| File name: | 1 (1150) |
| Full analysis: | https://app.any.run/tasks/858e6e30-035b-47f2-aacc-c1007b6f5ea0 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 08:26:38 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | 29291827FBE78077583B0AC6330DDB90 |
| SHA1: | 9CB7AE6C9F973649DBDE10451D1C1862CD751D6C |
| SHA256: | E6CF3BDD862CEF5ABAD735737BFAD6287F995F3F7F9E1B7D786CFE6354A34012 |
| SSDEEP: | 6144:+7K0fsIJvDoHA5iTXpeJ/sLx/tBtlvJGBH/WceOEgk/8SwjwpyAvEh91f5/lsQQa:++ibqHA5aXoaBPhaHOceOEFx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- Unicorn-56923.exe (PID: 7624)
- Unicorn-48952.exe (PID: 1184)
- 1 (1150).exe (PID: 300)
- Unicorn-5262.exe (PID: 7644)
- Unicorn-26000.exe (PID: 1180)
- Unicorn-5065.exe (PID: 7288)
- Unicorn-29456.exe (PID: 6028)
- Unicorn-8521.exe (PID: 3768)
- Unicorn-64427.exe (PID: 4180)
- Unicorn-19280.exe (PID: 5324)
- Unicorn-58297.exe (PID: 3268)
- Unicorn-29485.exe (PID: 5380)
- Unicorn-34739.exe (PID: 7388)
- Unicorn-50810.exe (PID: 7404)
- Unicorn-1033.exe (PID: 7560)
- Unicorn-23128.exe (PID: 7588)
- Unicorn-29067.exe (PID: 7548)
- Unicorn-61391.exe (PID: 7612)
- Unicorn-55875.exe (PID: 7452)
- Unicorn-3254.exe (PID: 7420)
- Unicorn-12766.exe (PID: 7488)
- Unicorn-46555.exe (PID: 7652)
- Unicorn-9013.exe (PID: 7712)
- Unicorn-46939.exe (PID: 7704)
- Unicorn-14759.exe (PID: 7432)
- Unicorn-31209.exe (PID: 7492)
- Unicorn-6213.exe (PID: 7740)
- Unicorn-9008.exe (PID: 7844)
- Unicorn-15138.exe (PID: 7852)
- Unicorn-6202.exe (PID: 7912)
- Unicorn-7162.exe (PID: 7868)
- Unicorn-29259.exe (PID: 7580)
- Unicorn-52943.exe (PID: 7928)
- Unicorn-39451.exe (PID: 7956)
- Unicorn-15750.exe (PID: 7968)
- Unicorn-11997.exe (PID: 8016)
- Unicorn-56747.exe (PID: 8032)
- Unicorn-8698.exe (PID: 7984)
- Unicorn-56747.exe (PID: 8040)
- Unicorn-57131.exe (PID: 8096)
- Unicorn-51001.exe (PID: 8092)
- Unicorn-46939.exe (PID: 7696)
- Unicorn-61687.exe (PID: 8004)
- Unicorn-54479.exe (PID: 8060)
- Unicorn-40603.exe (PID: 8052)
- Unicorn-11805.exe (PID: 7992)
- Unicorn-41667.exe (PID: 8120)
- Unicorn-62834.exe (PID: 7296)
- Unicorn-36658.exe (PID: 7320)
- Unicorn-3053.exe (PID: 1188)
- Unicorn-30899.exe (PID: 7920)
- Unicorn-63598.exe (PID: 8176)
- Unicorn-28922.exe (PID: 7304)
- Unicorn-41091.exe (PID: 7356)
- Unicorn-8802.exe (PID: 4696)
- Unicorn-62834.exe (PID: 4920)
- Unicorn-47062.exe (PID: 8188)
- Unicorn-39555.exe (PID: 8136)
- Unicorn-15745.exe (PID: 736)
- Unicorn-12865.exe (PID: 1244)
- Unicorn-37761.exe (PID: 2040)
- Unicorn-26600.exe (PID: 2504)
- Unicorn-40987.exe (PID: 7952)
- Unicorn-17080.exe (PID: 1240)
- Unicorn-50153.exe (PID: 4188)
- Unicorn-19083.exe (PID: 5376)
- Unicorn-33696.exe (PID: 7804)
- Unicorn-24306.exe (PID: 5084)
- Unicorn-3431.exe (PID: 7396)
- Unicorn-26291.exe (PID: 3300)
- Unicorn-46763.exe (PID: 8108)
- Unicorn-42744.exe (PID: 4408)
- Unicorn-54650.exe (PID: 7700)
- Unicorn-44083.exe (PID: 8868)
- Unicorn-3353.exe (PID: 8168)
- Unicorn-8926.exe (PID: 8104)
- Unicorn-33040.exe (PID: 6148)
- Unicorn-7001.exe (PID: 7256)
- Unicorn-28240.exe (PID: 8772)
- Unicorn-4674.exe (PID: 8296)
- Unicorn-39022.exe (PID: 8904)
- Unicorn-13449.exe (PID: 5508)
- Unicorn-42370.exe (PID: 7292)
- Unicorn-5662.exe (PID: 7788)
- Unicorn-30736.exe (PID: 8976)
- Unicorn-50987.exe (PID: 864)
- Unicorn-24571.exe (PID: 3140)
- Unicorn-46112.exe (PID: 9040)
- Unicorn-23995.exe (PID: 5352)
- Unicorn-36112.exe (PID: 8236)
- Unicorn-26747.exe (PID: 8564)
- Unicorn-34009.exe (PID: 8288)
- Unicorn-55626.exe (PID: 1300)
- Unicorn-53107.exe (PID: 8416)
- Unicorn-20072.exe (PID: 8828)
- Unicorn-3937.exe (PID: 6108)
- Unicorn-18619.exe (PID: 8508)
- Unicorn-32873.exe (PID: 8948)
- Unicorn-35147.exe (PID: 8556)
- Unicorn-52383.exe (PID: 8128)
- Unicorn-28249.exe (PID: 6632)
- Unicorn-24955.exe (PID: 6592)
- Unicorn-7201.exe (PID: 8248)
- Unicorn-56018.exe (PID: 5436)
- Unicorn-4430.exe (PID: 9192)
- Unicorn-27672.exe (PID: 8596)
- Unicorn-34185.exe (PID: 8528)
- Unicorn-52833.exe (PID: 9096)
- Unicorn-1234.exe (PID: 9932)
- Unicorn-63443.exe (PID: 8484)
- Unicorn-20160.exe (PID: 9124)
- Unicorn-17763.exe (PID: 9992)
- Unicorn-37114.exe (PID: 9964)
- Unicorn-45344.exe (PID: 8676)
- Unicorn-20273.exe (PID: 9028)
- Unicorn-62178.exe (PID: 9256)
- Unicorn-53315.exe (PID: 8212)
- Unicorn-20761.exe (PID: 9512)
- Unicorn-21520.exe (PID: 8436)
- Unicorn-20155.exe (PID: 8720)
- Unicorn-21041.exe (PID: 2644)
- Unicorn-43787.exe (PID: 7552)
- Unicorn-8261.exe (PID: 9552)
- Unicorn-13334.exe (PID: 8324)
- Unicorn-29981.exe (PID: 8228)
- Unicorn-38899.exe (PID: 9356)
- Unicorn-44865.exe (PID: 6228)
- Unicorn-24030.exe (PID: 6872)
- Unicorn-60066.exe (PID: 8580)
- Unicorn-40544.exe (PID: 9440)
- Unicorn-29480.exe (PID: 8428)
- Unicorn-44010.exe (PID: 9156)
- Unicorn-20573.exe (PID: 8588)
- Unicorn-33971.exe (PID: 10356)
- Unicorn-4809.exe (PID: 9576)
- Unicorn-7798.exe (PID: 8492)
- Unicorn-13849.exe (PID: 9900)
- Unicorn-63543.exe (PID: 10048)
- Unicorn-40097.exe (PID: 10260)
- Unicorn-49335.exe (PID: 10284)
- Unicorn-17379.exe (PID: 9912)
- Unicorn-28043.exe (PID: 8960)
- Unicorn-40097.exe (PID: 11256)
- Unicorn-22755.exe (PID: 9392)
- Unicorn-53623.exe (PID: 8160)
- Unicorn-11727.exe (PID: 10864)
- Unicorn-24395.exe (PID: 9800)
- Unicorn-16528.exe (PID: 9880)
- Unicorn-59459.exe (PID: 8500)
- Unicorn-25716.exe (PID: 10720)
- Unicorn-19979.exe (PID: 11004)
- Unicorn-58930.exe (PID: 11072)
- Unicorn-16728.exe (PID: 9640)
- Unicorn-35339.exe (PID: 8780)
- Unicorn-24296.exe (PID: 9200)
- Unicorn-14410.exe (PID: 11580)
- Unicorn-58587.exe (PID: 4944)
- Unicorn-33640.exe (PID: 9848)
- Unicorn-15848.exe (PID: 9428)
- Unicorn-38249.exe (PID: 9464)
- Unicorn-25976.exe (PID: 12304)
- Unicorn-54535.exe (PID: 12372)
- Unicorn-29838.exe (PID: 12332)
- Unicorn-57938.exe (PID: 8444)
- Unicorn-13928.exe (PID: 9648)
- Unicorn-2490.exe (PID: 10872)
- Unicorn-57970.exe (PID: 10288)
- Unicorn-52298.exe (PID: 11412)
- Unicorn-31058.exe (PID: 11428)
- Unicorn-25568.exe (PID: 11060)
- Unicorn-11337.exe (PID: 9168)
- Unicorn-36315.exe (PID: 10988)
- Unicorn-26376.exe (PID: 10088)
- Unicorn-25611.exe (PID: 10264)
- Unicorn-4616.exe (PID: 10132)
- Unicorn-10008.exe (PID: 4068)
- Unicorn-39844.exe (PID: 11100)
- Unicorn-50265.exe (PID: 11088)
- Unicorn-41826.exe (PID: 11144)
- Unicorn-49438.exe (PID: 4572)
- Unicorn-40112.exe (PID: 10080)
- Unicorn-11765.exe (PID: 9536)
- Unicorn-32267.exe (PID: 9500)
- Unicorn-8281.exe (PID: 10996)
- Unicorn-22288.exe (PID: 7212)
- Unicorn-34011.exe (PID: 10272)
- Unicorn-11846.exe (PID: 9616)
- Unicorn-39083.exe (PID: 13656)
- Unicorn-44948.exe (PID: 13664)
- Unicorn-48633.exe (PID: 12732)
- Unicorn-42947.exe (PID: 10816)
- Unicorn-22785.exe (PID: 10232)
- Unicorn-2298.exe (PID: 10840)
- Unicorn-9039.exe (PID: 6244)
- Unicorn-19024.exe (PID: 10224)
- Unicorn-52459.exe (PID: 10752)
- Unicorn-32096.exe (PID: 9656)
- Unicorn-10626.exe (PID: 13784)
- Unicorn-29491.exe (PID: 10976)
- Unicorn-3201.exe (PID: 11760)
- Unicorn-3850.exe (PID: 11608)
- Unicorn-15656.exe (PID: 9404)
- Unicorn-16629.exe (PID: 8996)
- Unicorn-43419.exe (PID: 10124)
- Unicorn-56003.exe (PID: 9272)
- Unicorn-39456.exe (PID: 11596)
- Unicorn-27955.exe (PID: 10744)
- Unicorn-843.exe (PID: 13704)
- Unicorn-63154.exe (PID: 10636)
- Unicorn-19137.exe (PID: 9624)
- Unicorn-9610.exe (PID: 11168)
- Unicorn-12687.exe (PID: 10768)
- Unicorn-2712.exe (PID: 12268)
- Unicorn-54201.exe (PID: 8452)
- Unicorn-6761.exe (PID: 12928)
- Unicorn-40891.exe (PID: 14564)
- Unicorn-24337.exe (PID: 15256)
- Unicorn-32459.exe (PID: 9528)
- Unicorn-39179.exe (PID: 9144)
- Unicorn-45635.exe (PID: 10956)
- Unicorn-59215.exe (PID: 8384)
- Unicorn-39859.exe (PID: 9284)
- Unicorn-31634.exe (PID: 9784)
- Unicorn-26625.exe (PID: 8624)
- Unicorn-45635.exe (PID: 10948)
- Unicorn-34393.exe (PID: 15228)
- Unicorn-28527.exe (PID: 15220)
- Unicorn-59889.exe (PID: 12244)
- Unicorn-64218.exe (PID: 11024)
- Unicorn-57627.exe (PID: 7224)
- Unicorn-43761.exe (PID: 7896)
- Unicorn-32859.exe (PID: 5048)
- Unicorn-27955.exe (PID: 10736)
- Unicorn-25347.exe (PID: 13648)
- Unicorn-40221.exe (PID: 14996)
- Unicorn-42577.exe (PID: 9248)
- Unicorn-17567.exe (PID: 14364)
- Unicorn-24616.exe (PID: 11556)
- Unicorn-63912.exe (PID: 11492)
- Unicorn-32563.exe (PID: 9788)
- Unicorn-4594.exe (PID: 16324)
- Unicorn-26397.exe (PID: 16484)
- Unicorn-53978.exe (PID: 16468)
- Unicorn-55026.exe (PID: 6940)
- Unicorn-44393.exe (PID: 10560)
- Unicorn-4482.exe (PID: 8280)
- Unicorn-61826.exe (PID: 12404)
- Unicorn-36765.exe (PID: 16412)
- Unicorn-65332.exe (PID: 16452)
- Unicorn-23610.exe (PID: 14784)
- Unicorn-1897.exe (PID: 16208)
- Unicorn-12329.exe (PID: 11348)
- Unicorn-18265.exe (PID: 9020)
- Unicorn-53065.exe (PID: 11080)
- Unicorn-20467.exe (PID: 3396)
- Unicorn-17776.exe (PID: 16112)
- Unicorn-6439.exe (PID: 9708)
- Unicorn-11986.exe (PID: 8708)
- Unicorn-60846.exe (PID: 10940)
- Unicorn-20840.exe (PID: 8684)
- Unicorn-10015.exe (PID: 12584)
- Unicorn-24165.exe (PID: 14672)
- Unicorn-21131.exe (PID: 10968)
Starts itself from another location
- 1 (1150).exe (PID: 300)
- Unicorn-48952.exe (PID: 1184)
- Unicorn-56923.exe (PID: 7624)
- Unicorn-5262.exe (PID: 7644)
- Unicorn-26000.exe (PID: 1180)
- Unicorn-29456.exe (PID: 6028)
- Unicorn-8521.exe (PID: 3768)
- Unicorn-5065.exe (PID: 7288)
- Unicorn-58297.exe (PID: 3268)
- Unicorn-50810.exe (PID: 7404)
- Unicorn-29485.exe (PID: 5380)
- Unicorn-19280.exe (PID: 5324)
- Unicorn-34739.exe (PID: 7388)
- Unicorn-31209.exe (PID: 7492)
- Unicorn-64427.exe (PID: 4180)
- Unicorn-1033.exe (PID: 7560)
- Unicorn-29259.exe (PID: 7580)
- Unicorn-55875.exe (PID: 7452)
- Unicorn-3254.exe (PID: 7420)
- Unicorn-12766.exe (PID: 7488)
- Unicorn-46939.exe (PID: 7696)
- Unicorn-46555.exe (PID: 7652)
- Unicorn-9013.exe (PID: 7712)
- Unicorn-46939.exe (PID: 7704)
- Unicorn-14759.exe (PID: 7432)
- Unicorn-54650.exe (PID: 7700)
- Unicorn-61002.exe (PID: 7884)
- Unicorn-9008.exe (PID: 7844)
- Unicorn-61391.exe (PID: 7612)
- Unicorn-7162.exe (PID: 7868)
- Unicorn-6202.exe (PID: 7912)
- Unicorn-29067.exe (PID: 7548)
- Unicorn-30899.exe (PID: 7920)
- Unicorn-23128.exe (PID: 7588)
- Unicorn-39451.exe (PID: 7956)
- Unicorn-8698.exe (PID: 7984)
- Unicorn-6213.exe (PID: 7740)
- Unicorn-11997.exe (PID: 8016)
- Unicorn-15750.exe (PID: 7968)
- Unicorn-56747.exe (PID: 8032)
- Unicorn-5662.exe (PID: 7788)
- Unicorn-56747.exe (PID: 8040)
- Unicorn-57131.exe (PID: 8096)
- Unicorn-61687.exe (PID: 8004)
- Unicorn-15138.exe (PID: 7852)
- Unicorn-11805.exe (PID: 7992)
- Unicorn-54479.exe (PID: 8060)
- Unicorn-40603.exe (PID: 8052)
- Unicorn-52943.exe (PID: 7928)
- Unicorn-41667.exe (PID: 8120)
- Unicorn-62834.exe (PID: 7296)
- Unicorn-51001.exe (PID: 8092)
- Unicorn-36658.exe (PID: 7320)
- Unicorn-3053.exe (PID: 1188)
- Unicorn-63598.exe (PID: 8176)
- Unicorn-28922.exe (PID: 7304)
- Unicorn-41091.exe (PID: 7356)
- Unicorn-47062.exe (PID: 8188)
- Unicorn-62834.exe (PID: 4920)
- Unicorn-8802.exe (PID: 4696)
- Unicorn-26600.exe (PID: 2504)
- Unicorn-15745.exe (PID: 736)
- Unicorn-12865.exe (PID: 1244)
- Unicorn-39555.exe (PID: 8136)
- Unicorn-19083.exe (PID: 5376)
- Unicorn-40987.exe (PID: 7952)
- Unicorn-33696.exe (PID: 7804)
- Unicorn-50153.exe (PID: 4188)
- Unicorn-37761.exe (PID: 2040)
- Unicorn-17080.exe (PID: 1240)
- Unicorn-3431.exe (PID: 7396)
- Unicorn-24306.exe (PID: 5084)
- Unicorn-53623.exe (PID: 8160)
- Unicorn-46763.exe (PID: 8108)
- Unicorn-26291.exe (PID: 3300)
- Unicorn-42744.exe (PID: 4408)
- Unicorn-3353.exe (PID: 8168)
- Unicorn-44083.exe (PID: 8868)
- Unicorn-33040.exe (PID: 6148)
- Unicorn-7001.exe (PID: 7256)
- Unicorn-28240.exe (PID: 8772)
- Unicorn-4674.exe (PID: 8296)
- Unicorn-39022.exe (PID: 8904)
- Unicorn-8926.exe (PID: 8104)
- Unicorn-42370.exe (PID: 7292)
- Unicorn-30736.exe (PID: 8976)
- Unicorn-50987.exe (PID: 864)
- Unicorn-13449.exe (PID: 5508)
- Unicorn-24571.exe (PID: 3140)
- Unicorn-23995.exe (PID: 5352)
- Unicorn-46112.exe (PID: 9040)
- Unicorn-26747.exe (PID: 8564)
- Unicorn-55626.exe (PID: 1300)
- Unicorn-34009.exe (PID: 8288)
- Unicorn-58587.exe (PID: 4944)
- Unicorn-20072.exe (PID: 8828)
- Unicorn-32873.exe (PID: 8948)
- Unicorn-18619.exe (PID: 8508)
- Unicorn-35147.exe (PID: 8556)
- Unicorn-52383.exe (PID: 8128)
- Unicorn-28249.exe (PID: 6632)
- Unicorn-56018.exe (PID: 5436)
- Unicorn-24955.exe (PID: 6592)
- Unicorn-7201.exe (PID: 8248)
- Unicorn-52833.exe (PID: 9096)
- Unicorn-53107.exe (PID: 8416)
- Unicorn-4430.exe (PID: 9192)
- Unicorn-27672.exe (PID: 8596)
- Unicorn-34185.exe (PID: 8528)
- Unicorn-57627.exe (PID: 7224)
- Unicorn-63443.exe (PID: 8484)
- Unicorn-17763.exe (PID: 9992)
- Unicorn-20160.exe (PID: 9124)
- Unicorn-37114.exe (PID: 9964)
- Unicorn-1234.exe (PID: 9932)
- Unicorn-20273.exe (PID: 9028)
- Unicorn-62178.exe (PID: 9256)
- Unicorn-14119.exe (PID: 9228)
- Unicorn-53315.exe (PID: 8212)
- Unicorn-59215.exe (PID: 8384)
- Unicorn-21520.exe (PID: 8436)
- Unicorn-45344.exe (PID: 8676)
- Unicorn-35339.exe (PID: 8780)
- Unicorn-21041.exe (PID: 2644)
- Unicorn-43787.exe (PID: 7552)
- Unicorn-20155.exe (PID: 8720)
- Unicorn-24030.exe (PID: 6872)
- Unicorn-29981.exe (PID: 8228)
- Unicorn-38899.exe (PID: 9356)
- Unicorn-20761.exe (PID: 9512)
- Unicorn-8261.exe (PID: 9552)
- Unicorn-44865.exe (PID: 6228)
- Unicorn-13334.exe (PID: 8324)
- Unicorn-44010.exe (PID: 9156)
- Unicorn-60066.exe (PID: 8580)
- Unicorn-29480.exe (PID: 8428)
- Unicorn-33971.exe (PID: 10356)
- Unicorn-20573.exe (PID: 8588)
- Unicorn-4809.exe (PID: 9576)
- Unicorn-33640.exe (PID: 9840)
- Unicorn-13849.exe (PID: 9900)
- Unicorn-28043.exe (PID: 8960)
- Unicorn-63543.exe (PID: 10048)
- Unicorn-7798.exe (PID: 8492)
- Unicorn-17379.exe (PID: 9912)
- Unicorn-49335.exe (PID: 10284)
- Unicorn-40544.exe (PID: 9440)
- Unicorn-39859.exe (PID: 9284)
- Unicorn-40097.exe (PID: 10260)
- Unicorn-40097.exe (PID: 11256)
- Unicorn-26625.exe (PID: 8624)
- Unicorn-22755.exe (PID: 9392)
- Unicorn-24395.exe (PID: 9800)
- Unicorn-16528.exe (PID: 9880)
- Unicorn-24296.exe (PID: 9200)
- Unicorn-25716.exe (PID: 10720)
- Unicorn-58930.exe (PID: 11072)
- Unicorn-19979.exe (PID: 11004)
- Unicorn-36112.exe (PID: 8236)
- Unicorn-16728.exe (PID: 9640)
- Unicorn-15848.exe (PID: 9428)
- Unicorn-14410.exe (PID: 11580)
- Unicorn-33640.exe (PID: 9848)
- Unicorn-3937.exe (PID: 6108)
- Unicorn-25976.exe (PID: 12304)
- Unicorn-38249.exe (PID: 9464)
- Unicorn-57970.exe (PID: 10288)
- Unicorn-29838.exe (PID: 12332)
- Unicorn-54535.exe (PID: 12372)
- Unicorn-13928.exe (PID: 9648)
- Unicorn-25568.exe (PID: 11060)
- Unicorn-11337.exe (PID: 9168)
- Unicorn-32563.exe (PID: 9788)
- Unicorn-64218.exe (PID: 11024)
- Unicorn-25611.exe (PID: 10264)
- Unicorn-26376.exe (PID: 10088)
- Unicorn-4616.exe (PID: 10132)
- Unicorn-39844.exe (PID: 11100)
- Unicorn-50265.exe (PID: 11088)
- Unicorn-41826.exe (PID: 11144)
- Unicorn-36315.exe (PID: 10988)
- Unicorn-49438.exe (PID: 4572)
- Unicorn-10008.exe (PID: 4068)
- Unicorn-52298.exe (PID: 11412)
- Unicorn-32267.exe (PID: 9500)
- Unicorn-11765.exe (PID: 9536)
- Unicorn-8281.exe (PID: 10996)
- Unicorn-22288.exe (PID: 7212)
- Unicorn-34011.exe (PID: 10272)
- Unicorn-40112.exe (PID: 10080)
- Unicorn-11846.exe (PID: 9616)
- Unicorn-31058.exe (PID: 11428)
- Unicorn-42947.exe (PID: 10816)
- Unicorn-44948.exe (PID: 13664)
- Unicorn-25347.exe (PID: 13648)
- Unicorn-39083.exe (PID: 13656)
- Unicorn-9039.exe (PID: 6244)
- Unicorn-22785.exe (PID: 10232)
- Unicorn-19024.exe (PID: 10224)
- Unicorn-2298.exe (PID: 10840)
- Unicorn-48633.exe (PID: 12732)
- Unicorn-32096.exe (PID: 9656)
- Unicorn-10626.exe (PID: 13784)
- Unicorn-29491.exe (PID: 10976)
- Unicorn-3850.exe (PID: 11608)
- Unicorn-3201.exe (PID: 11760)
- Unicorn-15656.exe (PID: 9404)
- Unicorn-16629.exe (PID: 8996)
- Unicorn-34393.exe (PID: 15228)
- Unicorn-59459.exe (PID: 8500)
- Unicorn-43419.exe (PID: 10124)
- Unicorn-24337.exe (PID: 15256)
- Unicorn-52459.exe (PID: 10752)
- Unicorn-28527.exe (PID: 15220)
- Unicorn-27955.exe (PID: 10744)
- Unicorn-41897.exe (PID: 9108)
- Unicorn-56003.exe (PID: 9272)
- Unicorn-22112.exe (PID: 11304)
- Unicorn-19137.exe (PID: 9624)
- Unicorn-2712.exe (PID: 12268)
- Unicorn-9610.exe (PID: 11168)
- Unicorn-63154.exe (PID: 10636)
- Unicorn-12687.exe (PID: 10768)
- Unicorn-54201.exe (PID: 8452)
- Unicorn-39179.exe (PID: 9144)
- Unicorn-45635.exe (PID: 10956)
- Unicorn-20467.exe (PID: 3396)
- Unicorn-843.exe (PID: 13704)
- Unicorn-39456.exe (PID: 11596)
- Unicorn-26397.exe (PID: 16484)
- Unicorn-53978.exe (PID: 16468)
- Unicorn-65332.exe (PID: 16452)
Executes application which crashes
- Unicorn-29456.exe (PID: 6028)
- Unicorn-29067.exe (PID: 7548)
- Unicorn-61002.exe (PID: 7884)
- Unicorn-63223.exe (PID: 7772)
- Unicorn-63223.exe (PID: 7764)
- Unicorn-7162.exe (PID: 7868)
- Unicorn-41667.exe (PID: 8120)
- Unicorn-39555.exe (PID: 8136)
- Unicorn-42744.exe (PID: 4408)
- Unicorn-29541.exe (PID: 13364)
- Unicorn-44010.exe (PID: 9156)
- Unicorn-62786.exe (PID: 12516)
INFO
Checks supported languages
- 1 (1150).exe (PID: 300)
- Unicorn-5262.exe (PID: 7644)
- Unicorn-48952.exe (PID: 1184)
- Unicorn-26000.exe (PID: 1180)
- Unicorn-64427.exe (PID: 4180)
- Unicorn-5065.exe (PID: 7288)
- Unicorn-58297.exe (PID: 3268)
- Unicorn-8521.exe (PID: 3768)
- Unicorn-50810.exe (PID: 7404)
- Unicorn-31209.exe (PID: 7492)
- Unicorn-29067.exe (PID: 7548)
- Unicorn-29259.exe (PID: 7580)
- Unicorn-34739.exe (PID: 7388)
- Unicorn-55875.exe (PID: 7452)
- Unicorn-12766.exe (PID: 7488)
- Unicorn-3254.exe (PID: 7420)
- Unicorn-46939.exe (PID: 7696)
- Unicorn-9013.exe (PID: 7712)
- Unicorn-9008.exe (PID: 7844)
- Unicorn-61002.exe (PID: 7884)
- Unicorn-46939.exe (PID: 7704)
- Unicorn-6202.exe (PID: 7912)
- Unicorn-39451.exe (PID: 7956)
- Unicorn-15750.exe (PID: 7968)
- Unicorn-11805.exe (PID: 7992)
- Unicorn-11997.exe (PID: 8016)
- Unicorn-56747.exe (PID: 8032)
- Unicorn-54479.exe (PID: 8060)
- Unicorn-33696.exe (PID: 7804)
- Unicorn-51001.exe (PID: 8092)
- Unicorn-57131.exe (PID: 8096)
- Unicorn-5662.exe (PID: 7788)
- Unicorn-40987.exe (PID: 7952)
- Unicorn-63598.exe (PID: 8176)
- Unicorn-47062.exe (PID: 8188)
- Unicorn-8926.exe (PID: 8104)
- Unicorn-63223.exe (PID: 7772)
- Unicorn-46763.exe (PID: 8108)
- Unicorn-3353.exe (PID: 8168)
- Unicorn-62834.exe (PID: 7296)
- Unicorn-28922.exe (PID: 7304)
- Unicorn-52383.exe (PID: 8128)
- Unicorn-15745.exe (PID: 736)
- Unicorn-12865.exe (PID: 1244)
- Unicorn-41667.exe (PID: 8120)
- Unicorn-26600.exe (PID: 2504)
- Unicorn-8802.exe (PID: 4696)
- Unicorn-36658.exe (PID: 7320)
- Unicorn-7001.exe (PID: 7256)
- Unicorn-62834.exe (PID: 4920)
- Unicorn-41091.exe (PID: 7356)
- Unicorn-3431.exe (PID: 7396)
- Unicorn-3053.exe (PID: 1188)
- Unicorn-50153.exe (PID: 4188)
- Unicorn-24306.exe (PID: 5084)
- Unicorn-24571.exe (PID: 3140)
- Unicorn-37761.exe (PID: 2040)
- Unicorn-28249.exe (PID: 6632)
- Unicorn-33040.exe (PID: 6148)
- Unicorn-55626.exe (PID: 1300)
- Unicorn-44865.exe (PID: 6228)
- Unicorn-24030.exe (PID: 6872)
- Unicorn-13449.exe (PID: 5508)
- Unicorn-58587.exe (PID: 4944)
- Unicorn-56018.exe (PID: 5436)
- Unicorn-29981.exe (PID: 8228)
- Unicorn-34009.exe (PID: 8288)
- Unicorn-4482.exe (PID: 8280)
- Unicorn-4674.exe (PID: 8296)
- Unicorn-53107.exe (PID: 8416)
- Unicorn-44083.exe (PID: 8868)
- Unicorn-6734.exe (PID: 5056)
- Unicorn-39022.exe (PID: 8904)
- Unicorn-18619.exe (PID: 8508)
- Unicorn-27672.exe (PID: 8596)
- Unicorn-34379.exe (PID: 8652)
- Unicorn-63443.exe (PID: 8484)
- Unicorn-59459.exe (PID: 8500)
- Unicorn-11986.exe (PID: 8708)
- Unicorn-20155.exe (PID: 8720)
- Unicorn-29480.exe (PID: 8428)
- Unicorn-20573.exe (PID: 8588)
- Unicorn-46112.exe (PID: 9040)
- Unicorn-41897.exe (PID: 9108)
- Unicorn-55633.exe (PID: 9116)
- Unicorn-39179.exe (PID: 9144)
- Unicorn-35147.exe (PID: 8556)
- Unicorn-34185.exe (PID: 8528)
- Unicorn-21520.exe (PID: 8436)
- Unicorn-28043.exe (PID: 8960)
- Unicorn-20160.exe (PID: 9124)
- Unicorn-44010.exe (PID: 9156)
- Unicorn-26625.exe (PID: 8624)
- Unicorn-62178.exe (PID: 9256)
- Unicorn-15656.exe (PID: 9404)
- Unicorn-54201.exe (PID: 8452)
- Unicorn-15848.exe (PID: 9428)
- Unicorn-14119.exe (PID: 9228)
- Unicorn-42577.exe (PID: 9248)
- Unicorn-32267.exe (PID: 9500)
- Unicorn-62863.exe (PID: 9544)
- Unicorn-4809.exe (PID: 9576)
- Unicorn-38249.exe (PID: 9464)
- Unicorn-11846.exe (PID: 9616)
- Unicorn-31027.exe (PID: 9632)
- Unicorn-13928.exe (PID: 9648)
- Unicorn-32563.exe (PID: 9788)
- Unicorn-24395.exe (PID: 9800)
- Unicorn-31520.exe (PID: 9600)
- Unicorn-13849.exe (PID: 9900)
- Unicorn-32459.exe (PID: 9528)
- Unicorn-63543.exe (PID: 10048)
- Unicorn-9039.exe (PID: 6244)
- Unicorn-64679.exe (PID: 2064)
- Unicorn-12033.exe (PID: 4212)
- Unicorn-25611.exe (PID: 10264)
- Unicorn-31634.exe (PID: 9784)
- Unicorn-34011.exe (PID: 10272)
- Unicorn-40097.exe (PID: 10260)
- Unicorn-9703.exe (PID: 10064)
- Unicorn-52459.exe (PID: 10752)
- Unicorn-19979.exe (PID: 11004)
- Unicorn-50265.exe (PID: 11088)
- Unicorn-19978.exe (PID: 11108)
- Unicorn-9610.exe (PID: 11168)
- Unicorn-12909.exe (PID: 11192)
- Unicorn-28443.exe (PID: 11232)
- Unicorn-13367.exe (PID: 4164)
- Unicorn-11352.exe (PID: 10616)
- Unicorn-20467.exe (PID: 3396)
- Unicorn-64218.exe (PID: 11024)
- Unicorn-21131.exe (PID: 10968)
- Unicorn-4026.exe (PID: 11040)
- Unicorn-63912.exe (PID: 11492)
- Unicorn-53051.exe (PID: 11588)
- Unicorn-25976.exe (PID: 12304)
- Unicorn-705.exe (PID: 11624)
- Unicorn-14445.exe (PID: 10484)
- Unicorn-15592.exe (PID: 11792)
- Unicorn-14410.exe (PID: 11580)
- Unicorn-53633.exe (PID: 11968)
- Unicorn-5697.exe (PID: 11892)
- Unicorn-64099.exe (PID: 12188)
- Unicorn-12329.exe (PID: 11348)
- Unicorn-31930.exe (PID: 12280)
- Unicorn-43761.exe (PID: 7896)
- Unicorn-36315.exe (PID: 10988)
- Unicorn-42889.exe (PID: 11812)
- Unicorn-36174.exe (PID: 11864)
- Unicorn-44209.exe (PID: 11848)
- Unicorn-50856.exe (PID: 12524)
- Unicorn-21531.exe (PID: 11960)
- Unicorn-43081.exe (PID: 12652)
- Unicorn-54234.exe (PID: 12748)
- Unicorn-1473.exe (PID: 12916)
- Unicorn-54312.exe (PID: 11640)
- Unicorn-24336.exe (PID: 11876)
- Unicorn-54234.exe (PID: 12756)
- Unicorn-14771.exe (PID: 12952)
- Unicorn-56873.exe (PID: 12980)
- Unicorn-14353.exe (PID: 12860)
- Unicorn-54042.exe (PID: 12692)
- Unicorn-2240.exe (PID: 12684)
- Unicorn-51899.exe (PID: 12832)
- Unicorn-58321.exe (PID: 13804)
- Unicorn-10626.exe (PID: 13784)
- Unicorn-28612.exe (PID: 13632)
- Unicorn-10.exe (PID: 12664)
- Unicorn-54234.exe (PID: 12764)
- Unicorn-24337.exe (PID: 15256)
- Unicorn-52432.exe (PID: 14284)
- Unicorn-31290.exe (PID: 14184)
- Unicorn-35789.exe (PID: 13308)
- Unicorn-61673.exe (PID: 13164)
- Unicorn-57330.exe (PID: 7548)
- Unicorn-26962.exe (PID: 13084)
- Unicorn-28527.exe (PID: 15220)
- Unicorn-21477.exe (PID: 2320)
- Unicorn-55026.exe (PID: 6940)
- Unicorn-56090.exe (PID: 14764)
- Unicorn-12872.exe (PID: 15288)
- Unicorn-40891.exe (PID: 14564)
- Unicorn-5012.exe (PID: 14928)
- Unicorn-57936.exe (PID: 14960)
- Unicorn-8425.exe (PID: 14972)
- Unicorn-26258.exe (PID: 15196)
- Unicorn-21773.exe (PID: 15348)
- Unicorn-49544.exe (PID: 14512)
- Unicorn-26607.exe (PID: 15272)
- Unicorn-28114.exe (PID: 13252)
- Unicorn-23807.exe (PID: 15204)
- Unicorn-26202.exe (PID: 14640)
- Unicorn-53978.exe (PID: 16468)
- Unicorn-17567.exe (PID: 14364)
- Unicorn-2763.exe (PID: 14388)
- Unicorn-62700.exe (PID: 14380)
- Unicorn-16498.exe (PID: 14396)
- Unicorn-6520.exe (PID: 14580)
- Unicorn-15642.exe (PID: 15308)
- Unicorn-30343.exe (PID: 13280)
- Unicorn-38700.exe (PID: 14348)
- Unicorn-36765.exe (PID: 16412)
- Unicorn-52752.exe (PID: 16072)
- Unicorn-56592.exe (PID: 7656)
- Unicorn-12872.exe (PID: 15468)
- Unicorn-17776.exe (PID: 16104)
- Unicorn-25141.exe (PID: 16056)
- Unicorn-28522.exe (PID: 16044)
- Unicorn-2674.exe (PID: 16152)
- Unicorn-2674.exe (PID: 16160)
- Unicorn-2674.exe (PID: 16184)
- Unicorn-3935.exe (PID: 16200)
- Unicorn-1897.exe (PID: 16208)
- Unicorn-10641.exe (PID: 15996)
- Unicorn-11528.exe (PID: 16316)
The sample compiled with chinese language support
- 1 (1150).exe (PID: 300)
Reads the computer name
- 1 (1150).exe (PID: 300)
- Unicorn-48952.exe (PID: 1184)
- Unicorn-56923.exe (PID: 7624)
- Unicorn-5262.exe (PID: 7644)
- Unicorn-5065.exe (PID: 7288)
- Unicorn-64427.exe (PID: 4180)
- Unicorn-29456.exe (PID: 6028)
- Unicorn-8521.exe (PID: 3768)
- Unicorn-26000.exe (PID: 1180)
- Unicorn-50810.exe (PID: 7404)
- Unicorn-19280.exe (PID: 5324)
- Unicorn-34739.exe (PID: 7388)
- Unicorn-31209.exe (PID: 7492)
- Unicorn-61391.exe (PID: 7612)
- Unicorn-9013.exe (PID: 7712)
- Unicorn-46939.exe (PID: 7696)
- Unicorn-54650.exe (PID: 7700)
- Unicorn-9008.exe (PID: 7844)
- Unicorn-55875.exe (PID: 7452)
- Unicorn-3254.exe (PID: 7420)
- Unicorn-15138.exe (PID: 7852)
- Unicorn-6202.exe (PID: 7912)
- Unicorn-15750.exe (PID: 7968)
- Unicorn-51001.exe (PID: 8092)
- Unicorn-40603.exe (PID: 8052)
- Unicorn-54479.exe (PID: 8060)
- Unicorn-41667.exe (PID: 8120)
- Unicorn-28922.exe (PID: 7304)
- Unicorn-62834.exe (PID: 7296)
- Unicorn-3053.exe (PID: 1188)
- Unicorn-36658.exe (PID: 7320)
- Unicorn-63598.exe (PID: 8176)
- Unicorn-41091.exe (PID: 7356)
- Unicorn-8802.exe (PID: 4696)
- Unicorn-15745.exe (PID: 736)
- Unicorn-12865.exe (PID: 1244)
- Unicorn-40987.exe (PID: 7952)
- Unicorn-33696.exe (PID: 7804)
- Unicorn-47062.exe (PID: 8188)
- Unicorn-50153.exe (PID: 4188)
- Unicorn-63223.exe (PID: 7764)
- Unicorn-17080.exe (PID: 1240)
- Unicorn-42744.exe (PID: 4408)
- Unicorn-53623.exe (PID: 8160)
- Unicorn-3353.exe (PID: 8168)
- Unicorn-46763.exe (PID: 8108)
- Unicorn-7001.exe (PID: 7256)
- Unicorn-44083.exe (PID: 8868)
- Unicorn-50987.exe (PID: 864)
- Unicorn-28240.exe (PID: 8772)
- Unicorn-33040.exe (PID: 6148)
- Unicorn-4674.exe (PID: 8296)
- Unicorn-24571.exe (PID: 3140)
- Unicorn-46112.exe (PID: 9040)
- Unicorn-23995.exe (PID: 5352)
- Unicorn-24955.exe (PID: 6592)
- Unicorn-20072.exe (PID: 8828)
- Unicorn-35147.exe (PID: 8556)
- Unicorn-7201.exe (PID: 8248)
- Unicorn-45344.exe (PID: 8676)
- Unicorn-20160.exe (PID: 9124)
- Unicorn-20273.exe (PID: 9028)
- Unicorn-57627.exe (PID: 7224)
- Unicorn-20761.exe (PID: 9512)
- Unicorn-20155.exe (PID: 8720)
- Unicorn-43787.exe (PID: 7552)
- Unicorn-13334.exe (PID: 8324)
- Unicorn-8261.exe (PID: 9552)
- Unicorn-39859.exe (PID: 9284)
- Unicorn-33640.exe (PID: 9840)
- Unicorn-17379.exe (PID: 9912)
- Unicorn-40097.exe (PID: 10260)
- Unicorn-40097.exe (PID: 11256)
- Unicorn-16528.exe (PID: 9880)
- Unicorn-11337.exe (PID: 9168)
- Unicorn-24296.exe (PID: 9200)
- Unicorn-25716.exe (PID: 10720)
- Unicorn-19979.exe (PID: 11004)
- Unicorn-58930.exe (PID: 11072)
- Unicorn-22785.exe (PID: 10232)
- Unicorn-34379.exe (PID: 8652)
- Unicorn-16728.exe (PID: 9640)
- Unicorn-2298.exe (PID: 10840)
- Unicorn-57938.exe (PID: 8444)
- Unicorn-9039.exe (PID: 6244)
- Unicorn-57970.exe (PID: 10288)
- Unicorn-36315.exe (PID: 10988)
- Unicorn-52298.exe (PID: 11412)
- Unicorn-31058.exe (PID: 11428)
- Unicorn-25568.exe (PID: 11060)
- Unicorn-4616.exe (PID: 10132)
- Unicorn-10008.exe (PID: 4068)
- Unicorn-39083.exe (PID: 13656)
- Unicorn-15656.exe (PID: 9404)
- Unicorn-3201.exe (PID: 11760)
- Unicorn-24337.exe (PID: 15256)
- Unicorn-54201.exe (PID: 8452)
- Unicorn-34393.exe (PID: 15228)
- Unicorn-26397.exe (PID: 16484)
- Unicorn-40891.exe (PID: 14564)
- Unicorn-4594.exe (PID: 16324)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 7680)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 7680)
- WerFault.exe (PID: 4188)
- WerFault.exe (PID: 728)
- WerFault.exe (PID: 8536)
- WerFault.exe (PID: 9064)
- WerFault.exe (PID: 10560)
- WerFault.exe (PID: 10288)
- WerFault.exe (PID: 14720)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 7680)
- BackgroundTransferHost.exe (PID: 7436)
- BackgroundTransferHost.exe (PID: 6744)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 7680)
Create files in a temporary directory
- Unicorn-48952.exe (PID: 1184)
- Unicorn-56923.exe (PID: 7624)
- Unicorn-26000.exe (PID: 1180)
- Unicorn-8521.exe (PID: 3768)
- Unicorn-19280.exe (PID: 5324)
- Unicorn-34739.exe (PID: 7388)
- Unicorn-64427.exe (PID: 4180)
- Unicorn-29456.exe (PID: 6028)
- Unicorn-29067.exe (PID: 7548)
- Unicorn-23128.exe (PID: 7588)
- Unicorn-61391.exe (PID: 7612)
- Unicorn-55875.exe (PID: 7452)
- Unicorn-3254.exe (PID: 7420)
- Unicorn-46555.exe (PID: 7652)
- Unicorn-29485.exe (PID: 5380)
- Unicorn-46939.exe (PID: 7704)
- 1 (1150).exe (PID: 300)
- Unicorn-6213.exe (PID: 7740)
- Unicorn-5262.exe (PID: 7644)
- Unicorn-31209.exe (PID: 7492)
- Unicorn-14759.exe (PID: 7432)
- Unicorn-1033.exe (PID: 7560)
- Unicorn-6202.exe (PID: 7912)
- Unicorn-39451.exe (PID: 7956)
- Unicorn-56747.exe (PID: 8032)
- Unicorn-8698.exe (PID: 7984)
- Unicorn-51001.exe (PID: 8092)
- Unicorn-58297.exe (PID: 3268)
- Unicorn-12766.exe (PID: 7488)
- Unicorn-57131.exe (PID: 8096)
- Unicorn-61687.exe (PID: 8004)
- Unicorn-46939.exe (PID: 7696)
- Unicorn-56747.exe (PID: 8040)
- Unicorn-9013.exe (PID: 7712)
- Unicorn-54479.exe (PID: 8060)
- Unicorn-40603.exe (PID: 8052)
- Unicorn-5065.exe (PID: 7288)
- Unicorn-7162.exe (PID: 7868)
- Unicorn-62834.exe (PID: 7296)
- Unicorn-50810.exe (PID: 7404)
- Unicorn-36658.exe (PID: 7320)
- Unicorn-63598.exe (PID: 8176)
- Unicorn-30899.exe (PID: 7920)
- Unicorn-28922.exe (PID: 7304)
- Unicorn-3053.exe (PID: 1188)
- Unicorn-26600.exe (PID: 2504)
- Unicorn-8802.exe (PID: 4696)
- Unicorn-39555.exe (PID: 8136)
- Unicorn-12865.exe (PID: 1244)
- Unicorn-15745.exe (PID: 736)
- Unicorn-50153.exe (PID: 4188)
- Unicorn-40987.exe (PID: 7952)
- Unicorn-17080.exe (PID: 1240)
- Unicorn-24306.exe (PID: 5084)
- Unicorn-15750.exe (PID: 7968)
- Unicorn-42744.exe (PID: 4408)
- Unicorn-11997.exe (PID: 8016)
- Unicorn-26291.exe (PID: 3300)
- Unicorn-41667.exe (PID: 8120)
- Unicorn-9008.exe (PID: 7844)
- Unicorn-3353.exe (PID: 8168)
- Unicorn-8926.exe (PID: 8104)
- Unicorn-33040.exe (PID: 6148)
- Unicorn-7001.exe (PID: 7256)
- Unicorn-4674.exe (PID: 8296)
- Unicorn-29259.exe (PID: 7580)
- Unicorn-42370.exe (PID: 7292)
- Unicorn-5662.exe (PID: 7788)
- Unicorn-3431.exe (PID: 7396)
- Unicorn-13449.exe (PID: 5508)
- Unicorn-24571.exe (PID: 3140)
- Unicorn-23995.exe (PID: 5352)
- Unicorn-46112.exe (PID: 9040)
- Unicorn-36112.exe (PID: 8236)
- Unicorn-11805.exe (PID: 7992)
- Unicorn-53107.exe (PID: 8416)
- Unicorn-20072.exe (PID: 8828)
- Unicorn-18619.exe (PID: 8508)
- Unicorn-32873.exe (PID: 8948)
- Unicorn-33696.exe (PID: 7804)
- Unicorn-15138.exe (PID: 7852)
- Unicorn-24955.exe (PID: 6592)
- Unicorn-7201.exe (PID: 8248)
- Unicorn-56018.exe (PID: 5436)
- Unicorn-52833.exe (PID: 9096)
- Unicorn-41091.exe (PID: 7356)
- Unicorn-27672.exe (PID: 8596)
- Unicorn-34185.exe (PID: 8528)
- Unicorn-20160.exe (PID: 9124)
- Unicorn-37114.exe (PID: 9964)
- Unicorn-63443.exe (PID: 8484)
- Unicorn-20273.exe (PID: 9028)
- Unicorn-62178.exe (PID: 9256)
- Unicorn-20761.exe (PID: 9512)
- Unicorn-53315.exe (PID: 8212)
- Unicorn-45344.exe (PID: 8676)
- Unicorn-21041.exe (PID: 2644)
- Unicorn-43787.exe (PID: 7552)
- Unicorn-29981.exe (PID: 8228)
- Unicorn-35147.exe (PID: 8556)
- Unicorn-13334.exe (PID: 8324)
- Unicorn-60066.exe (PID: 8580)
- Unicorn-44010.exe (PID: 9156)
- Unicorn-4809.exe (PID: 9576)
- Unicorn-13849.exe (PID: 9900)
- Unicorn-28043.exe (PID: 8960)
- Unicorn-63543.exe (PID: 10048)
- Unicorn-7798.exe (PID: 8492)
- Unicorn-40097.exe (PID: 11256)
- Unicorn-54650.exe (PID: 7700)
- Unicorn-37761.exe (PID: 2040)
- Unicorn-22755.exe (PID: 9392)
- Unicorn-11727.exe (PID: 10864)
- Unicorn-59459.exe (PID: 8500)
- Unicorn-24395.exe (PID: 9800)
- Unicorn-19979.exe (PID: 11004)
- Unicorn-24296.exe (PID: 9200)
- Unicorn-39022.exe (PID: 8904)
- Unicorn-13928.exe (PID: 9648)
- Unicorn-35339.exe (PID: 8780)
- Unicorn-44083.exe (PID: 8868)
- Unicorn-28249.exe (PID: 6632)
- Unicorn-11337.exe (PID: 9168)
- Unicorn-20155.exe (PID: 8720)
- Unicorn-10008.exe (PID: 4068)
- Unicorn-52298.exe (PID: 11412)
- Unicorn-31058.exe (PID: 11428)
- Unicorn-8281.exe (PID: 10996)
- Unicorn-22288.exe (PID: 7212)
- Unicorn-44948.exe (PID: 13664)
- Unicorn-39083.exe (PID: 13656)
- Unicorn-28240.exe (PID: 8772)
- Unicorn-42947.exe (PID: 10816)
- Unicorn-10626.exe (PID: 13784)
- Unicorn-33971.exe (PID: 10356)
- Unicorn-29491.exe (PID: 10976)
- Unicorn-19083.exe (PID: 5376)
- Unicorn-17763.exe (PID: 9992)
- Unicorn-14410.exe (PID: 11580)
- Unicorn-50987.exe (PID: 864)
- Unicorn-43419.exe (PID: 10124)
- Unicorn-843.exe (PID: 13704)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:20 00:32:00+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
723
Monitored processes
578
Malicious processes
85
Suspicious processes
68
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 300 | "C:\Users\admin\AppData\Local\Temp\1 (1150).exe" | C:\Users\admin\AppData\Local\Temp\1 (1150).exe | explorer.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 728 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7548 -s 748 | C:\Windows\SysWOW64\WerFault.exe | — | Unicorn-29067.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 736 | C:\Users\admin\AppData\Local\Temp\Unicorn-15745.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-15745.exe | Unicorn-26000.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 864 | C:\Users\admin\AppData\Local\Temp\Unicorn-50987.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-50987.exe | Unicorn-5662.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1180 | C:\Users\admin\AppData\Local\Temp\Unicorn-26000.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-26000.exe | Unicorn-56923.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1184 | C:\Users\admin\AppData\Local\Temp\Unicorn-48952.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-48952.exe | 1 (1150).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1188 | C:\Users\admin\AppData\Local\Temp\Unicorn-3053.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3053.exe | Unicorn-56923.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1240 | C:\Users\admin\AppData\Local\Temp\Unicorn-17080.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-17080.exe | Unicorn-9008.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1244 | C:\Users\admin\AppData\Local\Temp\Unicorn-12865.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-12865.exe | Unicorn-29259.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1300 | C:\Users\admin\AppData\Local\Temp\Unicorn-55626.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-55626.exe | Unicorn-55875.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
30 620
Read events
30 605
Write events
15
Delete events
0
Modification events
| (PID) Process: | (7436) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7436) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7436) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7680) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7772) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7772) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7772) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7680) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7680) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (8128) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
822
Suspicious files
31
Text files
10
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7680 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\9e0e0acc-6dfc-44f4-b9d0-e397b744225b.down_data | — | |
MD5:— | SHA256:— | |||
| 7680 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
| 300 | 1 (1150).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5262.exe | executable | |
MD5:F46F9F79BE017DCC7EEEAAB33E57141C | SHA256:34567EEB3E8555E2CB68B01AE71B415BFA351BB0FB544A2EAFB6AD8C01074769 | |||
| 300 | 1 (1150).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-48952.exe | executable | |
MD5:82AD1462ACDE9AC0EC1A63B345AEC68C | SHA256:ADFDC27E7D3BDD3374ABEE4BC8F33AA6CBCB262439E5CA035A637706C20898FC | |||
| 1184 | Unicorn-48952.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56923.exe | executable | |
MD5:4727077152D211599178C52ADDD8E5D7 | SHA256:0B7AC5937159C810B69CA057182F045CC0B45024FE14057698A05922907CCD86 | |||
| 7624 | Unicorn-56923.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-26000.exe | executable | |
MD5:5BC75FEA6AF5FF4B98CB6BB63036E9E5 | SHA256:288133C0C57961C764B88EF5E4193FBD3B527EE949D777ED64C1C158C86A46B5 | |||
| 7644 | Unicorn-5262.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-64427.exe | executable | |
MD5:C1AA69B844217ED3BA7700BFBBD971DE | SHA256:8E2B254DE6B27FC482D0A5C5E1B8A06DDEEFCEA1105AC27762D2DFC2BD72C439 | |||
| 7624 | Unicorn-56923.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8521.exe | executable | |
MD5:B93AFC1DA01E5FE25476FC1E11C39471 | SHA256:2F9D25A0E03552462EE2BB19A29A581A8E5ED6A61FBD6C2759EF30A42FF2A66B | |||
| 7680 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\9e0e0acc-6dfc-44f4-b9d0-e397b744225b.3893574c-1075-45f5-afc2-d896db25ce1c.down_meta | binary | |
MD5:10D4BA3FC9CFFF4800E3E0AF81C040C5 | SHA256:A4D261858A69614E3E9EB7CF3B18751FF06C2823E337F7B0714E958950EDFC93 | |||
| 7680 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:326F497EAAACD38F12C512B5BF34E6D5 | SHA256:8E2AA96B1E8A7D579AA663F07DC4AD841566DB600F81BAEA0854530529794BE5 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
31
DNS requests
20
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6476 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
1188 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
7680 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
6476 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.145:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
3284 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
3284 | svchost.exe | GET | 200 | 23.48.23.177:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.48.23.145:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.160.3:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
2104 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1188 | backgroundTaskHost.exe | 20.31.169.57:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1188 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |