| File name: | 1 (194) |
| Full analysis: | https://app.any.run/tasks/575ca6ea-11ee-449e-be16-9cc68012edd4 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 16:26:24 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | 4C1E70DA21D25851EB5D03F4F2176DC0 |
| SHA1: | 56D727AC61BD3CB7A2E05034F6EBA8027B115E6D |
| SHA256: | 1B2A0B76A86F93875021347C823CB408A4AAF9061543EE96502210695F5A8C60 |
| SSDEEP: | 6144:PTKgCnIJoDAWA5l3Ohe/hpfxGtBqcvJGBc/6yeO/gk/8SwjwpyAvEhXfePLnsEna:PWLIpWA5tOgQBdhaciyeO/Rx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- 1 (194).exe (PID: 5772)
- Unicorn-60429.exe (PID: 2108)
- Unicorn-25261.exe (PID: 6048)
- Unicorn-55948.exe (PID: 680)
- Unicorn-6192.exe (PID: 4608)
- Unicorn-59477.exe (PID: 4988)
- Unicorn-13327.exe (PID: 1184)
- Unicorn-25217.exe (PID: 5512)
- Unicorn-17049.exe (PID: 456)
- Unicorn-20674.exe (PID: 6156)
- Unicorn-56900.exe (PID: 5164)
- Unicorn-10918.exe (PID: 1116)
- Unicorn-57048.exe (PID: 6068)
- Unicorn-57313.exe (PID: 6040)
- Unicorn-37447.exe (PID: 6436)
- Unicorn-37277.exe (PID: 5720)
- Unicorn-19353.exe (PID: 6512)
- Unicorn-28075.exe (PID: 2420)
- Unicorn-35113.exe (PID: 3008)
- Unicorn-44397.exe (PID: 1040)
- Unicorn-2440.exe (PID: 6080)
- Unicorn-3187.exe (PID: 5756)
- Unicorn-65009.exe (PID: 6388)
- Unicorn-36229.exe (PID: 1240)
- Unicorn-60925.exe (PID: 6708)
- Unicorn-2118.exe (PID: 5436)
- Unicorn-61672.exe (PID: 2392)
- Unicorn-1702.exe (PID: 5380)
- Unicorn-1755.exe (PID: 5800)
- Unicorn-23274.exe (PID: 2092)
- Unicorn-4516.exe (PID: 3268)
- Unicorn-17515.exe (PID: 6148)
- Unicorn-12153.exe (PID: 2240)
- Unicorn-22197.exe (PID: 5204)
- Unicorn-30100.exe (PID: 5084)
- Unicorn-34619.exe (PID: 7208)
- Unicorn-59892.exe (PID: 7192)
- Unicorn-56079.exe (PID: 6644)
- Unicorn-2352.exe (PID: 7292)
- Unicorn-21813.exe (PID: 7228)
- Unicorn-42233.exe (PID: 7200)
- Unicorn-42425.exe (PID: 7248)
- Unicorn-48547.exe (PID: 7264)
- Unicorn-33297.exe (PID: 5324)
- Unicorn-22559.exe (PID: 7256)
- Unicorn-61257.exe (PID: 7556)
- Unicorn-8719.exe (PID: 7592)
- Unicorn-3291.exe (PID: 7324)
- Unicorn-55253.exe (PID: 7372)
- Unicorn-19073.exe (PID: 7332)
- Unicorn-34833.exe (PID: 7400)
- Unicorn-49176.exe (PID: 7708)
- Unicorn-38616.exe (PID: 7464)
- Unicorn-39384.exe (PID: 7688)
- Unicorn-30640.exe (PID: 7496)
- Unicorn-61449.exe (PID: 7636)
- Unicorn-65459.exe (PID: 7364)
- Unicorn-14412.exe (PID: 7380)
- Unicorn-51096.exe (PID: 7424)
- Unicorn-43193.exe (PID: 7408)
- Unicorn-60608.exe (PID: 7700)
- Unicorn-6436.exe (PID: 7284)
- Unicorn-32263.exe (PID: 7508)
- Unicorn-22454.exe (PID: 7600)
- Unicorn-188.exe (PID: 7852)
- Unicorn-1511.exe (PID: 7828)
- Unicorn-12056.exe (PID: 7744)
- Unicorn-29787.exe (PID: 7356)
- Unicorn-690.exe (PID: 7472)
- Unicorn-35387.exe (PID: 7456)
- Unicorn-34169.exe (PID: 7936)
- Unicorn-24618.exe (PID: 7392)
- Unicorn-21185.exe (PID: 7784)
- Unicorn-7426.exe (PID: 7984)
- Unicorn-35020.exe (PID: 8368)
- Unicorn-2020.exe (PID: 8880)
- Unicorn-764.exe (PID: 7812)
- Unicorn-10380.exe (PID: 8848)
- Unicorn-18549.exe (PID: 8872)
- Unicorn-52300.exe (PID: 4464)
- Unicorn-43363.exe (PID: 8412)
- Unicorn-60017.exe (PID: 8272)
- Unicorn-23134.exe (PID: 8456)
- Unicorn-19177.exe (PID: 8280)
- Unicorn-39575.exe (PID: 8028)
- Unicorn-54205.exe (PID: 7968)
- Unicorn-11838.exe (PID: 8492)
- Unicorn-38999.exe (PID: 7952)
- Unicorn-59944.exe (PID: 8812)
- Unicorn-29627.exe (PID: 8420)
- Unicorn-27343.exe (PID: 8292)
- Unicorn-44927.exe (PID: 7760)
- Unicorn-38563.exe (PID: 8540)
- Unicorn-34885.exe (PID: 8968)
- Unicorn-15861.exe (PID: 8404)
- Unicorn-51147.exe (PID: 8476)
- Unicorn-58647.exe (PID: 8380)
- Unicorn-58865.exe (PID: 7960)
- Unicorn-9207.exe (PID: 8432)
- Unicorn-36015.exe (PID: 9064)
- Unicorn-7308.exe (PID: 6300)
- Unicorn-48459.exe (PID: 7944)
- Unicorn-54345.exe (PID: 8548)
- Unicorn-59151.exe (PID: 7316)
- Unicorn-14272.exe (PID: 8820)
- Unicorn-27306.exe (PID: 7792)
- Unicorn-8548.exe (PID: 7888)
- Unicorn-34531.exe (PID: 7976)
- Unicorn-17375.exe (PID: 8000)
- Unicorn-55367.exe (PID: 9156)
- Unicorn-40277.exe (PID: 9164)
- Unicorn-16245.exe (PID: 8312)
- Unicorn-28579.exe (PID: 9172)
- Unicorn-21097.exe (PID: 8448)
- Unicorn-11838.exe (PID: 8484)
- Unicorn-32441.exe (PID: 10144)
- Unicorn-22117.exe (PID: 10180)
- Unicorn-58045.exe (PID: 8744)
- Unicorn-7287.exe (PID: 8236)
- Unicorn-27983.exe (PID: 10188)
- Unicorn-551.exe (PID: 7576)
- Unicorn-13727.exe (PID: 684)
- Unicorn-5367.exe (PID: 9512)
- Unicorn-47241.exe (PID: 9624)
- Unicorn-48445.exe (PID: 9184)
- Unicorn-30417.exe (PID: 9056)
- Unicorn-59228.exe (PID: 7992)
- Unicorn-21673.exe (PID: 8576)
- Unicorn-6275.exe (PID: 9024)
- Unicorn-53451.exe (PID: 9140)
- Unicorn-11252.exe (PID: 9812)
- Unicorn-24797.exe (PID: 8524)
- Unicorn-21842.exe (PID: 9968)
- Unicorn-18247.exe (PID: 9484)
- Unicorn-23327.exe (PID: 7416)
- Unicorn-32389.exe (PID: 8300)
- Unicorn-64551.exe (PID: 8776)
- Unicorn-14848.exe (PID: 9148)
- Unicorn-6260.exe (PID: 11000)
- Unicorn-1091.exe (PID: 10336)
- Unicorn-41377.exe (PID: 10324)
- Unicorn-30573.exe (PID: 8120)
- Unicorn-13919.exe (PID: 9468)
- Unicorn-52669.exe (PID: 10128)
- Unicorn-34391.exe (PID: 9356)
- Unicorn-12212.exe (PID: 9868)
- Unicorn-31407.exe (PID: 8020)
- Unicorn-26118.exe (PID: 10092)
- Unicorn-58268.exe (PID: 10316)
- Unicorn-46473.exe (PID: 9504)
- Unicorn-13727.exe (PID: 1660)
- Unicorn-33835.exe (PID: 9584)
- Unicorn-45897.exe (PID: 9324)
- Unicorn-17413.exe (PID: 10468)
- Unicorn-57433.exe (PID: 11140)
- Unicorn-61221.exe (PID: 9828)
- Unicorn-47101.exe (PID: 10992)
- Unicorn-9399.exe (PID: 8464)
- Unicorn-13727.exe (PID: 7052)
- Unicorn-24058.exe (PID: 11268)
- Unicorn-47817.exe (PID: 9776)
- Unicorn-42291.exe (PID: 8840)
- Unicorn-22265.exe (PID: 10556)
- Unicorn-60920.exe (PID: 10712)
- Unicorn-18809.exe (PID: 12484)
- Unicorn-22130.exe (PID: 12552)
- Unicorn-24930.exe (PID: 12560)
- Unicorn-21673.exe (PID: 8724)
- Unicorn-53904.exe (PID: 11172)
- Unicorn-40987.exe (PID: 11568)
- Unicorn-5595.exe (PID: 12524)
- Unicorn-39707.exe (PID: 7884)
- Unicorn-53904.exe (PID: 11180)
- Unicorn-17065.exe (PID: 536)
- Unicorn-8382.exe (PID: 10220)
- Unicorn-36119.exe (PID: 11232)
- Unicorn-728.exe (PID: 6988)
- Unicorn-55963.exe (PID: 11100)
- Unicorn-28299.exe (PID: 12772)
- Unicorn-36659.exe (PID: 12820)
- Unicorn-25825.exe (PID: 12352)
- Unicorn-2591.exe (PID: 10608)
- Unicorn-5898.exe (PID: 13672)
- Unicorn-7629.exe (PID: 13700)
- Unicorn-4096.exe (PID: 9308)
- Unicorn-30150.exe (PID: 8388)
- Unicorn-10344.exe (PID: 11228)
- Unicorn-17901.exe (PID: 14760)
- Unicorn-18839.exe (PID: 13812)
- Unicorn-8367.exe (PID: 13936)
- Unicorn-52264.exe (PID: 9192)
- Unicorn-30427.exe (PID: 15764)
- Unicorn-26362.exe (PID: 9244)
- Unicorn-61252.exe (PID: 8068)
- Unicorn-9976.exe (PID: 13524)
- Unicorn-62825.exe (PID: 14564)
- Unicorn-28905.exe (PID: 12788)
- Unicorn-12368.exe (PID: 13052)
- Unicorn-29769.exe (PID: 14500)
- Unicorn-32005.exe (PID: 8396)
- Unicorn-20957.exe (PID: 10352)
- Unicorn-25498.exe (PID: 14784)
- Unicorn-8995.exe (PID: 16796)
- Unicorn-30257.exe (PID: 15804)
- Unicorn-13202.exe (PID: 10676)
- Unicorn-3114.exe (PID: 10456)
- Unicorn-49907.exe (PID: 15812)
- Unicorn-8995.exe (PID: 16800)
- Unicorn-22732.exe (PID: 13732)
Executable content was dropped or overwritten
- Unicorn-25261.exe (PID: 6048)
- Unicorn-56900.exe (PID: 5164)
- 1 (194).exe (PID: 5772)
- Unicorn-60429.exe (PID: 2108)
- Unicorn-6192.exe (PID: 4608)
- Unicorn-55948.exe (PID: 680)
- Unicorn-20674.exe (PID: 6156)
- Unicorn-59477.exe (PID: 4988)
- Unicorn-37277.exe (PID: 5720)
- Unicorn-25217.exe (PID: 5512)
- Unicorn-17049.exe (PID: 456)
- Unicorn-57048.exe (PID: 6068)
- Unicorn-37447.exe (PID: 6436)
- Unicorn-57313.exe (PID: 6040)
- Unicorn-10918.exe (PID: 1116)
- Unicorn-19353.exe (PID: 6512)
- Unicorn-13327.exe (PID: 1184)
- Unicorn-28075.exe (PID: 2420)
- Unicorn-12153.exe (PID: 2240)
- Unicorn-44397.exe (PID: 1040)
- Unicorn-2440.exe (PID: 6080)
- Unicorn-3187.exe (PID: 5756)
- Unicorn-52300.exe (PID: 4464)
- Unicorn-65009.exe (PID: 6388)
- Unicorn-56079.exe (PID: 6644)
- Unicorn-61672.exe (PID: 2392)
- Unicorn-60925.exe (PID: 6708)
- Unicorn-1702.exe (PID: 5380)
- Unicorn-2118.exe (PID: 5436)
- Unicorn-4516.exe (PID: 3268)
- Unicorn-1755.exe (PID: 5800)
- Unicorn-33297.exe (PID: 5324)
- Unicorn-23274.exe (PID: 2092)
- Unicorn-35113.exe (PID: 3008)
- Unicorn-22197.exe (PID: 5204)
- Unicorn-30100.exe (PID: 5084)
- Unicorn-34619.exe (PID: 7208)
- Unicorn-59892.exe (PID: 7192)
- Unicorn-21813.exe (PID: 7228)
- Unicorn-22559.exe (PID: 7256)
- Unicorn-42233.exe (PID: 7200)
- Unicorn-42425.exe (PID: 7248)
- Unicorn-48547.exe (PID: 7264)
- Unicorn-2352.exe (PID: 7292)
- Unicorn-61257.exe (PID: 7556)
- Unicorn-8719.exe (PID: 7592)
- Unicorn-17515.exe (PID: 6148)
- Unicorn-59151.exe (PID: 7316)
- Unicorn-3291.exe (PID: 7324)
- Unicorn-551.exe (PID: 7576)
- Unicorn-19073.exe (PID: 7332)
- Unicorn-34833.exe (PID: 7400)
- Unicorn-55253.exe (PID: 7372)
- Unicorn-49176.exe (PID: 7708)
- Unicorn-43193.exe (PID: 7408)
- Unicorn-36229.exe (PID: 1240)
- Unicorn-38616.exe (PID: 7464)
- Unicorn-39384.exe (PID: 7688)
- Unicorn-30640.exe (PID: 7496)
- Unicorn-61449.exe (PID: 7636)
- Unicorn-14412.exe (PID: 7380)
- Unicorn-51096.exe (PID: 7424)
- Unicorn-12056.exe (PID: 7744)
- Unicorn-65459.exe (PID: 7364)
- Unicorn-60608.exe (PID: 7700)
- Unicorn-6436.exe (PID: 7284)
- Unicorn-32263.exe (PID: 7508)
- Unicorn-188.exe (PID: 7852)
- Unicorn-22454.exe (PID: 7600)
- Unicorn-35387.exe (PID: 7456)
- Unicorn-1511.exe (PID: 7828)
- Unicorn-29787.exe (PID: 7356)
- Unicorn-690.exe (PID: 7472)
- Unicorn-24618.exe (PID: 7392)
- Unicorn-21185.exe (PID: 7784)
- Unicorn-7426.exe (PID: 7984)
- Unicorn-34169.exe (PID: 7936)
- Unicorn-764.exe (PID: 7812)
- Unicorn-10380.exe (PID: 8848)
- Unicorn-18549.exe (PID: 8872)
- Unicorn-2020.exe (PID: 8880)
- Unicorn-35020.exe (PID: 8368)
- Unicorn-60017.exe (PID: 8272)
- Unicorn-23134.exe (PID: 8456)
- Unicorn-30150.exe (PID: 8388)
- Unicorn-43363.exe (PID: 8412)
- Unicorn-54205.exe (PID: 7968)
- Unicorn-11838.exe (PID: 8492)
- Unicorn-38999.exe (PID: 7952)
- Unicorn-59944.exe (PID: 8812)
- Unicorn-39575.exe (PID: 8028)
- Unicorn-55367.exe (PID: 9156)
- Unicorn-38563.exe (PID: 8540)
- Unicorn-44927.exe (PID: 7760)
- Unicorn-34885.exe (PID: 8968)
- Unicorn-15861.exe (PID: 8404)
- Unicorn-51147.exe (PID: 8476)
- Unicorn-29627.exe (PID: 8420)
- Unicorn-58045.exe (PID: 8744)
- Unicorn-58647.exe (PID: 8380)
- Unicorn-58865.exe (PID: 7960)
- Unicorn-7287.exe (PID: 8236)
- Unicorn-7308.exe (PID: 6300)
- Unicorn-48459.exe (PID: 7944)
- Unicorn-54345.exe (PID: 8548)
- Unicorn-8548.exe (PID: 7888)
- Unicorn-34531.exe (PID: 7976)
- Unicorn-14272.exe (PID: 8820)
- Unicorn-27306.exe (PID: 7792)
- Unicorn-40277.exe (PID: 9164)
- Unicorn-16245.exe (PID: 8312)
- Unicorn-17375.exe (PID: 8000)
- Unicorn-28579.exe (PID: 9172)
- Unicorn-11838.exe (PID: 8484)
- Unicorn-32441.exe (PID: 10144)
- Unicorn-21097.exe (PID: 8448)
- Unicorn-22117.exe (PID: 10180)
- Unicorn-27983.exe (PID: 10188)
- Unicorn-5367.exe (PID: 9512)
- Unicorn-13727.exe (PID: 684)
- Unicorn-48445.exe (PID: 9184)
- Unicorn-47241.exe (PID: 9624)
- Unicorn-30417.exe (PID: 9056)
- Unicorn-36015.exe (PID: 9064)
- Unicorn-59228.exe (PID: 7992)
- Unicorn-53451.exe (PID: 9140)
- Unicorn-6275.exe (PID: 9024)
- Unicorn-24797.exe (PID: 8524)
- Unicorn-1091.exe (PID: 10336)
- Unicorn-21673.exe (PID: 8576)
- Unicorn-11252.exe (PID: 9812)
- Unicorn-21842.exe (PID: 9968)
- Unicorn-18247.exe (PID: 9484)
- Unicorn-32389.exe (PID: 8300)
- Unicorn-64551.exe (PID: 8776)
- Unicorn-30573.exe (PID: 8120)
- Unicorn-14848.exe (PID: 9148)
- Unicorn-6260.exe (PID: 11000)
- Unicorn-12212.exe (PID: 9868)
- Unicorn-41377.exe (PID: 10324)
- Unicorn-57433.exe (PID: 11140)
- Unicorn-34391.exe (PID: 9356)
- Unicorn-33835.exe (PID: 9584)
- Unicorn-52669.exe (PID: 10128)
- Unicorn-31407.exe (PID: 8020)
- Unicorn-26118.exe (PID: 10092)
- Unicorn-58268.exe (PID: 10316)
- Unicorn-46473.exe (PID: 9504)
- Unicorn-13727.exe (PID: 1660)
- Unicorn-19177.exe (PID: 8280)
- Unicorn-13727.exe (PID: 7052)
- Unicorn-17413.exe (PID: 10468)
- Unicorn-61221.exe (PID: 9828)
- Unicorn-47101.exe (PID: 10992)
- Unicorn-45897.exe (PID: 9324)
- Unicorn-9399.exe (PID: 8464)
- Unicorn-24058.exe (PID: 11268)
- Unicorn-47817.exe (PID: 9776)
- Unicorn-22265.exe (PID: 10556)
- Unicorn-42291.exe (PID: 8840)
- Unicorn-60920.exe (PID: 10712)
- Unicorn-24930.exe (PID: 12560)
- Unicorn-18809.exe (PID: 12484)
- Unicorn-21673.exe (PID: 8724)
- Unicorn-40987.exe (PID: 11568)
- Unicorn-53904.exe (PID: 11172)
- Unicorn-5595.exe (PID: 12524)
- Unicorn-22130.exe (PID: 12552)
- Unicorn-39707.exe (PID: 7884)
- Unicorn-53904.exe (PID: 11180)
- Unicorn-17065.exe (PID: 536)
- Unicorn-4096.exe (PID: 9308)
- Unicorn-36659.exe (PID: 12820)
- Unicorn-55963.exe (PID: 11100)
- Unicorn-36119.exe (PID: 11232)
- Unicorn-728.exe (PID: 6988)
- Unicorn-28299.exe (PID: 12772)
- Unicorn-25825.exe (PID: 12352)
- Unicorn-5898.exe (PID: 13672)
- Unicorn-63068.exe (PID: 13692)
- Unicorn-22732.exe (PID: 13732)
- Unicorn-8367.exe (PID: 13936)
- Unicorn-2591.exe (PID: 10608)
- Unicorn-52264.exe (PID: 9192)
- Unicorn-10344.exe (PID: 11228)
- Unicorn-17901.exe (PID: 14760)
- Unicorn-18839.exe (PID: 13812)
- Unicorn-62825.exe (PID: 14564)
- Unicorn-9976.exe (PID: 13524)
- Unicorn-28905.exe (PID: 12788)
- Unicorn-26362.exe (PID: 9244)
- Unicorn-30427.exe (PID: 15764)
- Unicorn-61252.exe (PID: 8068)
- Unicorn-12368.exe (PID: 13052)
- Unicorn-29769.exe (PID: 14500)
- Unicorn-20957.exe (PID: 10352)
- Unicorn-32005.exe (PID: 8396)
- Unicorn-25498.exe (PID: 14784)
- Unicorn-13202.exe (PID: 10676)
- Unicorn-30257.exe (PID: 15804)
- Unicorn-3114.exe (PID: 10456)
- Unicorn-61900.exe (PID: 1748)
- Unicorn-28299.exe (PID: 12780)
- Unicorn-34133.exe (PID: 10372)
- Unicorn-52109.exe (PID: 15184)
- Unicorn-12383.exe (PID: 10100)
- Unicorn-39784.exe (PID: 11764)
- Unicorn-32087.exe (PID: 11408)
- Unicorn-12286.exe (PID: 14612)
- Unicorn-46539.exe (PID: 10120)
- Unicorn-58438.exe (PID: 8504)
- Unicorn-40237.exe (PID: 8360)
- Unicorn-56193.exe (PID: 15200)
- Unicorn-10484.exe (PID: 9636)
- Unicorn-28299.exe (PID: 12748)
- Unicorn-54257.exe (PID: 9340)
- Unicorn-12574.exe (PID: 11512)
- Unicorn-27462.exe (PID: 10244)
- Unicorn-46791.exe (PID: 16048)
- Unicorn-2102.exe (PID: 11156)
- Unicorn-14267.exe (PID: 10364)
- Unicorn-47433.exe (PID: 9528)
- Unicorn-19629.exe (PID: 11696)
- Unicorn-42965.exe (PID: 9576)
- Unicorn-47595.exe (PID: 12796)
- Unicorn-22730.exe (PID: 16812)
- Unicorn-5559.exe (PID: 10260)
- Unicorn-8382.exe (PID: 10220)
- Unicorn-13499.exe (PID: 13160)
- Unicorn-36120.exe (PID: 8216)
- Unicorn-13727.exe (PID: 10272)
- Unicorn-25340.exe (PID: 17220)
- Unicorn-13926.exe (PID: 15988)
- Unicorn-55752.exe (PID: 14348)
- Unicorn-19975.exe (PID: 9296)
- Unicorn-40225.exe (PID: 9732)
- Unicorn-49177.exe (PID: 12204)
- Unicorn-61984.exe (PID: 12148)
- Unicorn-3410.exe (PID: 14572)
- Unicorn-60327.exe (PID: 7020)
- Unicorn-29834.exe (PID: 11772)
- Unicorn-32057.exe (PID: 9724)
- Unicorn-26437.exe (PID: 9476)
- Unicorn-28299.exe (PID: 12828)
- Unicorn-44661.exe (PID: 13908)
- Unicorn-54967.exe (PID: 13960)
- Unicorn-50676.exe (PID: 10228)
- Unicorn-11896.exe (PID: 13900)
- Unicorn-59856.exe (PID: 9460)
- Unicorn-9207.exe (PID: 8432)
- Unicorn-38475.exe (PID: 9332)
- Unicorn-10188.exe (PID: 8804)
- Unicorn-41201.exe (PID: 11852)
- Unicorn-63188.exe (PID: 13592)
- Unicorn-58204.exe (PID: 18340)
- Unicorn-12678.exe (PID: 12460)
- Unicorn-64293.exe (PID: 8188)
- Unicorn-54729.exe (PID: 8996)
- Unicorn-23327.exe (PID: 7416)
INFO
Checks supported languages
- 1 (194).exe (PID: 5772)
- Unicorn-25261.exe (PID: 6048)
- Unicorn-60429.exe (PID: 2108)
- Unicorn-56900.exe (PID: 5164)
- Unicorn-55948.exe (PID: 680)
- Unicorn-6192.exe (PID: 4608)
- Unicorn-20674.exe (PID: 6156)
- Unicorn-59477.exe (PID: 4988)
- Unicorn-37277.exe (PID: 5720)
- Unicorn-13327.exe (PID: 1184)
- Unicorn-10918.exe (PID: 1116)
- Unicorn-25217.exe (PID: 5512)
- Unicorn-57048.exe (PID: 6068)
- Unicorn-37447.exe (PID: 6436)
- Unicorn-28075.exe (PID: 2420)
- Unicorn-12153.exe (PID: 2240)
- Unicorn-3187.exe (PID: 5756)
- Unicorn-44397.exe (PID: 1040)
- Unicorn-52300.exe (PID: 4464)
- Unicorn-36229.exe (PID: 1240)
- Unicorn-2440.exe (PID: 6080)
- Unicorn-4516.exe (PID: 3268)
- Unicorn-17515.exe (PID: 6148)
- Unicorn-33297.exe (PID: 5324)
- Unicorn-22197.exe (PID: 5204)
- Unicorn-34619.exe (PID: 7208)
- Unicorn-22559.exe (PID: 7256)
- Unicorn-42425.exe (PID: 7248)
- Unicorn-48547.exe (PID: 7264)
- Unicorn-6436.exe (PID: 7284)
- Unicorn-2352.exe (PID: 7292)
- Unicorn-19073.exe (PID: 7332)
- Unicorn-3291.exe (PID: 7324)
- Unicorn-65459.exe (PID: 7364)
- Unicorn-29787.exe (PID: 7356)
- Unicorn-14412.exe (PID: 7380)
- Unicorn-24618.exe (PID: 7392)
- Unicorn-34833.exe (PID: 7400)
- Unicorn-23327.exe (PID: 7416)
- Unicorn-61257.exe (PID: 7556)
- Unicorn-38616.exe (PID: 7464)
- Unicorn-551.exe (PID: 7576)
- Unicorn-32263.exe (PID: 7508)
- Unicorn-61449.exe (PID: 7636)
- Unicorn-39384.exe (PID: 7688)
- Unicorn-60608.exe (PID: 7700)
- Unicorn-49176.exe (PID: 7708)
- Unicorn-12056.exe (PID: 7744)
- Unicorn-21185.exe (PID: 7784)
- Unicorn-44927.exe (PID: 7760)
- Unicorn-27306.exe (PID: 7792)
- Unicorn-188.exe (PID: 7852)
- Unicorn-8548.exe (PID: 7888)
- Unicorn-48459.exe (PID: 7944)
- Unicorn-38999.exe (PID: 7952)
- Unicorn-31407.exe (PID: 8020)
- Unicorn-59228.exe (PID: 7992)
- Unicorn-34169.exe (PID: 7936)
- Unicorn-64293.exe (PID: 8188)
- Unicorn-54205.exe (PID: 7968)
- Unicorn-17375.exe (PID: 8000)
- Unicorn-58865.exe (PID: 7960)
- Unicorn-7308.exe (PID: 6300)
- Unicorn-15476.exe (PID: 6972)
- Unicorn-19177.exe (PID: 8280)
- Unicorn-60017.exe (PID: 8272)
- Unicorn-54345.exe (PID: 8548)
- Unicorn-58647.exe (PID: 8380)
- Unicorn-32005.exe (PID: 8396)
- Unicorn-51147.exe (PID: 8476)
- Unicorn-15861.exe (PID: 8404)
- Unicorn-10380.exe (PID: 8848)
- Unicorn-23134.exe (PID: 8456)
- Unicorn-34885.exe (PID: 8968)
- Unicorn-6275.exe (PID: 9024)
- Unicorn-11838.exe (PID: 8492)
- Unicorn-10188.exe (PID: 8804)
- Unicorn-59944.exe (PID: 8812)
- Unicorn-30150.exe (PID: 8388)
- Unicorn-30417.exe (PID: 9056)
- Unicorn-9207.exe (PID: 8432)
- Unicorn-14848.exe (PID: 9148)
- Unicorn-36120.exe (PID: 8216)
- Unicorn-26362.exe (PID: 9244)
- Unicorn-37707.exe (PID: 9228)
- Unicorn-43219.exe (PID: 9200)
- Unicorn-4096.exe (PID: 9308)
- Unicorn-49597.exe (PID: 9368)
- Unicorn-38475.exe (PID: 9332)
- Unicorn-54257.exe (PID: 9340)
- Unicorn-53681.exe (PID: 9380)
- Unicorn-30713.exe (PID: 9568)
- Unicorn-63577.exe (PID: 9600)
- Unicorn-47817.exe (PID: 9776)
- Unicorn-23080.exe (PID: 9764)
- Unicorn-47433.exe (PID: 9528)
- Unicorn-12212.exe (PID: 9868)
- Unicorn-33835.exe (PID: 9584)
- Unicorn-27983.exe (PID: 10188)
- Unicorn-26118.exe (PID: 10092)
- Unicorn-12383.exe (PID: 10100)
- Unicorn-46539.exe (PID: 10120)
- Unicorn-32249.exe (PID: 10136)
- Unicorn-8382.exe (PID: 10220)
- Unicorn-50676.exe (PID: 10228)
- Unicorn-13727.exe (PID: 684)
- Unicorn-60327.exe (PID: 7020)
- Unicorn-13172.exe (PID: 10252)
- Unicorn-13727.exe (PID: 10272)
- Unicorn-58268.exe (PID: 10316)
- Unicorn-2591.exe (PID: 10608)
- Unicorn-17413.exe (PID: 10468)
- Unicorn-41289.exe (PID: 10960)
- Unicorn-62695.exe (PID: 10844)
- Unicorn-34443.exe (PID: 11196)
- Unicorn-62404.exe (PID: 11208)
- Unicorn-61907.exe (PID: 11216)
- Unicorn-61900.exe (PID: 1748)
- Unicorn-12574.exe (PID: 11512)
- Unicorn-24058.exe (PID: 11268)
- Unicorn-26873.exe (PID: 11440)
- Unicorn-35700.exe (PID: 11748)
- Unicorn-29834.exe (PID: 12112)
- Unicorn-57537.exe (PID: 11816)
- Unicorn-16867.exe (PID: 12160)
- Unicorn-16099.exe (PID: 11708)
- Unicorn-41201.exe (PID: 11852)
- Unicorn-21549.exe (PID: 12248)
- Unicorn-22130.exe (PID: 12552)
- Unicorn-38461.exe (PID: 12200)
- Unicorn-54723.exe (PID: 11560)
- Unicorn-4446.exe (PID: 10736)
- Unicorn-50521.exe (PID: 12380)
- Unicorn-12678.exe (PID: 12500)
- Unicorn-62965.exe (PID: 12444)
- Unicorn-31180.exe (PID: 12920)
- Unicorn-12368.exe (PID: 13052)
- Unicorn-28905.exe (PID: 12788)
- Unicorn-15170.exe (PID: 12812)
- Unicorn-62892.exe (PID: 13276)
- Unicorn-39487.exe (PID: 13184)
- Unicorn-2384.exe (PID: 13500)
- Unicorn-11320.exe (PID: 13640)
- Unicorn-22732.exe (PID: 13732)
- Unicorn-13499.exe (PID: 13160)
- Unicorn-25943.exe (PID: 13240)
- Unicorn-50817.exe (PID: 13388)
- Unicorn-27966.exe (PID: 13356)
- Unicorn-44657.exe (PID: 13136)
- Unicorn-55752.exe (PID: 14348)
- Unicorn-16955.exe (PID: 13304)
- Unicorn-17058.exe (PID: 13780)
- Unicorn-2768.exe (PID: 13892)
- Unicorn-14127.exe (PID: 14712)
- Unicorn-11090.exe (PID: 13292)
- Unicorn-12286.exe (PID: 14612)
- Unicorn-17901.exe (PID: 14760)
- Unicorn-64480.exe (PID: 12492)
- Unicorn-19223.exe (PID: 15268)
- Unicorn-22103.exe (PID: 14752)
- Unicorn-28041.exe (PID: 4696)
- Unicorn-21217.exe (PID: 14604)
- Unicorn-29769.exe (PID: 14500)
- Unicorn-44652.exe (PID: 16104)
- Unicorn-55587.exe (PID: 16116)
- Unicorn-61777.exe (PID: 15656)
- Unicorn-64900.exe (PID: 15624)
- Unicorn-61843.exe (PID: 16008)
- Unicorn-8995.exe (PID: 16800)
- Unicorn-13270.exe (PID: 15752)
- Unicorn-59043.exe (PID: 16032)
- Unicorn-55456.exe (PID: 16016)
- Unicorn-27111.exe (PID: 15884)
- Unicorn-50796.exe (PID: 15904)
- Unicorn-64731.exe (PID: 18356)
- Unicorn-23418.exe (PID: 18348)
- Unicorn-49591.exe (PID: 16424)
- Unicorn-56607.exe (PID: 16496)
- Unicorn-15852.exe (PID: 15672)
- Unicorn-43535.exe (PID: 16912)
- Unicorn-1655.exe (PID: 17068)
The sample compiled with chinese language support
- 1 (194).exe (PID: 5772)
Reads the computer name
- Unicorn-25261.exe (PID: 6048)
- 1 (194).exe (PID: 5772)
- Unicorn-60429.exe (PID: 2108)
- Unicorn-56900.exe (PID: 5164)
- Unicorn-59477.exe (PID: 4988)
- Unicorn-55948.exe (PID: 680)
- Unicorn-37277.exe (PID: 5720)
- Unicorn-6192.exe (PID: 4608)
- Unicorn-20674.exe (PID: 6156)
- Unicorn-19353.exe (PID: 6512)
- Unicorn-25217.exe (PID: 5512)
- Unicorn-37447.exe (PID: 6436)
- Unicorn-57313.exe (PID: 6040)
- Unicorn-28075.exe (PID: 2420)
- Unicorn-35113.exe (PID: 3008)
- Unicorn-12153.exe (PID: 2240)
- Unicorn-2440.exe (PID: 6080)
- Unicorn-3187.exe (PID: 5756)
- Unicorn-52300.exe (PID: 4464)
- Unicorn-56079.exe (PID: 6644)
- Unicorn-60925.exe (PID: 6708)
- Unicorn-1702.exe (PID: 5380)
- Unicorn-33297.exe (PID: 5324)
- Unicorn-23274.exe (PID: 2092)
- Unicorn-59892.exe (PID: 7192)
- Unicorn-21813.exe (PID: 7228)
- Unicorn-2352.exe (PID: 7292)
- Unicorn-22559.exe (PID: 7256)
- Unicorn-551.exe (PID: 7576)
- Unicorn-19073.exe (PID: 7332)
- Unicorn-55253.exe (PID: 7372)
- Unicorn-43193.exe (PID: 7408)
- Unicorn-23327.exe (PID: 7416)
- Unicorn-65459.exe (PID: 7364)
- Unicorn-35387.exe (PID: 7456)
- Unicorn-61449.exe (PID: 7636)
- Unicorn-32263.exe (PID: 7508)
- Unicorn-51096.exe (PID: 7424)
- Unicorn-34169.exe (PID: 7936)
- Unicorn-7426.exe (PID: 7984)
- Unicorn-764.exe (PID: 7812)
- Unicorn-18549.exe (PID: 8872)
- Unicorn-2020.exe (PID: 8880)
- Unicorn-10380.exe (PID: 8848)
- Unicorn-38563.exe (PID: 8540)
- Unicorn-30150.exe (PID: 8388)
- Unicorn-38999.exe (PID: 7952)
- Unicorn-9207.exe (PID: 8432)
- Unicorn-36015.exe (PID: 9064)
- Unicorn-34531.exe (PID: 7976)
- Unicorn-15861.exe (PID: 8404)
- Unicorn-40277.exe (PID: 9164)
- Unicorn-11838.exe (PID: 8484)
- Unicorn-21097.exe (PID: 8448)
- Unicorn-22117.exe (PID: 10180)
- Unicorn-48445.exe (PID: 9184)
- Unicorn-30417.exe (PID: 9056)
- Unicorn-47241.exe (PID: 9624)
- Unicorn-64551.exe (PID: 8776)
- Unicorn-26118.exe (PID: 10092)
- Unicorn-52669.exe (PID: 10128)
- Unicorn-47101.exe (PID: 10992)
- Unicorn-60920.exe (PID: 10712)
- Unicorn-47817.exe (PID: 9776)
- Unicorn-53904.exe (PID: 11180)
- Unicorn-4096.exe (PID: 9308)
- Unicorn-12368.exe (PID: 13052)
- Unicorn-61252.exe (PID: 8068)
- Unicorn-29769.exe (PID: 14500)
- Unicorn-47595.exe (PID: 12796)
- Unicorn-54729.exe (PID: 8996)
- Unicorn-22130.exe (PID: 13028)
- Unicorn-39784.exe (PID: 11764)
- Unicorn-28299.exe (PID: 12828)
- Unicorn-12678.exe (PID: 12460)
- Unicorn-12574.exe (PID: 11512)
Create files in a temporary directory
- Unicorn-25261.exe (PID: 6048)
- Unicorn-60429.exe (PID: 2108)
- Unicorn-56900.exe (PID: 5164)
- Unicorn-55948.exe (PID: 680)
- Unicorn-20674.exe (PID: 6156)
- 1 (194).exe (PID: 5772)
- Unicorn-59477.exe (PID: 4988)
- Unicorn-37277.exe (PID: 5720)
- Unicorn-10918.exe (PID: 1116)
- Unicorn-57048.exe (PID: 6068)
- Unicorn-37447.exe (PID: 6436)
- Unicorn-13327.exe (PID: 1184)
- Unicorn-19353.exe (PID: 6512)
- Unicorn-28075.exe (PID: 2420)
- Unicorn-65009.exe (PID: 6388)
- Unicorn-57313.exe (PID: 6040)
- Unicorn-60925.exe (PID: 6708)
- Unicorn-1702.exe (PID: 5380)
- Unicorn-1755.exe (PID: 5800)
- Unicorn-33297.exe (PID: 5324)
- Unicorn-12153.exe (PID: 2240)
- Unicorn-23274.exe (PID: 2092)
- Unicorn-22197.exe (PID: 5204)
- Unicorn-35113.exe (PID: 3008)
- Unicorn-30100.exe (PID: 5084)
- Unicorn-59892.exe (PID: 7192)
- Unicorn-56079.exe (PID: 6644)
- Unicorn-21813.exe (PID: 7228)
- Unicorn-44397.exe (PID: 1040)
- Unicorn-22559.exe (PID: 7256)
- Unicorn-42233.exe (PID: 7200)
- Unicorn-48547.exe (PID: 7264)
- Unicorn-25217.exe (PID: 5512)
- Unicorn-2440.exe (PID: 6080)
- Unicorn-17049.exe (PID: 456)
- Unicorn-551.exe (PID: 7576)
- Unicorn-59151.exe (PID: 7316)
- Unicorn-8719.exe (PID: 7592)
- Unicorn-3291.exe (PID: 7324)
- Unicorn-19073.exe (PID: 7332)
- Unicorn-30640.exe (PID: 7496)
- Unicorn-39384.exe (PID: 7688)
- Unicorn-61449.exe (PID: 7636)
- Unicorn-49176.exe (PID: 7708)
- Unicorn-38616.exe (PID: 7464)
- Unicorn-36229.exe (PID: 1240)
- Unicorn-43193.exe (PID: 7408)
- Unicorn-2118.exe (PID: 5436)
- Unicorn-65459.exe (PID: 7364)
- Unicorn-51096.exe (PID: 7424)
- Unicorn-12056.exe (PID: 7744)
- Unicorn-60608.exe (PID: 7700)
- Unicorn-690.exe (PID: 7472)
- Unicorn-35387.exe (PID: 7456)
- Unicorn-29787.exe (PID: 7356)
- Unicorn-61672.exe (PID: 2392)
- Unicorn-6192.exe (PID: 4608)
- Unicorn-24618.exe (PID: 7392)
- Unicorn-21185.exe (PID: 7784)
- Unicorn-34169.exe (PID: 7936)
- Unicorn-764.exe (PID: 7812)
- Unicorn-52300.exe (PID: 4464)
- Unicorn-35020.exe (PID: 8368)
- Unicorn-32263.exe (PID: 7508)
- Unicorn-43363.exe (PID: 8412)
- Unicorn-60017.exe (PID: 8272)
- Unicorn-11838.exe (PID: 8492)
- Unicorn-38999.exe (PID: 7952)
- Unicorn-59944.exe (PID: 8812)
- Unicorn-39575.exe (PID: 8028)
- Unicorn-44927.exe (PID: 7760)
- Unicorn-34833.exe (PID: 7400)
- Unicorn-38563.exe (PID: 8540)
- Unicorn-51147.exe (PID: 8476)
- Unicorn-58045.exe (PID: 8744)
- Unicorn-58647.exe (PID: 8380)
- Unicorn-7287.exe (PID: 8236)
- Unicorn-2352.exe (PID: 7292)
- Unicorn-14412.exe (PID: 7380)
- Unicorn-22454.exe (PID: 7600)
- Unicorn-40277.exe (PID: 9164)
- Unicorn-55367.exe (PID: 9156)
- Unicorn-42425.exe (PID: 7248)
- Unicorn-28579.exe (PID: 9172)
- Unicorn-22117.exe (PID: 10180)
- Unicorn-5367.exe (PID: 9512)
- Unicorn-55253.exe (PID: 7372)
- Unicorn-48445.exe (PID: 9184)
- Unicorn-47241.exe (PID: 9624)
- Unicorn-21673.exe (PID: 8576)
- Unicorn-11252.exe (PID: 9812)
- Unicorn-24797.exe (PID: 8524)
- Unicorn-10380.exe (PID: 8848)
- Unicorn-21842.exe (PID: 9968)
- Unicorn-18247.exe (PID: 9484)
- Unicorn-188.exe (PID: 7852)
- Unicorn-4516.exe (PID: 3268)
- Unicorn-18549.exe (PID: 8872)
- Unicorn-41377.exe (PID: 10324)
- Unicorn-34619.exe (PID: 7208)
- Unicorn-34391.exe (PID: 9356)
- Unicorn-33835.exe (PID: 9584)
- Unicorn-31407.exe (PID: 8020)
- Unicorn-26118.exe (PID: 10092)
- Unicorn-61257.exe (PID: 7556)
- Unicorn-46473.exe (PID: 9504)
- Unicorn-45897.exe (PID: 9324)
- Unicorn-57433.exe (PID: 11140)
- Unicorn-9399.exe (PID: 8464)
- Unicorn-42291.exe (PID: 8840)
- Unicorn-60920.exe (PID: 10712)
- Unicorn-16245.exe (PID: 8312)
- Unicorn-24930.exe (PID: 12560)
- Unicorn-21673.exe (PID: 8724)
- Unicorn-53904.exe (PID: 11180)
- Unicorn-4096.exe (PID: 9308)
- Unicorn-1511.exe (PID: 7828)
- Unicorn-30150.exe (PID: 8388)
- Unicorn-2591.exe (PID: 10608)
- Unicorn-7629.exe (PID: 13700)
- Unicorn-30427.exe (PID: 15764)
- Unicorn-5595.exe (PID: 12524)
- Unicorn-5898.exe (PID: 13672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
742
Monitored processes
608
Malicious processes
95
Suspicious processes
67
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 456 | C:\Users\admin\AppData\Local\Temp\Unicorn-17049.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-17049.exe | Unicorn-55948.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 536 | C:\Users\admin\AppData\Local\Temp\Unicorn-17065.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-17065.exe | Unicorn-7308.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 680 | C:\Users\admin\AppData\Local\Temp\Unicorn-55948.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-55948.exe | Unicorn-25261.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 684 | C:\Users\admin\AppData\Local\Temp\Unicorn-13727.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13727.exe | Unicorn-551.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 776 | C:\Users\admin\AppData\Local\Temp\Unicorn-10950.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-10950.exe | — | Unicorn-34619.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 896 | C:\Users\admin\AppData\Local\Temp\Unicorn-13788.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13788.exe | — | Unicorn-49907.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 | |||||||||||||||
| 924 | C:\Users\admin\AppData\Local\Temp\Unicorn-28462.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-28462.exe | — | 1 (194).exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1040 | C:\Users\admin\AppData\Local\Temp\Unicorn-44397.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-44397.exe | Unicorn-10918.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1052 | C:\Users\admin\AppData\Local\Temp\Unicorn-13788.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13788.exe | — | Unicorn-22730.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 | |||||||||||||||
| 1116 | C:\Users\admin\AppData\Local\Temp\Unicorn-10918.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-10918.exe | Unicorn-25261.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
11 588
Read events
11 588
Write events
0
Delete events
0
Modification events
Executable files
857
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6048 | Unicorn-25261.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-60429.exe | executable | |
MD5:7FDA9588B075F253D00477023927AC9F | SHA256:1135413962A844C560C5CBA5C040DAB84E895014F40B294337E7EFC9C275567F | |||
| 680 | Unicorn-55948.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-17049.exe | executable | |
MD5:A7716133AC158747438BF9940580B575 | SHA256:91F7E154D90DDC0FE5C21CF8E3A0C9657971720A2B003866E5E9F002E9483D85 | |||
| 4988 | Unicorn-59477.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-37277.exe | executable | |
MD5:8D437EF337D64FDC3EBB045DD68F382F | SHA256:287B649B5E1C1995A46C82AC099EBA1EAC5232FDB1C563F12F16A2651A6083F9 | |||
| 5164 | Unicorn-56900.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-6192.exe | executable | |
MD5:FD2C31958BD85A2067D36773048DDBDC | SHA256:9DD514E847F52FB868F34B5E09CE231D28AB33F97643F817A378F75D3910A1BE | |||
| 5772 | 1 (194).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20674.exe | executable | |
MD5:120F5305414607532DAF34DBAA55383D | SHA256:C166BE1582B7CAA77CFD24D6FB766F82B51081B9EE231E29B818E23DA7BDC905 | |||
| 4608 | Unicorn-6192.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-25217.exe | executable | |
MD5:ABBB93AB16138C1C3068C3F94D8A00B8 | SHA256:1A208145E36031583F35D52BF518DD2416F27898466EA0757A95E528663AE688 | |||
| 4988 | Unicorn-59477.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-28075.exe | executable | |
MD5:B44151433A8EB04F77C1562BF0E6F57E | SHA256:DAE98266EEA463779095E9CC202796F5255E9DC1AB1DD809127F1483036AFC2C | |||
| 6048 | Unicorn-25261.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-55948.exe | executable | |
MD5:848F49E97613F0E80A5C59E4F5A76B77 | SHA256:D65294C16C1B4C774D6AD1C030CD279ED7EF72BAF777699AF60A887FA3BC42C4 | |||
| 2108 | Unicorn-60429.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-12153.exe | executable | |
MD5:D137DF416B1BD095FC45790FDD39E129 | SHA256:5374F7DB136F5ADD44A1715CCAAD368ABBAAFFE4F35C93E7F2F463ED2B04FF14 | |||
| 6048 | Unicorn-25261.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-10918.exe | executable | |
MD5:4E18A123B288B31AD3A12AADC24F5CB6 | SHA256:D65294C16C1B4C774D6AD1C030CD279ED7EF72BAF777699AF60A887FA3BC42C4 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
13
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.16.168.114:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
8064 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
2516 | backgroundTaskHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
8064 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.16.168.114:80 | crl.microsoft.com | Akamai International B.V. | RU | whitelisted |
— | — | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.160.3:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
4628 | RUXIMICS.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2516 | backgroundTaskHost.exe | 20.223.35.26:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2516 | backgroundTaskHost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |