| File name: | 1 (1307) |
| Full analysis: | https://app.any.run/tasks/8f228e4e-5d09-4220-9a32-c6ee45052bc4 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 13:07:35 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | BB2929BBC723E240F02FBC9EAC8E5AD0 |
| SHA1: | 7834D19B4CEA9276D427A8919868BC13A5307BB1 |
| SHA256: | 2BC8890D30691FC4C340A76E85A7557016FEA442450A55FCB34679F251044D97 |
| SSDEEP: | 6144:U7tgxc2VaDULU5LO7peU3kMx5W7Yfp8GBV/aUVOH+k/8SwjwpyAvEhWxULyDQREa:UZodBLU5a7od7o+aVSUVOHtx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- Unicorn-46752.exe (PID: 8132)
- Unicorn-24220.exe (PID: 7992)
- Unicorn-61339.exe (PID: 8000)
- Unicorn-9471.exe (PID: 7488)
- 1 (1307).exe (PID: 7272)
- Unicorn-15733.exe (PID: 8172)
- Unicorn-21864.exe (PID: 8164)
- Unicorn-6466.exe (PID: 8148)
- Unicorn-48828.exe (PID: 1244)
- Unicorn-24878.exe (PID: 2568)
- Unicorn-36384.exe (PID: 1164)
- Unicorn-30253.exe (PID: 1052)
- Unicorn-28216.exe (PID: 6192)
- Unicorn-56804.exe (PID: 1184)
- Unicorn-13991.exe (PID: 632)
- Unicorn-39242.exe (PID: 2772)
- Unicorn-26436.exe (PID: 1096)
- Unicorn-2106.exe (PID: 5360)
- Unicorn-27780.exe (PID: 1568)
- Unicorn-64899.exe (PID: 2320)
- Unicorn-6326.exe (PID: 4880)
- Unicorn-40394.exe (PID: 856)
- Unicorn-59876.exe (PID: 7312)
- Unicorn-45578.exe (PID: 7304)
- Unicorn-39648.exe (PID: 6620)
- Unicorn-8682.exe (PID: 1812)
- Unicorn-23674.exe (PID: 7292)
- Unicorn-10675.exe (PID: 2140)
- Unicorn-6591.exe (PID: 7256)
- Unicorn-61635.exe (PID: 920)
- Unicorn-12367.exe (PID: 4428)
- Unicorn-60260.exe (PID: 6964)
- Unicorn-27809.exe (PID: 6272)
- Unicorn-21688.exe (PID: 680)
- Unicorn-62528.exe (PID: 2692)
- Unicorn-42470.exe (PID: 5720)
- Unicorn-8157.exe (PID: 7328)
- Unicorn-38984.exe (PID: 4892)
- Unicorn-18372.exe (PID: 1532)
- Unicorn-51215.exe (PID: 7456)
- Unicorn-38143.exe (PID: 7340)
- Unicorn-34905.exe (PID: 7620)
- Unicorn-9051.exe (PID: 5404)
- Unicorn-6695.exe (PID: 7628)
- Unicorn-6887.exe (PID: 7556)
- Unicorn-47054.exe (PID: 5508)
- Unicorn-6783.exe (PID: 4008)
- Unicorn-43836.exe (PID: 3900)
- Unicorn-26029.exe (PID: 6028)
- Unicorn-52367.exe (PID: 7632)
- Unicorn-44007.exe (PID: 1072)
- Unicorn-28268.exe (PID: 7580)
- Unicorn-23394.exe (PID: 6404)
- Unicorn-19310.exe (PID: 7652)
- Unicorn-31584.exe (PID: 4112)
- Unicorn-15632.exe (PID: 7656)
- Unicorn-48496.exe (PID: 7712)
- Unicorn-35595.exe (PID: 6584)
- Unicorn-41672.exe (PID: 8036)
- Unicorn-35860.exe (PID: 7812)
- Unicorn-47344.exe (PID: 5156)
- Unicorn-10971.exe (PID: 4120)
- Unicorn-47920.exe (PID: 6988)
- Unicorn-39295.exe (PID: 7552)
- Unicorn-54935.exe (PID: 7544)
- Unicorn-29153.exe (PID: 1056)
- Unicorn-2803.exe (PID: 664)
- Unicorn-10068.exe (PID: 5984)
- Unicorn-37758.exe (PID: 6668)
- Unicorn-49264.exe (PID: 8056)
- Unicorn-15439.exe (PID: 7664)
- Unicorn-43452.exe (PID: 2392)
- Unicorn-32928.exe (PID: 8116)
- Unicorn-12123.exe (PID: 8032)
- Unicorn-23673.exe (PID: 5384)
- Unicorn-28849.exe (PID: 2240)
- Unicorn-60046.exe (PID: 4188)
- Unicorn-54531.exe (PID: 8768)
- Unicorn-59435.exe (PID: 4336)
- Unicorn-12315.exe (PID: 8068)
- Unicorn-8733.exe (PID: 4040)
- Unicorn-54095.exe (PID: 7660)
- Unicorn-255.exe (PID: 1272)
- Unicorn-46799.exe (PID: 8832)
- Unicorn-63680.exe (PID: 7636)
- Unicorn-58179.exe (PID: 8096)
- Unicorn-53954.exe (PID: 8488)
- Unicorn-39088.exe (PID: 8248)
- Unicorn-42928.exe (PID: 9068)
- Unicorn-39809.exe (PID: 7748)
- Unicorn-57603.exe (PID: 7616)
- Unicorn-5491.exe (PID: 7780)
- Unicorn-31073.exe (PID: 5960)
- Unicorn-44324.exe (PID: 8424)
- Unicorn-22752.exe (PID: 8264)
- Unicorn-64942.exe (PID: 8568)
- Unicorn-42160.exe (PID: 8868)
- Unicorn-41480.exe (PID: 8112)
- Unicorn-20950.exe (PID: 8584)
- Unicorn-63348.exe (PID: 9044)
- Unicorn-29524.exe (PID: 8624)
- Unicorn-59382.exe (PID: 8516)
- Unicorn-41008.exe (PID: 8548)
- Unicorn-16400.exe (PID: 8120)
- Unicorn-62196.exe (PID: 8612)
- Unicorn-47130.exe (PID: 8532)
- Unicorn-3483.exe (PID: 8440)
- Unicorn-25618.exe (PID: 9296)
- Unicorn-4067.exe (PID: 9336)
- Unicorn-36732.exe (PID: 8576)
- Unicorn-57986.exe (PID: 2564)
- Unicorn-15233.exe (PID: 9444)
- Unicorn-37116.exe (PID: 8712)
- Unicorn-6778.exe (PID: 8352)
- Unicorn-22898.exe (PID: 9948)
- Unicorn-48364.exe (PID: 9940)
- Unicorn-37182.exe (PID: 8072)
- Unicorn-45647.exe (PID: 8524)
- Unicorn-10255.exe (PID: 9108)
- Unicorn-48556.exe (PID: 9888)
- Unicorn-7878.exe (PID: 9192)
- Unicorn-37124.exe (PID: 9324)
- Unicorn-57419.exe (PID: 10080)
- Unicorn-8038.exe (PID: 6132)
- Unicorn-55371.exe (PID: 6712)
- Unicorn-63400.exe (PID: 8308)
- Unicorn-25440.exe (PID: 8632)
- Unicorn-47780.exe (PID: 7084)
- Unicorn-31989.exe (PID: 8272)
- Unicorn-2279.exe (PID: 8944)
- Unicorn-6171.exe (PID: 9092)
- Unicorn-65003.exe (PID: 8408)
- Unicorn-64892.exe (PID: 9872)
- Unicorn-51376.exe (PID: 8644)
- Unicorn-64951.exe (PID: 8124)
- Unicorn-55188.exe (PID: 9576)
- Unicorn-51515.exe (PID: 8432)
- Unicorn-2450.exe (PID: 9144)
- Unicorn-40218.exe (PID: 8496)
- Unicorn-51467.exe (PID: 9648)
- Unicorn-44088.exe (PID: 10044)
- Unicorn-45476.exe (PID: 8680)
- Unicorn-28498.exe (PID: 9976)
- Unicorn-21429.exe (PID: 10004)
- Unicorn-18432.exe (PID: 9504)
- Unicorn-44768.exe (PID: 11036)
- Unicorn-37020.exe (PID: 11044)
- Unicorn-31154.exe (PID: 11052)
- Unicorn-51205.exe (PID: 8908)
- Unicorn-37500.exe (PID: 8652)
- Unicorn-18593.exe (PID: 12936)
- Unicorn-57079.exe (PID: 9212)
- Unicorn-7658.exe (PID: 12928)
- Unicorn-32721.exe (PID: 9596)
- Unicorn-34930.exe (PID: 8776)
- Unicorn-38830.exe (PID: 9384)
- Unicorn-21083.exe (PID: 14252)
- Unicorn-32018.exe (PID: 14260)
- Unicorn-45868.exe (PID: 9492)
- Unicorn-2619.exe (PID: 14292)
- Unicorn-48148.exe (PID: 7936)
- Unicorn-20382.exe (PID: 12044)
- Unicorn-30876.exe (PID: 9536)
- Unicorn-21726.exe (PID: 9276)
- Unicorn-24414.exe (PID: 9988)
- Unicorn-61930.exe (PID: 5968)
- Unicorn-35256.exe (PID: 10736)
- Unicorn-28053.exe (PID: 9772)
- Unicorn-48562.exe (PID: 7908)
- Unicorn-379.exe (PID: 11172)
- Unicorn-3086.exe (PID: 11840)
- Unicorn-27744.exe (PID: 9184)
- Unicorn-11327.exe (PID: 10848)
- Unicorn-45866.exe (PID: 8752)
- Unicorn-7554.exe (PID: 11828)
- Unicorn-26631.exe (PID: 10784)
- Unicorn-56253.exe (PID: 11240)
- Unicorn-19614.exe (PID: 11876)
- Unicorn-41836.exe (PID: 11152)
- Unicorn-54820.exe (PID: 15284)
- Unicorn-10087.exe (PID: 15260)
- Unicorn-47020.exe (PID: 9584)
- Unicorn-3138.exe (PID: 10744)
- Unicorn-36038.exe (PID: 9428)
- Unicorn-46252.exe (PID: 9412)
- Unicorn-49148.exe (PID: 12620)
- Unicorn-53771.exe (PID: 10632)
- Unicorn-65202.exe (PID: 9664)
- Unicorn-11407.exe (PID: 4180)
- Unicorn-45671.exe (PID: 4208)
- Unicorn-123.exe (PID: 10120)
- Unicorn-2266.exe (PID: 9624)
- Unicorn-47591.exe (PID: 976)
- Unicorn-60823.exe (PID: 12684)
- Unicorn-33097.exe (PID: 13008)
- Unicorn-5390.exe (PID: 9468)
- Unicorn-8867.exe (PID: 10520)
- Unicorn-46422.exe (PID: 10812)
- Unicorn-51052.exe (PID: 10584)
- Unicorn-45287.exe (PID: 14072)
- Unicorn-48911.exe (PID: 9224)
- Unicorn-45868.exe (PID: 9484)
- Unicorn-40446.exe (PID: 9312)
- Unicorn-20972.exe (PID: 8692)
Executable content was dropped or overwritten
- Unicorn-46752.exe (PID: 8132)
- 1 (1307).exe (PID: 7272)
- Unicorn-9471.exe (PID: 7488)
- Unicorn-61339.exe (PID: 8000)
- Unicorn-24220.exe (PID: 7992)
- Unicorn-15733.exe (PID: 8172)
- Unicorn-21864.exe (PID: 8164)
- Unicorn-6466.exe (PID: 8148)
- Unicorn-48828.exe (PID: 1244)
- Unicorn-56804.exe (PID: 1184)
- Unicorn-8682.exe (PID: 1812)
- Unicorn-36384.exe (PID: 1164)
- Unicorn-30253.exe (PID: 1052)
- Unicorn-61635.exe (PID: 920)
- Unicorn-28216.exe (PID: 6192)
- Unicorn-13991.exe (PID: 632)
- Unicorn-39242.exe (PID: 2772)
- Unicorn-24878.exe (PID: 2568)
- Unicorn-26436.exe (PID: 1096)
- Unicorn-2106.exe (PID: 5360)
- Unicorn-27780.exe (PID: 1568)
- Unicorn-6326.exe (PID: 4880)
- Unicorn-59876.exe (PID: 7312)
- Unicorn-40394.exe (PID: 856)
- Unicorn-47054.exe (PID: 5508)
- Unicorn-45578.exe (PID: 7304)
- Unicorn-6783.exe (PID: 4008)
- Unicorn-64899.exe (PID: 2320)
- Unicorn-39648.exe (PID: 6620)
- Unicorn-23674.exe (PID: 7292)
- Unicorn-10675.exe (PID: 2140)
- Unicorn-6591.exe (PID: 7256)
- Unicorn-12367.exe (PID: 4428)
- Unicorn-60260.exe (PID: 6964)
- Unicorn-27809.exe (PID: 6272)
- Unicorn-21688.exe (PID: 680)
- Unicorn-62528.exe (PID: 2692)
- Unicorn-42470.exe (PID: 5720)
- Unicorn-38984.exe (PID: 4892)
- Unicorn-18372.exe (PID: 1532)
- Unicorn-8157.exe (PID: 7328)
- Unicorn-51215.exe (PID: 7456)
- Unicorn-38143.exe (PID: 7340)
- Unicorn-34905.exe (PID: 7620)
- Unicorn-9051.exe (PID: 5404)
- Unicorn-6695.exe (PID: 7628)
- Unicorn-6887.exe (PID: 7556)
- Unicorn-43836.exe (PID: 3900)
- Unicorn-57603.exe (PID: 7616)
- Unicorn-48496.exe (PID: 7712)
- Unicorn-44007.exe (PID: 1072)
- Unicorn-52367.exe (PID: 7632)
- Unicorn-28268.exe (PID: 7580)
- Unicorn-19310.exe (PID: 7652)
- Unicorn-23394.exe (PID: 6404)
- Unicorn-31584.exe (PID: 4112)
- Unicorn-15632.exe (PID: 7656)
- Unicorn-26029.exe (PID: 6028)
- Unicorn-35860.exe (PID: 7812)
- Unicorn-35595.exe (PID: 6584)
- Unicorn-47344.exe (PID: 5156)
- Unicorn-47920.exe (PID: 6988)
- Unicorn-10971.exe (PID: 4120)
- Unicorn-41672.exe (PID: 8036)
- Unicorn-29153.exe (PID: 1056)
- Unicorn-54935.exe (PID: 7544)
- Unicorn-2803.exe (PID: 664)
- Unicorn-10068.exe (PID: 5984)
- Unicorn-37758.exe (PID: 6668)
- Unicorn-49264.exe (PID: 8056)
- Unicorn-39295.exe (PID: 7552)
- Unicorn-15439.exe (PID: 7664)
- Unicorn-43452.exe (PID: 2392)
- Unicorn-32928.exe (PID: 8116)
- Unicorn-64951.exe (PID: 8124)
- Unicorn-12123.exe (PID: 8032)
- Unicorn-23673.exe (PID: 5384)
- Unicorn-28849.exe (PID: 2240)
- Unicorn-60046.exe (PID: 4188)
- Unicorn-63680.exe (PID: 7636)
- Unicorn-8733.exe (PID: 4040)
- Unicorn-34930.exe (PID: 8776)
- Unicorn-54095.exe (PID: 7660)
- Unicorn-12315.exe (PID: 8068)
- Unicorn-46799.exe (PID: 8832)
- Unicorn-255.exe (PID: 1272)
- Unicorn-58179.exe (PID: 8096)
- Unicorn-39809.exe (PID: 7748)
- Unicorn-42928.exe (PID: 9068)
- Unicorn-64942.exe (PID: 8568)
- Unicorn-39088.exe (PID: 8248)
- Unicorn-5491.exe (PID: 7780)
- Unicorn-31073.exe (PID: 5960)
- Unicorn-44324.exe (PID: 8424)
- Unicorn-42160.exe (PID: 8868)
- Unicorn-22752.exe (PID: 8264)
- Unicorn-41480.exe (PID: 8112)
- Unicorn-20950.exe (PID: 8584)
- Unicorn-59382.exe (PID: 8516)
- Unicorn-63348.exe (PID: 9044)
- Unicorn-29524.exe (PID: 8624)
- Unicorn-41008.exe (PID: 8548)
- Unicorn-16400.exe (PID: 8120)
- Unicorn-62196.exe (PID: 8612)
- Unicorn-47130.exe (PID: 8532)
- Unicorn-3483.exe (PID: 8440)
- Unicorn-25618.exe (PID: 9296)
- Unicorn-36732.exe (PID: 8576)
- Unicorn-54531.exe (PID: 8768)
- Unicorn-15233.exe (PID: 9444)
- Unicorn-37116.exe (PID: 8712)
- Unicorn-4067.exe (PID: 9336)
- Unicorn-57986.exe (PID: 2564)
- Unicorn-6778.exe (PID: 8352)
- Unicorn-37182.exe (PID: 8072)
- Unicorn-48364.exe (PID: 9940)
- Unicorn-22898.exe (PID: 9948)
- Unicorn-63400.exe (PID: 8308)
- Unicorn-45647.exe (PID: 8524)
- Unicorn-10255.exe (PID: 9108)
- Unicorn-48556.exe (PID: 9888)
- Unicorn-7878.exe (PID: 9192)
- Unicorn-37124.exe (PID: 9324)
- Unicorn-8038.exe (PID: 6132)
- Unicorn-57419.exe (PID: 10080)
- Unicorn-55371.exe (PID: 6712)
- Unicorn-6171.exe (PID: 9092)
- Unicorn-25440.exe (PID: 8632)
- Unicorn-47780.exe (PID: 7084)
- Unicorn-2279.exe (PID: 8944)
- Unicorn-51376.exe (PID: 8644)
- Unicorn-2450.exe (PID: 9144)
- Unicorn-55188.exe (PID: 9576)
- Unicorn-65003.exe (PID: 8408)
- Unicorn-64892.exe (PID: 9872)
- Unicorn-51515.exe (PID: 8432)
- Unicorn-40218.exe (PID: 8496)
- Unicorn-44088.exe (PID: 10044)
- Unicorn-51467.exe (PID: 9648)
- Unicorn-45476.exe (PID: 8680)
- Unicorn-18432.exe (PID: 9504)
- Unicorn-21429.exe (PID: 10004)
- Unicorn-37020.exe (PID: 11044)
- Unicorn-28498.exe (PID: 9976)
- Unicorn-53954.exe (PID: 8488)
- Unicorn-44768.exe (PID: 11036)
- Unicorn-51205.exe (PID: 8908)
- Unicorn-31154.exe (PID: 11052)
- Unicorn-31989.exe (PID: 8272)
- Unicorn-23994.exe (PID: 12960)
- Unicorn-37500.exe (PID: 8652)
- Unicorn-18593.exe (PID: 12936)
- Unicorn-32721.exe (PID: 9596)
- Unicorn-38830.exe (PID: 9384)
- Unicorn-45868.exe (PID: 9492)
- Unicorn-21083.exe (PID: 14252)
- Unicorn-32018.exe (PID: 14260)
- Unicorn-2619.exe (PID: 14292)
- Unicorn-48148.exe (PID: 7936)
- Unicorn-20382.exe (PID: 12044)
- Unicorn-30876.exe (PID: 9536)
- Unicorn-24414.exe (PID: 9988)
- Unicorn-61930.exe (PID: 5968)
- Unicorn-35256.exe (PID: 10736)
- Unicorn-28053.exe (PID: 9772)
- Unicorn-48562.exe (PID: 7908)
- Unicorn-11327.exe (PID: 10848)
- Unicorn-45866.exe (PID: 8752)
- Unicorn-379.exe (PID: 11172)
- Unicorn-3086.exe (PID: 11840)
- Unicorn-27744.exe (PID: 9184)
- Unicorn-26631.exe (PID: 10784)
- Unicorn-19614.exe (PID: 11876)
- Unicorn-56253.exe (PID: 11240)
- Unicorn-7554.exe (PID: 11828)
- Unicorn-48911.exe (PID: 9224)
- Unicorn-41836.exe (PID: 11152)
- Unicorn-3138.exe (PID: 10744)
- Unicorn-36038.exe (PID: 9428)
- Unicorn-46252.exe (PID: 9412)
- Unicorn-23136.exe (PID: 7568)
- Unicorn-47020.exe (PID: 9584)
- Unicorn-65202.exe (PID: 9664)
- Unicorn-2266.exe (PID: 9624)
- Unicorn-49148.exe (PID: 12620)
- Unicorn-53771.exe (PID: 10632)
- Unicorn-45671.exe (PID: 4208)
- Unicorn-123.exe (PID: 10120)
- Unicorn-47591.exe (PID: 976)
- Unicorn-11407.exe (PID: 4180)
- Unicorn-60823.exe (PID: 12684)
- Unicorn-33097.exe (PID: 13008)
- Unicorn-8867.exe (PID: 10520)
- Unicorn-51052.exe (PID: 10584)
- Unicorn-46422.exe (PID: 10812)
- Unicorn-45868.exe (PID: 9484)
- Unicorn-40446.exe (PID: 9312)
- Unicorn-53724.exe (PID: 12188)
- Unicorn-28055.exe (PID: 7904)
- Unicorn-17400.exe (PID: 15432)
- Unicorn-23772.exe (PID: 10880)
- Unicorn-49215.exe (PID: 11076)
- Unicorn-18188.exe (PID: 10564)
- Unicorn-20928.exe (PID: 10540)
- Unicorn-2753.exe (PID: 12584)
- Unicorn-3896.exe (PID: 12876)
- Unicorn-54820.exe (PID: 15284)
- Unicorn-10087.exe (PID: 15260)
- Unicorn-15113.exe (PID: 8904)
- Unicorn-10678.exe (PID: 11736)
- Unicorn-19722.exe (PID: 13372)
- Unicorn-13122.exe (PID: 9404)
- Unicorn-13496.exe (PID: 13060)
- Unicorn-30907.exe (PID: 10724)
- Unicorn-21726.exe (PID: 9276)
- Unicorn-59435.exe (PID: 4336)
- Unicorn-15884.exe (PID: 9808)
- Unicorn-33772.exe (PID: 12556)
- Unicorn-7658.exe (PID: 12928)
- Unicorn-30557.exe (PID: 10480)
- Unicorn-21674.exe (PID: 10556)
- Unicorn-5390.exe (PID: 9468)
- Unicorn-55868.exe (PID: 10684)
- Unicorn-4067.exe (PID: 9344)
- Unicorn-13571.exe (PID: 9028)
- Unicorn-45287.exe (PID: 14072)
- Unicorn-57079.exe (PID: 9212)
- Unicorn-10063.exe (PID: 9152)
- Unicorn-17925.exe (PID: 14328)
- Unicorn-2471.exe (PID: 8232)
- Unicorn-49932.exe (PID: 6744)
- Unicorn-886.exe (PID: 12392)
- Unicorn-53771.exe (PID: 10596)
- Unicorn-2619.exe (PID: 13916)
- Unicorn-33097.exe (PID: 13016)
- Unicorn-16922.exe (PID: 13404)
- Unicorn-37886.exe (PID: 14404)
- Unicorn-20972.exe (PID: 8692)
- Unicorn-49354.exe (PID: 10768)
- Unicorn-10050.exe (PID: 9436)
Executes application which crashes
- Unicorn-48364.exe (PID: 9940)
- Unicorn-29524.exe (PID: 8624)
INFO
Reads the computer name
- Unicorn-9471.exe (PID: 7488)
- 1 (1307).exe (PID: 7272)
- Unicorn-46752.exe (PID: 8132)
- Unicorn-6466.exe (PID: 8148)
- Unicorn-61339.exe (PID: 8000)
- Unicorn-24220.exe (PID: 7992)
- Unicorn-30253.exe (PID: 1052)
- Unicorn-8682.exe (PID: 1812)
- Unicorn-56804.exe (PID: 1184)
- Unicorn-28216.exe (PID: 6192)
- Unicorn-39242.exe (PID: 2772)
- Unicorn-64899.exe (PID: 2320)
- Unicorn-23674.exe (PID: 7292)
- Unicorn-2106.exe (PID: 5360)
- Unicorn-8157.exe (PID: 7328)
- Unicorn-6695.exe (PID: 7628)
- Unicorn-26029.exe (PID: 6028)
- Unicorn-44007.exe (PID: 1072)
- Unicorn-15632.exe (PID: 7656)
- Unicorn-43836.exe (PID: 3900)
- Unicorn-39295.exe (PID: 7552)
- Unicorn-10068.exe (PID: 5984)
- Unicorn-63680.exe (PID: 7636)
- Unicorn-8733.exe (PID: 4040)
- Unicorn-255.exe (PID: 1272)
- Unicorn-64942.exe (PID: 8568)
- Unicorn-22752.exe (PID: 8264)
- Unicorn-31073.exe (PID: 5960)
- Unicorn-41480.exe (PID: 8112)
- Unicorn-51376.exe (PID: 8644)
- Unicorn-47130.exe (PID: 8532)
- Unicorn-3483.exe (PID: 8440)
- Unicorn-37116.exe (PID: 8712)
- Unicorn-36732.exe (PID: 8576)
- Unicorn-37124.exe (PID: 9324)
- Unicorn-25440.exe (PID: 8632)
- Unicorn-44088.exe (PID: 10044)
- Unicorn-45476.exe (PID: 8680)
- Unicorn-38830.exe (PID: 9384)
- Unicorn-48148.exe (PID: 7936)
- Unicorn-2619.exe (PID: 14292)
- Unicorn-30876.exe (PID: 9536)
- Unicorn-21726.exe (PID: 9276)
- Unicorn-35256.exe (PID: 10736)
- Unicorn-45287.exe (PID: 14072)
- Unicorn-2266.exe (PID: 9624)
- Unicorn-123.exe (PID: 10120)
Checks supported languages
- Unicorn-24220.exe (PID: 7992)
- 1 (1307).exe (PID: 7272)
- Unicorn-9471.exe (PID: 7488)
- Unicorn-61339.exe (PID: 8000)
- Unicorn-6466.exe (PID: 8148)
- Unicorn-15733.exe (PID: 8172)
- Unicorn-48828.exe (PID: 1244)
- Unicorn-24878.exe (PID: 2568)
- Unicorn-21864.exe (PID: 8164)
- Unicorn-56804.exe (PID: 1184)
- Unicorn-61635.exe (PID: 920)
- Unicorn-8682.exe (PID: 1812)
- Unicorn-27780.exe (PID: 1568)
- Unicorn-40394.exe (PID: 856)
- Unicorn-27809.exe (PID: 6272)
- Unicorn-64899.exe (PID: 2320)
- Unicorn-45578.exe (PID: 7304)
- Unicorn-51215.exe (PID: 7456)
- Unicorn-18372.exe (PID: 1532)
- Unicorn-47920.exe (PID: 6988)
- Unicorn-52367.exe (PID: 7632)
- Unicorn-6695.exe (PID: 7628)
- Unicorn-43452.exe (PID: 2392)
- Unicorn-54935.exe (PID: 7544)
- Unicorn-23394.exe (PID: 6404)
- Unicorn-35595.exe (PID: 6584)
- Unicorn-64951.exe (PID: 8124)
- Unicorn-32928.exe (PID: 8116)
- Unicorn-16400.exe (PID: 8120)
- Unicorn-28849.exe (PID: 2240)
- Unicorn-60046.exe (PID: 4188)
- Unicorn-5491.exe (PID: 7780)
- Unicorn-59435.exe (PID: 4336)
- Unicorn-39088.exe (PID: 8248)
- Unicorn-40218.exe (PID: 8496)
- Unicorn-54531.exe (PID: 8768)
- Unicorn-51376.exe (PID: 8644)
- Unicorn-20972.exe (PID: 8692)
- Unicorn-64942.exe (PID: 8568)
- Unicorn-59382.exe (PID: 8516)
- Unicorn-7878.exe (PID: 9192)
- Unicorn-15113.exe (PID: 8904)
- Unicorn-33978.exe (PID: 9268)
- Unicorn-37124.exe (PID: 9324)
- Unicorn-38830.exe (PID: 9384)
- Unicorn-10071.exe (PID: 9564)
- Unicorn-2266.exe (PID: 9624)
- Unicorn-58888.exe (PID: 9708)
- Unicorn-28053.exe (PID: 9772)
- Unicorn-64892.exe (PID: 9872)
- Unicorn-28498.exe (PID: 9976)
- Unicorn-15845.exe (PID: 3896)
- Unicorn-32721.exe (PID: 9596)
- Unicorn-123.exe (PID: 10120)
- Unicorn-44768.exe (PID: 11036)
- Unicorn-33756.exe (PID: 10496)
- Unicorn-16822.exe (PID: 10508)
- Unicorn-58068.exe (PID: 10528)
- Unicorn-37011.exe (PID: 1132)
- Unicorn-42692.exe (PID: 10604)
- Unicorn-3138.exe (PID: 10744)
- Unicorn-56790.exe (PID: 10624)
- Unicorn-55868.exe (PID: 10684)
- Unicorn-30907.exe (PID: 10724)
- Unicorn-11327.exe (PID: 10848)
- Unicorn-32686.exe (PID: 10828)
- Unicorn-20928.exe (PID: 10540)
- Unicorn-46947.exe (PID: 10656)
- Unicorn-2256.exe (PID: 11364)
- Unicorn-15770.exe (PID: 11292)
- Unicorn-41836.exe (PID: 11152)
- Unicorn-43739.exe (PID: 10456)
- Unicorn-54088.exe (PID: 11460)
- Unicorn-10678.exe (PID: 11712)
- Unicorn-34117.exe (PID: 12036)
- Unicorn-40418.exe (PID: 11784)
- Unicorn-36526.exe (PID: 11752)
- Unicorn-41836.exe (PID: 11928)
- Unicorn-20382.exe (PID: 12044)
- Unicorn-61031.exe (PID: 11724)
- Unicorn-16860.exe (PID: 12264)
- Unicorn-16822.exe (PID: 11108)
- Unicorn-49148.exe (PID: 12620)
- Unicorn-21520.exe (PID: 12564)
- Unicorn-886.exe (PID: 12392)
- Unicorn-60823.exe (PID: 12684)
- Unicorn-33772.exe (PID: 12556)
- Unicorn-18394.exe (PID: 12912)
- Unicorn-3896.exe (PID: 12876)
- Unicorn-27231.exe (PID: 12996)
- Unicorn-10891.exe (PID: 12628)
- Unicorn-13496.exe (PID: 13032)
- Unicorn-63211.exe (PID: 12860)
- Unicorn-12064.exe (PID: 12868)
- Unicorn-13496.exe (PID: 13040)
- Unicorn-6917.exe (PID: 6248)
- Unicorn-28985.exe (PID: 13300)
- Unicorn-9718.exe (PID: 13848)
- Unicorn-48556.exe (PID: 13868)
- Unicorn-62291.exe (PID: 13928)
- Unicorn-19722.exe (PID: 13364)
- Unicorn-22198.exe (PID: 14044)
- Unicorn-43891.exe (PID: 14200)
- Unicorn-27990.exe (PID: 13484)
- Unicorn-17694.exe (PID: 13908)
- Unicorn-27877.exe (PID: 14644)
- Unicorn-4969.exe (PID: 14896)
- Unicorn-4991.exe (PID: 15220)
- Unicorn-29740.exe (PID: 14628)
- Unicorn-56075.exe (PID: 15880)
- Unicorn-20973.exe (PID: 15752)
- Unicorn-30506.exe (PID: 14984)
- Unicorn-3860.exe (PID: 15644)
- Unicorn-37789.exe (PID: 17076)
- Unicorn-29024.exe (PID: 16060)
- Unicorn-38706.exe (PID: 15604)
- Unicorn-23678.exe (PID: 15528)
- Unicorn-26785.exe (PID: 16104)
- Unicorn-56651.exe (PID: 16176)
- Unicorn-10834.exe (PID: 15864)
- Unicorn-40913.exe (PID: 16676)
Create files in a temporary directory
- 1 (1307).exe (PID: 7272)
- Unicorn-9471.exe (PID: 7488)
- Unicorn-61339.exe (PID: 8000)
- Unicorn-21864.exe (PID: 8164)
- Unicorn-6466.exe (PID: 8148)
- Unicorn-61635.exe (PID: 920)
- Unicorn-2106.exe (PID: 5360)
- Unicorn-24878.exe (PID: 2568)
- Unicorn-40394.exe (PID: 856)
- Unicorn-28216.exe (PID: 6192)
- Unicorn-39648.exe (PID: 6620)
- Unicorn-23674.exe (PID: 7292)
- Unicorn-6591.exe (PID: 7256)
- Unicorn-60260.exe (PID: 6964)
- Unicorn-48828.exe (PID: 1244)
- Unicorn-26436.exe (PID: 1096)
- Unicorn-46752.exe (PID: 8132)
- Unicorn-38984.exe (PID: 4892)
- Unicorn-15733.exe (PID: 8172)
- Unicorn-6887.exe (PID: 7556)
- Unicorn-6783.exe (PID: 4008)
- Unicorn-43836.exe (PID: 3900)
- Unicorn-44007.exe (PID: 1072)
- Unicorn-8682.exe (PID: 1812)
- Unicorn-35860.exe (PID: 7812)
- Unicorn-10068.exe (PID: 5984)
- Unicorn-43452.exe (PID: 2392)
- Unicorn-59876.exe (PID: 7312)
- Unicorn-64951.exe (PID: 8124)
- Unicorn-23673.exe (PID: 5384)
- Unicorn-36384.exe (PID: 1164)
- Unicorn-51215.exe (PID: 7456)
- Unicorn-255.exe (PID: 1272)
- Unicorn-58179.exe (PID: 8096)
- Unicorn-27780.exe (PID: 1568)
- Unicorn-63348.exe (PID: 9044)
- Unicorn-21688.exe (PID: 680)
- Unicorn-42470.exe (PID: 5720)
- Unicorn-42160.exe (PID: 8868)
- Unicorn-26029.exe (PID: 6028)
- Unicorn-47130.exe (PID: 8532)
- Unicorn-25618.exe (PID: 9296)
- Unicorn-36732.exe (PID: 8576)
- Unicorn-27809.exe (PID: 6272)
- Unicorn-34905.exe (PID: 7620)
- Unicorn-2803.exe (PID: 664)
- Unicorn-22898.exe (PID: 9948)
- Unicorn-63400.exe (PID: 8308)
- Unicorn-57419.exe (PID: 10080)
- Unicorn-24220.exe (PID: 7992)
- Unicorn-64892.exe (PID: 9872)
- Unicorn-65003.exe (PID: 8408)
- Unicorn-60046.exe (PID: 4188)
- Unicorn-56804.exe (PID: 1184)
- Unicorn-6326.exe (PID: 4880)
- Unicorn-44088.exe (PID: 10044)
- Unicorn-39088.exe (PID: 8248)
- Unicorn-28268.exe (PID: 7580)
- Unicorn-6778.exe (PID: 8352)
- Unicorn-47054.exe (PID: 5508)
- Unicorn-51376.exe (PID: 8644)
- Unicorn-48556.exe (PID: 9888)
- Unicorn-38143.exe (PID: 7340)
- Unicorn-60823.exe (PID: 12684)
The sample compiled with chinese language support
- 1 (1307).exe (PID: 7272)
- Unicorn-10971.exe (PID: 4120)
- Unicorn-25440.exe (PID: 8632)
- Unicorn-32721.exe (PID: 9596)
- Unicorn-34930.exe (PID: 8776)
- Unicorn-46799.exe (PID: 8832)
- Unicorn-34905.exe (PID: 7620)
- Unicorn-38830.exe (PID: 9384)
- Unicorn-35860.exe (PID: 7812)
- Unicorn-43836.exe (PID: 3900)
- Unicorn-64899.exe (PID: 2320)
- Unicorn-2803.exe (PID: 664)
- Unicorn-7878.exe (PID: 9192)
- Unicorn-47344.exe (PID: 5156)
- Unicorn-60260.exe (PID: 6964)
- Unicorn-21083.exe (PID: 14252)
- Unicorn-32018.exe (PID: 14260)
- Unicorn-45868.exe (PID: 9492)
- Unicorn-31989.exe (PID: 8272)
- Unicorn-48148.exe (PID: 7936)
- Unicorn-63348.exe (PID: 9044)
- Unicorn-51376.exe (PID: 8644)
- Unicorn-64892.exe (PID: 9872)
- Unicorn-255.exe (PID: 1272)
- Unicorn-30253.exe (PID: 1052)
- Unicorn-20382.exe (PID: 12044)
- Unicorn-9471.exe (PID: 7488)
- Unicorn-30876.exe (PID: 9536)
- Unicorn-2619.exe (PID: 14292)
- Unicorn-24414.exe (PID: 9988)
- Unicorn-35256.exe (PID: 10736)
- Unicorn-37020.exe (PID: 11044)
- Unicorn-48496.exe (PID: 7712)
- Unicorn-31154.exe (PID: 11052)
- Unicorn-44768.exe (PID: 11036)
- Unicorn-28053.exe (PID: 9772)
- Unicorn-48562.exe (PID: 7908)
- Unicorn-61930.exe (PID: 5968)
- Unicorn-11327.exe (PID: 10848)
- Unicorn-45866.exe (PID: 8752)
- Unicorn-3086.exe (PID: 11840)
- Unicorn-7554.exe (PID: 11828)
- Unicorn-6778.exe (PID: 8352)
- Unicorn-19614.exe (PID: 11876)
- Unicorn-56253.exe (PID: 11240)
- Unicorn-38143.exe (PID: 7340)
- Unicorn-27809.exe (PID: 6272)
- Unicorn-41836.exe (PID: 11152)
- Unicorn-8733.exe (PID: 4040)
- Unicorn-55188.exe (PID: 9576)
- Unicorn-24220.exe (PID: 7992)
- Unicorn-23994.exe (PID: 12960)
- Unicorn-18593.exe (PID: 12936)
- Unicorn-60046.exe (PID: 4188)
- Unicorn-22898.exe (PID: 9948)
- Unicorn-64951.exe (PID: 8124)
- Unicorn-47020.exe (PID: 9584)
- Unicorn-3138.exe (PID: 10744)
- Unicorn-36038.exe (PID: 9428)
- Unicorn-46252.exe (PID: 9412)
- Unicorn-23136.exe (PID: 7568)
- Unicorn-48911.exe (PID: 9224)
- Unicorn-49148.exe (PID: 12620)
- Unicorn-65202.exe (PID: 9664)
- Unicorn-53771.exe (PID: 10632)
- Unicorn-45671.exe (PID: 4208)
- Unicorn-123.exe (PID: 10120)
- Unicorn-2266.exe (PID: 9624)
- Unicorn-11407.exe (PID: 4180)
- Unicorn-33097.exe (PID: 13008)
- Unicorn-47591.exe (PID: 976)
- Unicorn-57603.exe (PID: 7616)
- Unicorn-60823.exe (PID: 12684)
- Unicorn-6783.exe (PID: 4008)
- Unicorn-39295.exe (PID: 7552)
- Unicorn-8867.exe (PID: 10520)
- Unicorn-46422.exe (PID: 10812)
- Unicorn-51052.exe (PID: 10584)
- Unicorn-45868.exe (PID: 9484)
- Unicorn-51215.exe (PID: 7456)
- Unicorn-40446.exe (PID: 9312)
- Unicorn-3483.exe (PID: 8440)
- Unicorn-43452.exe (PID: 2392)
- Unicorn-53724.exe (PID: 12188)
- Unicorn-42160.exe (PID: 8868)
- Unicorn-6466.exe (PID: 8148)
- Unicorn-54935.exe (PID: 7544)
- Unicorn-10068.exe (PID: 5984)
- Unicorn-28055.exe (PID: 7904)
- Unicorn-45476.exe (PID: 8680)
- Unicorn-65003.exe (PID: 8408)
- Unicorn-21688.exe (PID: 680)
- Unicorn-54531.exe (PID: 8768)
- Unicorn-42470.exe (PID: 5720)
- Unicorn-32928.exe (PID: 8116)
- Unicorn-58179.exe (PID: 8096)
- Unicorn-17400.exe (PID: 15432)
- Unicorn-24878.exe (PID: 2568)
- Unicorn-26436.exe (PID: 1096)
- Unicorn-52367.exe (PID: 7632)
- Unicorn-48556.exe (PID: 9888)
- Unicorn-51467.exe (PID: 9648)
- Unicorn-45578.exe (PID: 7304)
- Unicorn-27780.exe (PID: 1568)
- Unicorn-37124.exe (PID: 9324)
- Unicorn-46752.exe (PID: 8132)
- Unicorn-55371.exe (PID: 6712)
- Unicorn-35595.exe (PID: 6584)
- Unicorn-15439.exe (PID: 7664)
- Unicorn-25618.exe (PID: 9296)
- Unicorn-6695.exe (PID: 7628)
- Unicorn-64942.exe (PID: 8568)
- Unicorn-49215.exe (PID: 11076)
- Unicorn-41008.exe (PID: 8548)
- Unicorn-61635.exe (PID: 920)
- Unicorn-28849.exe (PID: 2240)
- Unicorn-23772.exe (PID: 10880)
- Unicorn-15733.exe (PID: 8172)
- Unicorn-18188.exe (PID: 10564)
- Unicorn-47054.exe (PID: 5508)
- Unicorn-41672.exe (PID: 8036)
- Unicorn-23673.exe (PID: 5384)
- Unicorn-62196.exe (PID: 8612)
- Unicorn-2753.exe (PID: 12584)
- Unicorn-10087.exe (PID: 15260)
- Unicorn-15113.exe (PID: 8904)
- Unicorn-26029.exe (PID: 6028)
- Unicorn-54820.exe (PID: 15284)
- Unicorn-10678.exe (PID: 11736)
- Unicorn-19722.exe (PID: 13372)
- Unicorn-39809.exe (PID: 7748)
- Unicorn-9051.exe (PID: 5404)
- Unicorn-28498.exe (PID: 9976)
- Unicorn-20928.exe (PID: 10540)
- Unicorn-21864.exe (PID: 8164)
- Unicorn-13122.exe (PID: 9404)
- Unicorn-44088.exe (PID: 10044)
- Unicorn-21726.exe (PID: 9276)
- Unicorn-30907.exe (PID: 10724)
- Unicorn-13496.exe (PID: 13060)
- Unicorn-8682.exe (PID: 1812)
- Unicorn-59435.exe (PID: 4336)
- Unicorn-47780.exe (PID: 7084)
- Unicorn-39088.exe (PID: 8248)
- Unicorn-2106.exe (PID: 5360)
- Unicorn-22752.exe (PID: 8264)
- Unicorn-13991.exe (PID: 632)
- Unicorn-19310.exe (PID: 7652)
- Unicorn-62528.exe (PID: 2692)
- Unicorn-7658.exe (PID: 12928)
- Unicorn-8157.exe (PID: 7328)
- Unicorn-6171.exe (PID: 9092)
- Unicorn-39648.exe (PID: 6620)
- Unicorn-51205.exe (PID: 8908)
- Unicorn-47130.exe (PID: 8532)
- Unicorn-38984.exe (PID: 4892)
- Unicorn-15884.exe (PID: 9808)
- Unicorn-6887.exe (PID: 7556)
- Unicorn-59382.exe (PID: 8516)
- Unicorn-23674.exe (PID: 7292)
- Unicorn-10675.exe (PID: 2140)
- Unicorn-6326.exe (PID: 4880)
- Unicorn-8038.exe (PID: 6132)
- Unicorn-2279.exe (PID: 8944)
- Unicorn-26631.exe (PID: 10784)
- Unicorn-59876.exe (PID: 7312)
- Unicorn-21674.exe (PID: 10556)
- Unicorn-23394.exe (PID: 6404)
- Unicorn-47920.exe (PID: 6988)
- Unicorn-29153.exe (PID: 1056)
- Unicorn-40218.exe (PID: 8496)
- Unicorn-39242.exe (PID: 2772)
- Unicorn-15233.exe (PID: 9444)
- Unicorn-51515.exe (PID: 8432)
- Unicorn-36384.exe (PID: 1164)
- Unicorn-33772.exe (PID: 12556)
- Unicorn-48828.exe (PID: 1244)
- Unicorn-12367.exe (PID: 4428)
- Unicorn-30557.exe (PID: 10480)
- Unicorn-31073.exe (PID: 5960)
- Unicorn-5390.exe (PID: 9468)
- Unicorn-49264.exe (PID: 8056)
- Unicorn-55868.exe (PID: 10684)
- Unicorn-37500.exe (PID: 8652)
- Unicorn-54095.exe (PID: 7660)
- Unicorn-20950.exe (PID: 8584)
- Unicorn-57986.exe (PID: 2564)
- Unicorn-28268.exe (PID: 7580)
- Unicorn-37182.exe (PID: 8072)
- Unicorn-53954.exe (PID: 8488)
- Unicorn-4067.exe (PID: 9344)
- Unicorn-2450.exe (PID: 9144)
- Unicorn-56804.exe (PID: 1184)
- Unicorn-61339.exe (PID: 8000)
- Unicorn-45647.exe (PID: 8524)
- Unicorn-40394.exe (PID: 856)
- Unicorn-57419.exe (PID: 10080)
- Unicorn-13571.exe (PID: 9028)
- Unicorn-37758.exe (PID: 6668)
- Unicorn-12315.exe (PID: 8068)
- Unicorn-15632.exe (PID: 7656)
- Unicorn-12123.exe (PID: 8032)
- Unicorn-45287.exe (PID: 14072)
- Unicorn-10063.exe (PID: 9152)
- Unicorn-17925.exe (PID: 14328)
- Unicorn-57079.exe (PID: 9212)
- Unicorn-2471.exe (PID: 8232)
- Unicorn-20972.exe (PID: 8692)
- Unicorn-49354.exe (PID: 10768)
- Unicorn-10050.exe (PID: 9436)
- Unicorn-49932.exe (PID: 6744)
- Unicorn-886.exe (PID: 12392)
- Unicorn-53771.exe (PID: 10596)
- Unicorn-33097.exe (PID: 13016)
- Unicorn-2619.exe (PID: 13916)
- Unicorn-16922.exe (PID: 13404)
- Unicorn-37886.exe (PID: 14404)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 6404)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 6404)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 6404)
- WerFault.exe (PID: 13956)
- WerFault.exe (PID: 14096)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 6404)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
695
Monitored processes
557
Malicious processes
81
Suspicious processes
66
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 632 | C:\Users\admin\AppData\Local\Temp\Unicorn-13991.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13991.exe | Unicorn-48828.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 664 | C:\Users\admin\AppData\Local\Temp\Unicorn-2803.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-2803.exe | Unicorn-6326.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 680 | C:\Users\admin\AppData\Local\Temp\Unicorn-21688.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-21688.exe | Unicorn-26436.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 744 | C:\Users\admin\AppData\Local\Temp\Unicorn-54592.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-54592.exe | — | Unicorn-40446.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 | |||||||||||||||
| 856 | C:\Users\admin\AppData\Local\Temp\Unicorn-40394.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-40394.exe | Unicorn-6466.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 920 | C:\Users\admin\AppData\Local\Temp\Unicorn-61635.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-61635.exe | Unicorn-61339.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 976 | C:\Users\admin\AppData\Local\Temp\Unicorn-47591.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-47591.exe | Unicorn-6783.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1052 | C:\Users\admin\AppData\Local\Temp\Unicorn-30253.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-30253.exe | Unicorn-9471.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1056 | C:\Users\admin\AppData\Local\Temp\Unicorn-29153.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-29153.exe | Unicorn-6466.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1072 | C:\Users\admin\AppData\Local\Temp\Unicorn-44007.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-44007.exe | Unicorn-8682.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
18 479
Read events
18 467
Write events
12
Delete events
0
Modification events
| (PID) Process: | (4428) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4428) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4428) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6404) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6404) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6404) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7688) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7688) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7688) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2096) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
790
Suspicious files
6
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6404 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\d11a6820-e2e7-4059-b3b7-81c488aff6dc.down_data | — | |
MD5:— | SHA256:— | |||
| 7992 | Unicorn-24220.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46752.exe | executable | |
MD5:7C0415068F3736C140AB2550FDF45F88 | SHA256:9B726C089BF1DC426911A838D54CD1B54558B32BDACB5AAF093A9FBB40417E07 | |||
| 7272 | 1 (1307).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9471.exe | executable | |
MD5:8B10CA541E3CC7E55D7EA765E755697E | SHA256:A6A3461D6F8C47A0258B94E766F526E3058E048DF6AB0967846B1D811E5314B3 | |||
| 7272 | 1 (1307).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-61339.exe | executable | |
MD5:7BB3C3358ECBF89865998223A247A3A3 | SHA256:8C16DEA78ECA3C352F97C7E22F3BF29BABD2A3ED26FAD9623CCDF200493FB7F4 | |||
| 7488 | Unicorn-9471.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24220.exe | executable | |
MD5:95B5FE6B1EC578CC1DD2F4DEC7296799 | SHA256:F5440383C232401F93BC6F2D179C09C51538900673FCB90F420391441EDCCA66 | |||
| 7488 | Unicorn-9471.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-6466.exe | executable | |
MD5:8E535A318A1736C521B3AC673A0BBA64 | SHA256:D283F8CD482FA4C13B6857585F7DA6206F73C3EAF570A2E1C8E8175959E20D0C | |||
| 6404 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\3d6f80a4-033f-4c3c-88d8-b00151199688.a0dd1f3b-956f-490d-8480-95a7259c3263.down_meta | binary | |
MD5:CAD3D1D51D733D9ACEC8BCFEE19806D8 | SHA256:7F740ECB15DB194CA963D3BD672AA3271BDC5DAAC991E6FD67C276B0281F7ACE | |||
| 6404 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\3d6f80a4-033f-4c3c-88d8-b00151199688.up_meta_secure | binary | |
MD5:63517C93C9A53BF4DC6B8FF418456C04 | SHA256:F0A564A2002B68FBDC79327487B85DDCB966D132B93537B64CFB6624D3C2B286 | |||
| 7272 | 1 (1307).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8682.exe | executable | |
MD5:0BE0C52A685731432ADD46AB99DFE980 | SHA256:34B421946770CF333001752DC318CADF19B88755B5EECF9FAC1AB78132F85ED3 | |||
| 6404 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:3703D556C9511EB645CB7C706DD359D1 | SHA256:51C779459A2F9FA9BDDB2533A4C92B7CC1888F09D2216437FACDFFBC445BFA85 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
26
DNS requests
16
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.16.164.34:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.16.164.34:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
8208 | SIHClient.exe | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7736 | backgroundTaskHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
8208 | SIHClient.exe | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
6404 | BackgroundTransferHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 2.16.164.34:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.16.164.34:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
2104 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5496 | MoUsoCoreWorker.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2112 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
3216 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.159.73:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |