicorn-32709.exe (PID: 8712)
- Unicorn-24519.exe (PID: 8684)
- Unicorn-56804.exe (PID: 9896)
- Unicorn-58702.exe (PID: 9916)
- Unicorn-55137.exe (PID: 8104)
- Unicorn-16435.exe (PID: 7660)
- Unicorn-55525.exe (PID: 9636)
- Unicorn-7384.exe (PID: 10064)
- Unicorn-35205.exe (PID: 9724)
- Unicorn-34655.exe (PID: 8932)
- Unicorn-11281.exe (PID: 6476)
- Unicorn-10959.exe (PID: 7568)
- Unicorn-34437.exe (PID: 9424)
- Unicorn-15797.exe (PID: 8640)
- Unicorn-58173.exe (PID: 9248)
- Unicorn-61032.exe (PID: 8816)
- Unicorn-25627.exe (PID: 9992)
- Unicorn-61385.exe (PID: 2108)
- Unicorn-18105.exe (PID: 8488)
- Unicorn-63414.exe (PID: 8672)
- Unicorn-49691.exe (PID: 11056)
- Unicorn-45628.exe (PID: 11128)
- Unicorn-14353.exe (PID: 9048)
- Unicorn-42247.exe (PID: 8428)
- Unicorn-42785.exe (PID: 7752)
- Unicorn-16464.exe (PID: 11084)
- Unicorn-55307.exe (PID: 10492)
- Unicorn-26679.exe (PID: 9104)
- Unicorn-12838.exe (PID: 9700)
- Unicorn-8873.exe (PID: 9856)
- Unicorn-22159.exe (PID: 10212)
- Unicorn-6299.exe (PID: 7688)
- Unicorn-52885.exe (PID: 10228)
- Unicorn-55307.exe (PID: 10500)
- Unicorn-12983.exe (PID: 10344)
- Unicorn-11058.exe (PID: 10804)
- Unicorn-2433.exe (PID: 10824)
- Unicorn-61172.exe (PID: 10408)
- Unicorn-48316.exe (PID: 12648)
- Unicorn-49520.exe (PID: 11260)
- Unicorn-19627.exe (PID: 12692)
- Unicorn-53102.exe (PID: 9924)
- Unicorn-48871.exe (PID: 12720)
- Unicorn-45869.exe (PID: 10796)
- Unicorn-19881.exe (PID: 8616)
- Unicorn-54016.exe (PID: 10368)
- Unicorn-43198.exe (PID: 10944)
- Unicorn-38993.exe (PID: 7644)
- Unicorn-11207.exe (PID: 12048)
- Unicorn-29060.exe (PID: 11244)
- Unicorn-58793.exe (PID: 12508)
- Unicorn-51850.exe (PID: 11192)
- Unicorn-38547.exe (PID: 8572)
- Unicorn-49447.exe (PID: 11164)
- Unicorn-52507.exe (PID: 10400)
- Unicorn-40109.exe (PID: 8880)
- Unicorn-35013.exe (PID: 9648)
- Unicorn-11058.exe (PID: 10812)
- Unicorn-41902.exe (PID: 12952)
- Unicorn-5630.exe (PID: 10316)
- Unicorn-61865.exe (PID: 14512)
- Unicorn-6764.exe (PID: 14536)
- Unicorn-51337.exe (PID: 7740)
- Unicorn-43783.exe (PID: 9176)
- Unicorn-65394.exe (PID: 14488)
- Unicorn-17542.exe (PID: 13716)
- Unicorn-55307.exe (PID: 10484)
- Unicorn-50365.exe (PID: 15824)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 1512)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 1512)
- WerFault.exe (PID: 16428)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 1512)
- slui.exe (PID: 7428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
669
Monitored processes
532
Malicious processes
82
Suspicious processes
71
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\Users\admin\AppData\Local\Temp\Unicorn-42671.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-42671.exe | Unicorn-53057.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 300 | C:\Users\admin\AppData\Local\Temp\Unicorn-23285.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-23285.exe | Unicorn-61198.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 496 | C:\Users\admin\AppData\Local\Temp\Unicorn-49221.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49221.exe | Unicorn-14628.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 660 | C:\Users\admin\AppData\Local\Temp\Unicorn-5744.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5744.exe | Unicorn-63331.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 924 | C:\Users\admin\AppData\Local\Temp\Unicorn-2457.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-2457.exe | Unicorn-10959.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1012 | C:\Users\admin\AppData\Local\Temp\Unicorn-53601.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53601.exe | Unicorn-42335.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1132 | C:\Users\admin\AppData\Local\Temp\Unicorn-65251.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-65251.exe | Unicorn-41327.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1180 | C:\Users\admin\AppData\Local\Temp\Unicorn-24058.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24058.exe | Unicorn-64815.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1240 | C:\Users\admin\AppData\Local\Temp\Unicorn-56678.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56678.exe | Unicorn-23285.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1512 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
14 621
Read events
14 604
Write events
17
Delete events
0
Modification events
| (PID) Process: | (8056) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (8056) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (8056) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (1512) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (1512) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (1512) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (4040) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4040) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4040) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6808) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
818
Suspicious files
5
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1512 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\d14d3ebb-f36d-47e1-9fe1-aded94130b6c.down_data | — | |
MD5:— | SHA256:— | |||
| 7268 | 1 (43).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-21405.exe | executable | |
MD5:77FB578BCF97831A14F73E977DA0CAD5 | SHA256:7FBFA35FD91C878DF7A07A5597B309313B02CD6C2575AAFA95E5B84DCB496867 | |||
| 7364 | Unicorn-64815.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-14628.exe | executable | |
MD5:10786D9F4192A60BA554791B836BB77A | SHA256:58F82DDAE3464EE3529712E524C830B69BE9D1C5AEBD3083A0B1BE448BF67D44 | |||
| 7268 | 1 (43).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-64815.exe | executable | |
MD5:68116A7DE7C334FC95D3A9DEDA096425 | SHA256:6F7B9555496DCDF9349CD5FCDF3AA32647AD9B0BED049EE854F77CD79850250B | |||
| 7968 | Unicorn-14628.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-61198.exe | executable | |
MD5:EB37938740D934B3C9FE795967B174F7 | SHA256:F7B8C1621044B649974A517F3EEC103158039AA30AE45B89D92B0D182B157822 | |||
| 7976 | Unicorn-21405.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-36969.exe | executable | |
MD5:287D73B2A0FA2E7EB3070F95184A1D79 | SHA256:7510473A495D40471F6FDEC50886C6552AC87B1EE61C918455BDC07C85B486D4 | |||
| 1512 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\c3869d50-a39e-431a-a7ed-677a358fc358.up_meta_secure | binary | |
MD5:8C24930D9E70F4E31C0C1262FA4D8662 | SHA256:812BBFD90D3EA0146AC1726994238140402B2B1B22762439B114DF3EAF6F20EA | |||
| 7148 | Unicorn-21187.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-37893.exe | executable | |
MD5:B70D4F216283C7DA41F71E2020C46F41 | SHA256:4E0D2EA368359E7AFA915AF11431E05AAB72A7CCA5C7F751E235FB3A9B05DFC4 | |||
| 1512 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:C632B179A64BB16DBA8923D06B6ABAF0 | SHA256:9B08D8E9463DED9F09C221409C499A887C95FE68601436F8883B571F3C0C17DE | |||
| 1512 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
16
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
7636 | backgroundTaskHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
2644 | SIHClient.exe | GET | 200 | 2.19.217.218:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.19.11.105:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1512 | BackgroundTransferHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
2644 | SIHClient.exe | GET | 200 | 2.19.217.218:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 2.19.11.105:80 | crl.microsoft.com | Elisa Oyj | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2112 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.160.22:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
7636 | backgroundTaskHost.exe | 20.223.36.55:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |