File name:

1 (150)

Full analysis: https://app.any.run/tasks/6f4eb616-87c5-40da-96e8-24de5e6af73c
Verdict: Malicious activity
Analysis date: March 24, 2025, 17:16:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

3C0016F6C4585A313E05A352DDD06CE0

SHA1:

7AC406A37593169372F11BBCDA540F494218CA5F

SHA256:

D72514D16DD8B4FFB517036FB70FAE697662C0849DA94BCC5E9A060ABD4FE516

SSDEEP:

6144:7RNgAKIBvDKHAk9XTZeyGvfC4KBqlvJGBCIW2evdak/8SwjwpyivEhtvCNEAslna:73ZxoHAkdTY+BMhaCz2evdmx4DxmDsR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 1 (150).exe (PID: 4428)
      • Unicorn-7906.exe (PID: 7728)
      • Unicorn-49048.exe (PID: 7392)
      • Unicorn-48192.exe (PID: 7704)
      • Unicorn-57787.exe (PID: 7856)
      • Unicorn-30268.exe (PID: 7892)
      • Unicorn-14900.exe (PID: 7912)
      • Unicorn-40164.exe (PID: 7952)
      • Unicorn-3962.exe (PID: 7972)
      • Unicorn-2265.exe (PID: 8044)
      • Unicorn-63983.exe (PID: 8020)
      • Unicorn-52608.exe (PID: 7988)
      • Unicorn-34906.exe (PID: 7876)
      • Unicorn-48202.exe (PID: 8060)
      • Unicorn-61098.exe (PID: 7296)
      • Unicorn-58638.exe (PID: 1912)
      • Unicorn-17033.exe (PID: 7260)
      • Unicorn-22095.exe (PID: 7324)
      • Unicorn-35608.exe (PID: 7280)
      • Unicorn-5628.exe (PID: 7308)
      • Unicorn-1290.exe (PID: 7172)
      • Unicorn-1290.exe (PID: 7244)
      • Unicorn-22951.exe (PID: 8004)
      • Unicorn-10527.exe (PID: 7368)
      • Unicorn-28024.exe (PID: 7592)
      • Unicorn-16820.exe (PID: 8012)
      • Unicorn-27610.exe (PID: 728)
      • Unicorn-63485.exe (PID: 1388)
      • Unicorn-25337.exe (PID: 5984)
      • Unicorn-5239.exe (PID: 7944)
      • Unicorn-20677.exe (PID: 1568)
      • Unicorn-58716.exe (PID: 3176)
      • Unicorn-18430.exe (PID: 1512)
      • Unicorn-1394.exe (PID: 4224)
      • Unicorn-13573.exe (PID: 1804)
      • Unicorn-21130.exe (PID: 6192)
      • Unicorn-5649.exe (PID: 8116)
      • Unicorn-22500.exe (PID: 8156)
      • Unicorn-41066.exe (PID: 7640)
      • Unicorn-1202.exe (PID: 7432)
      • Unicorn-1093.exe (PID: 7444)
      • Unicorn-19765.exe (PID: 7380)
      • Unicorn-46319.exe (PID: 7464)
      • Unicorn-20746.exe (PID: 7628)
      • Unicorn-20746.exe (PID: 7632)
      • Unicorn-25384.exe (PID: 7472)
      • Unicorn-22260.exe (PID: 4244)
      • Unicorn-1093.exe (PID: 7684)
      • Unicorn-116.exe (PID: 5640)
      • Unicorn-44072.exe (PID: 1628)
      • Unicorn-27610.exe (PID: 4920)
      • Unicorn-1093.exe (PID: 7460)
      • Unicorn-1093.exe (PID: 7692)
      • Unicorn-46765.exe (PID: 6540)
      • Unicorn-43287.exe (PID: 7292)
      • Unicorn-43387.exe (PID: 3300)
      • Unicorn-12972.exe (PID: 7384)
      • Unicorn-13645.exe (PID: 4724)
      • Unicorn-29551.exe (PID: 1532)
      • Unicorn-30180.exe (PID: 6644)
      • Unicorn-40948.exe (PID: 7752)
      • Unicorn-47211.exe (PID: 3156)
      • Unicorn-12451.exe (PID: 664)
      • Unicorn-7699.exe (PID: 7252)
      • Unicorn-44326.exe (PID: 5588)
      • Unicorn-59915.exe (PID: 4300)
      • Unicorn-50749.exe (PID: 2552)
      • Unicorn-63926.exe (PID: 8176)
      • Unicorn-44731.exe (PID: 7436)
      • Unicorn-51045.exe (PID: 208)
      • Unicorn-5514.exe (PID: 7788)
      • Unicorn-65343.exe (PID: 7832)
      • Unicorn-65514.exe (PID: 8220)
      • Unicorn-39194.exe (PID: 7156)
      • Unicorn-4575.exe (PID: 8240)
      • Unicorn-17958.exe (PID: 8300)
      • Unicorn-32863.exe (PID: 8320)
      • Unicorn-60196.exe (PID: 8260)
      • Unicorn-23608.exe (PID: 8360)
      • Unicorn-365.exe (PID: 8424)
      • Unicorn-38483.exe (PID: 8612)
      • Unicorn-10470.exe (PID: 8660)
      • Unicorn-60403.exe (PID: 8716)
      • Unicorn-20646.exe (PID: 8636)
      • Unicorn-47346.exe (PID: 8676)
      • Unicorn-33844.exe (PID: 8788)
      • Unicorn-9209.exe (PID: 8820)
      • Unicorn-33630.exe (PID: 8772)
      • Unicorn-8955.exe (PID: 8840)
      • Unicorn-44835.exe (PID: 8868)
      • Unicorn-27430.exe (PID: 8860)
      • Unicorn-28691.exe (PID: 8920)
      • Unicorn-13122.exe (PID: 8940)
      • Unicorn-42972.exe (PID: 8972)
      • Unicorn-53003.exe (PID: 8876)
      • Unicorn-14061.exe (PID: 9004)
      • Unicorn-42972.exe (PID: 8964)
      • Unicorn-14362.exe (PID: 9044)
      • Unicorn-14061.exe (PID: 9008)
      • Unicorn-55416.exe (PID: 9028)
      • Unicorn-60962.exe (PID: 9076)
      • Unicorn-41711.exe (PID: 9104)
      • Unicorn-58139.exe (PID: 9124)
      • Unicorn-13677.exe (PID: 9148)
      • Unicorn-22863.exe (PID: 8316)
      • Unicorn-63091.exe (PID: 9212)
      • Unicorn-63200.exe (PID: 9140)
      • Unicorn-34503.exe (PID: 5776)
      • Unicorn-46947.exe (PID: 5324)
      • Unicorn-22421.exe (PID: 8388)
      • Unicorn-34809.exe (PID: 3268)
      • Unicorn-22997.exe (PID: 6816)
      • Unicorn-61730.exe (PID: 8600)
      • Unicorn-42287.exe (PID: 8400)
      • Unicorn-34923.exe (PID: 8796)
      • Unicorn-51716.exe (PID: 8928)
      • Unicorn-22613.exe (PID: 2644)
      • Unicorn-43316.exe (PID: 8916)
      • Unicorn-10683.exe (PID: 968)
      • Unicorn-50630.exe (PID: 8816)
      • Unicorn-39654.exe (PID: 9240)
      • Unicorn-56376.exe (PID: 9272)
      • Unicorn-7699.exe (PID: 1128)
      • Unicorn-65130.exe (PID: 9400)
      • Unicorn-33792.exe (PID: 9428)
      • Unicorn-48675.exe (PID: 9480)
      • Unicorn-8197.exe (PID: 9364)
      • Unicorn-24555.exe (PID: 9436)
      • Unicorn-38400.exe (PID: 8272)
      • Unicorn-19000.exe (PID: 9564)
      • Unicorn-48675.exe (PID: 9472)
      • Unicorn-54020.exe (PID: 9548)
      • Unicorn-15985.exe (PID: 9580)
      • Unicorn-46490.exe (PID: 9628)
      • Unicorn-48675.exe (PID: 9464)
      • Unicorn-38379.exe (PID: 9620)
      • Unicorn-26008.exe (PID: 9716)
      • Unicorn-38846.exe (PID: 7532)
      • Unicorn-4518.exe (PID: 9708)
      • Unicorn-7258.exe (PID: 9776)
      • Unicorn-56849.exe (PID: 9684)
      • Unicorn-46620.exe (PID: 9740)
      • Unicorn-18778.exe (PID: 9612)
      • Unicorn-59256.exe (PID: 9668)
      • Unicorn-7480.exe (PID: 9756)
      • Unicorn-17695.exe (PID: 9876)
      • Unicorn-22656.exe (PID: 9840)
      • Unicorn-49390.exe (PID: 9860)
      • Unicorn-40123.exe (PID: 9332)
      • Unicorn-2873.exe (PID: 9900)
      • Unicorn-11534.exe (PID: 9916)
      • Unicorn-2354.exe (PID: 9784)
      • Unicorn-60543.exe (PID: 9804)
      • Unicorn-14871.exe (PID: 9812)
      • Unicorn-10979.exe (PID: 9936)
      • Unicorn-10979.exe (PID: 9944)
      • Unicorn-2042.exe (PID: 9980)
      • Unicorn-60927.exe (PID: 9996)
      • Unicorn-34154.exe (PID: 9532)
      • Unicorn-29628.exe (PID: 10016)
      • Unicorn-4710.exe (PID: 10040)
      • Unicorn-60948.exe (PID: 10088)
      • Unicorn-3086.exe (PID: 10032)
      • Unicorn-48888.exe (PID: 10148)
      • Unicorn-20802.exe (PID: 10156)
      • Unicorn-24467.exe (PID: 10192)
      • Unicorn-21705.exe (PID: 3956)
      • Unicorn-52270.exe (PID: 2656)
      • Unicorn-7014.exe (PID: 7084)
      • Unicorn-62490.exe (PID: 8448)
      • Unicorn-35110.exe (PID: 10080)
      • Unicorn-6267.exe (PID: 6028)
      • Unicorn-26880.exe (PID: 6068)
      • Unicorn-23049.exe (PID: 10336)
      • Unicorn-4814.exe (PID: 10184)
      • Unicorn-521.exe (PID: 10388)
      • Unicorn-64404.exe (PID: 10360)
      • Unicorn-64575.exe (PID: 10404)
      • Unicorn-19733.exe (PID: 10516)
      • Unicorn-7481.exe (PID: 10564)
      • Unicorn-1799.exe (PID: 10268)

    • Starts itself from another location

      • 1 (150).exe (PID: 4428)
      • Unicorn-48192.exe (PID: 7704)
      • Unicorn-57787.exe (PID: 7856)
      • Unicorn-34906.exe (PID: 7876)
      • Unicorn-7906.exe (PID: 7728)
      • Unicorn-14900.exe (PID: 7912)
      • Unicorn-30268.exe (PID: 7892)
      • Unicorn-49048.exe (PID: 7392)
      • Unicorn-40164.exe (PID: 7952)
      • Unicorn-52608.exe (PID: 7988)
      • Unicorn-3962.exe (PID: 7972)
      • Unicorn-16820.exe (PID: 8012)
      • Unicorn-2265.exe (PID: 8044)
      • Unicorn-61098.exe (PID: 7296)
      • Unicorn-58638.exe (PID: 1912)
      • Unicorn-63983.exe (PID: 8020)
      • Unicorn-17033.exe (PID: 7260)
      • Unicorn-35608.exe (PID: 7280)
      • Unicorn-1290.exe (PID: 7244)
      • Unicorn-5628.exe (PID: 7308)
      • Unicorn-1290.exe (PID: 7172)
      • Unicorn-22951.exe (PID: 8004)
      • Unicorn-48202.exe (PID: 8060)
      • Unicorn-10527.exe (PID: 7368)
      • Unicorn-27610.exe (PID: 4920)
      • Unicorn-12972.exe (PID: 7384)
      • Unicorn-47211.exe (PID: 3156)
      • Unicorn-28024.exe (PID: 7592)
      • Unicorn-19765.exe (PID: 7380)
      • Unicorn-27610.exe (PID: 728)
      • Unicorn-63485.exe (PID: 1388)
      • Unicorn-25337.exe (PID: 5984)
      • Unicorn-50749.exe (PID: 2552)
      • Unicorn-22095.exe (PID: 7324)
      • Unicorn-5239.exe (PID: 7944)
      • Unicorn-20677.exe (PID: 1568)
      • Unicorn-58716.exe (PID: 3176)
      • Unicorn-18430.exe (PID: 1512)
      • Unicorn-1394.exe (PID: 4224)
      • Unicorn-13573.exe (PID: 1804)
      • Unicorn-21130.exe (PID: 6192)
      • Unicorn-5649.exe (PID: 8116)
      • Unicorn-22500.exe (PID: 8156)
      • Unicorn-41066.exe (PID: 7640)
      • Unicorn-1202.exe (PID: 7432)
      • Unicorn-1093.exe (PID: 7444)
      • Unicorn-46319.exe (PID: 7464)
      • Unicorn-20746.exe (PID: 7628)
      • Unicorn-22260.exe (PID: 4244)
      • Unicorn-1093.exe (PID: 7684)
      • Unicorn-38846.exe (PID: 7532)
      • Unicorn-116.exe (PID: 5640)
      • Unicorn-20746.exe (PID: 7632)
      • Unicorn-25384.exe (PID: 7472)
      • Unicorn-44072.exe (PID: 1628)
      • Unicorn-1093.exe (PID: 7460)
      • Unicorn-1093.exe (PID: 7692)
      • Unicorn-46765.exe (PID: 6540)
      • Unicorn-43287.exe (PID: 7292)
      • Unicorn-43387.exe (PID: 3300)
      • Unicorn-13645.exe (PID: 4724)
      • Unicorn-29551.exe (PID: 1532)
      • Unicorn-12451.exe (PID: 664)
      • Unicorn-7699.exe (PID: 7252)
      • Unicorn-44326.exe (PID: 5588)
      • Unicorn-40948.exe (PID: 7752)
      • Unicorn-59915.exe (PID: 4300)
      • Unicorn-58061.exe (PID: 8184)
      • Unicorn-63926.exe (PID: 8176)
      • Unicorn-7699.exe (PID: 1128)
      • Unicorn-5514.exe (PID: 7788)
      • Unicorn-51045.exe (PID: 208)
      • Unicorn-44731.exe (PID: 7436)
      • Unicorn-65343.exe (PID: 7832)
      • Unicorn-65514.exe (PID: 8220)
      • Unicorn-39194.exe (PID: 7156)
      • Unicorn-60196.exe (PID: 8260)
      • Unicorn-38400.exe (PID: 8272)
      • Unicorn-17958.exe (PID: 8300)
      • Unicorn-32863.exe (PID: 8320)
      • Unicorn-30180.exe (PID: 6644)
      • Unicorn-4575.exe (PID: 8240)
      • Unicorn-23608.exe (PID: 8360)
      • Unicorn-365.exe (PID: 8424)
      • Unicorn-38483.exe (PID: 8612)
      • Unicorn-10470.exe (PID: 8660)
      • Unicorn-47346.exe (PID: 8676)
      • Unicorn-60403.exe (PID: 8716)
      • Unicorn-20646.exe (PID: 8636)
      • Unicorn-33844.exe (PID: 8788)
      • Unicorn-8955.exe (PID: 8840)
      • Unicorn-44835.exe (PID: 8868)
      • Unicorn-27430.exe (PID: 8860)
      • Unicorn-9209.exe (PID: 8820)
      • Unicorn-28691.exe (PID: 8920)
      • Unicorn-13122.exe (PID: 8940)
      • Unicorn-53003.exe (PID: 8876)
      • Unicorn-14061.exe (PID: 9004)
      • Unicorn-42972.exe (PID: 8964)
      • Unicorn-14362.exe (PID: 9044)
      • Unicorn-42972.exe (PID: 8972)
      • Unicorn-55416.exe (PID: 9028)
      • Unicorn-60962.exe (PID: 9076)
      • Unicorn-41711.exe (PID: 9104)
      • Unicorn-14061.exe (PID: 9008)
      • Unicorn-58139.exe (PID: 9124)
      • Unicorn-22863.exe (PID: 8316)
      • Unicorn-13677.exe (PID: 9148)
      • Unicorn-63091.exe (PID: 9212)
      • Unicorn-63200.exe (PID: 9140)
      • Unicorn-22997.exe (PID: 6816)
      • Unicorn-34809.exe (PID: 3268)
      • Unicorn-34503.exe (PID: 5776)
      • Unicorn-46947.exe (PID: 5324)
      • Unicorn-61730.exe (PID: 8600)
      • Unicorn-42287.exe (PID: 8400)
      • Unicorn-34923.exe (PID: 8796)
      • Unicorn-22421.exe (PID: 8388)
      • Unicorn-22613.exe (PID: 2644)
      • Unicorn-51716.exe (PID: 8928)
      • Unicorn-10683.exe (PID: 968)
      • Unicorn-39654.exe (PID: 9240)
      • Unicorn-43316.exe (PID: 8916)
      • Unicorn-50630.exe (PID: 8816)
      • Unicorn-56376.exe (PID: 9272)
      • Unicorn-40123.exe (PID: 9332)

  • INFO

    • The sample compiled with chinese language support

      • 1 (150).exe (PID: 4428)
      • Unicorn-49048.exe (PID: 7392)
      • Unicorn-61098.exe (PID: 7296)
      • Unicorn-40164.exe (PID: 7952)
      • Unicorn-58638.exe (PID: 1912)
      • Unicorn-57787.exe (PID: 7856)
      • Unicorn-63983.exe (PID: 8020)
      • Unicorn-17033.exe (PID: 7260)
      • Unicorn-48192.exe (PID: 7704)
      • Unicorn-22095.exe (PID: 7324)
      • Unicorn-52608.exe (PID: 7988)
      • Unicorn-35608.exe (PID: 7280)
      • Unicorn-34906.exe (PID: 7876)
      • Unicorn-1290.exe (PID: 7244)
      • Unicorn-1290.exe (PID: 7172)
      • Unicorn-5628.exe (PID: 7308)
      • Unicorn-22951.exe (PID: 8004)
      • Unicorn-10527.exe (PID: 7368)
      • Unicorn-28024.exe (PID: 7592)
      • Unicorn-16820.exe (PID: 8012)
      • Unicorn-27610.exe (PID: 728)
      • Unicorn-30268.exe (PID: 7892)
      • Unicorn-2265.exe (PID: 8044)
      • Unicorn-48202.exe (PID: 8060)
      • Unicorn-7906.exe (PID: 7728)
      • Unicorn-63485.exe (PID: 1388)
      • Unicorn-25337.exe (PID: 5984)
      • Unicorn-14900.exe (PID: 7912)
      • Unicorn-5239.exe (PID: 7944)
      • Unicorn-18430.exe (PID: 1512)
      • Unicorn-3962.exe (PID: 7972)
      • Unicorn-20677.exe (PID: 1568)
      • Unicorn-58716.exe (PID: 3176)
      • Unicorn-13573.exe (PID: 1804)
      • Unicorn-1394.exe (PID: 4224)
      • Unicorn-21130.exe (PID: 6192)
      • Unicorn-5649.exe (PID: 8116)
      • Unicorn-22500.exe (PID: 8156)
      • Unicorn-41066.exe (PID: 7640)
      • Unicorn-1202.exe (PID: 7432)
      • Unicorn-19765.exe (PID: 7380)
      • Unicorn-46319.exe (PID: 7464)
      • Unicorn-20746.exe (PID: 7628)
      • Unicorn-20746.exe (PID: 7632)
      • Unicorn-1093.exe (PID: 7444)
      • Unicorn-25384.exe (PID: 7472)
      • Unicorn-22260.exe (PID: 4244)
      • Unicorn-1093.exe (PID: 7684)
      • Unicorn-116.exe (PID: 5640)
      • Unicorn-44072.exe (PID: 1628)
      • Unicorn-27610.exe (PID: 4920)
      • Unicorn-1093.exe (PID: 7460)
      • Unicorn-1093.exe (PID: 7692)
      • Unicorn-43287.exe (PID: 7292)
      • Unicorn-43387.exe (PID: 3300)
      • Unicorn-12972.exe (PID: 7384)
      • Unicorn-46765.exe (PID: 6540)
      • Unicorn-47211.exe (PID: 3156)
      • Unicorn-30180.exe (PID: 6644)
      • Unicorn-13645.exe (PID: 4724)
      • Unicorn-29551.exe (PID: 1532)
      • Unicorn-40948.exe (PID: 7752)
      • Unicorn-44326.exe (PID: 5588)
      • Unicorn-7699.exe (PID: 7252)
      • Unicorn-12451.exe (PID: 664)
      • Unicorn-50749.exe (PID: 2552)
      • Unicorn-63926.exe (PID: 8176)
      • Unicorn-59915.exe (PID: 4300)
      • Unicorn-44731.exe (PID: 7436)
      • Unicorn-51045.exe (PID: 208)
      • Unicorn-65343.exe (PID: 7832)
      • Unicorn-5514.exe (PID: 7788)
      • Unicorn-65514.exe (PID: 8220)
      • Unicorn-39194.exe (PID: 7156)
      • Unicorn-60196.exe (PID: 8260)
      • Unicorn-17958.exe (PID: 8300)
      • Unicorn-32863.exe (PID: 8320)
      • Unicorn-4575.exe (PID: 8240)
      • Unicorn-365.exe (PID: 8424)
      • Unicorn-38483.exe (PID: 8612)
      • Unicorn-23608.exe (PID: 8360)
      • Unicorn-10470.exe (PID: 8660)
      • Unicorn-47346.exe (PID: 8676)
      • Unicorn-60403.exe (PID: 8716)
      • Unicorn-20646.exe (PID: 8636)
      • Unicorn-33630.exe (PID: 8772)
      • Unicorn-33844.exe (PID: 8788)
      • Unicorn-44835.exe (PID: 8868)
      • Unicorn-27430.exe (PID: 8860)
      • Unicorn-9209.exe (PID: 8820)
      • Unicorn-8955.exe (PID: 8840)
      • Unicorn-13122.exe (PID: 8940)
      • Unicorn-53003.exe (PID: 8876)
      • Unicorn-28691.exe (PID: 8920)
      • Unicorn-14061.exe (PID: 9004)
      • Unicorn-42972.exe (PID: 8964)
      • Unicorn-14362.exe (PID: 9044)
      • Unicorn-42972.exe (PID: 8972)
      • Unicorn-55416.exe (PID: 9028)
      • Unicorn-60962.exe (PID: 9076)
      • Unicorn-41711.exe (PID: 9104)
      • Unicorn-14061.exe (PID: 9008)
      • Unicorn-22863.exe (PID: 8316)
      • Unicorn-13677.exe (PID: 9148)
      • Unicorn-63091.exe (PID: 9212)
      • Unicorn-58139.exe (PID: 9124)
      • Unicorn-63200.exe (PID: 9140)
      • Unicorn-34809.exe (PID: 3268)
      • Unicorn-22997.exe (PID: 6816)
      • Unicorn-34503.exe (PID: 5776)
      • Unicorn-46947.exe (PID: 5324)
      • Unicorn-61730.exe (PID: 8600)
      • Unicorn-42287.exe (PID: 8400)
      • Unicorn-34923.exe (PID: 8796)
      • Unicorn-22421.exe (PID: 8388)
      • Unicorn-51716.exe (PID: 8928)
      • Unicorn-43316.exe (PID: 8916)
      • Unicorn-10683.exe (PID: 968)
      • Unicorn-50630.exe (PID: 8816)
      • Unicorn-39654.exe (PID: 9240)
      • Unicorn-22613.exe (PID: 2644)
      • Unicorn-7699.exe (PID: 1128)
      • Unicorn-56376.exe (PID: 9272)
      • Unicorn-8197.exe (PID: 9364)
      • Unicorn-33792.exe (PID: 9428)
      • Unicorn-65130.exe (PID: 9400)
      • Unicorn-38400.exe (PID: 8272)
      • Unicorn-24555.exe (PID: 9436)
      • Unicorn-48675.exe (PID: 9472)
      • Unicorn-19000.exe (PID: 9564)
      • Unicorn-54020.exe (PID: 9548)
      • Unicorn-15985.exe (PID: 9580)
      • Unicorn-46490.exe (PID: 9628)
      • Unicorn-48675.exe (PID: 9480)
      • Unicorn-48675.exe (PID: 9464)
      • Unicorn-38379.exe (PID: 9620)
      • Unicorn-59256.exe (PID: 9668)
      • Unicorn-38846.exe (PID: 7532)
      • Unicorn-7258.exe (PID: 9776)
      • Unicorn-26008.exe (PID: 9716)
      • Unicorn-56849.exe (PID: 9684)
      • Unicorn-4518.exe (PID: 9708)
      • Unicorn-46620.exe (PID: 9740)
      • Unicorn-18778.exe (PID: 9612)
      • Unicorn-7480.exe (PID: 9756)
      • Unicorn-17695.exe (PID: 9876)
      • Unicorn-60543.exe (PID: 9804)
      • Unicorn-14871.exe (PID: 9812)
      • Unicorn-49390.exe (PID: 9860)
      • Unicorn-40123.exe (PID: 9332)
      • Unicorn-2873.exe (PID: 9900)
      • Unicorn-2354.exe (PID: 9784)
      • Unicorn-22656.exe (PID: 9840)
      • Unicorn-10979.exe (PID: 9936)
      • Unicorn-2042.exe (PID: 9980)
      • Unicorn-60927.exe (PID: 9996)
      • Unicorn-34154.exe (PID: 9532)
      • Unicorn-3086.exe (PID: 10032)
      • Unicorn-29628.exe (PID: 10016)
      • Unicorn-4710.exe (PID: 10040)
      • Unicorn-11534.exe (PID: 9916)
      • Unicorn-10979.exe (PID: 9944)
      • Unicorn-48888.exe (PID: 10148)
      • Unicorn-7014.exe (PID: 7084)
      • Unicorn-20802.exe (PID: 10156)
      • Unicorn-24467.exe (PID: 10192)
      • Unicorn-21705.exe (PID: 3956)
      • Unicorn-52270.exe (PID: 2656)
      • Unicorn-6267.exe (PID: 6028)
      • Unicorn-60948.exe (PID: 10088)
      • Unicorn-35110.exe (PID: 10080)
      • Unicorn-521.exe (PID: 10388)
      • Unicorn-26880.exe (PID: 6068)
      • Unicorn-23049.exe (PID: 10336)
      • Unicorn-4814.exe (PID: 10184)
      • Unicorn-64404.exe (PID: 10360)
      • Unicorn-64575.exe (PID: 10404)
      • Unicorn-19733.exe (PID: 10516)
      • Unicorn-62490.exe (PID: 8448)
      • Unicorn-1799.exe (PID: 10268)
      • Unicorn-7481.exe (PID: 10564)
      • Unicorn-7481.exe (PID: 10548)
      • Unicorn-4688.exe (PID: 10496)

    • Checks supported languages

      • Unicorn-49048.exe (PID: 7392)
      • Unicorn-48192.exe (PID: 7704)
      • 1 (150).exe (PID: 4428)
      • Unicorn-7906.exe (PID: 7728)
      • Unicorn-57787.exe (PID: 7856)
      • Unicorn-30268.exe (PID: 7892)
      • Unicorn-14900.exe (PID: 7912)
      • Unicorn-34906.exe (PID: 7876)
      • Unicorn-3962.exe (PID: 7972)
      • Unicorn-16820.exe (PID: 8012)
      • Unicorn-48202.exe (PID: 8060)
      • Unicorn-22951.exe (PID: 8004)
      • Unicorn-2265.exe (PID: 8044)
      • Unicorn-63983.exe (PID: 8020)
      • Unicorn-58638.exe (PID: 1912)
      • Unicorn-22095.exe (PID: 7324)
      • Unicorn-17033.exe (PID: 7260)
      • Unicorn-35608.exe (PID: 7280)
      • Unicorn-19765.exe (PID: 7380)
      • Unicorn-40164.exe (PID: 7952)
      • Unicorn-25337.exe (PID: 5984)
      • Unicorn-13573.exe (PID: 1804)
      • Unicorn-22500.exe (PID: 8156)
      • Unicorn-1202.exe (PID: 7432)
      • Unicorn-25384.exe (PID: 7472)
      • Unicorn-46319.exe (PID: 7464)
      • Unicorn-20746.exe (PID: 7628)
      • Unicorn-44072.exe (PID: 1628)
      • Unicorn-20746.exe (PID: 7632)
      • Unicorn-1093.exe (PID: 7444)
      • Unicorn-13645.exe (PID: 4724)
      • Unicorn-38846.exe (PID: 7532)
      • Unicorn-43387.exe (PID: 3300)
      • Unicorn-29551.exe (PID: 1532)
      • Unicorn-46765.exe (PID: 6540)
      • Unicorn-40948.exe (PID: 7752)
      • Unicorn-7699.exe (PID: 1128)
      • Unicorn-58061.exe (PID: 8184)
      • Unicorn-51045.exe (PID: 208)
      • Unicorn-65343.exe (PID: 7832)
      • Unicorn-5514.exe (PID: 7788)
      • Unicorn-65514.exe (PID: 8220)
      • Unicorn-38400.exe (PID: 8272)
      • Unicorn-32863.exe (PID: 8320)
      • Unicorn-33630.exe (PID: 8772)
      • Unicorn-9209.exe (PID: 8820)
      • Unicorn-27430.exe (PID: 8860)
      • Unicorn-53003.exe (PID: 8876)
      • Unicorn-14061.exe (PID: 9008)
      • Unicorn-14362.exe (PID: 9044)
      • Unicorn-14061.exe (PID: 9004)
      • Unicorn-63926.exe (PID: 8176)
      • Unicorn-42972.exe (PID: 8964)
      • Unicorn-63091.exe (PID: 9212)
      • Unicorn-34809.exe (PID: 3268)
      • Unicorn-13677.exe (PID: 9148)
      • Unicorn-42287.exe (PID: 8400)
      • Unicorn-22421.exe (PID: 8388)
      • Unicorn-10683.exe (PID: 968)
      • Unicorn-39654.exe (PID: 9240)
      • Unicorn-33792.exe (PID: 9428)
      • Unicorn-24555.exe (PID: 9436)
      • Unicorn-48675.exe (PID: 9480)
      • Unicorn-34154.exe (PID: 9532)
      • Unicorn-19000.exe (PID: 9564)
      • Unicorn-46490.exe (PID: 9628)
      • Unicorn-48675.exe (PID: 9464)
      • Unicorn-4518.exe (PID: 9708)
      • Unicorn-56849.exe (PID: 9684)
      • Unicorn-7258.exe (PID: 9776)
      • Unicorn-2354.exe (PID: 9784)
      • Unicorn-60543.exe (PID: 9804)
      • Unicorn-46620.exe (PID: 9740)
      • Unicorn-29628.exe (PID: 10016)
      • Unicorn-35110.exe (PID: 10080)
      • Unicorn-17695.exe (PID: 9876)
      • Unicorn-4710.exe (PID: 10040)
      • Unicorn-20802.exe (PID: 10156)
      • Unicorn-24467.exe (PID: 10192)
      • Unicorn-21705.exe (PID: 3956)
      • Unicorn-7014.exe (PID: 7084)
      • Unicorn-26880.exe (PID: 6068)
      • Unicorn-4814.exe (PID: 10184)
      • Unicorn-64404.exe (PID: 10360)
      • Unicorn-51960.exe (PID: 10480)
      • Unicorn-7481.exe (PID: 10552)
      • Unicorn-7481.exe (PID: 10564)
      • Unicorn-12058.exe (PID: 10616)
      • Unicorn-43854.exe (PID: 10640)
      • Unicorn-521.exe (PID: 10388)
      • Unicorn-40284.exe (PID: 10668)
      • Unicorn-15923.exe (PID: 10852)
      • Unicorn-29222.exe (PID: 10896)
      • Unicorn-33498.exe (PID: 11024)
      • Unicorn-39281.exe (PID: 11000)
      • Unicorn-63762.exe (PID: 11056)
      • Unicorn-8439.exe (PID: 11072)
      • Unicorn-47042.exe (PID: 10904)
      • Unicorn-47509.exe (PID: 11184)
      • Unicorn-53639.exe (PID: 11208)
      • Unicorn-16115.exe (PID: 11236)
      • Unicorn-65507.exe (PID: 11316)
      • Unicorn-65129.exe (PID: 11224)
      • Unicorn-21118.exe (PID: 11356)
      • Unicorn-30588.exe (PID: 11384)
      • Unicorn-17267.exe (PID: 11392)
      • Unicorn-29135.exe (PID: 11544)
      • Unicorn-30204.exe (PID: 11564)
      • Unicorn-29327.exe (PID: 11624)
      • Unicorn-26312.exe (PID: 11672)
      • Unicorn-50899.exe (PID: 11744)
      • Unicorn-4905.exe (PID: 11752)
      • Unicorn-7214.exe (PID: 11936)
      • Unicorn-52736.exe (PID: 12068)
      • Unicorn-52087.exe (PID: 12140)
      • Unicorn-119.exe (PID: 12208)
      • Unicorn-62856.exe (PID: 12200)
      • Unicorn-32761.exe (PID: 4692)
      • Unicorn-43752.exe (PID: 12252)
      • Unicorn-45014.exe (PID: 6960)
      • Unicorn-7214.exe (PID: 11928)
      • Unicorn-24532.exe (PID: 12284)
      • Unicorn-38713.exe (PID: 12344)
      • Unicorn-24532.exe (PID: 12292)
      • Unicorn-16809.exe (PID: 12316)
      • Unicorn-27744.exe (PID: 12336)
      • Unicorn-33529.exe (PID: 12392)
      • Unicorn-37146.exe (PID: 3396)
      • Unicorn-12642.exe (PID: 11484)
      • Unicorn-60957.exe (PID: 4452)

    • Create files in a temporary directory

      • 1 (150).exe (PID: 4428)
      • Unicorn-7906.exe (PID: 7728)
      • Unicorn-34906.exe (PID: 7876)
      • Unicorn-14900.exe (PID: 7912)
      • Unicorn-63983.exe (PID: 8020)
      • Unicorn-3962.exe (PID: 7972)
      • Unicorn-2265.exe (PID: 8044)
      • Unicorn-48202.exe (PID: 8060)
      • Unicorn-49048.exe (PID: 7392)
      • Unicorn-61098.exe (PID: 7296)
      • Unicorn-57787.exe (PID: 7856)
      • Unicorn-17033.exe (PID: 7260)
      • Unicorn-48192.exe (PID: 7704)
      • Unicorn-35608.exe (PID: 7280)
      • Unicorn-22951.exe (PID: 8004)
      • Unicorn-30268.exe (PID: 7892)
      • Unicorn-10527.exe (PID: 7368)
      • Unicorn-28024.exe (PID: 7592)
      • Unicorn-27610.exe (PID: 728)
      • Unicorn-63485.exe (PID: 1388)
      • Unicorn-40164.exe (PID: 7952)
      • Unicorn-5239.exe (PID: 7944)
      • Unicorn-20677.exe (PID: 1568)
      • Unicorn-58716.exe (PID: 3176)
      • Unicorn-13573.exe (PID: 1804)
      • Unicorn-21130.exe (PID: 6192)
      • Unicorn-52608.exe (PID: 7988)
      • Unicorn-5628.exe (PID: 7308)
      • Unicorn-19765.exe (PID: 7380)
      • Unicorn-20746.exe (PID: 7632)
      • Unicorn-20746.exe (PID: 7628)
      • Unicorn-25384.exe (PID: 7472)
      • Unicorn-116.exe (PID: 5640)
      • Unicorn-44072.exe (PID: 1628)
      • Unicorn-27610.exe (PID: 4920)
      • Unicorn-43287.exe (PID: 7292)
      • Unicorn-12972.exe (PID: 7384)
      • Unicorn-47211.exe (PID: 3156)
      • Unicorn-25337.exe (PID: 5984)
      • Unicorn-7699.exe (PID: 7252)
      • Unicorn-63926.exe (PID: 8176)
      • Unicorn-58638.exe (PID: 1912)
      • Unicorn-44731.exe (PID: 7436)
      • Unicorn-51045.exe (PID: 208)
      • Unicorn-65343.exe (PID: 7832)
      • Unicorn-65514.exe (PID: 8220)
      • Unicorn-39194.exe (PID: 7156)
      • Unicorn-4575.exe (PID: 8240)
      • Unicorn-13645.exe (PID: 4724)
      • Unicorn-1394.exe (PID: 4224)
      • Unicorn-23608.exe (PID: 8360)
      • Unicorn-41066.exe (PID: 7640)
      • Unicorn-47346.exe (PID: 8676)
      • Unicorn-1202.exe (PID: 7432)
      • Unicorn-22260.exe (PID: 4244)
      • Unicorn-1093.exe (PID: 7684)
      • Unicorn-9209.exe (PID: 8820)
      • Unicorn-1093.exe (PID: 7444)
      • Unicorn-8955.exe (PID: 8840)
      • Unicorn-53003.exe (PID: 8876)
      • Unicorn-42972.exe (PID: 8972)
      • Unicorn-43387.exe (PID: 3300)
      • Unicorn-29551.exe (PID: 1532)
      • Unicorn-16820.exe (PID: 8012)
      • Unicorn-14061.exe (PID: 9004)
      • Unicorn-60962.exe (PID: 9076)
      • Unicorn-13677.exe (PID: 9148)
      • Unicorn-34503.exe (PID: 5776)
      • Unicorn-61730.exe (PID: 8600)
      • Unicorn-22613.exe (PID: 2644)
      • Unicorn-22421.exe (PID: 8388)
      • Unicorn-7699.exe (PID: 1128)
      • Unicorn-56376.exe (PID: 9272)
      • Unicorn-22095.exe (PID: 7324)

    • Reads the computer name

      • Unicorn-7906.exe (PID: 7728)
      • Unicorn-49048.exe (PID: 7392)
      • Unicorn-48192.exe (PID: 7704)
      • Unicorn-14900.exe (PID: 7912)
      • Unicorn-57787.exe (PID: 7856)
      • Unicorn-34906.exe (PID: 7876)
      • Unicorn-30268.exe (PID: 7892)
      • Unicorn-40164.exe (PID: 7952)
      • Unicorn-3962.exe (PID: 7972)
      • Unicorn-52608.exe (PID: 7988)
      • 1 (150).exe (PID: 4428)
      • Unicorn-2265.exe (PID: 8044)
      • Unicorn-16820.exe (PID: 8012)
      • Unicorn-61098.exe (PID: 7296)
      • Unicorn-58638.exe (PID: 1912)
      • Unicorn-22095.exe (PID: 7324)
      • Unicorn-17033.exe (PID: 7260)
      • Unicorn-35608.exe (PID: 7280)
      • Unicorn-1290.exe (PID: 7244)
      • Unicorn-27610.exe (PID: 728)
      • Unicorn-28024.exe (PID: 7592)
      • Unicorn-27610.exe (PID: 4920)
      • Unicorn-63983.exe (PID: 8020)
      • Unicorn-25337.exe (PID: 5984)
      • Unicorn-20677.exe (PID: 1568)
      • Unicorn-58716.exe (PID: 3176)
      • Unicorn-5239.exe (PID: 7944)
      • Unicorn-18430.exe (PID: 1512)
      • Unicorn-5649.exe (PID: 8116)
      • Unicorn-21130.exe (PID: 6192)
      • Unicorn-1202.exe (PID: 7432)
      • Unicorn-1093.exe (PID: 7684)
      • Unicorn-116.exe (PID: 5640)
      • Unicorn-20746.exe (PID: 7628)
      • Unicorn-25384.exe (PID: 7472)
      • Unicorn-46765.exe (PID: 6540)
      • Unicorn-13645.exe (PID: 4724)
      • Unicorn-7699.exe (PID: 7252)
      • Unicorn-43287.exe (PID: 7292)
      • Unicorn-44731.exe (PID: 7436)
      • Unicorn-17958.exe (PID: 8300)
      • Unicorn-32863.exe (PID: 8320)
      • Unicorn-10470.exe (PID: 8660)
      • Unicorn-47346.exe (PID: 8676)
      • Unicorn-28691.exe (PID: 8920)
      • Unicorn-14061.exe (PID: 9008)
      • Unicorn-58139.exe (PID: 9124)
      • Unicorn-22997.exe (PID: 6816)
      • Unicorn-10683.exe (PID: 968)
      • Unicorn-40123.exe (PID: 9332)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 6324)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 6324)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 6324)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 6324)
      • BackgroundTransferHost.exe (PID: 7212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:01:20 00:32:00+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 176128
InitializedDataSize: 299008
UninitializedDataSize: -
EntryPoint: 0x13d4
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
CompanyName: UEFI
ProductName: Kawaii-Unicorn
FileVersion: 1
ProductVersion: 1
InternalName: Kawaii-Unicorn
OriginalFileName: Kawaii-Unicorn.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
428
Monitored processes
295
Malicious processes
41
Suspicious processes
47

Behavior graph

Click at the process to see the details
start 1 (150).exe sppextcomobj.exe no specs slui.exe no specs unicorn-49048.exe unicorn-48192.exe unicorn-7906.exe unicorn-57787.exe unicorn-34906.exe unicorn-30268.exe unicorn-14900.exe unicorn-40164.exe unicorn-3962.exe unicorn-52608.exe unicorn-22951.exe unicorn-16820.exe unicorn-63983.exe unicorn-2265.exe unicorn-48202.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs unicorn-61098.exe unicorn-58638.exe unicorn-22095.exe unicorn-17033.exe unicorn-35608.exe unicorn-5628.exe unicorn-10527.exe unicorn-1290.exe unicorn-1290.exe unicorn-19765.exe unicorn-12972.exe unicorn-47211.exe unicorn-27610.exe unicorn-27610.exe unicorn-28024.exe unicorn-63485.exe unicorn-25337.exe unicorn-5239.exe unicorn-50749.exe backgroundtransferhost.exe no specs unicorn-20677.exe unicorn-58716.exe unicorn-18430.exe unicorn-1394.exe unicorn-13573.exe unicorn-21130.exe unicorn-5649.exe unicorn-22500.exe unicorn-41066.exe unicorn-1202.exe unicorn-46319.exe unicorn-25384.exe unicorn-20746.exe unicorn-20746.exe unicorn-1093.exe unicorn-1093.exe unicorn-1093.exe unicorn-1093.exe unicorn-46765.exe unicorn-44072.exe unicorn-116.exe unicorn-22260.exe unicorn-30180.exe unicorn-13645.exe unicorn-29551.exe unicorn-43287.exe unicorn-38846.exe unicorn-43387.exe unicorn-62909.exe no specs unicorn-40948.exe unicorn-12451.exe unicorn-7699.exe unicorn-7699.exe unicorn-59915.exe unicorn-63926.exe unicorn-58061.exe no specs unicorn-44326.exe backgroundtransferhost.exe no specs unicorn-44731.exe unicorn-65343.exe unicorn-5514.exe unicorn-51045.exe unicorn-39194.exe unicorn-65514.exe unicorn-4575.exe unicorn-60196.exe unicorn-38400.exe unicorn-17958.exe unicorn-32863.exe unicorn-23608.exe unicorn-365.exe unicorn-38483.exe unicorn-20646.exe unicorn-10470.exe unicorn-47346.exe unicorn-60403.exe unicorn-33630.exe unicorn-33844.exe unicorn-9209.exe unicorn-8955.exe unicorn-27430.exe unicorn-44835.exe unicorn-53003.exe unicorn-28691.exe unicorn-13122.exe unicorn-42972.exe unicorn-42972.exe unicorn-14061.exe unicorn-14061.exe unicorn-55416.exe unicorn-14362.exe unicorn-60962.exe unicorn-41711.exe unicorn-58139.exe unicorn-63200.exe unicorn-13677.exe unicorn-63091.exe unicorn-22863.exe unicorn-34809.exe unicorn-34503.exe unicorn-22997.exe unicorn-46947.exe unicorn-56163.exe no specs unicorn-22421.exe unicorn-42287.exe unicorn-61730.exe unicorn-34923.exe unicorn-10683.exe unicorn-22613.exe unicorn-43316.exe unicorn-51716.exe unicorn-50630.exe unicorn-39654.exe unicorn-56376.exe unicorn-40123.exe unicorn-8197.exe unicorn-65130.exe unicorn-33792.exe unicorn-24555.exe unicorn-48675.exe unicorn-48675.exe unicorn-48675.exe unicorn-34154.exe unicorn-54020.exe unicorn-19000.exe unicorn-15985.exe unicorn-18778.exe unicorn-38379.exe unicorn-46490.exe unicorn-59256.exe unicorn-56849.exe unicorn-4518.exe unicorn-26008.exe unicorn-46620.exe unicorn-7480.exe unicorn-7258.exe unicorn-2354.exe unicorn-60543.exe unicorn-14871.exe unicorn-22656.exe unicorn-49390.exe unicorn-17695.exe unicorn-2873.exe unicorn-11534.exe unicorn-10979.exe unicorn-10979.exe unicorn-2042.exe unicorn-60927.exe unicorn-29628.exe unicorn-3086.exe unicorn-4710.exe unicorn-35110.exe unicorn-60948.exe unicorn-48888.exe unicorn-20802.exe unicorn-24467.exe unicorn-21705.exe unicorn-52270.exe unicorn-6267.exe unicorn-7014.exe unicorn-26880.exe unicorn-4814.exe unicorn-62490.exe unicorn-1799.exe unicorn-23049.exe unicorn-64404.exe unicorn-521.exe unicorn-64575.exe unicorn-51960.exe no specs unicorn-4688.exe no specs unicorn-19733.exe unicorn-39599.exe no specs unicorn-7481.exe no specs unicorn-7481.exe no specs unicorn-7481.exe unicorn-12058.exe no specs unicorn-43854.exe no specs unicorn-40284.exe no specs unicorn-12250.exe no specs unicorn-12250.exe no specs unicorn-59827.exe no specs unicorn-47426.exe no specs unicorn-20369.exe no specs unicorn-34104.exe no specs unicorn-54717.exe no specs unicorn-27910.exe no specs unicorn-28175.exe no specs unicorn-15923.exe no specs unicorn-4739.exe no specs unicorn-48823.exe no specs unicorn-29222.exe no specs unicorn-47042.exe no specs unicorn-33306.exe no specs unicorn-28668.exe no specs unicorn-634.exe no specs unicorn-39281.exe no specs unicorn-33498.exe no specs unicorn-27898.exe no specs unicorn-63762.exe no specs unicorn-8439.exe no specs unicorn-34458.exe no specs unicorn-24667.exe no specs unicorn-8257.exe no specs unicorn-54194.exe no specs unicorn-8522.exe no specs unicorn-43010.exe no specs unicorn-47509.exe no specs unicorn-2392.exe no specs unicorn-53639.exe no specs unicorn-65129.exe no specs unicorn-16115.exe no specs unicorn-21268.exe no specs unicorn-60957.exe no specs unicorn-5486.exe no specs unicorn-32643.exe no specs unicorn-53867.exe no specs unicorn-65507.exe no specs unicorn-9207.exe no specs unicorn-21118.exe no specs unicorn-30588.exe no specs unicorn-17267.exe no specs unicorn-6083.exe no specs unicorn-33795.exe no specs unicorn-63130.exe no specs unicorn-43032.exe no specs unicorn-29135.exe no specs unicorn-37303.exe no specs unicorn-30204.exe no specs unicorn-61999.exe no specs unicorn-29327.exe no specs unicorn-41579.exe no specs unicorn-1293.exe no specs unicorn-26312.exe no specs unicorn-24156.exe no specs unicorn-64220.exe no specs unicorn-50899.exe no specs unicorn-4905.exe no specs unicorn-18227.exe no specs unicorn-34563.exe no specs unicorn-63343.exe no specs unicorn-32347.exe no specs unicorn-7214.exe no specs unicorn-7214.exe no specs unicorn-27080.exe no specs unicorn-32870.exe no specs unicorn-32870.exe no specs unicorn-32870.exe no specs unicorn-52736.exe no specs unicorn-32486.exe no specs unicorn-46222.exe no specs unicorn-52087.exe no specs unicorn-52087.exe no specs unicorn-62856.exe no specs unicorn-119.exe no specs unicorn-119.exe no specs unicorn-43752.exe no specs unicorn-38152.exe no specs unicorn-45014.exe no specs unicorn-32761.exe no specs unicorn-37146.exe no specs unicorn-12642.exe no specs unicorn-47702.exe no specs unicorn-18401.exe no specs unicorn-24532.exe no specs unicorn-24532.exe no specs unicorn-16809.exe no specs unicorn-27744.exe no specs unicorn-38713.exe no specs unicorn-33529.exe no specs unicorn-19689.exe no specs unicorn-60473.exe no specs unicorn-35506.exe no specs unicorn-55595.exe no specs unicorn-3793.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208C:\Users\admin\AppData\Local\Temp\Unicorn-51045.exeC:\Users\admin\AppData\Local\Temp\Unicorn-51045.exe
Unicorn-3962.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-51045.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
456C:\Users\admin\AppData\Local\Temp\Unicorn-18401.exeC:\Users\admin\AppData\Local\Temp\Unicorn-18401.exe—Unicorn-58716.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-18401.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
664C:\Users\admin\AppData\Local\Temp\Unicorn-12451.exeC:\Users\admin\AppData\Local\Temp\Unicorn-12451.exe
Unicorn-40164.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-12451.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
728C:\Users\admin\AppData\Local\Temp\Unicorn-27610.exeC:\Users\admin\AppData\Local\Temp\Unicorn-27610.exe
Unicorn-14900.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-27610.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
968C:\Users\admin\AppData\Local\Temp\Unicorn-10683.exeC:\Users\admin\AppData\Local\Temp\Unicorn-10683.exe
Unicorn-29551.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-10683.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1128C:\Users\admin\AppData\Local\Temp\Unicorn-7699.exeC:\Users\admin\AppData\Local\Temp\Unicorn-7699.exe
Unicorn-5239.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-7699.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1388C:\Users\admin\AppData\Local\Temp\Unicorn-63485.exeC:\Users\admin\AppData\Local\Temp\Unicorn-63485.exe
Unicorn-61098.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-63485.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1512C:\Users\admin\AppData\Local\Temp\Unicorn-18430.exeC:\Users\admin\AppData\Local\Temp\Unicorn-18430.exe
Unicorn-3962.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-18430.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1532C:\Users\admin\AppData\Local\Temp\Unicorn-29551.exeC:\Users\admin\AppData\Local\Temp\Unicorn-29551.exe
Unicorn-48202.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-29551.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1568C:\Users\admin\AppData\Local\Temp\Unicorn-20677.exeC:\Users\admin\AppData\Local\Temp\Unicorn-20677.exe
Unicorn-63983.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-20677.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
Total events
7 721
Read events
7 706
Write events
15
Delete events
0

Modification events

(PID) Process:(8108) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8108) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8108) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6324) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6324) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6324) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7212) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7212) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7212) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3008) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
917
Suspicious files
5
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6324BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\53bb33af-940e-4262-981c-4fe174f1c155.down_data —
MD5:—
SHA256:—
7876Unicorn-34906.exeC:\Users\admin\AppData\Local\Temp\Unicorn-52608.exeexecutable
MD5:29DB7C7DDB584CE3AACDB412823851B9
SHA256:1A12CCC3A3763F71B2A46E94699185E0B28F42AABF563BCD2BBB63D3C3BB4088
7856Unicorn-57787.exeC:\Users\admin\AppData\Local\Temp\Unicorn-40164.exeexecutable
MD5:04EA931802485CE2C10A6AB67D608D72
SHA256:A46746C3AA810648D6C23796328C80268F5C1AF8F7A13CB12D2BE48FBBE717FE
7912Unicorn-14900.exeC:\Users\admin\AppData\Local\Temp\Unicorn-63983.exeexecutable
MD5:1076A84AA21461567085126A12278E36
SHA256:692A5305F3E69DD94BAC3DD6F416DD2FFFE4022A88121E37DF85A4AB0FDCC0D0
7704Unicorn-48192.exeC:\Users\admin\AppData\Local\Temp\Unicorn-3962.exeexecutable
MD5:4CEC8CDB225DF4F428626078F64FDA1E
SHA256:111ADA1EB27EB0F6D3368EFE39E56615AE2834320EB232951932928D3EFE299C
44281 (150).exeC:\Users\admin\AppData\Local\Temp\Unicorn-14900.exeexecutable
MD5:F651A0310D5C083FFC4550D844A067DD
SHA256:9D152364C0CE5B062CCFAD2195A23FC8F5BC4CF5FA6BFD18CD9FF3D3B209295E
6324BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4872BABAF39AA62B8D32695EBB7E9173
SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999
44281 (150).exeC:\Users\admin\AppData\Local\Temp\Unicorn-2265.exeexecutable
MD5:72C3F250639444A7F06B20CAE5760368
SHA256:874BACB7A9BB4D9ADE89C45F459CC29B98A5A46F4AF6F8702AC4322D0C467976
7728Unicorn-7906.exeC:\Users\admin\AppData\Local\Temp\Unicorn-48202.exeexecutable
MD5:A0A5364EACFAE652F3BEE83131746F7E
SHA256:39D9E1F3B2891962340286A8E8DE7D4C67723A3E604EBD077F2929C01EEE0839
6324BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:595D3FB78191E5AA0576C13A8C86D1D1
SHA256:0F76A6C06DBF9880B216AF312D10EBE888B19009C0FB9AC8056D2508A49ED3C4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.146:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6324
BackgroundTransferHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7428
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
8344
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8344
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.146:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.146
  • 23.48.23.137
  • 23.48.23.193
  • 23.48.23.138
  • 23.48.23.191
  • 23.48.23.177
  • 23.48.23.183
  • 23.48.23.181
  • 23.48.23.176
whitelisted
google.com
  • 142.250.181.238
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.160.131
  • 40.126.32.138
  • 20.190.160.64
  • 40.126.32.68
  • 20.190.160.22
  • 20.190.160.66
  • 40.126.32.76
  • 20.190.160.3
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
www.bing.com
  • 104.126.37.161
  • 104.126.37.154
  • 104.126.37.131
  • 104.126.37.153
  • 104.126.37.152
  • 104.126.37.147
  • 104.126.37.155
  • 104.126.37.137
  • 104.126.37.144
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (150)