| File name: | 1 (399) |
| Full analysis: | https://app.any.run/tasks/8d646b1f-b347-4f95-9cb5-44275bfb0691 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 19:40:43 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | 8BA77388CB6CCB3D94C8BBAA84E4E000 |
| SHA1: | DF4EF608F281B3EC374D13F3EB39FDEB4603A086 |
| SHA256: | 16DA25EA3537CCBA49A34CD80DA23A01051EAEF636CB48ABFF7AFDC1AB75D89F |
| SSDEEP: | 6144:+7KifKIJvDoHA5iTtpeCQsLx/tBtlvJgBH/WceOEgk/8SwjwpyAvEhyBf620sQXa:++AxqHA5atoUBPhYHOceOEGx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- 1 (399).exe (PID: 1276)
- Unicorn-37676.exe (PID: 7620)
- Unicorn-173.exe (PID: 7612)
- Unicorn-24787.exe (PID: 2140)
- Unicorn-32628.exe (PID: 7792)
- Unicorn-24460.exe (PID: 7808)
- Unicorn-29098.exe (PID: 7828)
- Unicorn-18329.exe (PID: 7816)
- Unicorn-22658.exe (PID: 7888)
- Unicorn-56722.exe (PID: 7936)
- Unicorn-9083.exe (PID: 7860)
- Unicorn-11797.exe (PID: 7880)
- Unicorn-52638.exe (PID: 7924)
- Unicorn-16436.exe (PID: 7904)
- Unicorn-9394.exe (PID: 7944)
- Unicorn-58585.exe (PID: 2096)
- Unicorn-12913.exe (PID: 7232)
- Unicorn-47532.exe (PID: 1280)
- Unicorn-25528.exe (PID: 5544)
- Unicorn-3529.exe (PID: 7952)
- Unicorn-25641.exe (PID: 1052)
- Unicorn-52092.exe (PID: 7384)
- Unicorn-32326.exe (PID: 672)
- Unicorn-47651.exe (PID: 6068)
- Unicorn-13297.exe (PID: 1164)
- Unicorn-24180.exe (PID: 6676)
- Unicorn-51377.exe (PID: 5436)
- Unicorn-35664.exe (PID: 4688)
- Unicorn-28648.exe (PID: 7716)
- Unicorn-60121.exe (PID: 5228)
- Unicorn-6089.exe (PID: 8084)
- Unicorn-54714.exe (PID: 1240)
- Unicorn-44600.exe (PID: 1096)
- Unicorn-56831.exe (PID: 680)
- Unicorn-65404.exe (PID: 8136)
- Unicorn-22980.exe (PID: 8120)
- Unicorn-20955.exe (PID: 7224)
- Unicorn-51616.exe (PID: 4008)
- Unicorn-53847.exe (PID: 7548)
- Unicorn-51782.exe (PID: 4880)
- Unicorn-27470.exe (PID: 7560)
- Unicorn-16514.exe (PID: 8052)
- Unicorn-41236.exe (PID: 7388)
- Unicorn-50988.exe (PID: 3900)
- Unicorn-9881.exe (PID: 6080)
- Unicorn-7433.exe (PID: 6032)
- Unicorn-53105.exe (PID: 5324)
- Unicorn-11159.exe (PID: 5116)
- Unicorn-9279.exe (PID: 5968)
- Unicorn-32876.exe (PID: 5576)
- Unicorn-13655.exe (PID: 7524)
- Unicorn-18124.exe (PID: 4920)
- Unicorn-38986.exe (PID: 7456)
- Unicorn-24730.exe (PID: 3768)
- Unicorn-19494.exe (PID: 4724)
- Unicorn-29416.exe (PID: 7652)
- Unicorn-31122.exe (PID: 5332)
- Unicorn-48227.exe (PID: 8008)
- Unicorn-6063.exe (PID: 7564)
- Unicorn-31772.exe (PID: 5892)
- Unicorn-36115.exe (PID: 4988)
- Unicorn-48658.exe (PID: 2568)
- Unicorn-6644.exe (PID: 8092)
- Unicorn-45950.exe (PID: 1272)
- Unicorn-635.exe (PID: 5680)
- Unicorn-31720.exe (PID: 2644)
- Unicorn-2109.exe (PID: 8288)
- Unicorn-19281.exe (PID: 8204)
- Unicorn-58341.exe (PID: 1388)
- Unicorn-22299.exe (PID: 5404)
- Unicorn-32836.exe (PID: 8296)
- Unicorn-22683.exe (PID: 4448)
- Unicorn-22976.exe (PID: 8040)
- Unicorn-58672.exe (PID: 2904)
- Unicorn-46089.exe (PID: 8068)
- Unicorn-23936.exe (PID: 4120)
- Unicorn-53448.exe (PID: 8212)
- Unicorn-63344.exe (PID: 9032)
- Unicorn-609.exe (PID: 7380)
- Unicorn-17138.exe (PID: 4464)
- Unicorn-18804.exe (PID: 9096)
- Unicorn-11708.exe (PID: 632)
- Unicorn-43500.exe (PID: 9076)
- Unicorn-9052.exe (PID: 8304)
- Unicorn-12918.exe (PID: 8496)
- Unicorn-37205.exe (PID: 7272)
- Unicorn-42156.exe (PID: 8612)
- Unicorn-58855.exe (PID: 8488)
- Unicorn-35166.exe (PID: 8388)
- Unicorn-8589.exe (PID: 9120)
- Unicorn-28150.exe (PID: 8888)
- Unicorn-9524.exe (PID: 7728)
- Unicorn-15606.exe (PID: 9268)
- Unicorn-51564.exe (PID: 8196)
- Unicorn-26676.exe (PID: 5988)
- Unicorn-16296.exe (PID: 2420)
- Unicorn-3110.exe (PID: 7552)
- Unicorn-60426.exe (PID: 4428)
- Unicorn-19883.exe (PID: 3008)
- Unicorn-14043.exe (PID: 8816)
- Unicorn-15706.exe (PID: 8552)
- Unicorn-9052.exe (PID: 9172)
- Unicorn-55129.exe (PID: 7528)
- Unicorn-20750.exe (PID: 9132)
- Unicorn-22787.exe (PID: 9188)
- Unicorn-1294.exe (PID: 8524)
- Unicorn-30763.exe (PID: 8956)
- Unicorn-40786.exe (PID: 9016)
- Unicorn-59644.exe (PID: 9180)
- Unicorn-20174.exe (PID: 8828)
- Unicorn-16562.exe (PID: 2240)
- Unicorn-65238.exe (PID: 9936)
- Unicorn-40542.exe (PID: 9960)
- Unicorn-24428.exe (PID: 8580)
- Unicorn-44626.exe (PID: 9968)
- Unicorn-38164.exe (PID: 8572)
- Unicorn-36894.exe (PID: 8964)
- Unicorn-46961.exe (PID: 7664)
- Unicorn-42128.exe (PID: 9328)
- Unicorn-56686.exe (PID: 9776)
- Unicorn-55486.exe (PID: 8264)
- Unicorn-63410.exe (PID: 9360)
- Unicorn-42388.exe (PID: 7712)
- Unicorn-10355.exe (PID: 10148)
- Unicorn-19764.exe (PID: 9300)
- Unicorn-26452.exe (PID: 10656)
- Unicorn-15030.exe (PID: 5556)
- Unicorn-32104.exe (PID: 1056)
- Unicorn-9343.exe (PID: 2968)
- Unicorn-9741.exe (PID: 9260)
- Unicorn-36219.exe (PID: 7708)
- Unicorn-7105.exe (PID: 11268)
- Unicorn-50739.exe (PID: 11288)
- Unicorn-52031.exe (PID: 9160)
- Unicorn-40188.exe (PID: 10648)
- Unicorn-51580.exe (PID: 10440)
- Unicorn-20230.exe (PID: 10760)
- Unicorn-57340.exe (PID: 8332)
- Unicorn-2633.exe (PID: 9588)
- Unicorn-43889.exe (PID: 8248)
- Unicorn-17028.exe (PID: 12768)
- Unicorn-46577.exe (PID: 12548)
- Unicorn-42346.exe (PID: 9148)
- Unicorn-54102.exe (PID: 10480)
- Unicorn-58771.exe (PID: 12716)
- Unicorn-29750.exe (PID: 12824)
- Unicorn-33006.exe (PID: 12588)
- Unicorn-65216.exe (PID: 12580)
- Unicorn-57676.exe (PID: 11228)
- Unicorn-26321.exe (PID: 12572)
- Unicorn-60591.exe (PID: 13884)
- Unicorn-30158.exe (PID: 516)
- Unicorn-13349.exe (PID: 6708)
- Unicorn-43758.exe (PID: 13916)
- Unicorn-51694.exe (PID: 8356)
- Unicorn-58523.exe (PID: 10056)
Executable content was dropped or overwritten
- 1 (399).exe (PID: 1276)
- Unicorn-37676.exe (PID: 7620)
- Unicorn-24787.exe (PID: 2140)
- Unicorn-173.exe (PID: 7612)
- Unicorn-32628.exe (PID: 7792)
- Unicorn-24460.exe (PID: 7808)
- Unicorn-18329.exe (PID: 7816)
- Unicorn-29098.exe (PID: 7828)
- Unicorn-9083.exe (PID: 7860)
- Unicorn-56722.exe (PID: 7936)
- Unicorn-11797.exe (PID: 7880)
- Unicorn-22658.exe (PID: 7888)
- Unicorn-52638.exe (PID: 7924)
- Unicorn-16436.exe (PID: 7904)
- Unicorn-3529.exe (PID: 7952)
- Unicorn-58585.exe (PID: 2096)
- Unicorn-12913.exe (PID: 7232)
- Unicorn-47532.exe (PID: 1280)
- Unicorn-25528.exe (PID: 5544)
- Unicorn-51616.exe (PID: 4008)
- Unicorn-25641.exe (PID: 1052)
- Unicorn-52092.exe (PID: 7384)
- Unicorn-11159.exe (PID: 5116)
- Unicorn-56831.exe (PID: 680)
- Unicorn-31772.exe (PID: 5892)
- Unicorn-35664.exe (PID: 4688)
- Unicorn-13297.exe (PID: 1164)
- Unicorn-24180.exe (PID: 6676)
- Unicorn-51377.exe (PID: 5436)
- Unicorn-6644.exe (PID: 8092)
- Unicorn-9394.exe (PID: 7944)
- Unicorn-16514.exe (PID: 8052)
- Unicorn-6089.exe (PID: 8084)
- Unicorn-22980.exe (PID: 8120)
- Unicorn-28648.exe (PID: 7716)
- Unicorn-54714.exe (PID: 1240)
- Unicorn-44600.exe (PID: 1096)
- Unicorn-65404.exe (PID: 8136)
- Unicorn-27470.exe (PID: 7560)
- Unicorn-20955.exe (PID: 7224)
- Unicorn-53847.exe (PID: 7548)
- Unicorn-51782.exe (PID: 4880)
- Unicorn-50988.exe (PID: 3900)
- Unicorn-9881.exe (PID: 6080)
- Unicorn-11708.exe (PID: 632)
- Unicorn-9279.exe (PID: 5968)
- Unicorn-7433.exe (PID: 6032)
- Unicorn-32876.exe (PID: 5576)
- Unicorn-53105.exe (PID: 5324)
- Unicorn-47651.exe (PID: 6068)
- Unicorn-13655.exe (PID: 7524)
- Unicorn-18124.exe (PID: 4920)
- Unicorn-38986.exe (PID: 7456)
- Unicorn-24730.exe (PID: 3768)
- Unicorn-19494.exe (PID: 4724)
- Unicorn-29416.exe (PID: 7652)
- Unicorn-31122.exe (PID: 5332)
- Unicorn-48227.exe (PID: 8008)
- Unicorn-6063.exe (PID: 7564)
- Unicorn-36115.exe (PID: 4988)
- Unicorn-48658.exe (PID: 2568)
- Unicorn-45950.exe (PID: 1272)
- Unicorn-19281.exe (PID: 8204)
- Unicorn-22976.exe (PID: 8040)
- Unicorn-31720.exe (PID: 2644)
- Unicorn-32326.exe (PID: 672)
- Unicorn-2109.exe (PID: 8288)
- Unicorn-58341.exe (PID: 1388)
- Unicorn-32836.exe (PID: 8296)
- Unicorn-22683.exe (PID: 4448)
- Unicorn-53448.exe (PID: 8212)
- Unicorn-22299.exe (PID: 5404)
- Unicorn-58672.exe (PID: 2904)
- Unicorn-46089.exe (PID: 8068)
- Unicorn-60121.exe (PID: 5228)
- Unicorn-23936.exe (PID: 4120)
- Unicorn-41236.exe (PID: 7388)
- Unicorn-63344.exe (PID: 9032)
- Unicorn-609.exe (PID: 7380)
- Unicorn-18804.exe (PID: 9096)
- Unicorn-17138.exe (PID: 4464)
- Unicorn-43500.exe (PID: 9076)
- Unicorn-635.exe (PID: 5680)
- Unicorn-12918.exe (PID: 8496)
- Unicorn-37205.exe (PID: 7272)
- Unicorn-9524.exe (PID: 7728)
- Unicorn-42156.exe (PID: 8612)
- Unicorn-9052.exe (PID: 8304)
- Unicorn-58855.exe (PID: 8488)
- Unicorn-35166.exe (PID: 8388)
- Unicorn-28150.exe (PID: 8888)
- Unicorn-8589.exe (PID: 9120)
- Unicorn-51564.exe (PID: 8196)
- Unicorn-16296.exe (PID: 2420)
- Unicorn-3110.exe (PID: 7552)
- Unicorn-15606.exe (PID: 9268)
- Unicorn-26676.exe (PID: 5988)
- Unicorn-19883.exe (PID: 3008)
- Unicorn-60426.exe (PID: 4428)
- Unicorn-14043.exe (PID: 8816)
- Unicorn-15706.exe (PID: 8552)
- Unicorn-9052.exe (PID: 9172)
- Unicorn-22787.exe (PID: 9188)
- Unicorn-40786.exe (PID: 9016)
- Unicorn-20750.exe (PID: 9132)
- Unicorn-30763.exe (PID: 8956)
- Unicorn-1294.exe (PID: 8524)
- Unicorn-55129.exe (PID: 7528)
- Unicorn-20174.exe (PID: 8828)
- Unicorn-16562.exe (PID: 2240)
- Unicorn-24428.exe (PID: 8580)
- Unicorn-40542.exe (PID: 9960)
- Unicorn-65238.exe (PID: 9936)
- Unicorn-44626.exe (PID: 9968)
- Unicorn-38164.exe (PID: 8572)
- Unicorn-36894.exe (PID: 8964)
- Unicorn-46961.exe (PID: 7664)
- Unicorn-42128.exe (PID: 9328)
- Unicorn-56686.exe (PID: 9776)
- Unicorn-55486.exe (PID: 8264)
- Unicorn-42388.exe (PID: 7712)
- Unicorn-32104.exe (PID: 1056)
- Unicorn-10355.exe (PID: 10148)
- Unicorn-19764.exe (PID: 9300)
- Unicorn-26452.exe (PID: 10656)
- Unicorn-15030.exe (PID: 5556)
- Unicorn-9343.exe (PID: 2968)
- Unicorn-9741.exe (PID: 9260)
- Unicorn-36219.exe (PID: 7708)
- Unicorn-52031.exe (PID: 9160)
- Unicorn-7105.exe (PID: 11268)
- Unicorn-50739.exe (PID: 11288)
- Unicorn-40188.exe (PID: 10648)
- Unicorn-43889.exe (PID: 8248)
- Unicorn-51580.exe (PID: 10440)
- Unicorn-20230.exe (PID: 10760)
- Unicorn-63037.exe (PID: 11200)
- Unicorn-57340.exe (PID: 8332)
- Unicorn-2633.exe (PID: 9588)
- Unicorn-46577.exe (PID: 12548)
- Unicorn-42346.exe (PID: 9148)
- Unicorn-54102.exe (PID: 10480)
- Unicorn-58771.exe (PID: 12716)
- Unicorn-17028.exe (PID: 12768)
- Unicorn-29750.exe (PID: 12824)
- Unicorn-65216.exe (PID: 12580)
- Unicorn-33006.exe (PID: 12588)
- Unicorn-51694.exe (PID: 8356)
- Unicorn-26321.exe (PID: 12572)
- Unicorn-57676.exe (PID: 11228)
- Unicorn-30158.exe (PID: 516)
- Unicorn-13349.exe (PID: 6708)
- Unicorn-42502.exe (PID: 7084)
- Unicorn-13818.exe (PID: 13356)
- Unicorn-59178.exe (PID: 10908)
- Unicorn-63410.exe (PID: 9360)
- Unicorn-2327.exe (PID: 11992)
- Unicorn-4994.exe (PID: 8228)
- Unicorn-17386.exe (PID: 9440)
- Unicorn-27230.exe (PID: 1180)
- Unicorn-1460.exe (PID: 12556)
- Unicorn-41196.exe (PID: 8240)
- Unicorn-40990.exe (PID: 13892)
- Unicorn-55103.exe (PID: 9828)
- Unicorn-17028.exe (PID: 8948)
- Unicorn-64.exe (PID: 9736)
- Unicorn-11740.exe (PID: 9688)
- Unicorn-58523.exe (PID: 10056)
- Unicorn-23659.exe (PID: 10792)
- Unicorn-59644.exe (PID: 9180)
- Unicorn-59518.exe (PID: 9508)
- Unicorn-37072.exe (PID: 12628)
- Unicorn-43758.exe (PID: 13916)
- Unicorn-54309.exe (PID: 9292)
- Unicorn-12210.exe (PID: 14068)
- Unicorn-60591.exe (PID: 13884)
Executes application which crashes
- Unicorn-29416.exe (PID: 7652)
- Unicorn-15706.exe (PID: 8552)
- Unicorn-62965.exe (PID: 10576)
INFO
Checks supported languages
- 1 (399).exe (PID: 1276)
- Unicorn-24787.exe (PID: 2140)
- Unicorn-173.exe (PID: 7612)
- Unicorn-37676.exe (PID: 7620)
- Unicorn-32628.exe (PID: 7792)
- Unicorn-29098.exe (PID: 7828)
- Unicorn-24460.exe (PID: 7808)
- Unicorn-11797.exe (PID: 7880)
- Unicorn-22658.exe (PID: 7888)
- Unicorn-16436.exe (PID: 7904)
- Unicorn-56722.exe (PID: 7936)
- Unicorn-9394.exe (PID: 7944)
- Unicorn-3529.exe (PID: 7952)
- Unicorn-47532.exe (PID: 1280)
- Unicorn-51616.exe (PID: 4008)
- Unicorn-25528.exe (PID: 5544)
- Unicorn-58585.exe (PID: 2096)
- Unicorn-12913.exe (PID: 7232)
- Unicorn-25641.exe (PID: 1052)
- Unicorn-38986.exe (PID: 7456)
- Unicorn-32326.exe (PID: 672)
- Unicorn-31772.exe (PID: 5892)
- Unicorn-56831.exe (PID: 680)
- Unicorn-11159.exe (PID: 5116)
- Unicorn-52092.exe (PID: 7384)
- Unicorn-35664.exe (PID: 4688)
- Unicorn-47651.exe (PID: 6068)
- Unicorn-24180.exe (PID: 6676)
- Unicorn-44600.exe (PID: 1096)
- Unicorn-9881.exe (PID: 6080)
- Unicorn-51377.exe (PID: 5436)
- Unicorn-16514.exe (PID: 8052)
- Unicorn-54714.exe (PID: 1240)
- Unicorn-28648.exe (PID: 7716)
- Unicorn-60121.exe (PID: 5228)
- Unicorn-6089.exe (PID: 8084)
- Unicorn-6644.exe (PID: 8092)
- Unicorn-65404.exe (PID: 8136)
- Unicorn-22980.exe (PID: 8120)
- Unicorn-53847.exe (PID: 7548)
- Unicorn-29416.exe (PID: 7652)
- Unicorn-635.exe (PID: 5680)
- Unicorn-53105.exe (PID: 5324)
- Unicorn-19494.exe (PID: 4724)
- Unicorn-45950.exe (PID: 1272)
- Unicorn-32876.exe (PID: 5576)
- Unicorn-41236.exe (PID: 7388)
- Unicorn-11708.exe (PID: 632)
- Unicorn-31122.exe (PID: 5332)
- Unicorn-22299.exe (PID: 5404)
- Unicorn-13655.exe (PID: 7524)
- Unicorn-48658.exe (PID: 2568)
- Unicorn-47651.exe (PID: 920)
- Unicorn-27230.exe (PID: 1180)
- Unicorn-48227.exe (PID: 8008)
- Unicorn-6063.exe (PID: 7564)
- Unicorn-609.exe (PID: 7380)
- Unicorn-9524.exe (PID: 7728)
- Unicorn-26676.exe (PID: 5988)
- Unicorn-24730.exe (PID: 3768)
- Unicorn-19883.exe (PID: 3008)
- Unicorn-46089.exe (PID: 8068)
- Unicorn-16562.exe (PID: 2240)
- Unicorn-16296.exe (PID: 2420)
- Unicorn-22976.exe (PID: 8040)
- Unicorn-17138.exe (PID: 4464)
- Unicorn-31720.exe (PID: 2644)
- Unicorn-42388.exe (PID: 7712)
- Unicorn-36115.exe (PID: 4988)
- Unicorn-30158.exe (PID: 516)
- Unicorn-23936.exe (PID: 4120)
- Unicorn-19281.exe (PID: 8204)
- Unicorn-53448.exe (PID: 8212)
- Unicorn-42502.exe (PID: 7084)
- Unicorn-53448.exe (PID: 8216)
- Unicorn-41196.exe (PID: 8240)
- Unicorn-43889.exe (PID: 8248)
- Unicorn-30658.exe (PID: 8256)
- Unicorn-2109.exe (PID: 8288)
- Unicorn-57340.exe (PID: 8332)
- Unicorn-51694.exe (PID: 8356)
- Unicorn-10531.exe (PID: 8452)
- Unicorn-12918.exe (PID: 8496)
- Unicorn-27382.exe (PID: 8508)
- Unicorn-15706.exe (PID: 8552)
- Unicorn-7437.exe (PID: 8596)
- Unicorn-58855.exe (PID: 8488)
- Unicorn-1294.exe (PID: 8524)
- Unicorn-42156.exe (PID: 8612)
- Unicorn-4994.exe (PID: 8228)
- Unicorn-55486.exe (PID: 8264)
- Unicorn-28512.exe (PID: 8588)
- Unicorn-17268.exe (PID: 8476)
- Unicorn-24428.exe (PID: 8580)
- Unicorn-20174.exe (PID: 8828)
- Unicorn-14043.exe (PID: 8816)
- Unicorn-38164.exe (PID: 8572)
- Unicorn-63344.exe (PID: 9032)
- Unicorn-15898.exe (PID: 8880)
- Unicorn-18804.exe (PID: 9096)
- Unicorn-12997.exe (PID: 8900)
- Unicorn-40786.exe (PID: 9016)
- Unicorn-8589.exe (PID: 9120)
- Unicorn-42346.exe (PID: 9148)
- Unicorn-36894.exe (PID: 8964)
- Unicorn-52031.exe (PID: 9160)
- Unicorn-50900.exe (PID: 8836)
- Unicorn-64496.exe (PID: 3024)
- Unicorn-59644.exe (PID: 9180)
- Unicorn-9052.exe (PID: 9172)
- Unicorn-9052.exe (PID: 8304)
- Unicorn-13349.exe (PID: 6708)
- Unicorn-9741.exe (PID: 9260)
- Unicorn-37205.exe (PID: 7272)
- Unicorn-19764.exe (PID: 9300)
- Unicorn-15606.exe (PID: 9268)
- Unicorn-63410.exe (PID: 9360)
- Unicorn-55129.exe (PID: 7528)
- Unicorn-31121.exe (PID: 9432)
- Unicorn-16155.exe (PID: 9400)
- Unicorn-15030.exe (PID: 5556)
- Unicorn-40542.exe (PID: 9960)
- Unicorn-63681.exe (PID: 9236)
- Unicorn-29446.exe (PID: 9492)
- Unicorn-15248.exe (PID: 9456)
- Unicorn-59518.exe (PID: 9508)
- Unicorn-58664.exe (PID: 9320)
- Unicorn-2633.exe (PID: 9588)
- Unicorn-54309.exe (PID: 9292)
- Unicorn-3328.exe (PID: 9716)
- Unicorn-48034.exe (PID: 9672)
- Unicorn-19930.exe (PID: 9744)
- Unicorn-64.exe (PID: 9736)
- Unicorn-2010.exe (PID: 9768)
- Unicorn-42296.exe (PID: 9800)
- Unicorn-11569.exe (PID: 9808)
- Unicorn-55103.exe (PID: 9828)
- Unicorn-25768.exe (PID: 9860)
- Unicorn-29468.exe (PID: 9556)
- Unicorn-44626.exe (PID: 9968)
- Unicorn-42872.exe (PID: 9876)
- Unicorn-63640.exe (PID: 10128)
- Unicorn-12301.exe (PID: 10172)
- Unicorn-10801.exe (PID: 9580)
- Unicorn-32401.exe (PID: 9700)
- Unicorn-56712.exe (PID: 9284)
- Unicorn-10355.exe (PID: 10148)
- Unicorn-51580.exe (PID: 10440)
- Unicorn-4969.exe (PID: 10036)
- Unicorn-2571.exe (PID: 10408)
- Unicorn-54102.exe (PID: 10480)
- Unicorn-15207.exe (PID: 10468)
- Unicorn-40188.exe (PID: 10648)
- Unicorn-32120.exe (PID: 10552)
- Unicorn-46053.exe (PID: 10640)
- Unicorn-60476.exe (PID: 10668)
- Unicorn-7978.exe (PID: 10720)
- Unicorn-56048.exe (PID: 10496)
- Unicorn-26452.exe (PID: 10656)
- Unicorn-49395.exe (PID: 10976)
- Unicorn-29525.exe (PID: 10768)
- Unicorn-32722.exe (PID: 10208)
- Unicorn-49395.exe (PID: 10984)
- Unicorn-20230.exe (PID: 10760)
- Unicorn-63130.exe (PID: 11020)
- Unicorn-49395.exe (PID: 10968)
- Unicorn-7105.exe (PID: 11268)
- Unicorn-50739.exe (PID: 11288)
- Unicorn-49395.exe (PID: 11000)
- Unicorn-45332.exe (PID: 11248)
- Unicorn-55538.exe (PID: 3156)
- Unicorn-23659.exe (PID: 10792)
- Unicorn-40240.exe (PID: 10924)
- Unicorn-33199.exe (PID: 10696)
- Unicorn-6821.exe (PID: 10028)
- Unicorn-33965.exe (PID: 10784)
- Unicorn-65150.exe (PID: 11308)
- Unicorn-20230.exe (PID: 10140)
- Unicorn-38508.exe (PID: 11336)
- Unicorn-22701.exe (PID: 11192)
- Unicorn-63037.exe (PID: 11200)
- Unicorn-31033.exe (PID: 11260)
- Unicorn-20636.exe (PID: 11092)
- Unicorn-17896.exe (PID: 11400)
- Unicorn-14942.exe (PID: 11748)
- Unicorn-9846.exe (PID: 11764)
- Unicorn-51044.exe (PID: 11772)
- Unicorn-26448.exe (PID: 11780)
- Unicorn-52798.exe (PID: 11384)
- Unicorn-4252.exe (PID: 11376)
- Unicorn-9104.exe (PID: 12000)
- Unicorn-22839.exe (PID: 12016)
- Unicorn-2135.exe (PID: 12060)
- Unicorn-3458.exe (PID: 10952)
- Unicorn-22839.exe (PID: 12008)
- Unicorn-14124.exe (PID: 12024)
- Unicorn-2327.exe (PID: 11992)
- Unicorn-2479.exe (PID: 12184)
- Unicorn-29.exe (PID: 10540)
- Unicorn-115.exe (PID: 11124)
- Unicorn-3100.exe (PID: 11208)
- Unicorn-28399.exe (PID: 12224)
- Unicorn-29750.exe (PID: 12824)
- Unicorn-17028.exe (PID: 11408)
- Unicorn-62965.exe (PID: 6724)
- Unicorn-1512.exe (PID: 11068)
- Unicorn-8363.exe (PID: 7672)
- Unicorn-13209.exe (PID: 6036)
- Unicorn-6722.exe (PID: 12312)
- Unicorn-4749.exe (PID: 12192)
- Unicorn-62965.exe (PID: 10576)
- Unicorn-45617.exe (PID: 12340)
- Unicorn-18854.exe (PID: 12452)
- Unicorn-39752.exe (PID: 12332)
- Unicorn-40406.exe (PID: 12348)
- Unicorn-31967.exe (PID: 12504)
- Unicorn-48980.exe (PID: 12528)
- Unicorn-2280.exe (PID: 12684)
- Unicorn-1460.exe (PID: 12556)
- Unicorn-33006.exe (PID: 12588)
- Unicorn-37072.exe (PID: 12628)
- Unicorn-35389.exe (PID: 12460)
- Unicorn-24454.exe (PID: 12496)
- Unicorn-23550.exe (PID: 12972)
- Unicorn-45432.exe (PID: 12920)
- Unicorn-31041.exe (PID: 12936)
- Unicorn-9955.exe (PID: 12988)
- Unicorn-45432.exe (PID: 12908)
- Unicorn-40990.exe (PID: 13892)
- Unicorn-40270.exe (PID: 13096)
- Unicorn-15573.exe (PID: 13168)
- Unicorn-42308.exe (PID: 13144)
- Unicorn-24872.exe (PID: 13236)
- Unicorn-21914.exe (PID: 13252)
- Unicorn-28956.exe (PID: 13264)
- Unicorn-48557.exe (PID: 13280)
- Unicorn-17638.exe (PID: 13304)
- Unicorn-21172.exe (PID: 12820)
- Unicorn-1559.exe (PID: 11368)
- Unicorn-28572.exe (PID: 13124)
The sample compiled with chinese language support
- 1 (399).exe (PID: 1276)
- Unicorn-2633.exe (PID: 9588)
- Unicorn-27230.exe (PID: 1180)
- Unicorn-40188.exe (PID: 10648)
- Unicorn-9881.exe (PID: 6080)
- Unicorn-29750.exe (PID: 12824)
- Unicorn-17028.exe (PID: 12768)
- Unicorn-50988.exe (PID: 3900)
- Unicorn-29098.exe (PID: 7828)
- Unicorn-17028.exe (PID: 8948)
- Unicorn-30763.exe (PID: 8956)
- Unicorn-25641.exe (PID: 1052)
- Unicorn-63344.exe (PID: 9032)
- Unicorn-9279.exe (PID: 5968)
- Unicorn-42156.exe (PID: 8612)
- Unicorn-4994.exe (PID: 8228)
- Unicorn-24428.exe (PID: 8580)
- Unicorn-22299.exe (PID: 5404)
- Unicorn-57340.exe (PID: 8332)
- Unicorn-54309.exe (PID: 9292)
- Unicorn-58672.exe (PID: 2904)
- Unicorn-56831.exe (PID: 680)
- Unicorn-22683.exe (PID: 4448)
- Unicorn-7105.exe (PID: 11268)
- Unicorn-53847.exe (PID: 7548)
- Unicorn-36115.exe (PID: 4988)
- Unicorn-9343.exe (PID: 2968)
- Unicorn-54102.exe (PID: 10480)
- Unicorn-32876.exe (PID: 5576)
- Unicorn-52031.exe (PID: 9160)
- Unicorn-55129.exe (PID: 7528)
- Unicorn-16514.exe (PID: 8052)
- Unicorn-26676.exe (PID: 5988)
- Unicorn-28150.exe (PID: 8888)
- Unicorn-35166.exe (PID: 8388)
- Unicorn-43889.exe (PID: 8248)
- Unicorn-58341.exe (PID: 1388)
- Unicorn-60591.exe (PID: 13884)
- Unicorn-25528.exe (PID: 5544)
- Unicorn-48658.exe (PID: 2568)
- Unicorn-22787.exe (PID: 9188)
- Unicorn-56722.exe (PID: 7936)
- Unicorn-48227.exe (PID: 8008)
- Unicorn-32836.exe (PID: 8296)
- Unicorn-7433.exe (PID: 6032)
- Unicorn-31772.exe (PID: 5892)
- Unicorn-16562.exe (PID: 2240)
- Unicorn-58523.exe (PID: 10056)
- Unicorn-12210.exe (PID: 14068)
- Unicorn-6089.exe (PID: 8084)
- Unicorn-27470.exe (PID: 7560)
- Unicorn-9052.exe (PID: 8304)
- Unicorn-46577.exe (PID: 12548)
- Unicorn-24787.exe (PID: 2140)
- Unicorn-40786.exe (PID: 9016)
Reads the computer name
- Unicorn-24787.exe (PID: 2140)
- 1 (399).exe (PID: 1276)
- Unicorn-37676.exe (PID: 7620)
- Unicorn-173.exe (PID: 7612)
- Unicorn-32628.exe (PID: 7792)
- Unicorn-24460.exe (PID: 7808)
- Unicorn-18329.exe (PID: 7816)
- Unicorn-29098.exe (PID: 7828)
- Unicorn-9083.exe (PID: 7860)
- Unicorn-22658.exe (PID: 7888)
- Unicorn-56722.exe (PID: 7936)
- Unicorn-52638.exe (PID: 7924)
- Unicorn-16436.exe (PID: 7904)
- Unicorn-9394.exe (PID: 7944)
- Unicorn-3529.exe (PID: 7952)
- Unicorn-47532.exe (PID: 1280)
- Unicorn-58585.exe (PID: 2096)
- Unicorn-25528.exe (PID: 5544)
- Unicorn-52092.exe (PID: 7384)
- Unicorn-51616.exe (PID: 4008)
- Unicorn-25641.exe (PID: 1052)
- Unicorn-13297.exe (PID: 1164)
- Unicorn-11159.exe (PID: 5116)
- Unicorn-32326.exe (PID: 672)
- Unicorn-47651.exe (PID: 6068)
- Unicorn-31772.exe (PID: 5892)
- Unicorn-35664.exe (PID: 4688)
- Unicorn-24180.exe (PID: 6676)
- Unicorn-16514.exe (PID: 8052)
- Unicorn-28648.exe (PID: 7716)
- Unicorn-9881.exe (PID: 6080)
- Unicorn-65404.exe (PID: 8136)
- Unicorn-6089.exe (PID: 8084)
- Unicorn-44600.exe (PID: 1096)
- Unicorn-22980.exe (PID: 8120)
- Unicorn-54714.exe (PID: 1240)
- Unicorn-50988.exe (PID: 3900)
- Unicorn-53847.exe (PID: 7548)
- Unicorn-51782.exe (PID: 4880)
- Unicorn-11708.exe (PID: 632)
- Unicorn-9279.exe (PID: 5968)
- Unicorn-32876.exe (PID: 5576)
- Unicorn-13655.exe (PID: 7524)
- Unicorn-18124.exe (PID: 4920)
- Unicorn-24730.exe (PID: 3768)
- Unicorn-29416.exe (PID: 7652)
- Unicorn-6063.exe (PID: 7564)
- Unicorn-31122.exe (PID: 5332)
- Unicorn-48658.exe (PID: 2568)
- Unicorn-36115.exe (PID: 4988)
- Unicorn-45950.exe (PID: 1272)
- Unicorn-19281.exe (PID: 8204)
- Unicorn-58341.exe (PID: 1388)
- Unicorn-22976.exe (PID: 8040)
- Unicorn-31720.exe (PID: 2644)
- Unicorn-2109.exe (PID: 8288)
- Unicorn-22299.exe (PID: 5404)
- Unicorn-32836.exe (PID: 8296)
- Unicorn-22683.exe (PID: 4448)
- Unicorn-58672.exe (PID: 2904)
- Unicorn-23936.exe (PID: 4120)
- Unicorn-43500.exe (PID: 9076)
- Unicorn-17138.exe (PID: 4464)
- Unicorn-58855.exe (PID: 8488)
- Unicorn-28150.exe (PID: 8888)
- Unicorn-37205.exe (PID: 7272)
- Unicorn-12918.exe (PID: 8496)
- Unicorn-15606.exe (PID: 9268)
- Unicorn-16296.exe (PID: 2420)
- Unicorn-40786.exe (PID: 9016)
- Unicorn-3110.exe (PID: 7552)
- Unicorn-60426.exe (PID: 4428)
- Unicorn-19883.exe (PID: 3008)
- Unicorn-8589.exe (PID: 9120)
- Unicorn-59644.exe (PID: 9180)
- Unicorn-14043.exe (PID: 8816)
- Unicorn-9052.exe (PID: 9172)
- Unicorn-15706.exe (PID: 8552)
- Unicorn-55129.exe (PID: 7528)
- Unicorn-44626.exe (PID: 9968)
- Unicorn-46961.exe (PID: 7664)
- Unicorn-56686.exe (PID: 9776)
- Unicorn-32104.exe (PID: 1056)
- Unicorn-26452.exe (PID: 10656)
- Unicorn-27230.exe (PID: 1180)
- Unicorn-10355.exe (PID: 10148)
- Unicorn-36219.exe (PID: 7708)
- Unicorn-50739.exe (PID: 11288)
- Unicorn-42346.exe (PID: 9148)
- Unicorn-4994.exe (PID: 8228)
- Unicorn-54102.exe (PID: 10480)
- Unicorn-65216.exe (PID: 12580)
- Unicorn-57676.exe (PID: 11228)
- Unicorn-42502.exe (PID: 7084)
- Unicorn-30158.exe (PID: 516)
- Unicorn-13349.exe (PID: 6708)
- Unicorn-40990.exe (PID: 13892)
- Unicorn-60591.exe (PID: 13884)
Create files in a temporary directory
- 1 (399).exe (PID: 1276)
- Unicorn-24787.exe (PID: 2140)
- Unicorn-32628.exe (PID: 7792)
- Unicorn-24460.exe (PID: 7808)
- Unicorn-173.exe (PID: 7612)
- Unicorn-29098.exe (PID: 7828)
- Unicorn-9083.exe (PID: 7860)
- Unicorn-22658.exe (PID: 7888)
- Unicorn-11797.exe (PID: 7880)
- Unicorn-18329.exe (PID: 7816)
- Unicorn-16436.exe (PID: 7904)
- Unicorn-52638.exe (PID: 7924)
- Unicorn-58585.exe (PID: 2096)
- Unicorn-12913.exe (PID: 7232)
- Unicorn-47532.exe (PID: 1280)
- Unicorn-3529.exe (PID: 7952)
- Unicorn-51616.exe (PID: 4008)
- Unicorn-37676.exe (PID: 7620)
- Unicorn-52092.exe (PID: 7384)
- Unicorn-13297.exe (PID: 1164)
- Unicorn-56722.exe (PID: 7936)
- Unicorn-31772.exe (PID: 5892)
- Unicorn-35664.exe (PID: 4688)
- Unicorn-11159.exe (PID: 5116)
- Unicorn-24180.exe (PID: 6676)
- Unicorn-9394.exe (PID: 7944)
- Unicorn-51377.exe (PID: 5436)
- Unicorn-6644.exe (PID: 8092)
- Unicorn-28648.exe (PID: 7716)
- Unicorn-25641.exe (PID: 1052)
- Unicorn-6089.exe (PID: 8084)
- Unicorn-22980.exe (PID: 8120)
- Unicorn-54714.exe (PID: 1240)
- Unicorn-44600.exe (PID: 1096)
- Unicorn-25528.exe (PID: 5544)
- Unicorn-9881.exe (PID: 6080)
- Unicorn-20955.exe (PID: 7224)
- Unicorn-50988.exe (PID: 3900)
- Unicorn-27470.exe (PID: 7560)
- Unicorn-16514.exe (PID: 8052)
- Unicorn-38986.exe (PID: 7456)
- Unicorn-53105.exe (PID: 5324)
- Unicorn-9279.exe (PID: 5968)
- Unicorn-7433.exe (PID: 6032)
- Unicorn-32876.exe (PID: 5576)
- Unicorn-13655.exe (PID: 7524)
- Unicorn-18124.exe (PID: 4920)
- Unicorn-65404.exe (PID: 8136)
- Unicorn-19494.exe (PID: 4724)
- Unicorn-29416.exe (PID: 7652)
- Unicorn-48227.exe (PID: 8008)
- Unicorn-48658.exe (PID: 2568)
- Unicorn-45950.exe (PID: 1272)
- Unicorn-56831.exe (PID: 680)
- Unicorn-19281.exe (PID: 8204)
- Unicorn-31720.exe (PID: 2644)
- Unicorn-32326.exe (PID: 672)
- Unicorn-22299.exe (PID: 5404)
- Unicorn-22976.exe (PID: 8040)
- Unicorn-22683.exe (PID: 4448)
- Unicorn-53448.exe (PID: 8212)
- Unicorn-46089.exe (PID: 8068)
- Unicorn-23936.exe (PID: 4120)
- Unicorn-60121.exe (PID: 5228)
- Unicorn-41236.exe (PID: 7388)
- Unicorn-63344.exe (PID: 9032)
- Unicorn-609.exe (PID: 7380)
- Unicorn-58341.exe (PID: 1388)
- Unicorn-11708.exe (PID: 632)
- Unicorn-43500.exe (PID: 9076)
- Unicorn-18804.exe (PID: 9096)
- Unicorn-53847.exe (PID: 7548)
- Unicorn-9052.exe (PID: 8304)
- Unicorn-12918.exe (PID: 8496)
- Unicorn-51782.exe (PID: 4880)
- Unicorn-9524.exe (PID: 7728)
- Unicorn-31122.exe (PID: 5332)
- Unicorn-58855.exe (PID: 8488)
- Unicorn-35166.exe (PID: 8388)
- Unicorn-28150.exe (PID: 8888)
- Unicorn-8589.exe (PID: 9120)
- Unicorn-51564.exe (PID: 8196)
- Unicorn-3110.exe (PID: 7552)
- Unicorn-60426.exe (PID: 4428)
- Unicorn-14043.exe (PID: 8816)
- Unicorn-15706.exe (PID: 8552)
- Unicorn-30763.exe (PID: 8956)
- Unicorn-9052.exe (PID: 9172)
- Unicorn-55129.exe (PID: 7528)
- Unicorn-20750.exe (PID: 9132)
- Unicorn-1294.exe (PID: 8524)
- Unicorn-22787.exe (PID: 9188)
- Unicorn-635.exe (PID: 5680)
- Unicorn-47651.exe (PID: 6068)
- Unicorn-24428.exe (PID: 8580)
- Unicorn-36115.exe (PID: 4988)
- Unicorn-24730.exe (PID: 3768)
- Unicorn-40542.exe (PID: 9960)
- Unicorn-65238.exe (PID: 9936)
- Unicorn-15606.exe (PID: 9268)
- Unicorn-38164.exe (PID: 8572)
- Unicorn-26676.exe (PID: 5988)
- Unicorn-44626.exe (PID: 9968)
- Unicorn-42128.exe (PID: 9328)
- Unicorn-56686.exe (PID: 9776)
- Unicorn-55486.exe (PID: 8264)
- Unicorn-26452.exe (PID: 10656)
- Unicorn-32836.exe (PID: 8296)
- Unicorn-10355.exe (PID: 10148)
- Unicorn-19764.exe (PID: 9300)
- Unicorn-15030.exe (PID: 5556)
- Unicorn-9343.exe (PID: 2968)
- Unicorn-20174.exe (PID: 8828)
- Unicorn-9741.exe (PID: 9260)
- Unicorn-36219.exe (PID: 7708)
- Unicorn-7105.exe (PID: 11268)
- Unicorn-50739.exe (PID: 11288)
- Unicorn-36894.exe (PID: 8964)
- Unicorn-37205.exe (PID: 7272)
- Unicorn-42156.exe (PID: 8612)
- Unicorn-40188.exe (PID: 10648)
- Unicorn-51580.exe (PID: 10440)
- Unicorn-63037.exe (PID: 11200)
- Unicorn-43889.exe (PID: 8248)
- Unicorn-57340.exe (PID: 8332)
- Unicorn-58771.exe (PID: 12716)
- Unicorn-2633.exe (PID: 9588)
- Unicorn-16296.exe (PID: 2420)
- Unicorn-40786.exe (PID: 9016)
- Unicorn-57676.exe (PID: 11228)
- Unicorn-51694.exe (PID: 8356)
- Unicorn-30158.exe (PID: 516)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 8016)
- BackgroundTransferHost.exe (PID: 6032)
- BackgroundTransferHost.exe (PID: 2692)
- BackgroundTransferHost.exe (PID: 7376)
- BackgroundTransferHost.exe (PID: 208)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 6032)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 6032)
- WerFault.exe (PID: 12868)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 6032)
- slui.exe (PID: 2616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:20 00:32:00+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
571
Monitored processes
434
Malicious processes
64
Suspicious processes
53
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 516 | C:\Users\admin\AppData\Local\Temp\Unicorn-30158.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-30158.exe | Unicorn-53847.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 632 | C:\Users\admin\AppData\Local\Temp\Unicorn-11708.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-11708.exe | 1 (399).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 664 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 672 | C:\Users\admin\AppData\Local\Temp\Unicorn-32326.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-32326.exe | Unicorn-29098.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 680 | C:\Users\admin\AppData\Local\Temp\Unicorn-56831.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56831.exe | Unicorn-18329.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 732 | C:\Users\admin\AppData\Local\Temp\Unicorn-9052.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9052.exe | — | Unicorn-51377.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 920 | C:\Users\admin\AppData\Local\Temp\Unicorn-47651.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-47651.exe | — | Unicorn-52638.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1052 | C:\Users\admin\AppData\Local\Temp\Unicorn-25641.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-25641.exe | Unicorn-37676.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1056 | C:\Users\admin\AppData\Local\Temp\Unicorn-32104.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-32104.exe | Unicorn-51782.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
12 897
Read events
12 882
Write events
15
Delete events
0
Modification events
| (PID) Process: | (8016) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (8016) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (8016) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6032) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6032) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6032) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2692) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2692) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2692) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7376) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
700
Suspicious files
8
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6032 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\96907c14-e3da-4006-a437-4d78f431ca87.down_data | — | |
MD5:— | SHA256:— | |||
| 1276 | 1 (399).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24787.exe | executable | |
MD5:FCA747E9B4B52EC0E480DA54CFD2BA69 | SHA256:F6039B82F04D9B833A84765CEC367828EAE2431D7D4C42A4555F58EEFDD3CCB3 | |||
| 7828 | Unicorn-29098.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-52638.exe | executable | |
MD5:457E17535DA6F7AA12B6E425A106FC5D | SHA256:6CA9BE260E78001A75B8745E343CD4D8598D1C83B0A3219FA6BCFA96BD4AD9F3 | |||
| 7620 | Unicorn-37676.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-22658.exe | executable | |
MD5:EEE1CCF633EB32D9101F80B91BB72CB2 | SHA256:4CCC13A94B5CDC2B4A0206B19216DF24189FCAF6CA397EDC30B46BA5DBD92AB1 | |||
| 7612 | Unicorn-173.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-16436.exe | executable | |
MD5:0EC9541B0A6201F2B942EBFFCE6F451B | SHA256:0478D2735C87D6EA51A342E9C567B6378FB3BF646ED674780A5B71251BA7BEFD | |||
| 7816 | Unicorn-18329.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56722.exe | executable | |
MD5:F2D266A21AAF485A1F11702149A962A0 | SHA256:C6023314D3F8B33C3648D1622737C835B45900381F0BB8FDFF81597BAA4DBF06 | |||
| 7620 | Unicorn-37676.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-32628.exe | executable | |
MD5:D13CE61EC2F5A292561A2CD8D715D339 | SHA256:9A5A743AB7D1724BEBC0A1E7238A6152C4022D958BF3ED70EE5323B06A53001A | |||
| 7792 | Unicorn-32628.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9083.exe | executable | |
MD5:0C8A9EAC550DDD7AE77FE416820915E5 | SHA256:1D17B3A33471279BD1E0D51CBAEE00185D394481C2C3BBC956A8243D7925D90B | |||
| 1276 | 1 (399).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-18329.exe | executable | |
MD5:FBF0079A43F0D59279E385BCE9A080E3 | SHA256:DAF7DCF8E46AAB4286D5DA83F21F2EDDB4BCAA34A8078CD9D821E6BDA68F8EEC | |||
| 7612 | Unicorn-173.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24460.exe | executable | |
MD5:B7CC612B9B0DA76D16FE4E56F8F39CE1 | SHA256:5801FC5159649AF2CB5463F7EDE107728515BF2AF730F7855FBAFD9750F1350B | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
19
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 95.101.54.128:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5404 | backgroundTaskHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
6032 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
1568 | SIHClient.exe | GET | 200 | 92.123.22.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
1568 | SIHClient.exe | GET | 200 | 92.123.22.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 95.101.54.128:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 40.126.32.138:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2112 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5404 | backgroundTaskHost.exe | 20.31.169.57:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |