File name:

1 (200)

Full analysis: https://app.any.run/tasks/09716e81-3efd-49cc-bc84-0d954faca1a4
Verdict: Malicious activity
Analysis date: March 24, 2025, 16:05:52
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

4C36EFA324005E0DA4BDA6045DFF83A0

SHA1:

5ECB761592DE4D33D7E8419BB168D3DAA658A77A

SHA256:

D5AE41F1B58950A2F75929A408AB23495C03C06ACCB24BA9B605208E8CA7E468

SSDEEP:

6144:QPH/eOIYEDrLA5yU5NeODT6x5t3PwA8GBH/reDSHk/8SwjwpyA7EhpjU0l6b7yxM:QP2VfLA5j5EF3o9aHTeDSRx4DxmDsR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Unicorn-53832.exe (PID: 2136)
      • Unicorn-53832.exe (PID: 2140)
      • 1 (200).exe (PID: 7364)
      • Unicorn-53811.exe (PID: 7020)
      • Unicorn-21200.exe (PID: 7728)
      • Unicorn-37802.exe (PID: 7408)
      • Unicorn-31938.exe (PID: 7720)
      • Unicorn-9649.exe (PID: 496)
      • Unicorn-13733.exe (PID: 7188)
      • Unicorn-53375.exe (PID: 5508)
      • Unicorn-57459.exe (PID: 2616)
      • Unicorn-1673.exe (PID: 5556)
      • Unicorn-52555.exe (PID: 5588)
      • Unicorn-1673.exe (PID: 7184)
      • Unicorn-2009.exe (PID: 6436)
      • Unicorn-6847.exe (PID: 6112)
      • Unicorn-60132.exe (PID: 960)
      • Unicorn-39712.exe (PID: 6372)
      • Unicorn-40458.exe (PID: 1452)
      • Unicorn-7786.exe (PID: 4976)
      • Unicorn-48072.exe (PID: 5124)
      • Unicorn-36780.exe (PID: 6768)
      • Unicorn-53863.exe (PID: 7276)
      • Unicorn-63322.exe (PID: 6964)
      • Unicorn-14313.exe (PID: 5428)
      • Unicorn-55561.exe (PID: 7580)
      • Unicorn-63100.exe (PID: 7384)
      • Unicorn-46690.exe (PID: 1764)
      • Unicorn-50376.exe (PID: 7220)
      • Unicorn-62353.exe (PID: 6048)
      • Unicorn-23302.exe (PID: 2568)
      • Unicorn-56188.exe (PID: 8100)
      • Unicorn-19986.exe (PID: 7196)
      • Unicorn-14963.exe (PID: 7244)
      • Unicorn-19794.exe (PID: 5984)
      • Unicorn-7755.exe (PID: 1388)
      • Unicorn-18153.exe (PID: 5964)
      • Unicorn-36728.exe (PID: 2984)
      • Unicorn-42850.exe (PID: 1240)
      • Unicorn-48959.exe (PID: 4200)
      • Unicorn-24476.exe (PID: 6752)
      • Unicorn-44320.exe (PID: 5780)
      • Unicorn-64932.exe (PID: 6640)
      • Unicorn-15539.exe (PID: 668)
      • Unicorn-44320.exe (PID: 1164)
      • Unicorn-32068.exe (PID: 4736)
      • Unicorn-49032.exe (PID: 5680)
      • Unicorn-57319.exe (PID: 7604)
      • Unicorn-3214.exe (PID: 5772)
      • Unicorn-44055.exe (PID: 4268)
      • Unicorn-56764.exe (PID: 7596)
      • Unicorn-7563.exe (PID: 4300)
      • Unicorn-15409.exe (PID: 7984)
      • Unicorn-7563.exe (PID: 7544)
      • Unicorn-26344.exe (PID: 7808)
      • Unicorn-15409.exe (PID: 5408)
      • Unicorn-11647.exe (PID: 7588)
      • Unicorn-48547.exe (PID: 7084)
      • Unicorn-34760.exe (PID: 1912)
      • Unicorn-64226.exe (PID: 7560)
      • Unicorn-49032.exe (PID: 5244)
      • Unicorn-29144.exe (PID: 6028)
      • Unicorn-43535.exe (PID: 7828)
      • Unicorn-33725.exe (PID: 8144)
      • Unicorn-33472.exe (PID: 8096)
      • Unicorn-63897.exe (PID: 8184)
      • Unicorn-27525.exe (PID: 8140)
      • Unicorn-31425.exe (PID: 8012)
      • Unicorn-2698.exe (PID: 5204)
      • Unicorn-2143.exe (PID: 7852)
      • Unicorn-28109.exe (PID: 7616)
      • Unicorn-62143.exe (PID: 900)
      • Unicorn-55044.exe (PID: 8208)
      • Unicorn-28162.exe (PID: 8256)
      • Unicorn-47763.exe (PID: 8264)
      • Unicorn-42911.exe (PID: 8300)
      • Unicorn-28930.exe (PID: 8392)
      • Unicorn-45096.exe (PID: 8492)
      • Unicorn-37120.exe (PID: 8520)
      • Unicorn-44328.exe (PID: 8348)
      • Unicorn-21338.exe (PID: 8532)
      • Unicorn-59386.exe (PID: 8632)
      • Unicorn-28376.exe (PID: 8556)
      • Unicorn-57924.exe (PID: 8692)
      • Unicorn-11966.exe (PID: 8652)
      • Unicorn-607.exe (PID: 7632)
      • Unicorn-33420.exe (PID: 8716)
      • Unicorn-7563.exe (PID: 1072)
      • Unicorn-30082.exe (PID: 8748)
      • Unicorn-59631.exe (PID: 8808)
      • Unicorn-45672.exe (PID: 8736)
      • Unicorn-24199.exe (PID: 7212)
      • Unicorn-17660.exe (PID: 8840)
      • Unicorn-6154.exe (PID: 8904)
      • Unicorn-31042.exe (PID: 8800)
      • Unicorn-54608.exe (PID: 8860)
      • Unicorn-9491.exe (PID: 8884)
      • Unicorn-3508.exe (PID: 8972)
      • Unicorn-2994.exe (PID: 8940)
      • Unicorn-35304.exe (PID: 9012)
      • Unicorn-62746.exe (PID: 9096)
      • Unicorn-30644.exe (PID: 9144)
      • Unicorn-64447.exe (PID: 8932)
      • Unicorn-26944.exe (PID: 8956)
      • Unicorn-55916.exe (PID: 9048)
      • Unicorn-18392.exe (PID: 9104)
      • Unicorn-8369.exe (PID: 9208)
      • Unicorn-14307.exe (PID: 9088)
      • Unicorn-43088.exe (PID: 9160)
      • Unicorn-22476.exe (PID: 9112)
      • Unicorn-6139.exe (PID: 9080)
      • Unicorn-43664.exe (PID: 9032)
      • Unicorn-34920.exe (PID: 8272)
      • Unicorn-23414.exe (PID: 8384)
      • Unicorn-46986.exe (PID: 9040)
      • Unicorn-37150.exe (PID: 4776)
      • Unicorn-1161.exe (PID: 2284)
      • Unicorn-38234.exe (PID: 2268)
      • Unicorn-36684.exe (PID: 8116)
      • Unicorn-3762.exe (PID: 8608)
      • Unicorn-43835.exe (PID: 8424)
      • Unicorn-1261.exe (PID: 8948)
      • Unicorn-25857.exe (PID: 8732)
      • Unicorn-7251.exe (PID: 8108)
      • Unicorn-24374.exe (PID: 8672)
      • Unicorn-61323.exe (PID: 7940)
      • Unicorn-9521.exe (PID: 7700)
      • Unicorn-27063.exe (PID: 8228)
      • Unicorn-32756.exe (PID: 9348)
      • Unicorn-12335.exe (PID: 9332)
      • Unicorn-13404.exe (PID: 9384)
      • Unicorn-53347.exe (PID: 9416)
      • Unicorn-37010.exe (PID: 9436)
      • Unicorn-34985.exe (PID: 9360)
      • Unicorn-11686.exe (PID: 9452)
      • Unicorn-33332.exe (PID: 9500)
      • Unicorn-14565.exe (PID: 9548)
      • Unicorn-35640.exe (PID: 9540)
      • Unicorn-65236.exe (PID: 9472)
      • Unicorn-29802.exe (PID: 9648)
      • Unicorn-54307.exe (PID: 9596)
      • Unicorn-62615.exe (PID: 1088)
      • Unicorn-29802.exe (PID: 9640)
      • Unicorn-57644.exe (PID: 9588)
      • Unicorn-4551.exe (PID: 9660)
      • Unicorn-29802.exe (PID: 9632)
      • Unicorn-43088.exe (PID: 9168)
      • Unicorn-22402.exe (PID: 9764)
      • Unicorn-19086.exe (PID: 9784)
      • Unicorn-7846.exe (PID: 4812)
      • Unicorn-6471.exe (PID: 9832)
      • Unicorn-22232.exe (PID: 9840)
      • Unicorn-32564.exe (PID: 9304)
      • Unicorn-35257.exe (PID: 9892)
      • Unicorn-42387.exe (PID: 9724)
      • Unicorn-58796.exe (PID: 9712)
      • Unicorn-60908.exe (PID: 10036)
      • Unicorn-45859.exe (PID: 10096)
      • Unicorn-34897.exe (PID: 10080)
      • Unicorn-50156.exe (PID: 10164)
      • Unicorn-51116.exe (PID: 10204)
      • Unicorn-32541.exe (PID: 208)
      • Unicorn-38058.exe (PID: 9884)
      • Unicorn-7239.exe (PID: 9916)
      • Unicorn-60338.exe (PID: 9956)
      • Unicorn-44572.exe (PID: 10016)
      • Unicorn-46648.exe (PID: 9756)
      • Unicorn-30120.exe (PID: 8028)
      • Unicorn-26782.exe (PID: 9804)

    • Starts itself from another location

      • Unicorn-21200.exe (PID: 7728)
      • 1 (200).exe (PID: 7364)
      • Unicorn-37802.exe (PID: 7408)
      • Unicorn-31938.exe (PID: 7720)
      • Unicorn-53832.exe (PID: 2136)
      • Unicorn-53832.exe (PID: 2140)
      • Unicorn-2009.exe (PID: 6436)
      • Unicorn-53811.exe (PID: 7020)
      • Unicorn-9649.exe (PID: 496)
      • Unicorn-57459.exe (PID: 2616)
      • Unicorn-1673.exe (PID: 5556)
      • Unicorn-1673.exe (PID: 7184)
      • Unicorn-53375.exe (PID: 5508)
      • Unicorn-46690.exe (PID: 1764)
      • Unicorn-60132.exe (PID: 960)
      • Unicorn-6847.exe (PID: 6112)
      • Unicorn-13733.exe (PID: 7188)
      • Unicorn-40458.exe (PID: 1452)
      • Unicorn-39712.exe (PID: 6372)
      • Unicorn-7786.exe (PID: 4976)
      • Unicorn-48072.exe (PID: 5124)
      • Unicorn-49032.exe (PID: 5680)
      • Unicorn-36780.exe (PID: 6768)
      • Unicorn-53863.exe (PID: 7276)
      • Unicorn-14313.exe (PID: 5428)
      • Unicorn-63322.exe (PID: 6964)
      • Unicorn-55561.exe (PID: 7580)
      • Unicorn-63100.exe (PID: 7384)
      • Unicorn-23302.exe (PID: 2568)
      • Unicorn-56188.exe (PID: 8100)
      • Unicorn-19986.exe (PID: 7196)
      • Unicorn-50376.exe (PID: 7220)
      • Unicorn-19794.exe (PID: 5984)
      • Unicorn-7755.exe (PID: 1388)
      • Unicorn-14963.exe (PID: 7244)
      • Unicorn-18153.exe (PID: 5964)
      • Unicorn-36728.exe (PID: 2984)
      • Unicorn-42850.exe (PID: 1240)
      • Unicorn-48959.exe (PID: 4200)
      • Unicorn-24476.exe (PID: 6752)
      • Unicorn-32068.exe (PID: 4736)
      • Unicorn-64932.exe (PID: 6640)
      • Unicorn-15539.exe (PID: 668)
      • Unicorn-44320.exe (PID: 5780)
      • Unicorn-44320.exe (PID: 1164)
      • Unicorn-7563.exe (PID: 4300)
      • Unicorn-62353.exe (PID: 6048)
      • Unicorn-3214.exe (PID: 5772)
      • Unicorn-44055.exe (PID: 4268)
      • Unicorn-57319.exe (PID: 7604)
      • Unicorn-56764.exe (PID: 7596)
      • Unicorn-15409.exe (PID: 7984)
      • Unicorn-11647.exe (PID: 7588)
      • Unicorn-7563.exe (PID: 7544)
      • Unicorn-26344.exe (PID: 7808)
      • Unicorn-15409.exe (PID: 5408)
      • Unicorn-29144.exe (PID: 6028)
      • Unicorn-7563.exe (PID: 1072)
      • Unicorn-607.exe (PID: 7632)
      • Unicorn-52555.exe (PID: 5588)
      • Unicorn-49032.exe (PID: 5244)
      • Unicorn-64226.exe (PID: 7560)
      • Unicorn-43535.exe (PID: 7828)
      • Unicorn-33725.exe (PID: 8144)
      • Unicorn-63897.exe (PID: 8184)
      • Unicorn-31425.exe (PID: 8012)
      • Unicorn-27525.exe (PID: 8140)
      • Unicorn-33472.exe (PID: 8096)
      • Unicorn-2143.exe (PID: 7852)
      • Unicorn-28109.exe (PID: 7616)
      • Unicorn-34760.exe (PID: 1912)
      • Unicorn-62615.exe (PID: 1088)
      • Unicorn-24199.exe (PID: 7212)
      • Unicorn-2698.exe (PID: 5204)
      • Unicorn-55044.exe (PID: 8208)
      • Unicorn-47763.exe (PID: 8264)
      • Unicorn-62143.exe (PID: 900)
      • Unicorn-45096.exe (PID: 8492)
      • Unicorn-37120.exe (PID: 8520)
      • Unicorn-44328.exe (PID: 8348)
      • Unicorn-28930.exe (PID: 8392)
      • Unicorn-21338.exe (PID: 8532)
      • Unicorn-59386.exe (PID: 8632)
      • Unicorn-28376.exe (PID: 8556)
      • Unicorn-57924.exe (PID: 8692)
      • Unicorn-11966.exe (PID: 8652)
      • Unicorn-48547.exe (PID: 7084)
      • Unicorn-33420.exe (PID: 8716)
      • Unicorn-45672.exe (PID: 8736)
      • Unicorn-30082.exe (PID: 8748)
      • Unicorn-31042.exe (PID: 8800)
      • Unicorn-17660.exe (PID: 8840)
      • Unicorn-59631.exe (PID: 8808)
      • Unicorn-54608.exe (PID: 8860)
      • Unicorn-28162.exe (PID: 8256)
      • Unicorn-9491.exe (PID: 8884)
      • Unicorn-3508.exe (PID: 8972)
      • Unicorn-42911.exe (PID: 8300)
      • Unicorn-6154.exe (PID: 8904)
      • Unicorn-64447.exe (PID: 8932)
      • Unicorn-26944.exe (PID: 8956)
      • Unicorn-2994.exe (PID: 8940)
      • Unicorn-62746.exe (PID: 9096)
      • Unicorn-30644.exe (PID: 9144)
      • Unicorn-22476.exe (PID: 9112)
      • Unicorn-8369.exe (PID: 9208)
      • Unicorn-43088.exe (PID: 9168)
      • Unicorn-14307.exe (PID: 9088)
      • Unicorn-46986.exe (PID: 9040)
      • Unicorn-6139.exe (PID: 9080)
      • Unicorn-43664.exe (PID: 9032)
      • Unicorn-34920.exe (PID: 8272)
      • Unicorn-23414.exe (PID: 8384)
      • Unicorn-43088.exe (PID: 9160)
      • Unicorn-43835.exe (PID: 8424)
      • Unicorn-1161.exe (PID: 2284)
      • Unicorn-38234.exe (PID: 2268)
      • Unicorn-3762.exe (PID: 8608)
      • Unicorn-37150.exe (PID: 4776)
      • Unicorn-24374.exe (PID: 8672)
      • Unicorn-61323.exe (PID: 7940)
      • Unicorn-1261.exe (PID: 8948)
      • Unicorn-25857.exe (PID: 8732)
      • Unicorn-7251.exe (PID: 8108)
      • Unicorn-36684.exe (PID: 8116)
      • Unicorn-7846.exe (PID: 4812)
      • Unicorn-9521.exe (PID: 7700)
      • Unicorn-55916.exe (PID: 9048)
      • Unicorn-27063.exe (PID: 8228)
      • Unicorn-32756.exe (PID: 9348)
      • Unicorn-13404.exe (PID: 9384)
      • Unicorn-32564.exe (PID: 9304)
      • Unicorn-34985.exe (PID: 9360)
      • Unicorn-12335.exe (PID: 9332)
      • Unicorn-11686.exe (PID: 9452)
      • Unicorn-14565.exe (PID: 9548)
      • Unicorn-33332.exe (PID: 9500)
      • Unicorn-35640.exe (PID: 9540)
      • Unicorn-65236.exe (PID: 9472)
      • Unicorn-29802.exe (PID: 9640)
      • Unicorn-29802.exe (PID: 9648)
      • Unicorn-4551.exe (PID: 9660)
      • Unicorn-57644.exe (PID: 9588)

    • Executes application which crashes

      • Unicorn-8827.exe (PID: 9480)

  • INFO

    • The sample compiled with chinese language support

      • 1 (200).exe (PID: 7364)
      • Unicorn-53832.exe (PID: 2136)
      • Unicorn-53832.exe (PID: 2140)
      • Unicorn-31938.exe (PID: 7720)
      • Unicorn-21200.exe (PID: 7728)
      • Unicorn-53811.exe (PID: 7020)
      • Unicorn-37802.exe (PID: 7408)
      • Unicorn-13733.exe (PID: 7188)
      • Unicorn-9649.exe (PID: 496)
      • Unicorn-53375.exe (PID: 5508)
      • Unicorn-57459.exe (PID: 2616)
      • Unicorn-1673.exe (PID: 5556)
      • Unicorn-1673.exe (PID: 7184)
      • Unicorn-52555.exe (PID: 5588)
      • Unicorn-60132.exe (PID: 960)
      • Unicorn-6847.exe (PID: 6112)
      • Unicorn-2009.exe (PID: 6436)
      • Unicorn-40458.exe (PID: 1452)
      • Unicorn-7786.exe (PID: 4976)
      • Unicorn-48072.exe (PID: 5124)
      • Unicorn-36780.exe (PID: 6768)
      • Unicorn-53863.exe (PID: 7276)
      • Unicorn-63322.exe (PID: 6964)
      • Unicorn-14313.exe (PID: 5428)
      • Unicorn-55561.exe (PID: 7580)
      • Unicorn-63100.exe (PID: 7384)
      • Unicorn-46690.exe (PID: 1764)
      • Unicorn-62353.exe (PID: 6048)
      • Unicorn-56188.exe (PID: 8100)
      • Unicorn-19986.exe (PID: 7196)
      • Unicorn-50376.exe (PID: 7220)
      • Unicorn-23302.exe (PID: 2568)
      • Unicorn-19794.exe (PID: 5984)
      • Unicorn-39712.exe (PID: 6372)
      • Unicorn-7755.exe (PID: 1388)
      • Unicorn-18153.exe (PID: 5964)
      • Unicorn-14963.exe (PID: 7244)
      • Unicorn-36728.exe (PID: 2984)
      • Unicorn-42850.exe (PID: 1240)
      • Unicorn-48959.exe (PID: 4200)
      • Unicorn-24476.exe (PID: 6752)
      • Unicorn-32068.exe (PID: 4736)
      • Unicorn-64932.exe (PID: 6640)
      • Unicorn-15539.exe (PID: 668)
      • Unicorn-44320.exe (PID: 5780)
      • Unicorn-7563.exe (PID: 4300)
      • Unicorn-49032.exe (PID: 5680)
      • Unicorn-3214.exe (PID: 5772)
      • Unicorn-44055.exe (PID: 4268)
      • Unicorn-57319.exe (PID: 7604)
      • Unicorn-56764.exe (PID: 7596)
      • Unicorn-44320.exe (PID: 1164)
      • Unicorn-15409.exe (PID: 7984)
      • Unicorn-7563.exe (PID: 7544)
      • Unicorn-26344.exe (PID: 7808)
      • Unicorn-15409.exe (PID: 5408)
      • Unicorn-11647.exe (PID: 7588)
      • Unicorn-29144.exe (PID: 6028)
      • Unicorn-48547.exe (PID: 7084)
      • Unicorn-34760.exe (PID: 1912)
      • Unicorn-43535.exe (PID: 7828)
      • Unicorn-33725.exe (PID: 8144)
      • Unicorn-49032.exe (PID: 5244)
      • Unicorn-64226.exe (PID: 7560)
      • Unicorn-63897.exe (PID: 8184)
      • Unicorn-31425.exe (PID: 8012)
      • Unicorn-27525.exe (PID: 8140)
      • Unicorn-33472.exe (PID: 8096)
      • Unicorn-28109.exe (PID: 7616)
      • Unicorn-62143.exe (PID: 900)
      • Unicorn-2698.exe (PID: 5204)
      • Unicorn-2143.exe (PID: 7852)
      • Unicorn-28162.exe (PID: 8256)
      • Unicorn-47763.exe (PID: 8264)
      • Unicorn-42911.exe (PID: 8300)
      • Unicorn-55044.exe (PID: 8208)
      • Unicorn-28930.exe (PID: 8392)
      • Unicorn-45096.exe (PID: 8492)
      • Unicorn-44328.exe (PID: 8348)
      • Unicorn-37120.exe (PID: 8520)
      • Unicorn-21338.exe (PID: 8532)
      • Unicorn-59386.exe (PID: 8632)
      • Unicorn-28376.exe (PID: 8556)
      • Unicorn-57924.exe (PID: 8692)
      • Unicorn-11966.exe (PID: 8652)
      • Unicorn-607.exe (PID: 7632)
      • Unicorn-33420.exe (PID: 8716)
      • Unicorn-7563.exe (PID: 1072)
      • Unicorn-30082.exe (PID: 8748)
      • Unicorn-59631.exe (PID: 8808)
      • Unicorn-45672.exe (PID: 8736)
      • Unicorn-24199.exe (PID: 7212)
      • Unicorn-17660.exe (PID: 8840)
      • Unicorn-6154.exe (PID: 8904)
      • Unicorn-31042.exe (PID: 8800)
      • Unicorn-54608.exe (PID: 8860)
      • Unicorn-9491.exe (PID: 8884)
      • Unicorn-3508.exe (PID: 8972)
      • Unicorn-26944.exe (PID: 8956)
      • Unicorn-2994.exe (PID: 8940)
      • Unicorn-35304.exe (PID: 9012)
      • Unicorn-62746.exe (PID: 9096)
      • Unicorn-30644.exe (PID: 9144)
      • Unicorn-64447.exe (PID: 8932)
      • Unicorn-22476.exe (PID: 9112)
      • Unicorn-18392.exe (PID: 9104)
      • Unicorn-8369.exe (PID: 9208)
      • Unicorn-14307.exe (PID: 9088)
      • Unicorn-43088.exe (PID: 9160)
      • Unicorn-55916.exe (PID: 9048)
      • Unicorn-6139.exe (PID: 9080)
      • Unicorn-34920.exe (PID: 8272)
      • Unicorn-23414.exe (PID: 8384)
      • Unicorn-46986.exe (PID: 9040)
      • Unicorn-43664.exe (PID: 9032)
      • Unicorn-37150.exe (PID: 4776)
      • Unicorn-43835.exe (PID: 8424)
      • Unicorn-1161.exe (PID: 2284)
      • Unicorn-38234.exe (PID: 2268)
      • Unicorn-3762.exe (PID: 8608)
      • Unicorn-24374.exe (PID: 8672)
      • Unicorn-61323.exe (PID: 7940)
      • Unicorn-1261.exe (PID: 8948)
      • Unicorn-25857.exe (PID: 8732)
      • Unicorn-7251.exe (PID: 8108)
      • Unicorn-36684.exe (PID: 8116)
      • Unicorn-9521.exe (PID: 7700)
      • Unicorn-27063.exe (PID: 8228)
      • Unicorn-32756.exe (PID: 9348)
      • Unicorn-12335.exe (PID: 9332)
      • Unicorn-53347.exe (PID: 9416)
      • Unicorn-13404.exe (PID: 9384)
      • Unicorn-34985.exe (PID: 9360)
      • Unicorn-37010.exe (PID: 9436)
      • Unicorn-33332.exe (PID: 9500)
      • Unicorn-14565.exe (PID: 9548)
      • Unicorn-35640.exe (PID: 9540)
      • Unicorn-65236.exe (PID: 9472)
      • Unicorn-11686.exe (PID: 9452)
      • Unicorn-29802.exe (PID: 9632)
      • Unicorn-54307.exe (PID: 9596)
      • Unicorn-62615.exe (PID: 1088)
      • Unicorn-4551.exe (PID: 9660)
      • Unicorn-29802.exe (PID: 9640)
      • Unicorn-29802.exe (PID: 9648)
      • Unicorn-57644.exe (PID: 9588)
      • Unicorn-42387.exe (PID: 9724)
      • Unicorn-32564.exe (PID: 9304)
      • Unicorn-58796.exe (PID: 9712)
      • Unicorn-19086.exe (PID: 9784)
      • Unicorn-22232.exe (PID: 9840)
      • Unicorn-7846.exe (PID: 4812)
      • Unicorn-6471.exe (PID: 9832)
      • Unicorn-35257.exe (PID: 9892)
      • Unicorn-43088.exe (PID: 9168)
      • Unicorn-22402.exe (PID: 9764)
      • Unicorn-7239.exe (PID: 9916)
      • Unicorn-60338.exe (PID: 9956)
      • Unicorn-44572.exe (PID: 10016)
      • Unicorn-60908.exe (PID: 10036)
      • Unicorn-34897.exe (PID: 10080)
      • Unicorn-51116.exe (PID: 10204)
      • Unicorn-32541.exe (PID: 208)
      • Unicorn-38058.exe (PID: 9884)
      • Unicorn-45859.exe (PID: 10096)
      • Unicorn-50156.exe (PID: 10164)
      • Unicorn-30120.exe (PID: 8028)
      • Unicorn-26782.exe (PID: 9804)
      • Unicorn-46648.exe (PID: 9756)

    • Checks supported languages

      • 1 (200).exe (PID: 7364)
      • Unicorn-37802.exe (PID: 7408)
      • Unicorn-21200.exe (PID: 7728)
      • Unicorn-2009.exe (PID: 6436)
      • Unicorn-53832.exe (PID: 2136)
      • Unicorn-53811.exe (PID: 7020)
      • Unicorn-31938.exe (PID: 7720)
      • Unicorn-13733.exe (PID: 7188)
      • Unicorn-53375.exe (PID: 5508)
      • Unicorn-57459.exe (PID: 2616)
      • Unicorn-1673.exe (PID: 7184)
      • Unicorn-1673.exe (PID: 5556)
      • Unicorn-6847.exe (PID: 6112)
      • Unicorn-52555.exe (PID: 5588)
      • Unicorn-40458.exe (PID: 1452)
      • Unicorn-63100.exe (PID: 7384)
      • Unicorn-24476.exe (PID: 6752)
      • Unicorn-42850.exe (PID: 1240)
      • Unicorn-3214.exe (PID: 5772)
      • Unicorn-7563.exe (PID: 4300)
      • Unicorn-44320.exe (PID: 1164)
      • Unicorn-7563.exe (PID: 7544)
      • Unicorn-57319.exe (PID: 7604)
      • Unicorn-26344.exe (PID: 7808)
      • Unicorn-24199.exe (PID: 7212)
      • Unicorn-29144.exe (PID: 6028)
      • Unicorn-2698.exe (PID: 5204)
      • Unicorn-62143.exe (PID: 900)
      • Unicorn-28162.exe (PID: 8256)
      • Unicorn-21338.exe (PID: 8532)
      • Unicorn-59386.exe (PID: 8632)
      • Unicorn-33420.exe (PID: 8716)
      • Unicorn-64447.exe (PID: 8932)
      • Unicorn-22476.exe (PID: 9112)
      • Unicorn-6139.exe (PID: 9080)
      • Unicorn-43088.exe (PID: 9160)
      • Unicorn-38234.exe (PID: 2268)
      • Unicorn-37150.exe (PID: 4776)
      • Unicorn-7846.exe (PID: 4812)
      • Unicorn-24374.exe (PID: 8672)
      • Unicorn-7251.exe (PID: 8108)
      • Unicorn-36684.exe (PID: 8116)
      • Unicorn-32756.exe (PID: 9348)
      • Unicorn-11686.exe (PID: 9452)
      • Unicorn-12335.exe (PID: 9332)
      • Unicorn-8827.exe (PID: 9480)
      • Unicorn-14565.exe (PID: 9548)
      • Unicorn-65236.exe (PID: 9472)
      • Unicorn-57644.exe (PID: 9588)
      • Unicorn-42387.exe (PID: 9724)
      • Unicorn-58796.exe (PID: 9712)
      • Unicorn-38058.exe (PID: 9884)
      • Unicorn-29802.exe (PID: 9648)
      • Unicorn-44572.exe (PID: 10016)
      • Unicorn-14722.exe (PID: 1748)
      • Unicorn-51116.exe (PID: 10204)
      • Unicorn-4774.exe (PID: 10528)
      • Unicorn-62335.exe (PID: 10604)
      • Unicorn-38738.exe (PID: 10648)
      • Unicorn-27380.exe (PID: 10268)
      • Unicorn-12366.exe (PID: 10384)
      • Unicorn-58582.exe (PID: 10488)
      • Unicorn-58582.exe (PID: 10496)
      • Unicorn-63980.exe (PID: 10896)
      • Unicorn-54935.exe (PID: 10904)
      • Unicorn-38406.exe (PID: 10888)
      • Unicorn-56418.exe (PID: 10972)
      • Unicorn-19981.exe (PID: 11156)
      • Unicorn-61899.exe (PID: 11188)
      • Unicorn-38620.exe (PID: 11236)
      • Unicorn-45058.exe (PID: 10784)
      • Unicorn-5542.exe (PID: 10820)
      • Unicorn-46026.exe (PID: 11256)
      • Unicorn-10202.exe (PID: 4692)
      • Unicorn-8525.exe (PID: 10376)
      • Unicorn-12801.exe (PID: 11296)
      • Unicorn-55319.exe (PID: 536)
      • Unicorn-17653.exe (PID: 11512)
      • Unicorn-10955.exe (PID: 11576)
      • Unicorn-18146.exe (PID: 11556)
      • Unicorn-23186.exe (PID: 11356)
      • Unicorn-35771.exe (PID: 11456)
      • Unicorn-29905.exe (PID: 11448)
      • Unicorn-29212.exe (PID: 11956)
      • Unicorn-51286.exe (PID: 11744)
      • Unicorn-14027.exe (PID: 11292)
      • Unicorn-27624.exe (PID: 11416)
      • Unicorn-40644.exe (PID: 12396)
      • Unicorn-62927.exe (PID: 13060)
      • Unicorn-65496.exe (PID: 12820)
      • Unicorn-29129.exe (PID: 13004)
      • Unicorn-49034.exe (PID: 13116)
      • Unicorn-16680.exe (PID: 12648)
      • Unicorn-39522.exe (PID: 12776)
      • Unicorn-27344.exe (PID: 9996)
      • Unicorn-54078.exe (PID: 13360)
      • Unicorn-10623.exe (PID: 13696)
      • Unicorn-21021.exe (PID: 13720)
      • Unicorn-23763.exe (PID: 13848)
      • Unicorn-44640.exe (PID: 14028)
      • Unicorn-50378.exe (PID: 14088)
      • Unicorn-3970.exe (PID: 14148)
      • Unicorn-53384.exe (PID: 14256)
      • Unicorn-49106.exe (PID: 14396)

    • Reads the computer name

      • 1 (200).exe (PID: 7364)
      • Unicorn-37802.exe (PID: 7408)
      • Unicorn-21200.exe (PID: 7728)
      • Unicorn-31938.exe (PID: 7720)
      • Unicorn-53832.exe (PID: 2136)
      • Unicorn-53811.exe (PID: 7020)
      • Unicorn-13733.exe (PID: 7188)
      • Unicorn-57459.exe (PID: 2616)
      • Unicorn-1673.exe (PID: 7184)
      • Unicorn-52555.exe (PID: 5588)
      • Unicorn-1673.exe (PID: 5556)
      • Unicorn-46690.exe (PID: 1764)
      • Unicorn-36780.exe (PID: 6768)
      • Unicorn-49032.exe (PID: 5244)
      • Unicorn-19794.exe (PID: 5984)
      • Unicorn-64932.exe (PID: 6640)
      • Unicorn-7563.exe (PID: 4300)
      • Unicorn-44055.exe (PID: 4268)
      • Unicorn-7563.exe (PID: 7544)
      • Unicorn-28162.exe (PID: 8256)
      • Unicorn-21338.exe (PID: 8532)
      • Unicorn-43664.exe (PID: 9032)
      • Unicorn-22476.exe (PID: 9112)
      • Unicorn-8369.exe (PID: 9208)
      • Unicorn-23414.exe (PID: 8384)

    • Create files in a temporary directory

      • 1 (200).exe (PID: 7364)
      • Unicorn-21200.exe (PID: 7728)
      • Unicorn-37802.exe (PID: 7408)
      • Unicorn-53832.exe (PID: 2136)
      • Unicorn-13733.exe (PID: 7188)
      • Unicorn-53375.exe (PID: 5508)
      • Unicorn-1673.exe (PID: 5556)
      • Unicorn-31938.exe (PID: 7720)
      • Unicorn-1673.exe (PID: 7184)
      • Unicorn-53811.exe (PID: 7020)
      • Unicorn-53832.exe (PID: 2140)
      • Unicorn-57459.exe (PID: 2616)
      • Unicorn-60132.exe (PID: 960)
      • Unicorn-6847.exe (PID: 6112)
      • Unicorn-53863.exe (PID: 7276)
      • Unicorn-36780.exe (PID: 6768)
      • Unicorn-62353.exe (PID: 6048)
      • Unicorn-50376.exe (PID: 7220)
      • Unicorn-63100.exe (PID: 7384)
      • Unicorn-46690.exe (PID: 1764)
      • Unicorn-9649.exe (PID: 496)
      • Unicorn-19986.exe (PID: 7196)
      • Unicorn-39712.exe (PID: 6372)
      • Unicorn-19794.exe (PID: 5984)
      • Unicorn-7786.exe (PID: 4976)
      • Unicorn-24476.exe (PID: 6752)
      • Unicorn-15539.exe (PID: 668)
      • Unicorn-14313.exe (PID: 5428)
      • Unicorn-63322.exe (PID: 6964)
      • Unicorn-15409.exe (PID: 7984)
      • Unicorn-26344.exe (PID: 7808)
      • Unicorn-15409.exe (PID: 5408)
      • Unicorn-29144.exe (PID: 6028)
      • Unicorn-23302.exe (PID: 2568)
      • Unicorn-2009.exe (PID: 6436)
      • Unicorn-33472.exe (PID: 8096)
      • Unicorn-56188.exe (PID: 8100)
      • Unicorn-2143.exe (PID: 7852)
      • Unicorn-40458.exe (PID: 1452)
      • Unicorn-37120.exe (PID: 8520)
      • Unicorn-28930.exe (PID: 8392)
      • Unicorn-36728.exe (PID: 2984)
      • Unicorn-48072.exe (PID: 5124)
      • Unicorn-7563.exe (PID: 4300)
      • Unicorn-57319.exe (PID: 7604)
      • Unicorn-11966.exe (PID: 8652)
      • Unicorn-52555.exe (PID: 5588)
      • Unicorn-56764.exe (PID: 7596)
      • Unicorn-7563.exe (PID: 1072)
      • Unicorn-30082.exe (PID: 8748)
      • Unicorn-33725.exe (PID: 8144)
      • Unicorn-17660.exe (PID: 8840)
      • Unicorn-62143.exe (PID: 900)
      • Unicorn-26944.exe (PID: 8956)
      • Unicorn-22476.exe (PID: 9112)
      • Unicorn-55916.exe (PID: 9048)
      • Unicorn-6139.exe (PID: 9080)
      • Unicorn-1261.exe (PID: 8948)
      • Unicorn-48959.exe (PID: 4200)
      • Unicorn-48547.exe (PID: 7084)
      • Unicorn-65236.exe (PID: 9472)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 3240)
      • BackgroundTransferHost.exe (PID: 7852)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 7852)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 7852)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 7852)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (90.6)
.exe | Win32 Executable (generic) (4.9)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:01:20 00:32:00+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 176128
InitializedDataSize: 299008
UninitializedDataSize: -
EntryPoint: 0x13d4
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
CompanyName: UEFI
ProductName: Kawaii-Unicorn
FileVersion: 1
ProductVersion: 1
InternalName: Kawaii-Unicorn
OriginalFileName: Üawaii-Unicorn.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
549
Monitored processes
411
Malicious processes
56
Suspicious processes
41

Behavior graph

Click at the process to see the details
start 1 (200).exe unicorn-37802.exe sppextcomobj.exe no specs slui.exe no specs unicorn-31938.exe unicorn-21200.exe unicorn-53832.exe unicorn-53832.exe unicorn-2009.exe unicorn-53811.exe unicorn-9649.exe unicorn-13733.exe unicorn-53375.exe unicorn-57459.exe unicorn-1673.exe unicorn-1673.exe unicorn-52555.exe unicorn-46690.exe unicorn-60132.exe unicorn-6847.exe backgroundtransferhost.exe no specs unicorn-39712.exe unicorn-40458.exe unicorn-7786.exe unicorn-48072.exe unicorn-63322.exe unicorn-14313.exe unicorn-36780.exe unicorn-62353.exe unicorn-49032.exe unicorn-49032.exe unicorn-63100.exe unicorn-53863.exe unicorn-64226.exe unicorn-55561.exe unicorn-50376.exe unicorn-23302.exe backgroundtransferhost.exe unicorn-56188.exe unicorn-19986.exe backgroundtransferhost.exe no specs unicorn-14963.exe unicorn-19794.exe unicorn-7755.exe unicorn-18153.exe unicorn-24476.exe unicorn-36728.exe unicorn-42850.exe unicorn-48959.exe unicorn-15539.exe unicorn-32068.exe unicorn-44055.exe unicorn-44320.exe unicorn-44320.exe unicorn-64932.exe unicorn-3214.exe unicorn-7563.exe unicorn-7563.exe unicorn-7563.exe unicorn-57319.exe unicorn-56764.exe unicorn-11647.exe unicorn-34760.exe unicorn-15409.exe unicorn-29144.exe unicorn-43535.exe unicorn-15409.exe unicorn-24199.exe unicorn-26344.exe unicorn-48547.exe unicorn-62615.exe unicorn-607.exe unicorn-35811.exe no specs unicorn-63897.exe unicorn-33725.exe unicorn-33472.exe unicorn-31425.exe unicorn-27525.exe unicorn-2698.exe unicorn-2143.exe unicorn-28109.exe unicorn-62143.exe unicorn-55044.exe unicorn-28162.exe unicorn-47763.exe unicorn-42911.exe unicorn-44328.exe unicorn-28930.exe unicorn-45096.exe unicorn-37120.exe unicorn-21338.exe unicorn-28376.exe backgroundtransferhost.exe no specs unicorn-59386.exe unicorn-11966.exe unicorn-57924.exe unicorn-33420.exe unicorn-45672.exe unicorn-30082.exe unicorn-31042.exe unicorn-59631.exe unicorn-17660.exe unicorn-54608.exe unicorn-9491.exe unicorn-6154.exe unicorn-64447.exe unicorn-2994.exe unicorn-26944.exe unicorn-3508.exe unicorn-35304.exe unicorn-43664.exe unicorn-46986.exe unicorn-55916.exe unicorn-6139.exe unicorn-14307.exe unicorn-62746.exe unicorn-18392.exe unicorn-22476.exe unicorn-30644.exe unicorn-43088.exe unicorn-43088.exe unicorn-8369.exe unicorn-34920.exe unicorn-23414.exe unicorn-37150.exe unicorn-38234.exe unicorn-43835.exe unicorn-1161.exe unicorn-36684.exe unicorn-3762.exe unicorn-7846.exe unicorn-24374.exe unicorn-7251.exe unicorn-9521.exe unicorn-61323.exe unicorn-25857.exe unicorn-1261.exe unicorn-27063.exe unicorn-32564.exe unicorn-12335.exe unicorn-32756.exe unicorn-34985.exe unicorn-13404.exe unicorn-53347.exe unicorn-37010.exe unicorn-11686.exe unicorn-65236.exe unicorn-8827.exe unicorn-33332.exe unicorn-35640.exe unicorn-14565.exe unicorn-57644.exe unicorn-54307.exe unicorn-29802.exe unicorn-29802.exe unicorn-29802.exe unicorn-4551.exe unicorn-58796.exe unicorn-42387.exe unicorn-22402.exe unicorn-19086.exe unicorn-6471.exe unicorn-22232.exe unicorn-38058.exe unicorn-35257.exe unicorn-7239.exe unicorn-60338.exe unicorn-44572.exe unicorn-60908.exe unicorn-34897.exe unicorn-45859.exe unicorn-50156.exe unicorn-51116.exe unicorn-30120.exe unicorn-46648.exe unicorn-26782.exe backgroundtransferhost.exe no specs unicorn-14722.exe no specs unicorn-32541.exe unicorn-19766.exe no specs unicorn-27380.exe no specs unicorn-2034.exe no specs unicorn-9705.exe no specs unicorn-40400.exe no specs unicorn-32786.exe no specs unicorn-12366.exe no specs unicorn-37062.exe no specs unicorn-50798.exe no specs unicorn-58582.exe no specs unicorn-58582.exe no specs unicorn-4774.exe no specs unicorn-50083.exe no specs unicorn-62335.exe no specs unicorn-26869.exe no specs unicorn-38738.exe no specs unicorn-38738.exe no specs unicorn-29086.exe no specs unicorn-33170.exe no specs unicorn-45060.exe no specs unicorn-37446.exe no specs unicorn-45615.exe no specs unicorn-50659.exe no specs unicorn-45058.exe no specs unicorn-5542.exe no specs unicorn-5542.exe no specs unicorn-17986.exe no specs unicorn-20554.exe no specs unicorn-26154.exe no specs unicorn-38406.exe no specs unicorn-63980.exe no specs unicorn-54935.exe no specs unicorn-33503.exe no specs unicorn-56418.exe no specs unicorn-62283.exe no specs unicorn-42682.exe no specs unicorn-12539.exe no specs unicorn-22977.exe no specs unicorn-36705.exe no specs unicorn-45371.exe no specs unicorn-39506.exe no specs unicorn-39506.exe no specs unicorn-16070.exe no specs unicorn-49647.exe no specs unicorn-19981.exe no specs unicorn-47866.exe no specs unicorn-61899.exe no specs unicorn-2226.exe no specs unicorn-38620.exe no specs unicorn-46026.exe no specs unicorn-42896.exe no specs unicorn-46404.exe no specs unicorn-55319.exe no specs unicorn-10202.exe no specs unicorn-1214.exe no specs unicorn-47151.exe no specs unicorn-47151.exe no specs unicorn-8525.exe no specs unicorn-12801.exe no specs unicorn-10001.exe no specs unicorn-15018.exe no specs unicorn-23186.exe no specs unicorn-31354.exe no specs unicorn-59580.exe no specs unicorn-29905.exe no specs unicorn-35771.exe no specs unicorn-64816.exe no specs unicorn-3918.exe no specs unicorn-17653.exe no specs unicorn-54026.exe no specs unicorn-18146.exe no specs unicorn-18146.exe no specs unicorn-56627.exe no specs unicorn-10955.exe no specs unicorn-57779.exe no specs unicorn-3177.exe no specs unicorn-8215.exe no specs unicorn-32912.exe no specs unicorn-51286.exe no specs unicorn-9869.exe no specs unicorn-17706.exe no specs unicorn-42402.exe no specs unicorn-815.exe no specs unicorn-29212.exe no specs unicorn-57535.exe no specs unicorn-37378.exe no specs unicorn-18474.exe no specs unicorn-21428.exe no specs unicorn-33872.exe no specs unicorn-50208.exe no specs unicorn-49438.exe no specs unicorn-63612.exe no specs unicorn-31132.exe no specs unicorn-43362.exe no specs unicorn-59699.exe no specs unicorn-14027.exe no specs unicorn-18112.exe no specs unicorn-6051.exe no specs unicorn-34832.exe no specs unicorn-55252.exe no specs unicorn-11095.exe no specs unicorn-23348.exe no specs unicorn-52128.exe no specs unicorn-51863.exe no specs unicorn-54266.exe no specs unicorn-27624.exe no specs unicorn-25769.exe no specs unicorn-40068.exe no specs unicorn-3695.exe no specs unicorn-24116.exe no specs unicorn-40644.exe no specs unicorn-53088.exe no specs unicorn-11479.exe no specs unicorn-57151.exe no specs unicorn-23732.exe no specs unicorn-40260.exe no specs unicorn-3503.exe no specs unicorn-8142.exe no specs unicorn-56788.exe no specs unicorn-4427.exe no specs unicorn-16680.exe no specs unicorn-29124.exe no specs unicorn-38038.exe no specs unicorn-42122.exe no specs unicorn-2573.exe no specs unicorn-39522.exe no specs unicorn-65231.exe no specs unicorn-65496.exe no specs unicorn-65496.exe no specs unicorn-30777.exe no specs unicorn-59558.exe no specs unicorn-4982.exe no specs unicorn-37100.exe no specs unicorn-25402.exe no specs unicorn-12594.exe no specs unicorn-29129.exe no specs unicorn-62927.exe no specs unicorn-19485.exe no specs unicorn-49034.exe no specs unicorn-3917.exe no specs unicorn-9782.exe no specs unicorn-38179.exe no specs unicorn-38179.exe no specs unicorn-48842.exe no specs unicorn-18024.exe no specs unicorn-45827.exe no specs unicorn-40674.exe no specs unicorn-27344.exe no specs unicorn-43415.exe no specs unicorn-56124.exe no specs unicorn-59943.exe no specs unicorn-59943.exe no specs unicorn-54078.exe no specs unicorn-8961.exe no specs unicorn-15091.exe no specs unicorn-15091.exe no specs unicorn-60187.exe no specs unicorn-8385.exe no specs unicorn-8385.exe no specs unicorn-8385.exe no specs unicorn-22643.exe no specs unicorn-57778.exe no specs unicorn-57778.exe no specs unicorn-57778.exe no specs unicorn-4493.exe no specs unicorn-2223.exe no specs unicorn-10623.exe no specs unicorn-12661.exe no specs unicorn-12661.exe no specs unicorn-21021.exe no specs unicorn-47770.exe no specs unicorn-23763.exe no specs unicorn-19181.exe no specs unicorn-30149.exe no specs unicorn-18601.exe no specs unicorn-39594.exe no specs unicorn-64795.exe no specs unicorn-7426.exe no specs unicorn-7426.exe no specs unicorn-64298.exe no specs unicorn-23955.exe no specs unicorn-44640.exe no specs unicorn-6353.exe no specs unicorn-45554.exe no specs unicorn-22881.exe no specs unicorn-31547.exe no specs unicorn-50378.exe no specs unicorn-36088.exe no specs unicorn-3970.exe no specs unicorn-40170.exe no specs unicorn-654.exe no specs unicorn-43362.exe no specs unicorn-53384.exe no specs unicorn-9206.exe no specs unicorn-31817.exe no specs unicorn-34617.exe no specs unicorn-10990.exe no specs unicorn-34617.exe no specs unicorn-3726.exe no specs unicorn-49106.exe no specs unicorn-8770.exe no specs unicorn-4951.exe no specs unicorn-9035.exe no specs unicorn-58428.exe no specs unicorn-3097.exe no specs unicorn-31877.exe no specs unicorn-31877.exe no specs werfault.exe no specs unicorn-62491.exe no specs unicorn-8578.exe no specs unicorn-28693.exe no specs unicorn-45792.exe no specs unicorn-63643.exe no specs unicorn-28369.exe no specs unicorn-34235.exe no specs unicorn-61234.exe no specs unicorn-1562.exe no specs unicorn-2382.exe no specs unicorn-4758.exe no specs unicorn-24093.exe no specs unicorn-51568.exe no specs unicorn-48039.exe no specs unicorn-60483.exe no specs unicorn-26799.exe no specs unicorn-10535.exe no specs unicorn-63171.exe no specs unicorn-63436.exe no specs unicorn-34848.exe no specs slui.exe no specs unicorn-129.exe no specs unicorn-26854.exe no specs unicorn-13119.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208C:\Users\admin\AppData\Local\Temp\Unicorn-32541.exeC:\Users\admin\AppData\Local\Temp\Unicorn-32541.exe
Unicorn-48072.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-32541.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
496C:\Users\admin\AppData\Local\Temp\Unicorn-9649.exeC:\Users\admin\AppData\Local\Temp\Unicorn-9649.exe
Unicorn-53832.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-9649.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
536C:\Users\admin\AppData\Local\Temp\Unicorn-55319.exeC:\Users\admin\AppData\Local\Temp\Unicorn-55319.exe—Unicorn-33725.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-55319.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
668C:\Users\admin\AppData\Local\Temp\Unicorn-15539.exeC:\Users\admin\AppData\Local\Temp\Unicorn-15539.exe
Unicorn-63322.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-15539.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
900C:\Users\admin\AppData\Local\Temp\Unicorn-62143.exeC:\Users\admin\AppData\Local\Temp\Unicorn-62143.exe
Unicorn-7755.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-62143.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
960C:\Users\admin\AppData\Local\Temp\Unicorn-60132.exeC:\Users\admin\AppData\Local\Temp\Unicorn-60132.exe
Unicorn-9649.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-60132.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1072C:\Users\admin\AppData\Local\Temp\Unicorn-7563.exeC:\Users\admin\AppData\Local\Temp\Unicorn-7563.exe
Unicorn-49032.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-7563.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1088C:\Users\admin\AppData\Local\Temp\Unicorn-62615.exeC:\Users\admin\AppData\Local\Temp\Unicorn-62615.exe
Unicorn-60132.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-62615.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1164C:\Users\admin\AppData\Local\Temp\Unicorn-44320.exeC:\Users\admin\AppData\Local\Temp\Unicorn-44320.exe
Unicorn-49032.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-44320.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1240C:\Users\admin\AppData\Local\Temp\Unicorn-42850.exeC:\Users\admin\AppData\Local\Temp\Unicorn-42850.exe
Unicorn-53832.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-42850.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
Total events
9 611
Read events
9 596
Write events
15
Delete events
0

Modification events

(PID) Process:(3240) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3240) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3240) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7852) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7852) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7852) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7236) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7236) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7236) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8588) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
791
Suspicious files
5
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7728Unicorn-21200.exeC:\Users\admin\AppData\Local\Temp\Unicorn-57459.exeexecutable
MD5:3C9D2C7390113DF6C471B660F537322E
SHA256:61C96AC75C60FCF06D8828DA3EE40197A33E149AFF566950A3679991CACECDA5
7020Unicorn-53811.exeC:\Users\admin\AppData\Local\Temp\Unicorn-1673.exeexecutable
MD5:138D971D003557373AB14E88FFB3E794
SHA256:51510AF19A7D603617EF0C217FB05CA78CE18252C98F4325ECB0272DC510D6D4
496Unicorn-9649.exeC:\Users\admin\AppData\Local\Temp\Unicorn-60132.exeexecutable
MD5:29C73145E69FB2FFC126F8C2A7B999CF
SHA256:789DB5692F5E11BCECF5F62E8D5A3A8123CD05B8DA3AB02AC07983429C694F43
73641 (200).exeC:\Users\admin\AppData\Local\Temp\Unicorn-52555.exeexecutable
MD5:759B1DA828AC755A074CE2932E74B355
SHA256:CA49870DDB4AE0B973169D5971CEF80C718657EB10997FAF00019C5D5A962ECF
7728Unicorn-21200.exeC:\Users\admin\AppData\Local\Temp\Unicorn-53832.exeexecutable
MD5:42092B16AD5117EF7ACC5D8E116B1487
SHA256:173703EF3D9BF6772643E3F37DF2459F4A80D6B3BEF6BC7A5994318CF5EFF955
7408Unicorn-37802.exeC:\Users\admin\AppData\Local\Temp\Unicorn-46690.exeexecutable
MD5:25C4DF30AD955AD110FDF08A765BDABE
SHA256:6FF687770D737A68B32C22C14F16E6FA5826EB28907F17E974C8F6571557D49D
2140Unicorn-53832.exeC:\Users\admin\AppData\Local\Temp\Unicorn-7786.exeexecutable
MD5:B25BA9B5B5FD6940382948462BBA6E90
SHA256:33CA782E33C771072017ECB877C8495D0706AE2286734EAA642ABE39E5EDCAC7
2136Unicorn-53832.exeC:\Users\admin\AppData\Local\Temp\Unicorn-40458.exeexecutable
MD5:D853B6CFB576E725D0CC63A2DE3FFC9B
SHA256:88938043FF869A32E0AC96BFBB3ACCC3C116249A1FFA5B4BF1F0B1D7C359DE58
7408Unicorn-37802.exeC:\Users\admin\AppData\Local\Temp\Unicorn-31938.exeexecutable
MD5:92C155B07EBE9EC5D3CF0AC7A291C6D0
SHA256:F74EA1ECBAB6B823274D27B5D153C6981667A719A09D698AF00C2185673EE7BB
73641 (200).exeC:\Users\admin\AppData\Local\Temp\Unicorn-21200.exeexecutable
MD5:C2F5416F56E179B87A6B29B2EC2B3A89
SHA256:0A3F070DF487FA33C6D3BCFB04FA87322C5F6D03B51705AC29DD732ABAC0B575
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.150:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7952
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7952
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7852
BackgroundTransferHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7624
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.150:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5176
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 23.48.23.150
  • 23.48.23.147
  • 23.48.23.157
  • 23.48.23.141
  • 23.48.23.140
  • 23.48.23.143
  • 23.48.23.144
  • 23.48.23.148
  • 23.48.23.153
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.159.129
  • 40.126.31.67
  • 20.190.159.130
  • 20.190.159.75
  • 40.126.31.130
  • 40.126.31.128
  • 20.190.159.73
  • 40.126.31.71
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 104.126.37.139
  • 104.126.37.130
  • 104.126.37.186
  • 104.126.37.128
  • 104.126.37.131
  • 104.126.37.178
  • 104.126.37.179
  • 104.126.37.171
  • 104.126.37.185
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (200)