| File name: | 1 (257) |
| Full analysis: | https://app.any.run/tasks/1249e15a-f920-48ce-ab48-824dac020aeb |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 18:41:37 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 5DF107FE5F3EAD329A4C9FBEC41B7F00 |
| SHA1: | A787AA4BC9CFB9FE6DC057E6C77BE36B50B3F965 |
| SHA256: | 2A3291E31388FBAE49C825542A1556630137415FCDCD2131855B605A1E7FB33B |
| SSDEEP: | 6144:77wYlJIJ/DcLAyJyy7eQ0Dfx5Y3slp8GB3/2yeO6Ok/8SwjwpyAvEhe4xPnVsWpB:7sA6yLAyUyam3q+a3uyeO6Mx4oxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- 1 (257).exe (PID: 2284)
- Unicorn-37553.exe (PID: 6244)
- Unicorn-60448.exe (PID: 5116)
- Unicorn-10692.exe (PID: 4428)
- Unicorn-32037.exe (PID: 7348)
- Unicorn-56633.exe (PID: 7356)
- Unicorn-47750.exe (PID: 7364)
- Unicorn-32037.exe (PID: 7340)
- Unicorn-43879.exe (PID: 7572)
- Unicorn-43879.exe (PID: 7580)
- Unicorn-47963.exe (PID: 7608)
- Unicorn-47963.exe (PID: 7600)
- Unicorn-9623.exe (PID: 7664)
- Unicorn-25140.exe (PID: 7636)
- Unicorn-5539.exe (PID: 7644)
- Unicorn-22857.exe (PID: 3180)
- Unicorn-33717.exe (PID: 7264)
- Unicorn-14688.exe (PID: 6268)
- Unicorn-5150.exe (PID: 5740)
- Unicorn-48129.exe (PID: 7292)
- Unicorn-23358.exe (PID: 7676)
- Unicorn-63074.exe (PID: 4120)
- Unicorn-11159.exe (PID: 2088)
- Unicorn-60381.exe (PID: 7280)
- Unicorn-21487.exe (PID: 4408)
- Unicorn-64465.exe (PID: 1512)
- Unicorn-10915.exe (PID: 6972)
- Unicorn-44600.exe (PID: 6068)
- Unicorn-28892.exe (PID: 616)
- Unicorn-31692.exe (PID: 6108)
- Unicorn-31692.exe (PID: 7316)
- Unicorn-55311.exe (PID: 7756)
- Unicorn-29223.exe (PID: 7472)
- Unicorn-4548.exe (PID: 7904)
- Unicorn-62472.exe (PID: 7880)
- Unicorn-37221.exe (PID: 7984)
- Unicorn-43343.exe (PID: 8032)
- Unicorn-26915.exe (PID: 6372)
- Unicorn-33036.exe (PID: 8092)
- Unicorn-24777.exe (PID: 8112)
- Unicorn-32945.exe (PID: 7960)
- Unicorn-47890.exe (PID: 7948)
- Unicorn-35659.exe (PID: 7860)
- Unicorn-39743.exe (PID: 7832)
- Unicorn-64994.exe (PID: 6744)
- Unicorn-39743.exe (PID: 7820)
- Unicorn-45865.exe (PID: 3096)
- Unicorn-391.exe (PID: 2268)
- Unicorn-33521.exe (PID: 5984)
- Unicorn-9571.exe (PID: 6436)
- Unicorn-2794.exe (PID: 4880)
- Unicorn-391.exe (PID: 2984)
- Unicorn-6878.exe (PID: 6712)
- Unicorn-15046.exe (PID: 8176)
- Unicorn-10962.exe (PID: 6272)
- Unicorn-3349.exe (PID: 8184)
- Unicorn-46328.exe (PID: 8148)
- Unicorn-33521.exe (PID: 7176)
- Unicorn-14284.exe (PID: 5964)
- Unicorn-63286.exe (PID: 6080)
- Unicorn-64465.exe (PID: 5936)
- Unicorn-2794.exe (PID: 5156)
- Unicorn-9268.exe (PID: 7488)
- Unicorn-24213.exe (PID: 2644)
- Unicorn-3046.exe (PID: 7460)
- Unicorn-5084.exe (PID: 6824)
- Unicorn-12345.exe (PID: 8004)
- Unicorn-19959.exe (PID: 7896)
- Unicorn-21905.exe (PID: 4188)
- Unicorn-13655.exe (PID: 1328)
- Unicorn-23942.exe (PID: 7732)
- Unicorn-49123.exe (PID: 7328)
- Unicorn-18951.exe (PID: 7532)
- Unicorn-51069.exe (PID: 7784)
- Unicorn-45423.exe (PID: 8216)
- Unicorn-46528.exe (PID: 2908)
- Unicorn-37809.exe (PID: 8228)
- Unicorn-55272.exe (PID: 8268)
- Unicorn-46793.exe (PID: 4448)
- Unicorn-4753.exe (PID: 8364)
- Unicorn-57483.exe (PID: 8312)
- Unicorn-14888.exe (PID: 8468)
- Unicorn-60197.exe (PID: 8612)
- Unicorn-16835.exe (PID: 8528)
- Unicorn-47130.exe (PID: 8672)
- Unicorn-56305.exe (PID: 8544)
- Unicorn-27695.exe (PID: 8520)
- Unicorn-21586.exe (PID: 8508)
- Unicorn-34301.exe (PID: 8604)
- Unicorn-46383.exe (PID: 8712)
- Unicorn-42199.exe (PID: 8760)
- Unicorn-59211.exe (PID: 8780)
- Unicorn-6481.exe (PID: 8820)
- Unicorn-59211.exe (PID: 8788)
- Unicorn-17084.exe (PID: 208)
- Unicorn-32377.exe (PID: 8864)
- Unicorn-60965.exe (PID: 8916)
- Unicorn-32377.exe (PID: 8872)
- Unicorn-20701.exe (PID: 8992)
- Unicorn-4364.exe (PID: 8944)
- Unicorn-56881.exe (PID: 8900)
- Unicorn-35091.exe (PID: 8960)
- Unicorn-280.exe (PID: 8936)
- Unicorn-15854.exe (PID: 9000)
- Unicorn-16617.exe (PID: 8976)
- Unicorn-835.exe (PID: 8984)
- Unicorn-20701.exe (PID: 9008)
- Unicorn-21063.exe (PID: 2384)
- Unicorn-54557.exe (PID: 8304)
- Unicorn-40929.exe (PID: 7964)
- Unicorn-8256.exe (PID: 9140)
- Unicorn-24785.exe (PID: 9020)
- Unicorn-59495.exe (PID: 9096)
- Unicorn-54504.exe (PID: 5428)
- Unicorn-88.exe (PID: 9104)
- Unicorn-22455.exe (PID: 7924)
- Unicorn-34798.exe (PID: 8388)
- Unicorn-3211.exe (PID: 9196)
- Unicorn-18462.exe (PID: 9172)
- Unicorn-51579.exe (PID: 8696)
- Unicorn-39537.exe (PID: 8328)
- Unicorn-39537.exe (PID: 9212)
- Unicorn-7249.exe (PID: 8744)
- Unicorn-23122.exe (PID: 8708)
- Unicorn-49408.exe (PID: 8844)
- Unicorn-16809.exe (PID: 6388)
- Unicorn-31775.exe (PID: 9260)
- Unicorn-41867.exe (PID: 9236)
- Unicorn-42443.exe (PID: 9308)
- Unicorn-35859.exe (PID: 9268)
Executable content was dropped or overwritten
- 1 (257).exe (PID: 2284)
- Unicorn-37553.exe (PID: 6244)
- Unicorn-60448.exe (PID: 5116)
- Unicorn-56633.exe (PID: 7356)
- Unicorn-32037.exe (PID: 7348)
- Unicorn-10692.exe (PID: 4428)
- Unicorn-43879.exe (PID: 7572)
- Unicorn-43879.exe (PID: 7580)
- Unicorn-32037.exe (PID: 7340)
- Unicorn-47963.exe (PID: 7600)
- Unicorn-47963.exe (PID: 7608)
- Unicorn-47750.exe (PID: 7364)
- Unicorn-25140.exe (PID: 7636)
- Unicorn-9623.exe (PID: 7664)
- Unicorn-5539.exe (PID: 7644)
- Unicorn-22857.exe (PID: 3180)
- Unicorn-14688.exe (PID: 6268)
- Unicorn-5150.exe (PID: 5740)
- Unicorn-33717.exe (PID: 7264)
- Unicorn-48129.exe (PID: 7292)
- Unicorn-63074.exe (PID: 4120)
- Unicorn-11159.exe (PID: 2088)
- Unicorn-21487.exe (PID: 4408)
- Unicorn-64465.exe (PID: 1512)
- Unicorn-28892.exe (PID: 616)
- Unicorn-31692.exe (PID: 7316)
- Unicorn-23358.exe (PID: 7676)
- Unicorn-31692.exe (PID: 6108)
- Unicorn-64465.exe (PID: 5936)
- Unicorn-55311.exe (PID: 7756)
- Unicorn-29223.exe (PID: 7472)
- Unicorn-4548.exe (PID: 7904)
- Unicorn-62472.exe (PID: 7880)
- Unicorn-37221.exe (PID: 7984)
- Unicorn-26915.exe (PID: 6372)
- Unicorn-43343.exe (PID: 8032)
- Unicorn-24777.exe (PID: 8112)
- Unicorn-33036.exe (PID: 8092)
- Unicorn-32945.exe (PID: 7960)
- Unicorn-47890.exe (PID: 7948)
- Unicorn-35659.exe (PID: 7860)
- Unicorn-39743.exe (PID: 7832)
- Unicorn-60381.exe (PID: 7280)
- Unicorn-64994.exe (PID: 6744)
- Unicorn-45865.exe (PID: 3096)
- Unicorn-391.exe (PID: 2268)
- Unicorn-2794.exe (PID: 4880)
- Unicorn-391.exe (PID: 2984)
- Unicorn-6878.exe (PID: 6712)
- Unicorn-15046.exe (PID: 8176)
- Unicorn-14284.exe (PID: 5964)
- Unicorn-9571.exe (PID: 6436)
- Unicorn-44600.exe (PID: 6068)
- Unicorn-46328.exe (PID: 8148)
- Unicorn-3349.exe (PID: 8184)
- Unicorn-33521.exe (PID: 7176)
- Unicorn-2794.exe (PID: 5156)
- Unicorn-13655.exe (PID: 1328)
- Unicorn-9268.exe (PID: 7488)
- Unicorn-3046.exe (PID: 7460)
- Unicorn-24213.exe (PID: 2644)
- Unicorn-5084.exe (PID: 6824)
- Unicorn-19959.exe (PID: 7896)
- Unicorn-12345.exe (PID: 8004)
- Unicorn-21905.exe (PID: 4188)
- Unicorn-23942.exe (PID: 7732)
- Unicorn-49123.exe (PID: 7328)
- Unicorn-18951.exe (PID: 7532)
- Unicorn-46528.exe (PID: 2908)
- Unicorn-45423.exe (PID: 8216)
- Unicorn-46793.exe (PID: 4448)
- Unicorn-51069.exe (PID: 7784)
- Unicorn-37809.exe (PID: 8228)
- Unicorn-55272.exe (PID: 8268)
- Unicorn-14888.exe (PID: 8468)
- Unicorn-17084.exe (PID: 208)
- Unicorn-21586.exe (PID: 8508)
- Unicorn-4753.exe (PID: 8364)
- Unicorn-57483.exe (PID: 8312)
- Unicorn-16835.exe (PID: 8528)
- Unicorn-60197.exe (PID: 8612)
- Unicorn-56305.exe (PID: 8544)
- Unicorn-34301.exe (PID: 8604)
- Unicorn-46383.exe (PID: 8712)
- Unicorn-42199.exe (PID: 8760)
- Unicorn-59211.exe (PID: 8780)
- Unicorn-6481.exe (PID: 8820)
- Unicorn-33521.exe (PID: 5984)
- Unicorn-59211.exe (PID: 8788)
- Unicorn-54670.exe (PID: 8852)
- Unicorn-63286.exe (PID: 6080)
- Unicorn-60965.exe (PID: 8916)
- Unicorn-32377.exe (PID: 8864)
- Unicorn-20701.exe (PID: 8992)
- Unicorn-16617.exe (PID: 8976)
- Unicorn-4364.exe (PID: 8944)
- Unicorn-56881.exe (PID: 8900)
- Unicorn-32377.exe (PID: 8872)
- Unicorn-280.exe (PID: 8936)
- Unicorn-35091.exe (PID: 8960)
- Unicorn-15854.exe (PID: 9000)
- Unicorn-835.exe (PID: 8984)
- Unicorn-59495.exe (PID: 9096)
- Unicorn-40929.exe (PID: 7964)
- Unicorn-8256.exe (PID: 9140)
- Unicorn-21063.exe (PID: 2384)
- Unicorn-54557.exe (PID: 8304)
- Unicorn-54504.exe (PID: 5428)
- Unicorn-18462.exe (PID: 9172)
- Unicorn-34798.exe (PID: 8388)
- Unicorn-39537.exe (PID: 9212)
- Unicorn-39537.exe (PID: 8328)
- Unicorn-51579.exe (PID: 8696)
- Unicorn-7249.exe (PID: 8744)
- Unicorn-23122.exe (PID: 8708)
- Unicorn-49408.exe (PID: 8844)
- Unicorn-16809.exe (PID: 6388)
- Unicorn-31775.exe (PID: 9260)
- Unicorn-41867.exe (PID: 9236)
- Unicorn-35859.exe (PID: 9268)
- Unicorn-42443.exe (PID: 9308)
- Unicorn-56179.exe (PID: 9300)
- Unicorn-14789.exe (PID: 9368)
- Unicorn-64831.exe (PID: 9404)
- Unicorn-48495.exe (PID: 9384)
- Unicorn-59164.exe (PID: 9440)
- Unicorn-48879.exe (PID: 9484)
- Unicorn-13492.exe (PID: 9432)
- Unicorn-47130.exe (PID: 8672)
- Unicorn-27695.exe (PID: 8520)
- Unicorn-29013.exe (PID: 9476)
- Unicorn-39751.exe (PID: 9336)
- Unicorn-39743.exe (PID: 7820)
- Unicorn-6647.exe (PID: 9728)
- Unicorn-25313.exe (PID: 9632)
- Unicorn-20701.exe (PID: 9008)
- Unicorn-61515.exe (PID: 9672)
- Unicorn-45179.exe (PID: 9640)
- Unicorn-4046.exe (PID: 9708)
- Unicorn-24785.exe (PID: 9020)
- Unicorn-88.exe (PID: 9104)
- Unicorn-3211.exe (PID: 9196)
- Unicorn-8038.exe (PID: 9772)
- Unicorn-30410.exe (PID: 9808)
- Unicorn-53518.exe (PID: 9548)
- Unicorn-42749.exe (PID: 9504)
- Unicorn-28267.exe (PID: 9564)
- Unicorn-10962.exe (PID: 6272)
- Unicorn-42200.exe (PID: 9588)
- Unicorn-11115.exe (PID: 9872)
- Unicorn-19305.exe (PID: 9916)
- Unicorn-57815.exe (PID: 9792)
- Unicorn-16783.exe (PID: 9836)
- Unicorn-18729.exe (PID: 9856)
- Unicorn-8977.exe (PID: 9888)
- Unicorn-39817.exe (PID: 9908)
- Unicorn-18350.exe (PID: 9960)
- Unicorn-51785.exe (PID: 9980)
- Unicorn-55869.exe (PID: 9996)
- Unicorn-56501.exe (PID: 10040)
- Unicorn-50934.exe (PID: 10064)
- Unicorn-5646.exe (PID: 10140)
- Unicorn-4084.exe (PID: 10196)
- Unicorn-16145.exe (PID: 8204)
- Unicorn-32481.exe (PID: 10276)
- Unicorn-62008.exe (PID: 10220)
- Unicorn-16145.exe (PID: 7012)
- Unicorn-7976.exe (PID: 9816)
- Unicorn-32481.exe (PID: 10272)
- Unicorn-61161.exe (PID: 10304)
- Unicorn-62392.exe (PID: 10368)
- Unicorn-19963.exe (PID: 6656)
- Unicorn-47426.exe (PID: 10296)
- Unicorn-47447.exe (PID: 10392)
- Unicorn-41317.exe (PID: 10380)
- Unicorn-6314.exe (PID: 10492)
- Unicorn-45693.exe (PID: 10584)
- Unicorn-32049.exe (PID: 10560)
- Unicorn-41971.exe (PID: 10344)
Executes application which crashes
- Unicorn-10915.exe (PID: 6972)
- Unicorn-2794.exe (PID: 4880)
- Unicorn-2794.exe (PID: 5156)
INFO
The sample compiled with chinese language support
- 1 (257).exe (PID: 2284)
- Unicorn-42443.exe (PID: 9308)
- Unicorn-4753.exe (PID: 8364)
- Unicorn-56179.exe (PID: 9300)
- Unicorn-39751.exe (PID: 9336)
- Unicorn-11115.exe (PID: 9872)
- Unicorn-5150.exe (PID: 5740)
- Unicorn-14789.exe (PID: 9368)
- Unicorn-24777.exe (PID: 8112)
- Unicorn-64831.exe (PID: 9404)
- Unicorn-19305.exe (PID: 9916)
- Unicorn-48495.exe (PID: 9384)
- Unicorn-56633.exe (PID: 7356)
- Unicorn-21586.exe (PID: 8508)
- Unicorn-8977.exe (PID: 9888)
- Unicorn-32945.exe (PID: 7960)
- Unicorn-13492.exe (PID: 9432)
- Unicorn-16835.exe (PID: 8528)
- Unicorn-27695.exe (PID: 8520)
- Unicorn-47963.exe (PID: 7608)
- Unicorn-47890.exe (PID: 7948)
- Unicorn-48129.exe (PID: 7292)
- Unicorn-47130.exe (PID: 8672)
- Unicorn-60381.exe (PID: 7280)
- Unicorn-39743.exe (PID: 7832)
- Unicorn-14888.exe (PID: 8468)
- Unicorn-39817.exe (PID: 9908)
- Unicorn-59164.exe (PID: 9440)
- Unicorn-35659.exe (PID: 7860)
- Unicorn-18350.exe (PID: 9960)
- Unicorn-29013.exe (PID: 9476)
- Unicorn-51785.exe (PID: 9980)
- Unicorn-48879.exe (PID: 9484)
- Unicorn-63074.exe (PID: 4120)
- Unicorn-28267.exe (PID: 9564)
- Unicorn-53518.exe (PID: 9548)
- Unicorn-46383.exe (PID: 8712)
- Unicorn-42749.exe (PID: 9504)
- Unicorn-64994.exe (PID: 6744)
- Unicorn-47963.exe (PID: 7600)
- Unicorn-42199.exe (PID: 8760)
- Unicorn-45865.exe (PID: 3096)
- Unicorn-39743.exe (PID: 7820)
- Unicorn-34301.exe (PID: 8604)
- Unicorn-391.exe (PID: 2268)
- Unicorn-63286.exe (PID: 6080)
- Unicorn-9571.exe (PID: 6436)
- Unicorn-33521.exe (PID: 5984)
- Unicorn-391.exe (PID: 2984)
- Unicorn-6878.exe (PID: 6712)
- Unicorn-10692.exe (PID: 4428)
- Unicorn-10962.exe (PID: 6272)
- Unicorn-44600.exe (PID: 6068)
- Unicorn-14284.exe (PID: 5964)
- Unicorn-42200.exe (PID: 9588)
- Unicorn-9623.exe (PID: 7664)
- Unicorn-21487.exe (PID: 4408)
- Unicorn-59211.exe (PID: 8780)
- Unicorn-59211.exe (PID: 8788)
- Unicorn-47750.exe (PID: 7364)
- Unicorn-60448.exe (PID: 5116)
- Unicorn-37553.exe (PID: 6244)
- Unicorn-5539.exe (PID: 7644)
- Unicorn-31692.exe (PID: 6108)
- Unicorn-55869.exe (PID: 9996)
- Unicorn-25313.exe (PID: 9632)
- Unicorn-56501.exe (PID: 10040)
- Unicorn-4364.exe (PID: 8944)
- Unicorn-61515.exe (PID: 9672)
- Unicorn-35091.exe (PID: 8960)
- Unicorn-16617.exe (PID: 8976)
- Unicorn-25140.exe (PID: 7636)
- Unicorn-835.exe (PID: 8984)
- Unicorn-45179.exe (PID: 9640)
- Unicorn-31692.exe (PID: 7316)
- Unicorn-32037.exe (PID: 7348)
- Unicorn-64465.exe (PID: 1512)
- Unicorn-55311.exe (PID: 7756)
- Unicorn-15854.exe (PID: 9000)
- Unicorn-5084.exe (PID: 6824)
- Unicorn-59495.exe (PID: 9096)
- Unicorn-3046.exe (PID: 7460)
- Unicorn-4046.exe (PID: 9708)
- Unicorn-29223.exe (PID: 7472)
- Unicorn-40929.exe (PID: 7964)
- Unicorn-14688.exe (PID: 6268)
- Unicorn-12345.exe (PID: 8004)
- Unicorn-46328.exe (PID: 8148)
- Unicorn-32377.exe (PID: 8872)
- Unicorn-9268.exe (PID: 7488)
- Unicorn-50934.exe (PID: 10064)
- Unicorn-6647.exe (PID: 9728)
- Unicorn-43879.exe (PID: 7572)
- Unicorn-34798.exe (PID: 8388)
- Unicorn-39537.exe (PID: 8328)
- Unicorn-39537.exe (PID: 9212)
- Unicorn-21905.exe (PID: 4188)
- Unicorn-13655.exe (PID: 1328)
- Unicorn-30410.exe (PID: 9808)
- Unicorn-8038.exe (PID: 9772)
- Unicorn-4548.exe (PID: 7904)
- Unicorn-23942.exe (PID: 7732)
- Unicorn-54670.exe (PID: 8852)
- Unicorn-57815.exe (PID: 9792)
- Unicorn-88.exe (PID: 9104)
- Unicorn-3211.exe (PID: 9196)
- Unicorn-19959.exe (PID: 7896)
- Unicorn-51579.exe (PID: 8696)
- Unicorn-28892.exe (PID: 616)
- Unicorn-43879.exe (PID: 7580)
- Unicorn-37221.exe (PID: 7984)
- Unicorn-18951.exe (PID: 7532)
- Unicorn-51069.exe (PID: 7784)
- Unicorn-31775.exe (PID: 9260)
- Unicorn-24785.exe (PID: 9020)
- Unicorn-43343.exe (PID: 8032)
- Unicorn-46528.exe (PID: 2908)
- Unicorn-41867.exe (PID: 9236)
- Unicorn-32037.exe (PID: 7340)
- Unicorn-22857.exe (PID: 3180)
- Unicorn-62472.exe (PID: 7880)
- Unicorn-49408.exe (PID: 8844)
- Unicorn-49123.exe (PID: 7328)
- Unicorn-16809.exe (PID: 6388)
- Unicorn-33717.exe (PID: 7264)
- Unicorn-37809.exe (PID: 8228)
- Unicorn-26915.exe (PID: 6372)
- Unicorn-33036.exe (PID: 8092)
- Unicorn-18729.exe (PID: 9856)
- Unicorn-16783.exe (PID: 9836)
- Unicorn-55272.exe (PID: 8268)
- Unicorn-11159.exe (PID: 2088)
- Unicorn-60197.exe (PID: 8612)
- Unicorn-56305.exe (PID: 8544)
- Unicorn-5646.exe (PID: 10140)
- Unicorn-6481.exe (PID: 8820)
- Unicorn-35859.exe (PID: 9268)
- Unicorn-46793.exe (PID: 4448)
- Unicorn-7249.exe (PID: 8744)
- Unicorn-4084.exe (PID: 10196)
- Unicorn-8256.exe (PID: 9140)
- Unicorn-18462.exe (PID: 9172)
- Unicorn-54557.exe (PID: 8304)
- Unicorn-16145.exe (PID: 8204)
- Unicorn-32481.exe (PID: 10276)
- Unicorn-57483.exe (PID: 8312)
- Unicorn-33521.exe (PID: 7176)
- Unicorn-23358.exe (PID: 7676)
- Unicorn-32377.exe (PID: 8864)
- Unicorn-280.exe (PID: 8936)
- Unicorn-20701.exe (PID: 8992)
- Unicorn-62008.exe (PID: 10220)
- Unicorn-32481.exe (PID: 10272)
- Unicorn-62392.exe (PID: 10368)
- Unicorn-61161.exe (PID: 10304)
- Unicorn-17084.exe (PID: 208)
- Unicorn-15046.exe (PID: 8176)
- Unicorn-19963.exe (PID: 6656)
- Unicorn-47426.exe (PID: 10296)
- Unicorn-16145.exe (PID: 7012)
- Unicorn-7976.exe (PID: 9816)
- Unicorn-41971.exe (PID: 10344)
- Unicorn-47447.exe (PID: 10392)
- Unicorn-41317.exe (PID: 10380)
- Unicorn-45423.exe (PID: 8216)
- Unicorn-6314.exe (PID: 10492)
- Unicorn-45693.exe (PID: 10584)
- Unicorn-32049.exe (PID: 10560)
- Unicorn-20701.exe (PID: 9008)
- Unicorn-24213.exe (PID: 2644)
- Unicorn-3349.exe (PID: 8184)
- Unicorn-23122.exe (PID: 8708)
Checks supported languages
- 1 (257).exe (PID: 2284)
- Unicorn-37553.exe (PID: 6244)
- Unicorn-60448.exe (PID: 5116)
- Unicorn-10692.exe (PID: 4428)
- Unicorn-56633.exe (PID: 7356)
- Unicorn-47750.exe (PID: 7364)
- Unicorn-43879.exe (PID: 7572)
- Unicorn-47963.exe (PID: 7608)
- Unicorn-32037.exe (PID: 7340)
- Unicorn-25140.exe (PID: 7636)
- Unicorn-43879.exe (PID: 7580)
- Unicorn-23358.exe (PID: 7676)
- Unicorn-9623.exe (PID: 7664)
- Unicorn-47963.exe (PID: 7600)
- Unicorn-5539.exe (PID: 7644)
- Unicorn-33717.exe (PID: 7264)
- Unicorn-14688.exe (PID: 6268)
- Unicorn-11159.exe (PID: 2088)
- Unicorn-22857.exe (PID: 3180)
- Unicorn-5150.exe (PID: 5740)
- Unicorn-48129.exe (PID: 7292)
- Unicorn-32037.exe (PID: 7348)
- Unicorn-63074.exe (PID: 4120)
- Unicorn-21487.exe (PID: 4408)
- Unicorn-60381.exe (PID: 7280)
- Unicorn-44600.exe (PID: 6068)
- Unicorn-64465.exe (PID: 5936)
- Unicorn-31692.exe (PID: 6108)
- Unicorn-64465.exe (PID: 1512)
- Unicorn-31692.exe (PID: 7316)
- Unicorn-10915.exe (PID: 6972)
- Unicorn-28892.exe (PID: 616)
- Unicorn-55311.exe (PID: 7756)
- Unicorn-29223.exe (PID: 7472)
- Unicorn-4548.exe (PID: 7904)
- Unicorn-62472.exe (PID: 7880)
- Unicorn-37221.exe (PID: 7984)
- Unicorn-33036.exe (PID: 8092)
- Unicorn-47890.exe (PID: 7948)
- Unicorn-35659.exe (PID: 7860)
- Unicorn-39743.exe (PID: 7820)
- Unicorn-45865.exe (PID: 3096)
- Unicorn-39743.exe (PID: 7832)
- Unicorn-15046.exe (PID: 8176)
- Unicorn-6878.exe (PID: 6712)
- Unicorn-2794.exe (PID: 5156)
- Unicorn-3349.exe (PID: 8184)
- Unicorn-13655.exe (PID: 1328)
- Unicorn-10962.exe (PID: 6272)
- Unicorn-391.exe (PID: 2984)
- Unicorn-2794.exe (PID: 4880)
- Unicorn-17084.exe (PID: 208)
- Unicorn-391.exe (PID: 2268)
- Unicorn-63286.exe (PID: 6080)
- Unicorn-5084.exe (PID: 6824)
- Unicorn-19959.exe (PID: 7896)
- Unicorn-12345.exe (PID: 8004)
- Unicorn-21905.exe (PID: 4188)
- Unicorn-49123.exe (PID: 7328)
- Unicorn-46793.exe (PID: 4448)
- Unicorn-46528.exe (PID: 2908)
- Unicorn-51069.exe (PID: 7784)
- Unicorn-45423.exe (PID: 8216)
- Unicorn-55272.exe (PID: 8268)
- Unicorn-37809.exe (PID: 8228)
- Unicorn-57483.exe (PID: 8312)
- Unicorn-14888.exe (PID: 8468)
- Unicorn-4753.exe (PID: 8364)
- Unicorn-21586.exe (PID: 8508)
- Unicorn-56305.exe (PID: 8544)
- Unicorn-16835.exe (PID: 8528)
- Unicorn-60197.exe (PID: 8612)
- Unicorn-64994.exe (PID: 6744)
- Unicorn-47130.exe (PID: 8672)
- Unicorn-46383.exe (PID: 8712)
- Unicorn-6481.exe (PID: 8820)
- Unicorn-59211.exe (PID: 8788)
- Unicorn-59211.exe (PID: 8780)
- Unicorn-32377.exe (PID: 8864)
- Unicorn-54670.exe (PID: 8852)
- Unicorn-32377.exe (PID: 8872)
- Unicorn-56881.exe (PID: 8900)
- Unicorn-60965.exe (PID: 8916)
- Unicorn-280.exe (PID: 8936)
- Unicorn-835.exe (PID: 8984)
- Unicorn-24785.exe (PID: 9020)
- Unicorn-20701.exe (PID: 9008)
- Unicorn-15854.exe (PID: 9000)
- Unicorn-59495.exe (PID: 9096)
- Unicorn-8256.exe (PID: 9140)
- Unicorn-18462.exe (PID: 9172)
- Unicorn-3211.exe (PID: 9196)
- Unicorn-54504.exe (PID: 5428)
- Unicorn-54557.exe (PID: 8304)
- Unicorn-34798.exe (PID: 8388)
- Unicorn-21063.exe (PID: 2384)
- Unicorn-39537.exe (PID: 8328)
- Unicorn-39537.exe (PID: 9212)
- Unicorn-23122.exe (PID: 8708)
- Unicorn-51579.exe (PID: 8696)
- Unicorn-16809.exe (PID: 6388)
- Unicorn-41867.exe (PID: 9236)
- Unicorn-31775.exe (PID: 9260)
- Unicorn-35859.exe (PID: 9268)
- Unicorn-49408.exe (PID: 8844)
- Unicorn-39751.exe (PID: 9336)
- Unicorn-48495.exe (PID: 9384)
- Unicorn-59164.exe (PID: 9440)
- Unicorn-64831.exe (PID: 9404)
- Unicorn-13492.exe (PID: 9432)
- Unicorn-14789.exe (PID: 9368)
- Unicorn-48879.exe (PID: 9484)
- Unicorn-42749.exe (PID: 9504)
- Unicorn-6647.exe (PID: 9728)
- Unicorn-8038.exe (PID: 9772)
- Unicorn-25313.exe (PID: 9632)
- Unicorn-61515.exe (PID: 9672)
- Unicorn-4046.exe (PID: 9708)
- Unicorn-18729.exe (PID: 9856)
- Unicorn-8977.exe (PID: 9888)
- Unicorn-39817.exe (PID: 9908)
- Unicorn-18350.exe (PID: 9960)
- Unicorn-16783.exe (PID: 9836)
- Unicorn-55869.exe (PID: 9996)
- Unicorn-56501.exe (PID: 10040)
- Unicorn-5646.exe (PID: 10140)
- Unicorn-62008.exe (PID: 10220)
- Unicorn-7976.exe (PID: 9816)
- Unicorn-19963.exe (PID: 6656)
- Unicorn-16145.exe (PID: 8204)
- Unicorn-41317.exe (PID: 10380)
- Unicorn-41971.exe (PID: 10344)
- Unicorn-47447.exe (PID: 10392)
- Unicorn-6314.exe (PID: 10492)
- Unicorn-61161.exe (PID: 10304)
- Unicorn-47426.exe (PID: 10296)
- Unicorn-49512.exe (PID: 10596)
- Unicorn-32049.exe (PID: 10560)
- Unicorn-45693.exe (PID: 10584)
- Unicorn-49201.exe (PID: 10520)
- Unicorn-13959.exe (PID: 10808)
- Unicorn-56475.exe (PID: 10692)
- Unicorn-6606.exe (PID: 10676)
- Unicorn-63975.exe (PID: 10640)
- Unicorn-3653.exe (PID: 10864)
- Unicorn-17467.exe (PID: 10660)
- Unicorn-17467.exe (PID: 10652)
- Unicorn-1515.exe (PID: 10932)
- Unicorn-50061.exe (PID: 10944)
- Unicorn-28587.exe (PID: 11000)
- Unicorn-40409.exe (PID: 10968)
- Unicorn-15905.exe (PID: 10892)
- Unicorn-19989.exe (PID: 10900)
- Unicorn-51292.exe (PID: 11032)
- Unicorn-5620.exe (PID: 11040)
- Unicorn-1536.exe (PID: 11024)
- Unicorn-36901.exe (PID: 11092)
- Unicorn-36082.exe (PID: 11072)
- Unicorn-33944.exe (PID: 11116)
- Unicorn-25809.exe (PID: 11124)
- Unicorn-44415.exe (PID: 11188)
- Unicorn-32071.exe (PID: 11236)
- Unicorn-36155.exe (PID: 11260)
- Unicorn-29668.exe (PID: 10476)
- Unicorn-64743.exe (PID: 10548)
- Unicorn-65490.exe (PID: 11204)
- Unicorn-45507.exe (PID: 744)
- Unicorn-29933.exe (PID: 672)
- Unicorn-32647.exe (PID: 3396)
- Unicorn-18257.exe (PID: 10604)
- Unicorn-29117.exe (PID: 10484)
- Unicorn-28925.exe (PID: 11308)
- Unicorn-48791.exe (PID: 11316)
- Unicorn-42661.exe (PID: 11292)
- Unicorn-34812.exe (PID: 10424)
- Unicorn-24863.exe (PID: 11368)
- Unicorn-28755.exe (PID: 11464)
- Unicorn-32076.exe (PID: 11492)
- Unicorn-47229.exe (PID: 11444)
- Unicorn-30701.exe (PID: 11560)
- Unicorn-22533.exe (PID: 11524)
- Unicorn-43145.exe (PID: 11476)
- Unicorn-37477.exe (PID: 11544)
- Unicorn-23279.exe (PID: 11432)
- Unicorn-43145.exe (PID: 11568)
- Unicorn-51121.exe (PID: 11644)
- Unicorn-51121.exe (PID: 11636)
- Unicorn-25247.exe (PID: 11692)
- Unicorn-29885.exe (PID: 11796)
- Unicorn-19025.exe (PID: 11788)
- Unicorn-32738.exe (PID: 11584)
- Unicorn-32738.exe (PID: 11592)
- Unicorn-16978.exe (PID: 11808)
- Unicorn-2396.exe (PID: 11908)
- Unicorn-54198.exe (PID: 11896)
- Unicorn-58395.exe (PID: 11968)
- Unicorn-7156.exe (PID: 11992)
- Unicorn-22101.exe (PID: 12012)
- Unicorn-8340.exe (PID: 12096)
- Unicorn-47613.exe (PID: 11844)
- Unicorn-51240.exe (PID: 11936)
- Unicorn-25631.exe (PID: 11960)
- Unicorn-47897.exe (PID: 12152)
- Unicorn-34161.exe (PID: 12144)
- Unicorn-27939.exe (PID: 12176)
- Unicorn-59242.exe (PID: 12252)
- Unicorn-30891.exe (PID: 3156)
- Unicorn-48189.exe (PID: 12284)
- Unicorn-10617.exe (PID: 6736)
- Unicorn-60725.exe (PID: 12232)
- Unicorn-10617.exe (PID: 2800)
- Unicorn-3740.exe (PID: 12360)
- Unicorn-28244.exe (PID: 12384)
Reads the computer name
- 1 (257).exe (PID: 2284)
- Unicorn-37553.exe (PID: 6244)
- Unicorn-60448.exe (PID: 5116)
- Unicorn-10692.exe (PID: 4428)
- Unicorn-32037.exe (PID: 7348)
- Unicorn-56633.exe (PID: 7356)
- Unicorn-47750.exe (PID: 7364)
- Unicorn-32037.exe (PID: 7340)
- Unicorn-43879.exe (PID: 7580)
- Unicorn-47963.exe (PID: 7600)
- Unicorn-9623.exe (PID: 7664)
- Unicorn-47963.exe (PID: 7608)
- Unicorn-25140.exe (PID: 7636)
- Unicorn-43879.exe (PID: 7572)
- Unicorn-23358.exe (PID: 7676)
- Unicorn-5539.exe (PID: 7644)
- Unicorn-14688.exe (PID: 6268)
- Unicorn-22857.exe (PID: 3180)
- Unicorn-33717.exe (PID: 7264)
- Unicorn-48129.exe (PID: 7292)
- Unicorn-11159.exe (PID: 2088)
- Unicorn-5150.exe (PID: 5740)
- Unicorn-64465.exe (PID: 1512)
- Unicorn-60381.exe (PID: 7280)
- Unicorn-63074.exe (PID: 4120)
- Unicorn-21487.exe (PID: 4408)
- Unicorn-44600.exe (PID: 6068)
- Unicorn-28892.exe (PID: 616)
- Unicorn-31692.exe (PID: 6108)
- Unicorn-10915.exe (PID: 6972)
- Unicorn-31692.exe (PID: 7316)
- Unicorn-64465.exe (PID: 5936)
- Unicorn-37221.exe (PID: 7984)
- Unicorn-43343.exe (PID: 8032)
- Unicorn-33036.exe (PID: 8092)
- Unicorn-26915.exe (PID: 6372)
- Unicorn-24777.exe (PID: 8112)
- Unicorn-32945.exe (PID: 7960)
- Unicorn-35659.exe (PID: 7860)
- Unicorn-45865.exe (PID: 3096)
- Unicorn-33521.exe (PID: 5984)
- Unicorn-2794.exe (PID: 4880)
- Unicorn-391.exe (PID: 2984)
- Unicorn-6878.exe (PID: 6712)
- Unicorn-15046.exe (PID: 8176)
- Unicorn-3349.exe (PID: 8184)
- Unicorn-33521.exe (PID: 7176)
- Unicorn-17084.exe (PID: 208)
- Unicorn-9268.exe (PID: 7488)
- Unicorn-2794.exe (PID: 5156)
- Unicorn-12345.exe (PID: 8004)
- Unicorn-49123.exe (PID: 7328)
- Unicorn-18951.exe (PID: 7532)
- Unicorn-51069.exe (PID: 7784)
- Unicorn-46528.exe (PID: 2908)
- Unicorn-45423.exe (PID: 8216)
- Unicorn-55272.exe (PID: 8268)
- Unicorn-4753.exe (PID: 8364)
- Unicorn-57483.exe (PID: 8312)
- Unicorn-16835.exe (PID: 8528)
- Unicorn-14888.exe (PID: 8468)
- Unicorn-34301.exe (PID: 8604)
- Unicorn-42199.exe (PID: 8760)
- Unicorn-59211.exe (PID: 8780)
- Unicorn-54670.exe (PID: 8852)
- Unicorn-56881.exe (PID: 8900)
- Unicorn-15854.exe (PID: 9000)
- Unicorn-20701.exe (PID: 8992)
- Unicorn-54557.exe (PID: 8304)
- Unicorn-40929.exe (PID: 7964)
- Unicorn-47130.exe (PID: 8672)
- Unicorn-20701.exe (PID: 9008)
- Unicorn-88.exe (PID: 9104)
- Unicorn-21063.exe (PID: 2384)
- Unicorn-54504.exe (PID: 5428)
- Unicorn-18462.exe (PID: 9172)
- Unicorn-51579.exe (PID: 8696)
- Unicorn-39537.exe (PID: 9212)
- Unicorn-41867.exe (PID: 9236)
- Unicorn-42443.exe (PID: 9308)
- Unicorn-56179.exe (PID: 9300)
Create files in a temporary directory
- 1 (257).exe (PID: 2284)
- Unicorn-56633.exe (PID: 7356)
- Unicorn-37553.exe (PID: 6244)
- Unicorn-47750.exe (PID: 7364)
- Unicorn-25140.exe (PID: 7636)
- Unicorn-32037.exe (PID: 7348)
- Unicorn-60448.exe (PID: 5116)
- Unicorn-43879.exe (PID: 7580)
- Unicorn-32037.exe (PID: 7340)
- Unicorn-43879.exe (PID: 7572)
- Unicorn-64465.exe (PID: 1512)
- Unicorn-63074.exe (PID: 4120)
- Unicorn-31692.exe (PID: 7316)
- Unicorn-5539.exe (PID: 7644)
- Unicorn-10692.exe (PID: 4428)
- Unicorn-62472.exe (PID: 7880)
- Unicorn-26915.exe (PID: 6372)
- Unicorn-32945.exe (PID: 7960)
- Unicorn-5150.exe (PID: 5740)
- Unicorn-47890.exe (PID: 7948)
- Unicorn-47963.exe (PID: 7608)
- Unicorn-47963.exe (PID: 7600)
- Unicorn-45865.exe (PID: 3096)
- Unicorn-2794.exe (PID: 4880)
- Unicorn-391.exe (PID: 2984)
- Unicorn-6878.exe (PID: 6712)
- Unicorn-15046.exe (PID: 8176)
- Unicorn-14284.exe (PID: 5964)
- Unicorn-46328.exe (PID: 8148)
- Unicorn-33521.exe (PID: 7176)
- Unicorn-9623.exe (PID: 7664)
- Unicorn-63286.exe (PID: 6080)
- Unicorn-23358.exe (PID: 7676)
- Unicorn-64465.exe (PID: 5936)
- Unicorn-31692.exe (PID: 6108)
- Unicorn-28892.exe (PID: 616)
- Unicorn-9268.exe (PID: 7488)
- Unicorn-29223.exe (PID: 7472)
- Unicorn-5084.exe (PID: 6824)
- Unicorn-12345.exe (PID: 8004)
- Unicorn-4548.exe (PID: 7904)
- Unicorn-49123.exe (PID: 7328)
- Unicorn-37221.exe (PID: 7984)
- Unicorn-18951.exe (PID: 7532)
- Unicorn-23942.exe (PID: 7732)
- Unicorn-22857.exe (PID: 3180)
- Unicorn-51069.exe (PID: 7784)
- Unicorn-33717.exe (PID: 7264)
- Unicorn-43343.exe (PID: 8032)
- Unicorn-37809.exe (PID: 8228)
- Unicorn-33036.exe (PID: 8092)
- Unicorn-11159.exe (PID: 2088)
- Unicorn-55272.exe (PID: 8268)
- Unicorn-46793.exe (PID: 4448)
- Unicorn-57483.exe (PID: 8312)
- Unicorn-24777.exe (PID: 8112)
- Unicorn-14888.exe (PID: 8468)
- Unicorn-21586.exe (PID: 8508)
- Unicorn-60197.exe (PID: 8612)
- Unicorn-16835.exe (PID: 8528)
- Unicorn-56305.exe (PID: 8544)
- Unicorn-34301.exe (PID: 8604)
- Unicorn-39743.exe (PID: 7832)
- Unicorn-46383.exe (PID: 8712)
- Unicorn-48129.exe (PID: 7292)
- Unicorn-35659.exe (PID: 7860)
- Unicorn-64994.exe (PID: 6744)
- Unicorn-59211.exe (PID: 8780)
- Unicorn-391.exe (PID: 2268)
- Unicorn-33521.exe (PID: 5984)
- Unicorn-9571.exe (PID: 6436)
- Unicorn-46528.exe (PID: 2908)
- Unicorn-21487.exe (PID: 4408)
- Unicorn-59211.exe (PID: 8788)
- Unicorn-3349.exe (PID: 8184)
- Unicorn-54670.exe (PID: 8852)
- Unicorn-32377.exe (PID: 8864)
- Unicorn-44600.exe (PID: 6068)
- Unicorn-56881.exe (PID: 8900)
- Unicorn-20701.exe (PID: 8992)
- Unicorn-15854.exe (PID: 9000)
- Unicorn-55311.exe (PID: 7756)
- Unicorn-59495.exe (PID: 9096)
- Unicorn-21063.exe (PID: 2384)
- Unicorn-8256.exe (PID: 9140)
- Unicorn-40929.exe (PID: 7964)
- Unicorn-14688.exe (PID: 6268)
- Unicorn-54504.exe (PID: 5428)
- Unicorn-34798.exe (PID: 8388)
- Unicorn-39537.exe (PID: 8328)
- Unicorn-51579.exe (PID: 8696)
- Unicorn-39537.exe (PID: 9212)
- Unicorn-21905.exe (PID: 4188)
- Unicorn-13655.exe (PID: 1328)
- Unicorn-49408.exe (PID: 8844)
- Unicorn-31775.exe (PID: 9260)
- Unicorn-35859.exe (PID: 9268)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 7464)
- BackgroundTransferHost.exe (PID: 7836)
- BackgroundTransferHost.exe (PID: 8164)
- BackgroundTransferHost.exe (PID: 7948)
- BackgroundTransferHost.exe (PID: 5756)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 7836)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 7836)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 7836)
- WerFault.exe (PID: 10484)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
436
Monitored processes
298
Malicious processes
42
Suspicious processes
45
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\Users\admin\AppData\Local\Temp\Unicorn-17084.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-17084.exe | Unicorn-32037.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 616 | C:\Users\admin\AppData\Local\Temp\Unicorn-28892.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-28892.exe | 1 (257).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 672 | C:\Users\admin\AppData\Local\Temp\Unicorn-29933.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-29933.exe | — | Unicorn-4364.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 744 | C:\Users\admin\AppData\Local\Temp\Unicorn-45507.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-45507.exe | — | Unicorn-32037.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1328 | C:\Users\admin\AppData\Local\Temp\Unicorn-13655.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13655.exe | Unicorn-25140.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1512 | C:\Users\admin\AppData\Local\Temp\Unicorn-64465.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-64465.exe | Unicorn-23358.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2088 | C:\Users\admin\AppData\Local\Temp\Unicorn-11159.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-11159.exe | Unicorn-56633.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2268 | C:\Users\admin\AppData\Local\Temp\Unicorn-391.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-391.exe | Unicorn-10692.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2284 | "C:\Users\admin\AppData\Local\Temp\1 (257).exe" | C:\Users\admin\AppData\Local\Temp\1 (257).exe | explorer.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2384 | C:\Users\admin\AppData\Local\Temp\Unicorn-21063.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-21063.exe | Unicorn-31692.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
12 834
Read events
12 816
Write events
18
Delete events
0
Modification events
| (PID) Process: | (7464) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7464) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7464) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7836) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7836) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7836) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7948) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7948) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7948) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (8164) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
900
Suspicious files
14
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7836 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\af468f21-92ea-482d-a7a6-b943850d4369.down_data | — | |
MD5:— | SHA256:— | |||
| 2284 | 1 (257).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-37553.exe | executable | |
MD5:D791B1ACE9B7942976E0746393DC2A6D | SHA256:8B6F3066D1AF73C77FF2F2898E5FBD619F250C0A935A0B2033D20F95DD53F4D2 | |||
| 5116 | Unicorn-60448.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5539.exe | executable | |
MD5:FC3A125F4D6732A31A3A1CC37BBDF10F | SHA256:0D631EC2E8F3DE7B2C941B95DDF656355F5359ACE7749920D821150F3A649FDF | |||
| 7836 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:6EDBD6A7F185952C123334F14823A2E5 | SHA256:D24DF217B094B65B4656F3773A9D7DE8C6152090A63A3AD769F4770B562EEA16 | |||
| 7836 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\72d81a00-1ce3-4e12-8232-2ba4bcdb8f21.up_meta_secure | binary | |
MD5:1F375CF8BF305B4E13647B8F66917A1D | SHA256:AB28AE17567790A4716EE8CD84657E1BC37CC506A5EC26FA04472B42FF97741F | |||
| 4428 | Unicorn-10692.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9623.exe | executable | |
MD5:93FD17A0DEA104A3F8660C23D0326382 | SHA256:C8B058956735B890227A6BA753A6907B2E17BBF4B46E457100B4FB3CF9815269 | |||
| 5116 | Unicorn-60448.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-32037.exe | executable | |
MD5:E73ABB1A9C27A4244E4DB8AE1EC6CDD7 | SHA256:C8B058956735B890227A6BA753A6907B2E17BBF4B46E457100B4FB3CF9815269 | |||
| 7580 | Unicorn-43879.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-22857.exe | executable | |
MD5:8F77BDD12650BA89318B8F838AB0E69D | SHA256:28CBD254DABB6CAD918A02B96CCF48D8232EF98FCC34AAB5E53CC6DEF13FFA1D | |||
| 7836 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
| 2284 | 1 (257).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-60448.exe | executable | |
MD5:E5524EF97521BFD1E524B0A5F5622314 | SHA256:DD2E39C86D44298C1BBD27A59172B6147C5C0F886E39D3D2EDFC147847156341 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
16
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 88.221.110.114:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6708 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
5056 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5056 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7836 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 88.221.110.114:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
6404 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3216 | svchost.exe | 20.198.162.76:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | SG | whitelisted |
6544 | svchost.exe | 20.190.159.75:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6708 | backgroundTaskHost.exe | 20.31.169.57:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6708 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |