| File name: | 1 (286) |
| Full analysis: | https://app.any.run/tasks/0e998364-155d-4ac9-a978-704096fdbad0 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 18:11:34 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 6A5811ED3172B6C05BEF84F4B665E400 |
| SHA1: | D101AAC5D106C5FBC0A87871BB1FE3B2283268CB |
| SHA256: | C81CB8F8E1BE4CFF613DE2061AD90176594A77A5B1FB431B1DE9A191C7BC0891 |
| SSDEEP: | 6144:j7SDzdIBMDpHAkRYTbeMABfC4KBqEvJGBSIW2eQd1k/8SwjwpyivEh/vWXLAs3Ya:jOHO6HAkaT6YBdhaSz2eQdrx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- Unicorn-15344.exe (PID: 1180)
- 1 (286).exe (PID: 6436)
- Unicorn-4716.exe (PID: 1672)
- Unicorn-52848.exe (PID: 6040)
- Unicorn-12988.exe (PID: 780)
- Unicorn-42323.exe (PID: 2100)
- Unicorn-62189.exe (PID: 4424)
- Unicorn-43807.exe (PID: 6488)
- Unicorn-48868.exe (PID: 1388)
- Unicorn-45189.exe (PID: 7152)
- Unicorn-41105.exe (PID: 2420)
- Unicorn-8987.exe (PID: 1328)
- Unicorn-22722.exe (PID: 632)
- Unicorn-20419.exe (PID: 5260)
- Unicorn-37021.exe (PID: 2552)
- Unicorn-5500.exe (PID: 6592)
- Unicorn-35869.exe (PID: 2984)
- Unicorn-34835.exe (PID: 1348)
- Unicorn-30197.exe (PID: 5116)
- Unicorn-11814.exe (PID: 7176)
- Unicorn-22605.exe (PID: 7200)
- Unicorn-56024.exe (PID: 7236)
- Unicorn-14436.exe (PID: 7220)
- Unicorn-63637.exe (PID: 7264)
- Unicorn-35603.exe (PID: 7292)
- Unicorn-43217.exe (PID: 7312)
- Unicorn-35049.exe (PID: 7340)
- Unicorn-26616.exe (PID: 7372)
- Unicorn-35049.exe (PID: 7332)
- Unicorn-20750.exe (PID: 7364)
- Unicorn-16933.exe (PID: 7460)
- Unicorn-42183.exe (PID: 7480)
- Unicorn-13040.exe (PID: 7508)
- Unicorn-52027.exe (PID: 7524)
- Unicorn-45905.exe (PID: 7552)
- Unicorn-33388.exe (PID: 7584)
- Unicorn-34385.exe (PID: 7636)
- Unicorn-55552.exe (PID: 7656)
- Unicorn-29725.exe (PID: 7684)
- Unicorn-13787.exe (PID: 7576)
- Unicorn-13866.exe (PID: 7380)
- Unicorn-50892.exe (PID: 7708)
- Unicorn-1136.exe (PID: 7716)
- Unicorn-36039.exe (PID: 7748)
- Unicorn-6180.exe (PID: 7764)
- Unicorn-2096.exe (PID: 7772)
- Unicorn-63549.exe (PID: 7780)
- Unicorn-22709.exe (PID: 7860)
- Unicorn-43771.exe (PID: 7256)
- Unicorn-49251.exe (PID: 7808)
- Unicorn-14540.exe (PID: 7888)
- Unicorn-55308.exe (PID: 7988)
- Unicorn-36999.exe (PID: 7828)
- Unicorn-30107.exe (PID: 7980)
- Unicorn-14540.exe (PID: 7896)
- Unicorn-54811.exe (PID: 7932)
- Unicorn-35707.exe (PID: 8004)
- Unicorn-47960.exe (PID: 7920)
- Unicorn-39490.exe (PID: 8052)
- Unicorn-44089.exe (PID: 8072)
- Unicorn-23477.exe (PID: 8036)
- Unicorn-17538.exe (PID: 8096)
- Unicorn-14924.exe (PID: 8112)
- Unicorn-52833.exe (PID: 8168)
- Unicorn-10456.exe (PID: 7908)
- Unicorn-36232.exe (PID: 3784)
- Unicorn-65085.exe (PID: 8148)
- Unicorn-19398.exe (PID: 1512)
- Unicorn-36091.exe (PID: 8132)
- Unicorn-60212.exe (PID: 7880)
- Unicorn-36497.exe (PID: 6744)
- Unicorn-22198.exe (PID: 6404)
- Unicorn-49989.exe (PID: 7540)
- Unicorn-64701.exe (PID: 2908)
- Unicorn-8463.exe (PID: 920)
- Unicorn-8463.exe (PID: 4408)
- Unicorn-5478.exe (PID: 1116)
- Unicorn-23861.exe (PID: 1628)
- Unicorn-25567.exe (PID: 5112)
- Unicorn-37073.exe (PID: 8256)
- Unicorn-48749.exe (PID: 8184)
- Unicorn-50264.exe (PID: 7156)
- Unicorn-15885.exe (PID: 4996)
- Unicorn-38587.exe (PID: 8272)
- Unicorn-5360.exe (PID: 8304)
- Unicorn-36881.exe (PID: 8216)
- Unicorn-2162.exe (PID: 8236)
- Unicorn-17539.exe (PID: 8328)
- Unicorn-9828.exe (PID: 8440)
- Unicorn-4675.exe (PID: 8412)
- Unicorn-59776.exe (PID: 8528)
- Unicorn-64073.exe (PID: 8536)
- Unicorn-6491.exe (PID: 8500)
- Unicorn-47737.exe (PID: 8552)
- Unicorn-27509.exe (PID: 8640)
- Unicorn-27347.exe (PID: 7820)
- Unicorn-34961.exe (PID: 7840)
- Unicorn-6320.exe (PID: 8648)
- Unicorn-48484.exe (PID: 8588)
- Unicorn-59605.exe (PID: 8672)
- Unicorn-39496.exe (PID: 8616)
- Unicorn-6512.exe (PID: 8756)
- Unicorn-43269.exe (PID: 8712)
- Unicorn-39377.exe (PID: 8796)
- Unicorn-48204.exe (PID: 8848)
- Unicorn-39377.exe (PID: 8828)
- Unicorn-64436.exe (PID: 8764)
- Unicorn-25078.exe (PID: 8804)
- Unicorn-23195.exe (PID: 8968)
- Unicorn-28795.exe (PID: 8952)
- Unicorn-18765.exe (PID: 8744)
- Unicorn-41047.exe (PID: 8924)
- Unicorn-17834.exe (PID: 8884)
- Unicorn-31209.exe (PID: 8812)
- Unicorn-15.exe (PID: 8904)
- Unicorn-15034.exe (PID: 8896)
- Unicorn-41047.exe (PID: 8920)
- Unicorn-58291.exe (PID: 9040)
- Unicorn-8396.exe (PID: 9128)
- Unicorn-54975.exe (PID: 1088)
- Unicorn-61852.exe (PID: 968)
- Unicorn-57213.exe (PID: 3884)
- Unicorn-12288.exe (PID: 4112)
- Unicorn-13227.exe (PID: 9172)
- Unicorn-53824.exe (PID: 4980)
- Unicorn-34415.exe (PID: 9228)
- Unicorn-25117.exe (PID: 9280)
- Unicorn-5251.exe (PID: 9296)
- Unicorn-5251.exe (PID: 9288)
- Unicorn-52833.exe (PID: 8176)
- Unicorn-13440.exe (PID: 9252)
- Unicorn-31430.exe (PID: 9344)
- Unicorn-32583.exe (PID: 3332)
- Unicorn-24733.exe (PID: 9112)
- Unicorn-14208.exe (PID: 9448)
- Unicorn-14208.exe (PID: 9440)
- Unicorn-14208.exe (PID: 9456)
- Unicorn-14208.exe (PID: 9432)
- Unicorn-38137.exe (PID: 9520)
- Unicorn-26077.exe (PID: 9552)
- Unicorn-18099.exe (PID: 9612)
- Unicorn-31291.exe (PID: 9716)
- Unicorn-11447.exe (PID: 9652)
- Unicorn-27037.exe (PID: 9572)
- Unicorn-3279.exe (PID: 9668)
- Unicorn-22382.exe (PID: 9660)
- Unicorn-31483.exe (PID: 9792)
- Unicorn-20522.exe (PID: 9732)
- Unicorn-17014.exe (PID: 9676)
- Unicorn-26653.exe (PID: 9740)
- Unicorn-60477.exe (PID: 9816)
- Unicorn-35973.exe (PID: 9860)
- Unicorn-14135.exe (PID: 9756)
- Unicorn-40611.exe (PID: 9820)
- Unicorn-19615.exe (PID: 9620)
- Unicorn-44312.exe (PID: 9960)
- Unicorn-7384.exe (PID: 9908)
- Unicorn-35900.exe (PID: 9928)
- Unicorn-64177.exe (PID: 9972)
- Unicorn-47711.exe (PID: 10044)
- Unicorn-7576.exe (PID: 9952)
- Unicorn-13122.exe (PID: 10004)
- Unicorn-65521.exe (PID: 10072)
- Unicorn-36933.exe (PID: 10096)
- Unicorn-56777.exe (PID: 10132)
- Unicorn-58100.exe (PID: 10112)
- Unicorn-40441.exe (PID: 10148)
- Unicorn-39185.exe (PID: 8736)
- Unicorn-11480.exe (PID: 8976)
- Unicorn-42531.exe (PID: 8960)
- Unicorn-61608.exe (PID: 10172)
- Unicorn-30418.exe (PID: 10196)
- Unicorn-52553.exe (PID: 8840)
- Unicorn-53845.exe (PID: 10220)
- Unicorn-1307.exe (PID: 10236)
- Unicorn-12739.exe (PID: 8448)
- Unicorn-55499.exe (PID: 8420)
- Unicorn-4260.exe (PID: 8476)
Executable content was dropped or overwritten
- Unicorn-4716.exe (PID: 1672)
- 1 (286).exe (PID: 6436)
- Unicorn-15344.exe (PID: 1180)
- Unicorn-12988.exe (PID: 780)
- Unicorn-52848.exe (PID: 6040)
- Unicorn-42323.exe (PID: 2100)
- Unicorn-62189.exe (PID: 4424)
- Unicorn-43807.exe (PID: 6488)
- Unicorn-35869.exe (PID: 2984)
- Unicorn-48868.exe (PID: 1388)
- Unicorn-45189.exe (PID: 7152)
- Unicorn-41105.exe (PID: 2420)
- Unicorn-8987.exe (PID: 1328)
- Unicorn-20419.exe (PID: 5260)
- Unicorn-37021.exe (PID: 2552)
- Unicorn-5500.exe (PID: 6592)
- Unicorn-34835.exe (PID: 1348)
- Unicorn-30197.exe (PID: 5116)
- Unicorn-11814.exe (PID: 7176)
- Unicorn-56024.exe (PID: 7236)
- Unicorn-22605.exe (PID: 7200)
- Unicorn-14436.exe (PID: 7220)
- Unicorn-43771.exe (PID: 7256)
- Unicorn-63637.exe (PID: 7264)
- Unicorn-35603.exe (PID: 7292)
- Unicorn-13866.exe (PID: 7380)
- Unicorn-43217.exe (PID: 7312)
- Unicorn-35049.exe (PID: 7340)
- Unicorn-26616.exe (PID: 7372)
- Unicorn-22722.exe (PID: 632)
- Unicorn-16933.exe (PID: 7460)
- Unicorn-42183.exe (PID: 7480)
- Unicorn-13040.exe (PID: 7508)
- Unicorn-49989.exe (PID: 7540)
- Unicorn-52027.exe (PID: 7524)
- Unicorn-33388.exe (PID: 7584)
- Unicorn-55552.exe (PID: 7656)
- Unicorn-29725.exe (PID: 7684)
- Unicorn-34385.exe (PID: 7636)
- Unicorn-13787.exe (PID: 7576)
- Unicorn-50892.exe (PID: 7708)
- Unicorn-1136.exe (PID: 7716)
- Unicorn-36039.exe (PID: 7748)
- Unicorn-6180.exe (PID: 7764)
- Unicorn-2096.exe (PID: 7772)
- Unicorn-63549.exe (PID: 7780)
- Unicorn-49251.exe (PID: 7808)
- Unicorn-22709.exe (PID: 7860)
- Unicorn-27347.exe (PID: 7820)
- Unicorn-36999.exe (PID: 7828)
- Unicorn-30107.exe (PID: 7980)
- Unicorn-14540.exe (PID: 7888)
- Unicorn-47960.exe (PID: 7920)
- Unicorn-60212.exe (PID: 7880)
- Unicorn-34961.exe (PID: 7840)
- Unicorn-20750.exe (PID: 7364)
- Unicorn-14540.exe (PID: 7896)
- Unicorn-35707.exe (PID: 8004)
- Unicorn-35049.exe (PID: 7332)
- Unicorn-39490.exe (PID: 8052)
- Unicorn-44089.exe (PID: 8072)
- Unicorn-17538.exe (PID: 8096)
- Unicorn-23477.exe (PID: 8036)
- Unicorn-14924.exe (PID: 8112)
- Unicorn-36091.exe (PID: 8132)
- Unicorn-48749.exe (PID: 8184)
- Unicorn-10456.exe (PID: 7908)
- Unicorn-52833.exe (PID: 8168)
- Unicorn-36497.exe (PID: 6744)
- Unicorn-8463.exe (PID: 4408)
- Unicorn-22198.exe (PID: 6404)
- Unicorn-45905.exe (PID: 7552)
- Unicorn-8463.exe (PID: 920)
- Unicorn-64701.exe (PID: 2908)
- Unicorn-23861.exe (PID: 1628)
- Unicorn-32583.exe (PID: 3332)
- Unicorn-25567.exe (PID: 5112)
- Unicorn-15885.exe (PID: 4996)
- Unicorn-5478.exe (PID: 1116)
- Unicorn-37073.exe (PID: 8256)
- Unicorn-36881.exe (PID: 8216)
- Unicorn-50264.exe (PID: 7156)
- Unicorn-2162.exe (PID: 8236)
- Unicorn-38587.exe (PID: 8272)
- Unicorn-5360.exe (PID: 8304)
- Unicorn-17539.exe (PID: 8328)
- Unicorn-9828.exe (PID: 8440)
- Unicorn-6491.exe (PID: 8500)
- Unicorn-4675.exe (PID: 8412)
- Unicorn-64073.exe (PID: 8536)
- Unicorn-59776.exe (PID: 8528)
- Unicorn-47737.exe (PID: 8552)
- Unicorn-27509.exe (PID: 8640)
- Unicorn-6320.exe (PID: 8648)
- Unicorn-48484.exe (PID: 8588)
- Unicorn-59605.exe (PID: 8672)
- Unicorn-54811.exe (PID: 7932)
- Unicorn-43269.exe (PID: 8712)
- Unicorn-39496.exe (PID: 8616)
- Unicorn-6512.exe (PID: 8756)
- Unicorn-64436.exe (PID: 8764)
- Unicorn-39377.exe (PID: 8796)
- Unicorn-39185.exe (PID: 8736)
- Unicorn-48204.exe (PID: 8848)
- Unicorn-17834.exe (PID: 8884)
- Unicorn-39377.exe (PID: 8828)
- Unicorn-23195.exe (PID: 8968)
- Unicorn-41047.exe (PID: 8924)
- Unicorn-28795.exe (PID: 8952)
- Unicorn-18765.exe (PID: 8744)
- Unicorn-31209.exe (PID: 8812)
- Unicorn-52553.exe (PID: 8840)
- Unicorn-15.exe (PID: 8904)
- Unicorn-15034.exe (PID: 8896)
- Unicorn-58291.exe (PID: 9040)
- Unicorn-8396.exe (PID: 9128)
- Unicorn-13227.exe (PID: 9172)
- Unicorn-41047.exe (PID: 8920)
- Unicorn-54975.exe (PID: 1088)
- Unicorn-61852.exe (PID: 968)
- Unicorn-57213.exe (PID: 3884)
- Unicorn-12288.exe (PID: 4112)
- Unicorn-53824.exe (PID: 4980)
- Unicorn-34415.exe (PID: 9228)
- Unicorn-13440.exe (PID: 9252)
- Unicorn-5251.exe (PID: 9296)
- Unicorn-36232.exe (PID: 3784)
- Unicorn-5251.exe (PID: 9288)
- Unicorn-25117.exe (PID: 9280)
- Unicorn-31430.exe (PID: 9344)
- Unicorn-24733.exe (PID: 9112)
- Unicorn-14208.exe (PID: 9448)
- Unicorn-14208.exe (PID: 9432)
- Unicorn-51712.exe (PID: 9472)
- Unicorn-14208.exe (PID: 9440)
- Unicorn-14208.exe (PID: 9456)
- Unicorn-22953.exe (PID: 9580)
- Unicorn-38137.exe (PID: 9520)
- Unicorn-18099.exe (PID: 9612)
- Unicorn-31291.exe (PID: 9716)
- Unicorn-11447.exe (PID: 9652)
- Unicorn-19615.exe (PID: 9620)
- Unicorn-3279.exe (PID: 9668)
- Unicorn-22382.exe (PID: 9660)
- Unicorn-31483.exe (PID: 9792)
- Unicorn-20522.exe (PID: 9732)
- Unicorn-17014.exe (PID: 9676)
- Unicorn-14135.exe (PID: 9756)
- Unicorn-35973.exe (PID: 9860)
- Unicorn-7384.exe (PID: 9908)
- Unicorn-7576.exe (PID: 9952)
- Unicorn-44312.exe (PID: 9960)
- Unicorn-40611.exe (PID: 9820)
- Unicorn-64177.exe (PID: 9972)
- Unicorn-47711.exe (PID: 10044)
- Unicorn-13122.exe (PID: 10004)
- Unicorn-25566.exe (PID: 10028)
- Unicorn-65521.exe (PID: 10072)
- Unicorn-55308.exe (PID: 7988)
- Unicorn-36933.exe (PID: 10096)
- Unicorn-56777.exe (PID: 10132)
- Unicorn-58100.exe (PID: 10112)
- Unicorn-40441.exe (PID: 10148)
- Unicorn-61608.exe (PID: 10172)
- Unicorn-30418.exe (PID: 10196)
- Unicorn-11480.exe (PID: 8976)
- Unicorn-1307.exe (PID: 10236)
- Unicorn-12739.exe (PID: 8448)
- Unicorn-53845.exe (PID: 10220)
- Unicorn-55499.exe (PID: 8420)
- Unicorn-19398.exe (PID: 1512)
- Unicorn-65085.exe (PID: 8148)
- Unicorn-49569.exe (PID: 8348)
- Unicorn-4958.exe (PID: 4776)
- Unicorn-61887.exe (PID: 4844)
- Unicorn-26077.exe (PID: 9552)
- Unicorn-26653.exe (PID: 9740)
- Unicorn-42531.exe (PID: 8960)
- Unicorn-52833.exe (PID: 8176)
- Unicorn-53303.exe (PID: 10588)
- Unicorn-4260.exe (PID: 8476)
- Unicorn-27037.exe (PID: 9572)
- Unicorn-35900.exe (PID: 9928)
- Unicorn-54434.exe (PID: 10760)
- Unicorn-56986.exe (PID: 10688)
- Unicorn-33358.exe (PID: 10748)
- Unicorn-23153.exe (PID: 10724)
- Unicorn-62602.exe (PID: 10792)
- Unicorn-6878.exe (PID: 10916)
- Unicorn-52710.exe (PID: 10820)
- Unicorn-57771.exe (PID: 10856)
- Unicorn-22961.exe (PID: 10848)
- Unicorn-12031.exe (PID: 10896)
- Unicorn-14030.exe (PID: 10840)
- Unicorn-6878.exe (PID: 10924)
- Unicorn-46204.exe (PID: 10540)
- Unicorn-26661.exe (PID: 10604)
- Unicorn-18746.exe (PID: 10648)
- Unicorn-44320.exe (PID: 10664)
- Unicorn-32390.exe (PID: 10704)
- Unicorn-656.exe (PID: 10968)
- Unicorn-35466.exe (PID: 11000)
- Unicorn-656.exe (PID: 10976)
- Unicorn-59416.exe (PID: 11012)
- Unicorn-11284.exe (PID: 11040)
- Unicorn-48845.exe (PID: 11112)
- Unicorn-10215.exe (PID: 11084)
- Unicorn-55887.exe (PID: 11076)
- Unicorn-20007.exe (PID: 11144)
- Unicorn-41496.exe (PID: 11160)
- Unicorn-7008.exe (PID: 11256)
- Unicorn-8185.exe (PID: 11224)
- Unicorn-52432.exe (PID: 11168)
- Unicorn-5154.exe (PID: 11028)
- Unicorn-60477.exe (PID: 9816)
- Unicorn-63178.exe (PID: 10948)
- Unicorn-29244.exe (PID: 11120)
- Unicorn-54071.exe (PID: 3032)
- Unicorn-46707.exe (PID: 11200)
- Unicorn-3893.exe (PID: 11276)
- Unicorn-57178.exe (PID: 6632)
- Unicorn-23880.exe (PID: 11296)
- Unicorn-20056.exe (PID: 5020)
- Unicorn-11668.exe (PID: 11416)
- Unicorn-5373.exe (PID: 11316)
- Unicorn-60869.exe (PID: 11356)
- Unicorn-63043.exe (PID: 6988)
- Unicorn-27520.exe (PID: 11216)
- Unicorn-39380.exe (PID: 11340)
- Unicorn-31604.exe (PID: 11232)
Executes application which crashes
- Unicorn-24424.exe (PID: 12176)
INFO
Checks supported languages
- 1 (286).exe (PID: 6436)
- Unicorn-52848.exe (PID: 6040)
- Unicorn-15344.exe (PID: 1180)
- Unicorn-4716.exe (PID: 1672)
- Unicorn-12988.exe (PID: 780)
- Unicorn-43807.exe (PID: 6488)
- Unicorn-35869.exe (PID: 2984)
- Unicorn-48868.exe (PID: 1388)
- Unicorn-62189.exe (PID: 4424)
- Unicorn-41105.exe (PID: 2420)
- Unicorn-45189.exe (PID: 7152)
- Unicorn-37021.exe (PID: 2552)
- Unicorn-22722.exe (PID: 632)
- Unicorn-20419.exe (PID: 5260)
- Unicorn-8987.exe (PID: 1328)
- Unicorn-34835.exe (PID: 1348)
- Unicorn-30197.exe (PID: 5116)
- Unicorn-11814.exe (PID: 7176)
- Unicorn-22605.exe (PID: 7200)
- Unicorn-14436.exe (PID: 7220)
- Unicorn-43771.exe (PID: 7256)
- Unicorn-35603.exe (PID: 7292)
- Unicorn-43217.exe (PID: 7312)
- Unicorn-35049.exe (PID: 7340)
- Unicorn-35049.exe (PID: 7332)
- Unicorn-26616.exe (PID: 7372)
- Unicorn-56024.exe (PID: 7236)
- Unicorn-16933.exe (PID: 7460)
- Unicorn-42183.exe (PID: 7480)
- Unicorn-49989.exe (PID: 7540)
- Unicorn-34385.exe (PID: 7636)
- Unicorn-1136.exe (PID: 7716)
- Unicorn-52027.exe (PID: 7524)
- Unicorn-2096.exe (PID: 7772)
- Unicorn-6180.exe (PID: 7764)
- Unicorn-49251.exe (PID: 7808)
- Unicorn-34961.exe (PID: 7840)
- Unicorn-22709.exe (PID: 7860)
- Unicorn-54811.exe (PID: 7932)
- Unicorn-14540.exe (PID: 7888)
- Unicorn-47960.exe (PID: 7920)
- Unicorn-30107.exe (PID: 7980)
- Unicorn-35707.exe (PID: 8004)
- Unicorn-23477.exe (PID: 8036)
- Unicorn-39490.exe (PID: 8052)
- Unicorn-44089.exe (PID: 8072)
- Unicorn-60212.exe (PID: 7880)
- Unicorn-55308.exe (PID: 7988)
- Unicorn-17538.exe (PID: 8096)
- Unicorn-52833.exe (PID: 8168)
- Unicorn-36091.exe (PID: 8132)
- Unicorn-65085.exe (PID: 8148)
- Unicorn-52833.exe (PID: 8176)
- Unicorn-19398.exe (PID: 1512)
- Unicorn-8463.exe (PID: 920)
- Unicorn-8463.exe (PID: 4408)
- Unicorn-64701.exe (PID: 2908)
- Unicorn-32583.exe (PID: 3332)
- Unicorn-23861.exe (PID: 1628)
- Unicorn-5478.exe (PID: 1116)
- Unicorn-25567.exe (PID: 5112)
- Unicorn-36881.exe (PID: 8216)
- Unicorn-37073.exe (PID: 8256)
- Unicorn-15885.exe (PID: 4996)
- Unicorn-38587.exe (PID: 8272)
- Unicorn-5360.exe (PID: 8304)
- Unicorn-9828.exe (PID: 8440)
- Unicorn-6491.exe (PID: 8500)
- Unicorn-17539.exe (PID: 8328)
- Unicorn-59776.exe (PID: 8528)
- Unicorn-48484.exe (PID: 8588)
- Unicorn-39496.exe (PID: 8616)
- Unicorn-47737.exe (PID: 8552)
- Unicorn-43269.exe (PID: 8712)
- Unicorn-6320.exe (PID: 8648)
- Unicorn-18765.exe (PID: 8744)
- Unicorn-6512.exe (PID: 8756)
- Unicorn-39185.exe (PID: 8736)
- Unicorn-64436.exe (PID: 8764)
- Unicorn-25078.exe (PID: 8804)
- Unicorn-39377.exe (PID: 8796)
- Unicorn-39377.exe (PID: 8828)
- Unicorn-52553.exe (PID: 8840)
- Unicorn-41047.exe (PID: 8924)
- Unicorn-15034.exe (PID: 8896)
- Unicorn-28795.exe (PID: 8952)
- Unicorn-23195.exe (PID: 8968)
- Unicorn-42531.exe (PID: 8960)
- Unicorn-41047.exe (PID: 8920)
- Unicorn-58291.exe (PID: 9040)
- Unicorn-48204.exe (PID: 8848)
- Unicorn-31209.exe (PID: 8812)
- Unicorn-17834.exe (PID: 8884)
- Unicorn-24733.exe (PID: 9112)
- Unicorn-12672.exe (PID: 9204)
- Unicorn-8396.exe (PID: 9128)
- Unicorn-54975.exe (PID: 1088)
- Unicorn-61852.exe (PID: 968)
- Unicorn-12288.exe (PID: 4112)
- Unicorn-53824.exe (PID: 4980)
- Unicorn-34415.exe (PID: 9228)
- Unicorn-13440.exe (PID: 9252)
- Unicorn-57213.exe (PID: 3884)
- Unicorn-5251.exe (PID: 9288)
- Unicorn-5251.exe (PID: 9296)
- Unicorn-31430.exe (PID: 9344)
- Unicorn-38137.exe (PID: 9520)
- Unicorn-26077.exe (PID: 9552)
- Unicorn-51712.exe (PID: 9472)
- Unicorn-14208.exe (PID: 9456)
- Unicorn-17014.exe (PID: 9676)
- Unicorn-11447.exe (PID: 9652)
- Unicorn-18099.exe (PID: 9612)
- Unicorn-19615.exe (PID: 9620)
- Unicorn-22382.exe (PID: 9660)
- Unicorn-20522.exe (PID: 9732)
- Unicorn-31291.exe (PID: 9716)
- Unicorn-14135.exe (PID: 9756)
- Unicorn-27037.exe (PID: 9572)
- Unicorn-40611.exe (PID: 9820)
- Unicorn-35973.exe (PID: 9860)
- Unicorn-7384.exe (PID: 9908)
- Unicorn-31483.exe (PID: 9792)
- Unicorn-60477.exe (PID: 9816)
- Unicorn-44312.exe (PID: 9960)
- Unicorn-64177.exe (PID: 9972)
- Unicorn-25566.exe (PID: 10028)
- Unicorn-13122.exe (PID: 10004)
- Unicorn-47711.exe (PID: 10044)
- Unicorn-65521.exe (PID: 10072)
- Unicorn-36933.exe (PID: 10096)
- Unicorn-58100.exe (PID: 10112)
- Unicorn-7576.exe (PID: 9952)
- Unicorn-40441.exe (PID: 10148)
- Unicorn-56777.exe (PID: 10132)
- Unicorn-61608.exe (PID: 10172)
- Unicorn-30418.exe (PID: 10196)
- Unicorn-12739.exe (PID: 8448)
- Unicorn-53845.exe (PID: 10220)
- Unicorn-1307.exe (PID: 10236)
- Unicorn-49569.exe (PID: 8348)
- Unicorn-4958.exe (PID: 4776)
- Unicorn-61887.exe (PID: 4844)
- Unicorn-4260.exe (PID: 8476)
- Unicorn-55499.exe (PID: 8420)
- Unicorn-46204.exe (PID: 10540)
- Unicorn-18746.exe (PID: 10648)
- Unicorn-44320.exe (PID: 10664)
- Unicorn-56986.exe (PID: 10688)
- Unicorn-23153.exe (PID: 10724)
- Unicorn-53303.exe (PID: 10588)
- Unicorn-54434.exe (PID: 10760)
- Unicorn-52710.exe (PID: 10820)
- Unicorn-57771.exe (PID: 10856)
- Unicorn-14030.exe (PID: 10840)
- Unicorn-22961.exe (PID: 10848)
- Unicorn-12031.exe (PID: 10896)
- Unicorn-33358.exe (PID: 10748)
- Unicorn-62602.exe (PID: 10792)
- Unicorn-656.exe (PID: 10968)
- Unicorn-656.exe (PID: 10976)
- Unicorn-35466.exe (PID: 11000)
- Unicorn-11284.exe (PID: 11040)
- Unicorn-5154.exe (PID: 11028)
- Unicorn-6878.exe (PID: 10924)
- Unicorn-6878.exe (PID: 10916)
- Unicorn-63178.exe (PID: 10948)
- Unicorn-10215.exe (PID: 11084)
- Unicorn-55887.exe (PID: 11076)
- Unicorn-29244.exe (PID: 11120)
- Unicorn-48845.exe (PID: 11112)
- Unicorn-20007.exe (PID: 11144)
- Unicorn-41496.exe (PID: 11160)
- Unicorn-52432.exe (PID: 11168)
- Unicorn-46707.exe (PID: 11200)
- Unicorn-8185.exe (PID: 11224)
- Unicorn-59416.exe (PID: 11012)
- Unicorn-31604.exe (PID: 11232)
- Unicorn-57178.exe (PID: 6632)
- Unicorn-20056.exe (PID: 5020)
- Unicorn-63043.exe (PID: 6988)
- Unicorn-54071.exe (PID: 3032)
- Unicorn-23880.exe (PID: 11296)
- Unicorn-3893.exe (PID: 11276)
- Unicorn-5373.exe (PID: 11316)
- Unicorn-27520.exe (PID: 11216)
- Unicorn-7008.exe (PID: 11256)
- Unicorn-64953.exe (PID: 11376)
- Unicorn-60869.exe (PID: 11356)
- Unicorn-38311.exe (PID: 11392)
- Unicorn-39380.exe (PID: 11340)
- Unicorn-11668.exe (PID: 11416)
- Unicorn-7584.exe (PID: 11400)
- Unicorn-54647.exe (PID: 11484)
- Unicorn-33158.exe (PID: 11460)
- Unicorn-32089.exe (PID: 11556)
- Unicorn-23921.exe (PID: 11512)
- Unicorn-5446.exe (PID: 11588)
- Unicorn-5446.exe (PID: 11580)
- Unicorn-26936.exe (PID: 11600)
- Unicorn-5446.exe (PID: 11572)
- Unicorn-33158.exe (PID: 11468)
- Unicorn-50563.exe (PID: 11476)
- Unicorn-17699.exe (PID: 11652)
- Unicorn-27490.exe (PID: 11704)
- Unicorn-20714.exe (PID: 11728)
- Unicorn-53064.exe (PID: 11720)
- Unicorn-21682.exe (PID: 11768)
- Unicorn-9841.exe (PID: 11804)
- Unicorn-43272.exe (PID: 11680)
- Unicorn-41802.exe (PID: 11832)
- Unicorn-44725.exe (PID: 11916)
- Unicorn-20775.exe (PID: 11908)
- Unicorn-42587.exe (PID: 11972)
- Unicorn-40318.exe (PID: 11848)
- Unicorn-50947.exe (PID: 11868)
- Unicorn-34672.exe (PID: 12072)
- Unicorn-41217.exe (PID: 12092)
- Unicorn-28450.exe (PID: 12108)
- Unicorn-42186.exe (PID: 12124)
- Unicorn-42186.exe (PID: 12116)
- Unicorn-12436.exe (PID: 12156)
- Unicorn-7776.exe (PID: 11956)
- Unicorn-35794.exe (PID: 11928)
- Unicorn-36457.exe (PID: 11964)
- Unicorn-61445.exe (PID: 2084)
- Unicorn-38887.exe (PID: 10392)
- Unicorn-51393.exe (PID: 12400)
- Unicorn-48378.exe (PID: 12368)
- Unicorn-48378.exe (PID: 12348)
- Unicorn-65036.exe (PID: 12456)
- Unicorn-34864.exe (PID: 12484)
- Unicorn-63453.exe (PID: 12508)
- Unicorn-50132.exe (PID: 12524)
- Unicorn-18750.exe (PID: 12560)
- Unicorn-62113.exe (PID: 12328)
- Unicorn-50838.exe (PID: 12336)
- Unicorn-48378.exe (PID: 12364)
- Unicorn-48378.exe (PID: 12352)
- Unicorn-52191.exe (PID: 12660)
- Unicorn-190.exe (PID: 12728)
- Unicorn-687.exe (PID: 12680)
- Unicorn-46624.exe (PID: 12692)
- Unicorn-64906.exe (PID: 12792)
- Unicorn-11158.exe (PID: 12752)
- Unicorn-65320.exe (PID: 12800)
- Unicorn-18720.exe (PID: 12924)
- Unicorn-16480.exe (PID: 12552)
- Unicorn-55041.exe (PID: 12596)
- Unicorn-49176.exe (PID: 12608)
- Unicorn-49176.exe (PID: 12604)
- Unicorn-14636.exe (PID: 12916)
- Unicorn-64165.exe (PID: 12964)
- Unicorn-33132.exe (PID: 12996)
- Unicorn-42923.exe (PID: 13032)
- Unicorn-56659.exe (PID: 13048)
- Unicorn-42923.exe (PID: 13040)
- Unicorn-19104.exe (PID: 13264)
- Unicorn-18148.exe (PID: 12264)
- Unicorn-4413.exe (PID: 12476)
- Unicorn-4413.exe (PID: 12292)
- Unicorn-45768.exe (PID: 12780)
- Unicorn-11185.exe (PID: 13168)
- Unicorn-22634.exe (PID: 13240)
- Unicorn-3344.exe (PID: 2416)
- Unicorn-43530.exe (PID: 13380)
- Unicorn-51533.exe (PID: 13336)
- Unicorn-45668.exe (PID: 13328)
- Unicorn-137.exe (PID: 13360)
- Unicorn-14087.exe (PID: 13400)
- Unicorn-33635.exe (PID: 13428)
- Unicorn-14034.exe (PID: 13432)
- Unicorn-62488.exe (PID: 13516)
- Unicorn-4050.exe (PID: 13540)
- Unicorn-11456.exe (PID: 13564)
- Unicorn-13187.exe (PID: 13600)
- Unicorn-7065.exe (PID: 13556)
- Unicorn-14164.exe (PID: 13616)
- Unicorn-46152.exe (PID: 13476)
- Unicorn-42622.exe (PID: 13508)
- Unicorn-29131.exe (PID: 13708)
- Unicorn-17948.exe (PID: 13648)
- Unicorn-14272.exe (PID: 13632)
- Unicorn-45467.exe (PID: 13748)
- Unicorn-20771.exe (PID: 13824)
- Unicorn-20771.exe (PID: 13816)
- Unicorn-21347.exe (PID: 13892)
- Unicorn-21347.exe (PID: 13896)
- Unicorn-37299.exe (PID: 13728)
- Unicorn-53635.exe (PID: 13772)
- Unicorn-36422.exe (PID: 14032)
- Unicorn-22764.exe (PID: 14068)
- Unicorn-65228.exe (PID: 14140)
- Unicorn-55244.exe (PID: 14204)
- Unicorn-49276.exe (PID: 14292)
- Unicorn-3604.exe (PID: 14308)
- Unicorn-3604.exe (PID: 14300)
- Unicorn-38969.exe (PID: 6876)
- Unicorn-6811.exe (PID: 14224)
- Unicorn-39484.exe (PID: 14264)
- Unicorn-45414.exe (PID: 8092)
- Unicorn-50475.exe (PID: 14364)
- Unicorn-41741.exe (PID: 14372)
- Unicorn-42975.exe (PID: 14456)
- Unicorn-26224.exe (PID: 14396)
- Unicorn-51143.exe (PID: 14492)
- Unicorn-48840.exe (PID: 14448)
- Unicorn-20059.exe (PID: 14512)
- Unicorn-55306.exe (PID: 4024)
- Unicorn-48529.exe (PID: 5232)
- Unicorn-49498.exe (PID: 14344)
- Unicorn-26224.exe (PID: 14388)
- Unicorn-12711.exe (PID: 14560)
- Unicorn-42783.exe (PID: 14632)
- Unicorn-42783.exe (PID: 14624)
- Unicorn-23239.exe (PID: 14736)
- Unicorn-23239.exe (PID: 14728)
- Unicorn-42125.exe (PID: 14820)
- Unicorn-42390.exe (PID: 14828)
- Unicorn-48098.exe (PID: 14872)
- Unicorn-31106.exe (PID: 14880)
- Unicorn-30530.exe (PID: 14592)
- Unicorn-39353.exe (PID: 14540)
- Unicorn-53681.exe (PID: 14992)
- Unicorn-65063.exe (PID: 15040)
- Unicorn-56.exe (PID: 15036)
- Unicorn-50673.exe (PID: 15120)
- Unicorn-32696.exe (PID: 15160)
- Unicorn-59338.exe (PID: 15128)
- Unicorn-24337.exe (PID: 15112)
- Unicorn-32961.exe (PID: 15176)
- Unicorn-39737.exe (PID: 15136)
- Unicorn-23724.exe (PID: 15200)
- Unicorn-32390.exe (PID: 14912)
- Unicorn-12632.exe (PID: 14964)
- Unicorn-8191.exe (PID: 15028)
- Unicorn-62296.exe (PID: 15068)
- Unicorn-57465.exe (PID: 15264)
- Unicorn-53635.exe (PID: 15392)
- Unicorn-23209.exe (PID: 15356)
- Unicorn-49852.exe (PID: 15316)
- Unicorn-4180.exe (PID: 15324)
- Unicorn-59089.exe (PID: 15276)
- Unicorn-651.exe (PID: 15384)
- Unicorn-53635.exe (PID: 15400)
- Unicorn-22908.exe (PID: 15424)
- Unicorn-40367.exe (PID: 15240)
- Unicorn-28603.exe (PID: 15216)
- Unicorn-4434.exe (PID: 15504)
- Unicorn-53635.exe (PID: 15408)
- Unicorn-651.exe (PID: 15416)
- Unicorn-56650.exe (PID: 15536)
- Unicorn-49873.exe (PID: 15572)
- Unicorn-56650.exe (PID: 15548)
- Unicorn-16686.exe (PID: 15604)
- Unicorn-44398.exe (PID: 15496)
- Unicorn-50842.exe (PID: 15692)
- Unicorn-27315.exe (PID: 15636)
- Unicorn-63094.exe (PID: 15736)
- Unicorn-50428.exe (PID: 15680)
- Unicorn-49359.exe (PID: 15724)
- Unicorn-10521.exe (PID: 15784)
- Unicorn-10786.exe (PID: 15792)
- Unicorn-7449.exe (PID: 15628)
- Unicorn-35483.exe (PID: 15672)
- Unicorn-46666.exe (PID: 15764)
- Unicorn-64626.exe (PID: 15820)
- Unicorn-37028.exe (PID: 15896)
- Unicorn-14055.exe (PID: 15920)
- Unicorn-63064.exe (PID: 16028)
- Unicorn-43712.exe (PID: 15940)
- Unicorn-50365.exe (PID: 15996)
- Unicorn-48211.exe (PID: 15960)
- Unicorn-21211.exe (PID: 16036)
- Unicorn-1611.exe (PID: 16044)
- Unicorn-64455.exe (PID: 16088)
- Unicorn-787.exe (PID: 15840)
- Unicorn-43194.exe (PID: 15876)
- Unicorn-34475.exe (PID: 15980)
- Unicorn-45981.exe (PID: 16128)
- Unicorn-53172.exe (PID: 16104)
The sample compiled with chinese language support
- 1 (286).exe (PID: 6436)
Reads the computer name
- 1 (286).exe (PID: 6436)
- Unicorn-12988.exe (PID: 780)
- Unicorn-15344.exe (PID: 1180)
- Unicorn-4716.exe (PID: 1672)
- Unicorn-52848.exe (PID: 6040)
- Unicorn-62189.exe (PID: 4424)
- Unicorn-42323.exe (PID: 2100)
- Unicorn-43807.exe (PID: 6488)
- Unicorn-35869.exe (PID: 2984)
- Unicorn-20419.exe (PID: 5260)
- Unicorn-45189.exe (PID: 7152)
- Unicorn-37021.exe (PID: 2552)
- Unicorn-41105.exe (PID: 2420)
- Unicorn-8987.exe (PID: 1328)
- Unicorn-22722.exe (PID: 632)
- Unicorn-48868.exe (PID: 1388)
- Unicorn-5500.exe (PID: 6592)
- Unicorn-30197.exe (PID: 5116)
- Unicorn-11814.exe (PID: 7176)
- Unicorn-22605.exe (PID: 7200)
- Unicorn-14436.exe (PID: 7220)
- Unicorn-56024.exe (PID: 7236)
- Unicorn-35049.exe (PID: 7332)
- Unicorn-26616.exe (PID: 7372)
- Unicorn-63637.exe (PID: 7264)
- Unicorn-43217.exe (PID: 7312)
- Unicorn-35049.exe (PID: 7340)
- Unicorn-20750.exe (PID: 7364)
- Unicorn-13866.exe (PID: 7380)
- Unicorn-16933.exe (PID: 7460)
- Unicorn-45905.exe (PID: 7552)
- Unicorn-52027.exe (PID: 7524)
- Unicorn-33388.exe (PID: 7584)
- Unicorn-55552.exe (PID: 7656)
- Unicorn-29725.exe (PID: 7684)
- Unicorn-13040.exe (PID: 7508)
- Unicorn-1136.exe (PID: 7716)
- Unicorn-2096.exe (PID: 7772)
- Unicorn-49251.exe (PID: 7808)
- Unicorn-22709.exe (PID: 7860)
- Unicorn-34961.exe (PID: 7840)
- Unicorn-60212.exe (PID: 7880)
- Unicorn-47960.exe (PID: 7920)
- Unicorn-63549.exe (PID: 7780)
- Unicorn-27347.exe (PID: 7820)
- Unicorn-10456.exe (PID: 7908)
- Unicorn-35707.exe (PID: 8004)
- Unicorn-23477.exe (PID: 8036)
- Unicorn-39490.exe (PID: 8052)
- Unicorn-17538.exe (PID: 8096)
- Unicorn-14540.exe (PID: 7896)
- Unicorn-14924.exe (PID: 8112)
- Unicorn-52833.exe (PID: 8168)
- Unicorn-36091.exe (PID: 8132)
- Unicorn-52833.exe (PID: 8176)
- Unicorn-36232.exe (PID: 3784)
- Unicorn-8463.exe (PID: 920)
- Unicorn-65085.exe (PID: 8148)
- Unicorn-36497.exe (PID: 6744)
- Unicorn-8463.exe (PID: 4408)
- Unicorn-23861.exe (PID: 1628)
- Unicorn-25567.exe (PID: 5112)
- Unicorn-5478.exe (PID: 1116)
- Unicorn-15885.exe (PID: 4996)
- Unicorn-37073.exe (PID: 8256)
- Unicorn-2162.exe (PID: 8236)
- Unicorn-38587.exe (PID: 8272)
- Unicorn-64073.exe (PID: 8536)
- Unicorn-59776.exe (PID: 8528)
- Unicorn-9828.exe (PID: 8440)
- Unicorn-4675.exe (PID: 8412)
- Unicorn-27509.exe (PID: 8640)
- Unicorn-59605.exe (PID: 8672)
- Unicorn-48484.exe (PID: 8588)
- Unicorn-6320.exe (PID: 8648)
- Unicorn-39496.exe (PID: 8616)
- Unicorn-39377.exe (PID: 8796)
- Unicorn-48204.exe (PID: 8848)
- Unicorn-52553.exe (PID: 8840)
- Unicorn-39377.exe (PID: 8828)
- Unicorn-28795.exe (PID: 8952)
- Unicorn-41047.exe (PID: 8924)
- Unicorn-25078.exe (PID: 8804)
- Unicorn-18765.exe (PID: 8744)
- Unicorn-23195.exe (PID: 8968)
- Unicorn-15.exe (PID: 8904)
- Unicorn-42531.exe (PID: 8960)
- Unicorn-6512.exe (PID: 8756)
- Unicorn-64436.exe (PID: 8764)
- Unicorn-8396.exe (PID: 9128)
- Unicorn-24733.exe (PID: 9112)
- Unicorn-13227.exe (PID: 9172)
- Unicorn-54975.exe (PID: 1088)
- Unicorn-61852.exe (PID: 968)
- Unicorn-12288.exe (PID: 4112)
- Unicorn-57213.exe (PID: 3884)
- Unicorn-53824.exe (PID: 4980)
- Unicorn-13440.exe (PID: 9252)
- Unicorn-5251.exe (PID: 9296)
- Unicorn-31430.exe (PID: 9344)
- Unicorn-14208.exe (PID: 9432)
- Unicorn-14208.exe (PID: 9448)
- Unicorn-14208.exe (PID: 9440)
- Unicorn-51712.exe (PID: 9472)
- Unicorn-38137.exe (PID: 9520)
- Unicorn-26077.exe (PID: 9552)
- Unicorn-22953.exe (PID: 9580)
- Unicorn-19615.exe (PID: 9620)
- Unicorn-27037.exe (PID: 9572)
- Unicorn-18099.exe (PID: 9612)
- Unicorn-31291.exe (PID: 9716)
- Unicorn-11447.exe (PID: 9652)
- Unicorn-3279.exe (PID: 9668)
- Unicorn-20522.exe (PID: 9732)
- Unicorn-17014.exe (PID: 9676)
- Unicorn-26653.exe (PID: 9740)
- Unicorn-31483.exe (PID: 9792)
- Unicorn-60477.exe (PID: 9816)
- Unicorn-35973.exe (PID: 9860)
- Unicorn-7384.exe (PID: 9908)
- Unicorn-44312.exe (PID: 9960)
- Unicorn-7576.exe (PID: 9952)
- Unicorn-64177.exe (PID: 9972)
- Unicorn-13122.exe (PID: 10004)
- Unicorn-47711.exe (PID: 10044)
- Unicorn-25566.exe (PID: 10028)
- Unicorn-65521.exe (PID: 10072)
- Unicorn-56777.exe (PID: 10132)
- Unicorn-53845.exe (PID: 10220)
- Unicorn-1307.exe (PID: 10236)
- Unicorn-12739.exe (PID: 8448)
- Unicorn-55499.exe (PID: 8420)
- Unicorn-4260.exe (PID: 8476)
- Unicorn-4958.exe (PID: 4776)
- Unicorn-49569.exe (PID: 8348)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 6132)
- BackgroundTransferHost.exe (PID: 5640)
- BackgroundTransferHost.exe (PID: 3676)
- BackgroundTransferHost.exe (PID: 5548)
- BackgroundTransferHost.exe (PID: 3676)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 3676)
Create files in a temporary directory
- Unicorn-4716.exe (PID: 1672)
- 1 (286).exe (PID: 6436)
- Unicorn-15344.exe (PID: 1180)
- Unicorn-52848.exe (PID: 6040)
- Unicorn-42323.exe (PID: 2100)
- Unicorn-45189.exe (PID: 7152)
- Unicorn-12988.exe (PID: 780)
- Unicorn-20419.exe (PID: 5260)
- Unicorn-5500.exe (PID: 6592)
- Unicorn-11814.exe (PID: 7176)
- Unicorn-48868.exe (PID: 1388)
- Unicorn-14436.exe (PID: 7220)
- Unicorn-41105.exe (PID: 2420)
- Unicorn-56024.exe (PID: 7236)
- Unicorn-62189.exe (PID: 4424)
- Unicorn-37021.exe (PID: 2552)
- Unicorn-26616.exe (PID: 7372)
- Unicorn-8987.exe (PID: 1328)
- Unicorn-43771.exe (PID: 7256)
- Unicorn-42183.exe (PID: 7480)
- Unicorn-33388.exe (PID: 7584)
- Unicorn-35869.exe (PID: 2984)
- Unicorn-34835.exe (PID: 1348)
- Unicorn-52027.exe (PID: 7524)
- Unicorn-29725.exe (PID: 7684)
- Unicorn-30197.exe (PID: 5116)
- Unicorn-50892.exe (PID: 7708)
- Unicorn-1136.exe (PID: 7716)
- Unicorn-2096.exe (PID: 7772)
- Unicorn-63637.exe (PID: 7264)
- Unicorn-49251.exe (PID: 7808)
- Unicorn-27347.exe (PID: 7820)
- Unicorn-36999.exe (PID: 7828)
- Unicorn-30107.exe (PID: 7980)
- Unicorn-34961.exe (PID: 7840)
- Unicorn-47960.exe (PID: 7920)
- Unicorn-60212.exe (PID: 7880)
- Unicorn-35707.exe (PID: 8004)
- Unicorn-20750.exe (PID: 7364)
- Unicorn-43217.exe (PID: 7312)
- Unicorn-14540.exe (PID: 7896)
- Unicorn-43807.exe (PID: 6488)
- Unicorn-22722.exe (PID: 632)
- Unicorn-23477.exe (PID: 8036)
- Unicorn-39490.exe (PID: 8052)
- Unicorn-16933.exe (PID: 7460)
- Unicorn-17538.exe (PID: 8096)
- Unicorn-36091.exe (PID: 8132)
- Unicorn-13040.exe (PID: 7508)
- Unicorn-10456.exe (PID: 7908)
- Unicorn-52833.exe (PID: 8168)
- Unicorn-14924.exe (PID: 8112)
- Unicorn-48749.exe (PID: 8184)
- Unicorn-45905.exe (PID: 7552)
- Unicorn-36497.exe (PID: 6744)
- Unicorn-22198.exe (PID: 6404)
- Unicorn-8463.exe (PID: 4408)
- Unicorn-8463.exe (PID: 920)
- Unicorn-13787.exe (PID: 7576)
- Unicorn-64701.exe (PID: 2908)
- Unicorn-49989.exe (PID: 7540)
- Unicorn-34385.exe (PID: 7636)
- Unicorn-32583.exe (PID: 3332)
- Unicorn-55552.exe (PID: 7656)
- Unicorn-25567.exe (PID: 5112)
- Unicorn-15885.exe (PID: 4996)
- Unicorn-5478.exe (PID: 1116)
- Unicorn-22605.exe (PID: 7200)
- Unicorn-37073.exe (PID: 8256)
- Unicorn-2162.exe (PID: 8236)
- Unicorn-38587.exe (PID: 8272)
- Unicorn-13866.exe (PID: 7380)
- Unicorn-36881.exe (PID: 8216)
- Unicorn-36039.exe (PID: 7748)
- Unicorn-17539.exe (PID: 8328)
- Unicorn-9828.exe (PID: 8440)
- Unicorn-4675.exe (PID: 8412)
- Unicorn-6180.exe (PID: 7764)
- Unicorn-64073.exe (PID: 8536)
- Unicorn-47737.exe (PID: 8552)
- Unicorn-22709.exe (PID: 7860)
- Unicorn-63549.exe (PID: 7780)
- Unicorn-14540.exe (PID: 7888)
- Unicorn-48484.exe (PID: 8588)
- Unicorn-6320.exe (PID: 8648)
- Unicorn-35049.exe (PID: 7340)
- Unicorn-54811.exe (PID: 7932)
- Unicorn-43269.exe (PID: 8712)
- Unicorn-59605.exe (PID: 8672)
- Unicorn-6512.exe (PID: 8756)
- Unicorn-64436.exe (PID: 8764)
- Unicorn-39496.exe (PID: 8616)
- Unicorn-39377.exe (PID: 8796)
- Unicorn-39185.exe (PID: 8736)
- Unicorn-48204.exe (PID: 8848)
- Unicorn-39377.exe (PID: 8828)
- Unicorn-18765.exe (PID: 8744)
- Unicorn-23195.exe (PID: 8968)
- Unicorn-41047.exe (PID: 8924)
- Unicorn-17834.exe (PID: 8884)
- Unicorn-15034.exe (PID: 8896)
- Unicorn-41047.exe (PID: 8920)
- Unicorn-31209.exe (PID: 8812)
- Unicorn-58291.exe (PID: 9040)
- Unicorn-13227.exe (PID: 9172)
- Unicorn-61852.exe (PID: 968)
- Unicorn-12288.exe (PID: 4112)
- Unicorn-54975.exe (PID: 1088)
- Unicorn-57213.exe (PID: 3884)
- Unicorn-53824.exe (PID: 4980)
- Unicorn-34415.exe (PID: 9228)
- Unicorn-13440.exe (PID: 9252)
- Unicorn-25117.exe (PID: 9280)
- Unicorn-5251.exe (PID: 9296)
- Unicorn-5251.exe (PID: 9288)
- Unicorn-36232.exe (PID: 3784)
- Unicorn-31430.exe (PID: 9344)
- Unicorn-44089.exe (PID: 8072)
- Unicorn-23861.exe (PID: 1628)
- Unicorn-24733.exe (PID: 9112)
- Unicorn-14208.exe (PID: 9448)
- Unicorn-14208.exe (PID: 9432)
- Unicorn-51712.exe (PID: 9472)
- Unicorn-50264.exe (PID: 7156)
- Unicorn-38137.exe (PID: 9520)
- Unicorn-5360.exe (PID: 8304)
- Unicorn-26077.exe (PID: 9552)
- Unicorn-18099.exe (PID: 9612)
- Unicorn-31291.exe (PID: 9716)
- Unicorn-3279.exe (PID: 9668)
- Unicorn-22382.exe (PID: 9660)
- Unicorn-31483.exe (PID: 9792)
- Unicorn-20522.exe (PID: 9732)
- Unicorn-17014.exe (PID: 9676)
- Unicorn-40611.exe (PID: 9820)
- Unicorn-19615.exe (PID: 9620)
- Unicorn-7576.exe (PID: 9952)
- Unicorn-64177.exe (PID: 9972)
- Unicorn-6491.exe (PID: 8500)
- Unicorn-13122.exe (PID: 10004)
- Unicorn-35603.exe (PID: 7292)
- Unicorn-27509.exe (PID: 8640)
- Unicorn-59776.exe (PID: 8528)
- Unicorn-65521.exe (PID: 10072)
- Unicorn-35049.exe (PID: 7332)
- Unicorn-40441.exe (PID: 10148)
- Unicorn-58100.exe (PID: 10112)
- Unicorn-15.exe (PID: 8904)
- Unicorn-30418.exe (PID: 10196)
- Unicorn-53845.exe (PID: 10220)
- Unicorn-1307.exe (PID: 10236)
- Unicorn-55499.exe (PID: 8420)
- Unicorn-4260.exe (PID: 8476)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 3676)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 3676)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:20 00:32:00+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
607
Monitored processes
473
Malicious processes
72
Suspicious processes
58
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 632 | C:\Users\admin\AppData\Local\Temp\Unicorn-22722.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-22722.exe | Unicorn-4716.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 780 | C:\Users\admin\AppData\Local\Temp\Unicorn-12988.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-12988.exe | Unicorn-15344.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 920 | C:\Users\admin\AppData\Local\Temp\Unicorn-8463.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8463.exe | Unicorn-30197.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 968 | C:\Users\admin\AppData\Local\Temp\Unicorn-61852.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-61852.exe | Unicorn-42183.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1088 | C:\Users\admin\AppData\Local\Temp\Unicorn-54975.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-54975.exe | Unicorn-5500.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1116 | C:\Users\admin\AppData\Local\Temp\Unicorn-5478.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5478.exe | Unicorn-45189.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1180 | C:\Users\admin\AppData\Local\Temp\Unicorn-15344.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-15344.exe | Unicorn-4716.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1328 | C:\Users\admin\AppData\Local\Temp\Unicorn-8987.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8987.exe | Unicorn-52848.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1348 | C:\Users\admin\AppData\Local\Temp\Unicorn-34835.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-34835.exe | Unicorn-12988.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1388 | C:\Users\admin\AppData\Local\Temp\Unicorn-48868.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-48868.exe | Unicorn-15344.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
12 813
Read events
12 798
Write events
15
Delete events
0
Modification events
| (PID) Process: | (6132) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6132) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6132) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (5640) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (5640) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (5640) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (3676) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (3676) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (3676) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (5548) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
1 107
Suspicious files
8
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3676 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\e42e9e13-96a3-41ba-9132-7421b5ab9dc8.down_data | — | |
MD5:— | SHA256:— | |||
| 1672 | Unicorn-4716.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-15344.exe | executable | |
MD5:3F92D3F06DE2FB4A263B0791EE618A31 | SHA256:668E3530233A00496F74820A5AB86020F376A1E3040F9427AB0C5FF017CAE1CC | |||
| 6436 | 1 (286).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-52848.exe | executable | |
MD5:3831C54CADAB6F338AC83F8FA8B65E4D | SHA256:880B56E93A486C48F1DCF5E785669C3255E2E9A1ACC304E50D00C7173050BCB4 | |||
| 3676 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\41e2e862-28bc-4a1a-9741-cc035b016ee3.up_meta_secure | binary | |
MD5:170A1516391F7DD0597258C73DB21D55 | SHA256:6FE37865B6F27B522CE661A55602D91CB619DCAF9E937E8BA6AAF010B96D78D1 | |||
| 1180 | Unicorn-15344.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-12988.exe | executable | |
MD5:062F579360F7DC9FC1E7D0534B2646CE | SHA256:F5BC23F91424F96F2FEB1449B2B272F2EB43234CAA1065B7FB95C3A8881EFD72 | |||
| 3676 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
| 6436 | 1 (286).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-4716.exe | executable | |
MD5:5CC8620C8FEB3994D0218A8DF42C9DB5 | SHA256:70903DF39CAE9ABDBAEF2EA9431150C0658085680B0EF6EFCC039ACB6B3EC8FC | |||
| 1672 | Unicorn-4716.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-42323.exe | executable | |
MD5:DB71D51513B09D4EAC0DD087EF7F49B7 | SHA256:D449CC69925ABE87988D0A01F22574A38C680C444C9830B2F1BD08BAE5D7E8A7 | |||
| 6040 | Unicorn-52848.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-62189.exe | executable | |
MD5:DD5518121C1EC7999AE4CAB488F8B1C8 | SHA256:1A478324E5DF34EEBA09C03A0702904B65D07AF3A556B04D532E126131538528 | |||
| 6436 | 1 (286).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-43807.exe | executable | |
MD5:B7B91D3A1BD13AD4FCA187BF88536EE3 | SHA256:1A6CAA2401D89E8DDC9677D834C6A3ABBBC65D4FBB5D2B0E7AA0FB5CC2A45BE5 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
15
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6372 | backgroundTaskHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
3676 | BackgroundTransferHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.48.23.138:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
8400 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
8400 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.48.23.138:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
2104 | svchost.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2112 | svchost.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3216 | svchost.exe | 20.197.71.89:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | SG | whitelisted |
6544 | svchost.exe | 20.190.160.132:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 23.54.109.203:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
6372 | backgroundTaskHost.exe | 20.223.35.26:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |