| File name: | 1 (1478) |
| Full analysis: | https://app.any.run/tasks/cdd378b0-147d-40c3-aa53-0049f332c85a |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 17:20:29 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | FCEEEEFEAAD8595FC8CBD52403E592F0 |
| SHA1: | 189F48C998225A9FA56F73A3EF698C0C39A1855A |
| SHA256: | 2F4DE2CC0F2057678DC93D860F13CB069A41B968A216FC52B7F2876D3EF023EF |
| SSDEEP: | 6144:KU78CEMDLDhxA5G96o7vQ1fxdtBqpKJGBt/8yeL0Zk/8SwEwpyAvEhNgWvm0Hmsa:KK/f9xA5I6e6BICatkyeL0Yx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- 1 (1478).exe (PID: 976)
- Unicorn-43051.exe (PID: 4120)
- Unicorn-53715.exe (PID: 5116)
- Unicorn-17513.exe (PID: 2600)
- Unicorn-11094.exe (PID: 5416)
- Unicorn-37061.exe (PID: 1912)
- Unicorn-36345.exe (PID: 5960)
- Unicorn-12786.exe (PID: 4220)
- Unicorn-43191.exe (PID: 5740)
- Unicorn-33134.exe (PID: 5728)
- Unicorn-38037.exe (PID: 1188)
- Unicorn-53819.exe (PID: 5988)
- Unicorn-41759.exe (PID: 5864)
- Unicorn-43797.exe (PID: 6712)
- Unicorn-30061.exe (PID: 5384)
- Unicorn-15282.exe (PID: 2240)
- Unicorn-7312.exe (PID: 6752)
- Unicorn-28281.exe (PID: 1568)
- Unicorn-4182.exe (PID: 208)
- Unicorn-10112.exe (PID: 4188)
- Unicorn-11509.exe (PID: 1628)
- Unicorn-36279.exe (PID: 5720)
- Unicorn-37601.exe (PID: 6388)
- Unicorn-57467.exe (PID: 736)
- Unicorn-45215.exe (PID: 1240)
- Unicorn-16413.exe (PID: 4724)
- Unicorn-10342.exe (PID: 6724)
- Unicorn-31509.exe (PID: 3268)
- Unicorn-57689.exe (PID: 6344)
- Unicorn-26487.exe (PID: 2800)
- Unicorn-6450.exe (PID: 6964)
- Unicorn-48702.exe (PID: 5360)
- Unicorn-16243.exe (PID: 6592)
- Unicorn-24440.exe (PID: 7036)
- Unicorn-11110.exe (PID: 7172)
- Unicorn-47483.exe (PID: 4200)
- Unicorn-39891.exe (PID: 7192)
- Unicorn-32085.exe (PID: 7332)
- Unicorn-3689.exe (PID: 7212)
- Unicorn-7218.exe (PID: 7224)
- Unicorn-35158.exe (PID: 7284)
- Unicorn-40253.exe (PID: 7348)
- Unicorn-51759.exe (PID: 7256)
- Unicorn-6642.exe (PID: 7248)
- Unicorn-5644.exe (PID: 2244)
- Unicorn-53045.exe (PID: 3896)
- Unicorn-30576.exe (PID: 7276)
- Unicorn-44722.exe (PID: 7236)
- Unicorn-47867.exe (PID: 7364)
- Unicorn-39507.exe (PID: 7292)
- Unicorn-48147.exe (PID: 5400)
- Unicorn-10918.exe (PID: 7324)
- Unicorn-22084.exe (PID: 7388)
- Unicorn-27255.exe (PID: 7308)
- Unicorn-9330.exe (PID: 7580)
- Unicorn-38111.exe (PID: 7624)
- Unicorn-15557.exe (PID: 7268)
- Unicorn-26413.exe (PID: 7644)
- Unicorn-34581.exe (PID: 7608)
- Unicorn-50555.exe (PID: 7676)
- Unicorn-62575.exe (PID: 7656)
- Unicorn-62039.exe (PID: 7512)
- Unicorn-41235.exe (PID: 7556)
- Unicorn-34197.exe (PID: 7696)
- Unicorn-49138.exe (PID: 7568)
- Unicorn-2048.exe (PID: 7528)
- Unicorn-46450.exe (PID: 7716)
- Unicorn-25837.exe (PID: 7520)
- Unicorn-43783.exe (PID: 7356)
- Unicorn-37025.exe (PID: 7876)
- Unicorn-2122.exe (PID: 7868)
- Unicorn-62231.exe (PID: 7708)
- Unicorn-42557.exe (PID: 7760)
- Unicorn-29294.exe (PID: 7740)
- Unicorn-25366.exe (PID: 7916)
- Unicorn-49979.exe (PID: 7732)
- Unicorn-53871.exe (PID: 7504)
- Unicorn-50939.exe (PID: 7952)
- Unicorn-26627.exe (PID: 7860)
- Unicorn-31073.exe (PID: 7928)
- Unicorn-36858.exe (PID: 8628)
- Unicorn-19567.exe (PID: 8596)
- Unicorn-62237.exe (PID: 7892)
- Unicorn-26962.exe (PID: 8144)
- Unicorn-51658.exe (PID: 8184)
- Unicorn-56318.exe (PID: 8572)
- Unicorn-12908.exe (PID: 8648)
- Unicorn-5630.exe (PID: 7900)
- Unicorn-50188.exe (PID: 8580)
- Unicorn-36156.exe (PID: 8944)
- Unicorn-17899.exe (PID: 8720)
- Unicorn-23673.exe (PID: 8088)
- Unicorn-39790.exe (PID: 8556)
- Unicorn-58430.exe (PID: 9164)
- Unicorn-23240.exe (PID: 8312)
- Unicorn-24200.exe (PID: 8396)
- Unicorn-18602.exe (PID: 8320)
- Unicorn-17014.exe (PID: 8824)
- Unicorn-39626.exe (PID: 7200)
- Unicorn-11009.exe (PID: 8512)
- Unicorn-59634.exe (PID: 8372)
- Unicorn-38008.exe (PID: 5048)
- Unicorn-30254.exe (PID: 7788)
- Unicorn-19924.exe (PID: 8540)
- Unicorn-52091.exe (PID: 8008)
- Unicorn-28476.exe (PID: 8416)
- Unicorn-11009.exe (PID: 8840)
- Unicorn-1821.exe (PID: 8000)
- Unicorn-10625.exe (PID: 8176)
- Unicorn-56297.exe (PID: 8168)
- Unicorn-65254.exe (PID: 8768)
- Unicorn-58914.exe (PID: 8080)
- Unicorn-55602.exe (PID: 9968)
- Unicorn-14496.exe (PID: 9992)
- Unicorn-52265.exe (PID: 10028)
- Unicorn-9487.exe (PID: 9448)
- Unicorn-16172.exe (PID: 9416)
- Unicorn-14517.exe (PID: 8332)
- Unicorn-9613.exe (PID: 8996)
- Unicorn-16002.exe (PID: 9364)
- Unicorn-50753.exe (PID: 8048)
- Unicorn-677.exe (PID: 8852)
- Unicorn-6398.exe (PID: 8036)
- Unicorn-15313.exe (PID: 8064)
- Unicorn-52070.exe (PID: 8028)
- Unicorn-50891.exe (PID: 8548)
- Unicorn-61917.exe (PID: 8588)
- Unicorn-10433.exe (PID: 8340)
- Unicorn-4185.exe (PID: 8676)
- Unicorn-11829.exe (PID: 10108)
- Unicorn-34288.exe (PID: 8884)
- Unicorn-59967.exe (PID: 7936)
- Unicorn-30802.exe (PID: 6476)
- Unicorn-19126.exe (PID: 9320)
- Unicorn-26526.exe (PID: 7832)
- Unicorn-25107.exe (PID: 2644)
- Unicorn-61289.exe (PID: 9436)
- Unicorn-11037.exe (PID: 8016)
- Unicorn-13609.exe (PID: 9624)
- Unicorn-9976.exe (PID: 9192)
- Unicorn-41792.exe (PID: 10632)
- Unicorn-31479.exe (PID: 7992)
- Unicorn-59472.exe (PID: 924)
- Unicorn-33484.exe (PID: 5244)
- Unicorn-11512.exe (PID: 8728)
- Unicorn-7916.exe (PID: 10180)
- Unicorn-9089.exe (PID: 10648)
- Unicorn-57221.exe (PID: 11196)
- Unicorn-27922.exe (PID: 8440)
- Unicorn-57637.exe (PID: 8056)
- Unicorn-22214.exe (PID: 11776)
- Unicorn-10743.exe (PID: 10708)
- Unicorn-55668.exe (PID: 10548)
- Unicorn-6441.exe (PID: 8364)
- Unicorn-18144.exe (PID: 8272)
- Unicorn-50344.exe (PID: 11112)
- Unicorn-64812.exe (PID: 12532)
- Unicorn-50330.exe (PID: 12488)
- Unicorn-3267.exe (PID: 12508)
- Unicorn-60067.exe (PID: 7968)
- Unicorn-65306.exe (PID: 10376)
- Unicorn-42613.exe (PID: 14112)
- Unicorn-42613.exe (PID: 14120)
- Unicorn-7389.exe (PID: 7316)
- Unicorn-30034.exe (PID: 8988)
- Unicorn-23012.exe (PID: 14132)
- Unicorn-4372.exe (PID: 13648)
- Unicorn-53106.exe (PID: 12324)
- Unicorn-6877.exe (PID: 13516)
- Unicorn-55056.exe (PID: 13668)
- Unicorn-33947.exe (PID: 14088)
- Unicorn-9399.exe (PID: 10220)
- Unicorn-23838.exe (PID: 8448)
- Unicorn-57482.exe (PID: 10268)
- Unicorn-22244.exe (PID: 14660)
- Unicorn-6588.exe (PID: 14520)
- Unicorn-43994.exe (PID: 14588)
- Unicorn-55773.exe (PID: 9740)
- Unicorn-50920.exe (PID: 11292)
- Unicorn-52006.exe (PID: 11260)
- Unicorn-37538.exe (PID: 9648)
- Unicorn-52116.exe (PID: 15564)
- Unicorn-60781.exe (PID: 15572)
- Unicorn-54916.exe (PID: 15584)
Executable content was dropped or overwritten
- 1 (1478).exe (PID: 976)
- Unicorn-43051.exe (PID: 4120)
- Unicorn-53715.exe (PID: 5116)
- Unicorn-17513.exe (PID: 2600)
- Unicorn-11094.exe (PID: 5416)
- Unicorn-37061.exe (PID: 1912)
- Unicorn-43191.exe (PID: 5740)
- Unicorn-38037.exe (PID: 1188)
- Unicorn-33134.exe (PID: 5728)
- Unicorn-12786.exe (PID: 4220)
- Unicorn-53819.exe (PID: 5988)
- Unicorn-41759.exe (PID: 5864)
- Unicorn-36345.exe (PID: 5960)
- Unicorn-43797.exe (PID: 6712)
- Unicorn-30061.exe (PID: 5384)
- Unicorn-7312.exe (PID: 6752)
- Unicorn-15282.exe (PID: 2240)
- Unicorn-48702.exe (PID: 5360)
- Unicorn-28281.exe (PID: 1568)
- Unicorn-4182.exe (PID: 208)
- Unicorn-10112.exe (PID: 4188)
- Unicorn-48147.exe (PID: 5400)
- Unicorn-5644.exe (PID: 2244)
- Unicorn-16243.exe (PID: 6592)
- Unicorn-36279.exe (PID: 5720)
- Unicorn-57467.exe (PID: 736)
- Unicorn-45215.exe (PID: 1240)
- Unicorn-37601.exe (PID: 6388)
- Unicorn-16413.exe (PID: 4724)
- Unicorn-31509.exe (PID: 3268)
- Unicorn-10342.exe (PID: 6724)
- Unicorn-53045.exe (PID: 3896)
- Unicorn-26487.exe (PID: 2800)
- Unicorn-6450.exe (PID: 6964)
- Unicorn-24440.exe (PID: 7036)
- Unicorn-11110.exe (PID: 7172)
- Unicorn-47483.exe (PID: 4200)
- Unicorn-39891.exe (PID: 7192)
- Unicorn-3689.exe (PID: 7212)
- Unicorn-32085.exe (PID: 7332)
- Unicorn-39626.exe (PID: 7200)
- Unicorn-7218.exe (PID: 7224)
- Unicorn-35158.exe (PID: 7284)
- Unicorn-40253.exe (PID: 7348)
- Unicorn-51759.exe (PID: 7256)
- Unicorn-6642.exe (PID: 7248)
- Unicorn-47867.exe (PID: 7364)
- Unicorn-7389.exe (PID: 7316)
- Unicorn-11509.exe (PID: 1628)
- Unicorn-30576.exe (PID: 7276)
- Unicorn-44722.exe (PID: 7236)
- Unicorn-39507.exe (PID: 7292)
- Unicorn-22084.exe (PID: 7388)
- Unicorn-10918.exe (PID: 7324)
- Unicorn-27255.exe (PID: 7308)
- Unicorn-9330.exe (PID: 7580)
- Unicorn-34581.exe (PID: 7608)
- Unicorn-38111.exe (PID: 7624)
- Unicorn-15557.exe (PID: 7268)
- Unicorn-26413.exe (PID: 7644)
- Unicorn-50555.exe (PID: 7676)
- Unicorn-43783.exe (PID: 7356)
- Unicorn-62039.exe (PID: 7512)
- Unicorn-41235.exe (PID: 7556)
- Unicorn-34197.exe (PID: 7696)
- Unicorn-53871.exe (PID: 7504)
- Unicorn-2048.exe (PID: 7528)
- Unicorn-46450.exe (PID: 7716)
- Unicorn-25837.exe (PID: 7520)
- Unicorn-62231.exe (PID: 7708)
- Unicorn-57689.exe (PID: 6344)
- Unicorn-37025.exe (PID: 7876)
- Unicorn-2122.exe (PID: 7868)
- Unicorn-42557.exe (PID: 7760)
- Unicorn-29294.exe (PID: 7740)
- Unicorn-25366.exe (PID: 7916)
- Unicorn-49979.exe (PID: 7732)
- Unicorn-50939.exe (PID: 7952)
- Unicorn-26627.exe (PID: 7860)
- Unicorn-31073.exe (PID: 7928)
- Unicorn-62237.exe (PID: 7892)
- Unicorn-36858.exe (PID: 8628)
- Unicorn-12908.exe (PID: 8648)
- Unicorn-19567.exe (PID: 8596)
- Unicorn-56318.exe (PID: 8572)
- Unicorn-26962.exe (PID: 8144)
- Unicorn-51658.exe (PID: 8184)
- Unicorn-50188.exe (PID: 8580)
- Unicorn-5630.exe (PID: 7900)
- Unicorn-49138.exe (PID: 7568)
- Unicorn-36156.exe (PID: 8944)
- Unicorn-17899.exe (PID: 8720)
- Unicorn-23673.exe (PID: 8088)
- Unicorn-39790.exe (PID: 8556)
- Unicorn-58430.exe (PID: 9164)
- Unicorn-23240.exe (PID: 8312)
- Unicorn-18602.exe (PID: 8320)
- Unicorn-560.exe (PID: 7944)
- Unicorn-24200.exe (PID: 8396)
- Unicorn-17014.exe (PID: 8824)
- Unicorn-30254.exe (PID: 7788)
- Unicorn-11009.exe (PID: 8512)
- Unicorn-38008.exe (PID: 5048)
- Unicorn-59634.exe (PID: 8372)
- Unicorn-28476.exe (PID: 8416)
- Unicorn-19924.exe (PID: 8540)
- Unicorn-52091.exe (PID: 8008)
- Unicorn-11009.exe (PID: 8840)
- Unicorn-10625.exe (PID: 8176)
- Unicorn-1821.exe (PID: 8000)
- Unicorn-56297.exe (PID: 8168)
- Unicorn-14517.exe (PID: 8332)
- Unicorn-55602.exe (PID: 9968)
- Unicorn-52265.exe (PID: 10028)
- Unicorn-14496.exe (PID: 9992)
- Unicorn-58914.exe (PID: 8080)
- Unicorn-9487.exe (PID: 9448)
- Unicorn-16172.exe (PID: 9416)
- Unicorn-9613.exe (PID: 8996)
- Unicorn-62575.exe (PID: 7656)
- Unicorn-15313.exe (PID: 8064)
- Unicorn-18144.exe (PID: 8272)
- Unicorn-16002.exe (PID: 9364)
- Unicorn-50753.exe (PID: 8048)
- Unicorn-6398.exe (PID: 8036)
- Unicorn-677.exe (PID: 8852)
- Unicorn-52070.exe (PID: 8028)
- Unicorn-50891.exe (PID: 8548)
- Unicorn-61917.exe (PID: 8588)
- Unicorn-10433.exe (PID: 8340)
- Unicorn-4185.exe (PID: 8676)
- Unicorn-11829.exe (PID: 10108)
- Unicorn-34288.exe (PID: 8884)
- Unicorn-59967.exe (PID: 7936)
- Unicorn-30802.exe (PID: 6476)
- Unicorn-26526.exe (PID: 7832)
- Unicorn-25107.exe (PID: 2644)
- Unicorn-19126.exe (PID: 9320)
- Unicorn-61289.exe (PID: 9436)
- Unicorn-11037.exe (PID: 8016)
- Unicorn-13609.exe (PID: 9624)
- Unicorn-9976.exe (PID: 9192)
- Unicorn-7916.exe (PID: 10180)
- Unicorn-31479.exe (PID: 7992)
- Unicorn-41792.exe (PID: 10632)
- Unicorn-11512.exe (PID: 8728)
- Unicorn-59472.exe (PID: 924)
- Unicorn-33484.exe (PID: 5244)
- Unicorn-9089.exe (PID: 10648)
- Unicorn-27922.exe (PID: 8440)
- Unicorn-57637.exe (PID: 8056)
- Unicorn-22214.exe (PID: 11776)
- Unicorn-6441.exe (PID: 8364)
- Unicorn-55668.exe (PID: 10548)
- Unicorn-50344.exe (PID: 11112)
- Unicorn-3267.exe (PID: 12508)
- Unicorn-64812.exe (PID: 12532)
- Unicorn-60067.exe (PID: 7968)
- Unicorn-65306.exe (PID: 10376)
- Unicorn-30034.exe (PID: 8988)
- Unicorn-53106.exe (PID: 12324)
- Unicorn-4372.exe (PID: 13648)
- Unicorn-6877.exe (PID: 13516)
- Unicorn-55056.exe (PID: 13668)
- Unicorn-33947.exe (PID: 14088)
- Unicorn-9399.exe (PID: 10220)
- Unicorn-57482.exe (PID: 10268)
- Unicorn-23838.exe (PID: 8448)
- Unicorn-6588.exe (PID: 14520)
- Unicorn-55773.exe (PID: 9740)
- Unicorn-50920.exe (PID: 11292)
- Unicorn-52006.exe (PID: 11260)
- Unicorn-43994.exe (PID: 14588)
- Unicorn-39930.exe (PID: 9264)
- Unicorn-55794.exe (PID: 10076)
- Unicorn-57221.exe (PID: 11196)
- Unicorn-50330.exe (PID: 12488)
- Unicorn-39524.exe (PID: 5956)
- Unicorn-29644.exe (PID: 13624)
- Unicorn-42021.exe (PID: 8960)
- Unicorn-51378.exe (PID: 11740)
- Unicorn-18108.exe (PID: 11048)
- Unicorn-43608.exe (PID: 7796)
- Unicorn-10376.exe (PID: 13304)
- Unicorn-12737.exe (PID: 8936)
- Unicorn-26438.exe (PID: 9724)
- Unicorn-60781.exe (PID: 15572)
- Unicorn-23012.exe (PID: 14132)
- Unicorn-42613.exe (PID: 14120)
- Unicorn-21512.exe (PID: 10688)
- Unicorn-10743.exe (PID: 10708)
- Unicorn-15472.exe (PID: 13316)
- Unicorn-15351.exe (PID: 9116)
- Unicorn-61958.exe (PID: 9504)
- Unicorn-53189.exe (PID: 13524)
- Unicorn-19318.exe (PID: 9224)
- Unicorn-35514.exe (PID: 8464)
- Unicorn-21739.exe (PID: 9424)
- Unicorn-9333.exe (PID: 9608)
- Unicorn-54916.exe (PID: 15584)
- Unicorn-37434.exe (PID: 8812)
- Unicorn-52116.exe (PID: 15564)
- Unicorn-38756.exe (PID: 5380)
- Unicorn-62706.exe (PID: 5204)
- Unicorn-29754.exe (PID: 9584)
- Unicorn-7797.exe (PID: 12304)
- Unicorn-19230.exe (PID: 9932)
- Unicorn-61201.exe (PID: 10212)
- Unicorn-22420.exe (PID: 8952)
- Unicorn-32795.exe (PID: 14056)
- Unicorn-35179.exe (PID: 8072)
- Unicorn-55668.exe (PID: 10292)
- Unicorn-22244.exe (PID: 14660)
INFO
Create files in a temporary directory
- 1 (1478).exe (PID: 976)
- Unicorn-17513.exe (PID: 2600)
- Unicorn-37061.exe (PID: 1912)
- Unicorn-11094.exe (PID: 5416)
- Unicorn-38037.exe (PID: 1188)
- Unicorn-12786.exe (PID: 4220)
- Unicorn-43797.exe (PID: 6712)
- Unicorn-36345.exe (PID: 5960)
- Unicorn-48702.exe (PID: 5360)
- Unicorn-28281.exe (PID: 1568)
- Unicorn-4182.exe (PID: 208)
- Unicorn-10112.exe (PID: 4188)
- Unicorn-53819.exe (PID: 5988)
- Unicorn-48147.exe (PID: 5400)
- Unicorn-36279.exe (PID: 5720)
- Unicorn-30061.exe (PID: 5384)
- Unicorn-57467.exe (PID: 736)
- Unicorn-16413.exe (PID: 4724)
- Unicorn-10342.exe (PID: 6724)
- Unicorn-24440.exe (PID: 7036)
- Unicorn-16243.exe (PID: 6592)
- Unicorn-11110.exe (PID: 7172)
- Unicorn-43191.exe (PID: 5740)
- Unicorn-39891.exe (PID: 7192)
- Unicorn-32085.exe (PID: 7332)
- Unicorn-39626.exe (PID: 7200)
- Unicorn-35158.exe (PID: 7284)
- Unicorn-7218.exe (PID: 7224)
- Unicorn-40253.exe (PID: 7348)
- Unicorn-6642.exe (PID: 7248)
- Unicorn-47867.exe (PID: 7364)
- Unicorn-7389.exe (PID: 7316)
- Unicorn-11509.exe (PID: 1628)
- Unicorn-30576.exe (PID: 7276)
- Unicorn-43051.exe (PID: 4120)
- Unicorn-53045.exe (PID: 3896)
- Unicorn-44722.exe (PID: 7236)
- Unicorn-39507.exe (PID: 7292)
- Unicorn-27255.exe (PID: 7308)
- Unicorn-9330.exe (PID: 7580)
- Unicorn-6450.exe (PID: 6964)
- Unicorn-15557.exe (PID: 7268)
- Unicorn-34581.exe (PID: 7608)
- Unicorn-33134.exe (PID: 5728)
- Unicorn-43783.exe (PID: 7356)
- Unicorn-62039.exe (PID: 7512)
- Unicorn-37601.exe (PID: 6388)
- Unicorn-50555.exe (PID: 7676)
- Unicorn-34197.exe (PID: 7696)
- Unicorn-26487.exe (PID: 2800)
- Unicorn-41759.exe (PID: 5864)
- Unicorn-53871.exe (PID: 7504)
- Unicorn-2048.exe (PID: 7528)
- Unicorn-46450.exe (PID: 7716)
- Unicorn-62231.exe (PID: 7708)
- Unicorn-37025.exe (PID: 7876)
- Unicorn-2122.exe (PID: 7868)
- Unicorn-15282.exe (PID: 2240)
- Unicorn-49979.exe (PID: 7732)
- Unicorn-42557.exe (PID: 7760)
- Unicorn-29294.exe (PID: 7740)
- Unicorn-50939.exe (PID: 7952)
- Unicorn-26627.exe (PID: 7860)
- Unicorn-7312.exe (PID: 6752)
- Unicorn-3689.exe (PID: 7212)
- Unicorn-31073.exe (PID: 7928)
- Unicorn-62237.exe (PID: 7892)
- Unicorn-19567.exe (PID: 8596)
- Unicorn-56318.exe (PID: 8572)
- Unicorn-47483.exe (PID: 4200)
- Unicorn-26962.exe (PID: 8144)
- Unicorn-51658.exe (PID: 8184)
- Unicorn-53715.exe (PID: 5116)
- Unicorn-5630.exe (PID: 7900)
- Unicorn-22084.exe (PID: 7388)
- Unicorn-36156.exe (PID: 8944)
- Unicorn-17899.exe (PID: 8720)
- Unicorn-23673.exe (PID: 8088)
- Unicorn-23240.exe (PID: 8312)
- Unicorn-560.exe (PID: 7944)
- Unicorn-18602.exe (PID: 8320)
- Unicorn-58430.exe (PID: 9164)
- Unicorn-45215.exe (PID: 1240)
- Unicorn-11009.exe (PID: 8512)
- Unicorn-28476.exe (PID: 8416)
- Unicorn-30254.exe (PID: 7788)
- Unicorn-25837.exe (PID: 7520)
- Unicorn-11009.exe (PID: 8840)
- Unicorn-56297.exe (PID: 8168)
- Unicorn-14496.exe (PID: 9992)
- Unicorn-58914.exe (PID: 8080)
- Unicorn-16172.exe (PID: 9416)
- Unicorn-62575.exe (PID: 7656)
- Unicorn-14517.exe (PID: 8332)
- Unicorn-52265.exe (PID: 10028)
- Unicorn-9487.exe (PID: 9448)
- Unicorn-31509.exe (PID: 3268)
- Unicorn-6398.exe (PID: 8036)
- Unicorn-26413.exe (PID: 7644)
- Unicorn-57689.exe (PID: 6344)
- Unicorn-50891.exe (PID: 8548)
- Unicorn-10433.exe (PID: 8340)
- Unicorn-59967.exe (PID: 7936)
- Unicorn-61917.exe (PID: 8588)
- Unicorn-4185.exe (PID: 8676)
- Unicorn-34288.exe (PID: 8884)
- Unicorn-26526.exe (PID: 7832)
- Unicorn-51759.exe (PID: 7256)
- Unicorn-11037.exe (PID: 8016)
- Unicorn-61289.exe (PID: 9436)
- Unicorn-31479.exe (PID: 7992)
- Unicorn-41792.exe (PID: 10632)
- Unicorn-59472.exe (PID: 924)
- Unicorn-11512.exe (PID: 8728)
- Unicorn-57637.exe (PID: 8056)
- Unicorn-27922.exe (PID: 8440)
- Unicorn-41235.exe (PID: 7556)
- Unicorn-9089.exe (PID: 10648)
- Unicorn-38008.exe (PID: 5048)
- Unicorn-55602.exe (PID: 9968)
- Unicorn-6441.exe (PID: 8364)
- Unicorn-38111.exe (PID: 7624)
- Unicorn-5644.exe (PID: 2244)
- Unicorn-1821.exe (PID: 8000)
- Unicorn-15313.exe (PID: 8064)
- Unicorn-16002.exe (PID: 9364)
- Unicorn-9613.exe (PID: 8996)
- Unicorn-19924.exe (PID: 8540)
- Unicorn-12908.exe (PID: 8648)
- Unicorn-10918.exe (PID: 7324)
- Unicorn-50753.exe (PID: 8048)
- Unicorn-9399.exe (PID: 10220)
- Unicorn-677.exe (PID: 8852)
- Unicorn-33484.exe (PID: 5244)
- Unicorn-53106.exe (PID: 12324)
- Unicorn-52006.exe (PID: 11260)
- Unicorn-13609.exe (PID: 9624)
- Unicorn-25107.exe (PID: 2644)
Checks supported languages
- 1 (1478).exe (PID: 976)
- Unicorn-43051.exe (PID: 4120)
- Unicorn-17513.exe (PID: 2600)
- Unicorn-53715.exe (PID: 5116)
- Unicorn-11094.exe (PID: 5416)
- Unicorn-37061.exe (PID: 1912)
- Unicorn-43191.exe (PID: 5740)
- Unicorn-38037.exe (PID: 1188)
- Unicorn-43797.exe (PID: 6712)
- Unicorn-30061.exe (PID: 5384)
- Unicorn-15282.exe (PID: 2240)
- Unicorn-28281.exe (PID: 1568)
- Unicorn-48702.exe (PID: 5360)
- Unicorn-48147.exe (PID: 5400)
- Unicorn-10112.exe (PID: 4188)
- Unicorn-16243.exe (PID: 6592)
- Unicorn-4182.exe (PID: 208)
- Unicorn-45215.exe (PID: 1240)
- Unicorn-7312.exe (PID: 6752)
- Unicorn-36279.exe (PID: 5720)
- Unicorn-16413.exe (PID: 4724)
- Unicorn-11509.exe (PID: 1628)
- Unicorn-6450.exe (PID: 6964)
- Unicorn-31509.exe (PID: 3268)
- Unicorn-57467.exe (PID: 736)
- Unicorn-37601.exe (PID: 6388)
- Unicorn-57689.exe (PID: 6344)
- Unicorn-53045.exe (PID: 3896)
- Unicorn-26487.exe (PID: 2800)
- Unicorn-11110.exe (PID: 7172)
- Unicorn-39891.exe (PID: 7192)
- Unicorn-39626.exe (PID: 7200)
- Unicorn-3689.exe (PID: 7212)
- Unicorn-7218.exe (PID: 7224)
- Unicorn-39507.exe (PID: 7292)
- Unicorn-7389.exe (PID: 7316)
- Unicorn-10918.exe (PID: 7324)
- Unicorn-40253.exe (PID: 7348)
- Unicorn-22084.exe (PID: 7388)
- Unicorn-51759.exe (PID: 7256)
- Unicorn-15557.exe (PID: 7268)
- Unicorn-30576.exe (PID: 7276)
- Unicorn-53871.exe (PID: 7504)
- Unicorn-9330.exe (PID: 7580)
- Unicorn-25837.exe (PID: 7520)
- Unicorn-2048.exe (PID: 7528)
- Unicorn-49138.exe (PID: 7568)
- Unicorn-34581.exe (PID: 7608)
- Unicorn-38111.exe (PID: 7624)
- Unicorn-41235.exe (PID: 7556)
- Unicorn-26413.exe (PID: 7644)
- Unicorn-62575.exe (PID: 7656)
- Unicorn-50555.exe (PID: 7676)
- Unicorn-62231.exe (PID: 7708)
- Unicorn-34197.exe (PID: 7696)
- Unicorn-49979.exe (PID: 7732)
- Unicorn-29294.exe (PID: 7740)
- Unicorn-46450.exe (PID: 7716)
- Unicorn-37025.exe (PID: 7876)
- Unicorn-62237.exe (PID: 7892)
- Unicorn-2122.exe (PID: 7868)
- Unicorn-26627.exe (PID: 7860)
- Unicorn-30254.exe (PID: 7788)
- Unicorn-5630.exe (PID: 7900)
- Unicorn-25366.exe (PID: 7916)
- Unicorn-560.exe (PID: 7944)
- Unicorn-60067.exe (PID: 7968)
- Unicorn-50939.exe (PID: 7952)
- Unicorn-31479.exe (PID: 7992)
- Unicorn-52091.exe (PID: 8008)
- Unicorn-6398.exe (PID: 8036)
- Unicorn-11037.exe (PID: 8016)
- Unicorn-52070.exe (PID: 8028)
- Unicorn-57637.exe (PID: 8056)
- Unicorn-15313.exe (PID: 8064)
- Unicorn-1821.exe (PID: 8000)
- Unicorn-58914.exe (PID: 8080)
- Unicorn-23673.exe (PID: 8088)
- Unicorn-26962.exe (PID: 8144)
- Unicorn-22878.exe (PID: 8152)
- Unicorn-10625.exe (PID: 8176)
- Unicorn-51658.exe (PID: 8184)
- Unicorn-18602.exe (PID: 8320)
- Unicorn-23240.exe (PID: 8312)
- Unicorn-2628.exe (PID: 8300)
- Unicorn-6441.exe (PID: 8364)
- Unicorn-14517.exe (PID: 8332)
- Unicorn-59634.exe (PID: 8372)
- Unicorn-28476.exe (PID: 8416)
- Unicorn-19567.exe (PID: 8596)
- Unicorn-23838.exe (PID: 8448)
- Unicorn-35514.exe (PID: 8464)
- Unicorn-25107.exe (PID: 2644)
- Unicorn-29383.exe (PID: 8472)
- Unicorn-27922.exe (PID: 8440)
- Unicorn-50891.exe (PID: 8548)
- Unicorn-56318.exe (PID: 8572)
- Unicorn-50188.exe (PID: 8580)
- Unicorn-19924.exe (PID: 8540)
- Unicorn-39790.exe (PID: 8556)
- Unicorn-36452.exe (PID: 8564)
- Unicorn-61917.exe (PID: 8588)
- Unicorn-4185.exe (PID: 8676)
- Unicorn-56105.exe (PID: 8668)
- Unicorn-17899.exe (PID: 8720)
- Unicorn-11512.exe (PID: 8728)
- Unicorn-37434.exe (PID: 8812)
- Unicorn-36156.exe (PID: 8944)
- Unicorn-34288.exe (PID: 8884)
- Unicorn-45218.exe (PID: 8904)
- Unicorn-42021.exe (PID: 8960)
- Unicorn-22420.exe (PID: 8952)
- Unicorn-17014.exe (PID: 8824)
- Unicorn-677.exe (PID: 8852)
- Unicorn-30034.exe (PID: 8988)
- Unicorn-9613.exe (PID: 8996)
- Unicorn-42021.exe (PID: 8972)
- Unicorn-9976.exe (PID: 9192)
- Unicorn-62706.exe (PID: 5204)
- Unicorn-54922.exe (PID: 9080)
- Unicorn-12551.exe (PID: 9108)
- Unicorn-15351.exe (PID: 9116)
- Unicorn-1616.exe (PID: 9124)
- Unicorn-41200.exe (PID: 6300)
- Unicorn-42670.exe (PID: 7824)
- Unicorn-26526.exe (PID: 7832)
- Unicorn-39524.exe (PID: 5956)
- Unicorn-52182.exe (PID: 9256)
- Unicorn-39930.exe (PID: 9264)
- Unicorn-35462.exe (PID: 9304)
- Unicorn-19126.exe (PID: 9320)
- Unicorn-16172.exe (PID: 9416)
- Unicorn-43608.exe (PID: 7796)
- Unicorn-28616.exe (PID: 9464)
- Unicorn-21739.exe (PID: 9424)
- Unicorn-9487.exe (PID: 9448)
- Unicorn-55602.exe (PID: 9968)
- Unicorn-29754.exe (PID: 9584)
- Unicorn-9333.exe (PID: 9608)
- Unicorn-37538.exe (PID: 9648)
- Unicorn-19230.exe (PID: 9932)
- Unicorn-17886.exe (PID: 9824)
- Unicorn-55773.exe (PID: 9740)
- Unicorn-39193.exe (PID: 9872)
- Unicorn-41496.exe (PID: 10048)
- Unicorn-11829.exe (PID: 10108)
- Unicorn-7916.exe (PID: 10180)
- Unicorn-48394.exe (PID: 2192)
- Unicorn-55668.exe (PID: 10292)
- Unicorn-15337.exe (PID: 10148)
- Unicorn-64346.exe (PID: 9924)
- Unicorn-9399.exe (PID: 10220)
- Unicorn-4097.exe (PID: 9548)
- Unicorn-47361.exe (PID: 10520)
- Unicorn-516.exe (PID: 10420)
- Unicorn-44184.exe (PID: 10680)
- Unicorn-10743.exe (PID: 10708)
- Unicorn-10485.exe (PID: 9956)
- Unicorn-30448.exe (PID: 10672)
- Unicorn-9089.exe (PID: 10648)
- Unicorn-921.exe (PID: 10636)
- Unicorn-41378.exe (PID: 10696)
- Unicorn-13941.exe (PID: 10756)
- Unicorn-33484.exe (PID: 5244)
- Unicorn-32152.exe (PID: 10888)
- Unicorn-47553.exe (PID: 10912)
- Unicorn-42338.exe (PID: 10940)
- Unicorn-44201.exe (PID: 11032)
- Unicorn-10781.exe (PID: 11016)
- Unicorn-57936.exe (PID: 11024)
- Unicorn-46230.exe (PID: 10848)
- Unicorn-50920.exe (PID: 11292)
- Unicorn-50920.exe (PID: 11300)
- Unicorn-50728.exe (PID: 11268)
- Unicorn-50344.exe (PID: 11112)
- Unicorn-58445.exe (PID: 11064)
- Unicorn-12243.exe (PID: 11056)
- Unicorn-36992.exe (PID: 10428)
- Unicorn-50728.exe (PID: 10744)
- Unicorn-36992.exe (PID: 10396)
- Unicorn-29400.exe (PID: 10276)
- Unicorn-57221.exe (PID: 11196)
- Unicorn-1881.exe (PID: 10896)
- Unicorn-19888.exe (PID: 6404)
- Unicorn-39052.exe (PID: 10316)
- Unicorn-47928.exe (PID: 11276)
- Unicorn-49650.exe (PID: 11588)
- Unicorn-36992.exe (PID: 10340)
- Unicorn-47553.exe (PID: 10904)
- Unicorn-55078.exe (PID: 11816)
- Unicorn-23039.exe (PID: 11172)
- Unicorn-60314.exe (PID: 11884)
- Unicorn-40557.exe (PID: 11856)
- Unicorn-3116.exe (PID: 11188)
- Unicorn-11331.exe (PID: 11664)
- Unicorn-38669.exe (PID: 11876)
- Unicorn-16328.exe (PID: 11600)
- Unicorn-38550.exe (PID: 11632)
- Unicorn-3267.exe (PID: 12508)
- Unicorn-64812.exe (PID: 12532)
- Unicorn-61968.exe (PID: 12236)
- Unicorn-48233.exe (PID: 12284)
- Unicorn-48233.exe (PID: 9888)
- Unicorn-2296.exe (PID: 2416)
- Unicorn-60677.exe (PID: 4736)
- Unicorn-61968.exe (PID: 12244)
- Unicorn-22488.exe (PID: 12572)
- Unicorn-5645.exe (PID: 11800)
- Unicorn-39924.exe (PID: 12784)
- Unicorn-58394.exe (PID: 11656)
- Unicorn-53646.exe (PID: 12392)
- Unicorn-25058.exe (PID: 12416)
- Unicorn-2296.exe (PID: 6572)
- Unicorn-61968.exe (PID: 12252)
- Unicorn-7797.exe (PID: 12304)
- Unicorn-65513.exe (PID: 12748)
- Unicorn-25059.exe (PID: 13076)
- Unicorn-42632.exe (PID: 12268)
- Unicorn-6505.exe (PID: 10988)
- Unicorn-49754.exe (PID: 12436)
- Unicorn-2177.exe (PID: 12072)
- Unicorn-5088.exe (PID: 11492)
- Unicorn-63713.exe (PID: 13060)
- Unicorn-44554.exe (PID: 12364)
- Unicorn-32110.exe (PID: 12352)
- Unicorn-15109.exe (PID: 13152)
- Unicorn-4511.exe (PID: 3176)
- Unicorn-15472.exe (PID: 13316)
- Unicorn-56313.exe (PID: 13296)
- Unicorn-33099.exe (PID: 13264)
- Unicorn-29207.exe (PID: 13324)
- Unicorn-62374.exe (PID: 13548)
- Unicorn-57273.exe (PID: 13464)
- Unicorn-56509.exe (PID: 13556)
- Unicorn-45544.exe (PID: 5308)
- Unicorn-3604.exe (PID: 13480)
- Unicorn-53189.exe (PID: 13524)
- Unicorn-56313.exe (PID: 13284)
- Unicorn-29644.exe (PID: 13624)
- Unicorn-42773.exe (PID: 13600)
- Unicorn-42773.exe (PID: 13588)
- Unicorn-42773.exe (PID: 13580)
- Unicorn-32717.exe (PID: 13572)
- Unicorn-4511.exe (PID: 3396)
- Unicorn-61357.exe (PID: 13752)
- Unicorn-29644.exe (PID: 13852)
- Unicorn-29095.exe (PID: 13900)
- Unicorn-18160.exe (PID: 13928)
- Unicorn-18160.exe (PID: 13940)
- Unicorn-18160.exe (PID: 13948)
- Unicorn-18160.exe (PID: 13964)
- Unicorn-33293.exe (PID: 14040)
- Unicorn-32795.exe (PID: 14056)
- Unicorn-33947.exe (PID: 14088)
- Unicorn-36748.exe (PID: 14104)
- Unicorn-22436.exe (PID: 14232)
- Unicorn-6877.exe (PID: 13516)
- Unicorn-35073.exe (PID: 13332)
- Unicorn-10184.exe (PID: 14224)
- Unicorn-64414.exe (PID: 14572)
- Unicorn-14268.exe (PID: 14248)
- Unicorn-6588.exe (PID: 14520)
- Unicorn-3345.exe (PID: 14388)
- Unicorn-43994.exe (PID: 14588)
- Unicorn-40964.exe (PID: 14708)
- Unicorn-52473.exe (PID: 14740)
- Unicorn-22244.exe (PID: 14660)
- Unicorn-43808.exe (PID: 14724)
- Unicorn-8368.exe (PID: 14772)
- Unicorn-27272.exe (PID: 14788)
- Unicorn-27969.exe (PID: 14756)
- Unicorn-21911.exe (PID: 14448)
- Unicorn-9659.exe (PID: 14700)
- Unicorn-64414.exe (PID: 14568)
- Unicorn-59385.exe (PID: 14280)
- Unicorn-54916.exe (PID: 15584)
- Unicorn-34111.exe (PID: 15784)
- Unicorn-60854.exe (PID: 15800)
- Unicorn-47648.exe (PID: 15772)
- Unicorn-13883.exe (PID: 15684)
- Unicorn-49872.exe (PID: 15532)
- Unicorn-44554.exe (PID: 15516)
- Unicorn-8368.exe (PID: 14764)
- Unicorn-52302.exe (PID: 15436)
- Unicorn-34430.exe (PID: 14960)
- Unicorn-1565.exe (PID: 14948)
- Unicorn-6588.exe (PID: 14480)
- Unicorn-60085.exe (PID: 15548)
- Unicorn-43558.exe (PID: 15472)
- Unicorn-48529.exe (PID: 15596)
- Unicorn-57154.exe (PID: 15748)
- Unicorn-19748.exe (PID: 15556)
- Unicorn-53994.exe (PID: 16252)
- Unicorn-2909.exe (PID: 15420)
- Unicorn-41180.exe (PID: 15636)
- Unicorn-41180.exe (PID: 15628)
Reads the computer name
- 1 (1478).exe (PID: 976)
- Unicorn-43051.exe (PID: 4120)
- Unicorn-17513.exe (PID: 2600)
- Unicorn-53715.exe (PID: 5116)
- Unicorn-11094.exe (PID: 5416)
- Unicorn-37061.exe (PID: 1912)
- Unicorn-36345.exe (PID: 5960)
- Unicorn-12786.exe (PID: 4220)
- Unicorn-53819.exe (PID: 5988)
- Unicorn-43797.exe (PID: 6712)
- Unicorn-30061.exe (PID: 5384)
- Unicorn-7312.exe (PID: 6752)
- Unicorn-28281.exe (PID: 1568)
- Unicorn-48702.exe (PID: 5360)
- Unicorn-4182.exe (PID: 208)
- Unicorn-48147.exe (PID: 5400)
- Unicorn-10112.exe (PID: 4188)
- Unicorn-5644.exe (PID: 2244)
- Unicorn-36279.exe (PID: 5720)
- Unicorn-57467.exe (PID: 736)
- Unicorn-45215.exe (PID: 1240)
- Unicorn-10342.exe (PID: 6724)
- Unicorn-53045.exe (PID: 3896)
- Unicorn-57689.exe (PID: 6344)
- Unicorn-31509.exe (PID: 3268)
- Unicorn-26487.exe (PID: 2800)
- Unicorn-6450.exe (PID: 6964)
- Unicorn-24440.exe (PID: 7036)
- Unicorn-11110.exe (PID: 7172)
- Unicorn-47483.exe (PID: 4200)
- Unicorn-39891.exe (PID: 7192)
- Unicorn-6642.exe (PID: 7248)
- Unicorn-51759.exe (PID: 7256)
- Unicorn-39626.exe (PID: 7200)
- Unicorn-3689.exe (PID: 7212)
- Unicorn-40253.exe (PID: 7348)
- Unicorn-47867.exe (PID: 7364)
- Unicorn-7389.exe (PID: 7316)
- Unicorn-30576.exe (PID: 7276)
- Unicorn-44722.exe (PID: 7236)
- Unicorn-10918.exe (PID: 7324)
- Unicorn-22084.exe (PID: 7388)
- Unicorn-34581.exe (PID: 7608)
- Unicorn-9330.exe (PID: 7580)
- Unicorn-38111.exe (PID: 7624)
- Unicorn-15557.exe (PID: 7268)
- Unicorn-26413.exe (PID: 7644)
- Unicorn-62039.exe (PID: 7512)
- Unicorn-50555.exe (PID: 7676)
- Unicorn-43783.exe (PID: 7356)
- Unicorn-53871.exe (PID: 7504)
- Unicorn-41235.exe (PID: 7556)
- Unicorn-2048.exe (PID: 7528)
- Unicorn-25837.exe (PID: 7520)
- Unicorn-62231.exe (PID: 7708)
- Unicorn-2122.exe (PID: 7868)
- Unicorn-49979.exe (PID: 7732)
- Unicorn-25366.exe (PID: 7916)
- Unicorn-26627.exe (PID: 7860)
- Unicorn-62237.exe (PID: 7892)
- Unicorn-19567.exe (PID: 8596)
- Unicorn-36858.exe (PID: 8628)
- Unicorn-51658.exe (PID: 8184)
- Unicorn-12908.exe (PID: 8648)
- Unicorn-56318.exe (PID: 8572)
- Unicorn-23673.exe (PID: 8088)
- Unicorn-50188.exe (PID: 8580)
- Unicorn-39790.exe (PID: 8556)
- Unicorn-560.exe (PID: 7944)
- Unicorn-24200.exe (PID: 8396)
- Unicorn-18602.exe (PID: 8320)
- Unicorn-38008.exe (PID: 5048)
- Unicorn-19924.exe (PID: 8540)
- Unicorn-11009.exe (PID: 8840)
- Unicorn-56297.exe (PID: 8168)
- Unicorn-50753.exe (PID: 8048)
- Unicorn-55602.exe (PID: 9968)
- Unicorn-26526.exe (PID: 7832)
- Unicorn-19126.exe (PID: 9320)
- Unicorn-13609.exe (PID: 9624)
- Unicorn-11512.exe (PID: 8728)
- Unicorn-7916.exe (PID: 10180)
- Unicorn-59472.exe (PID: 924)
- Unicorn-3267.exe (PID: 12508)
- Unicorn-42021.exe (PID: 8960)
- Unicorn-23012.exe (PID: 14132)
- Unicorn-43608.exe (PID: 7796)
- Unicorn-55056.exe (PID: 13668)
- Unicorn-33947.exe (PID: 14088)
- Unicorn-37538.exe (PID: 9648)
- Unicorn-22244.exe (PID: 14660)
The sample compiled with chinese language support
- 1 (1478).exe (PID: 976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
636
Monitored processes
505
Malicious processes
77
Suspicious processes
59
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\Users\admin\AppData\Local\Temp\Unicorn-4182.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-4182.exe | Unicorn-53819.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 496 | C:\Users\admin\AppData\Local\Temp\Unicorn-20235.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20235.exe | — | Unicorn-14496.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 616 | C:\Users\admin\AppData\Local\Temp\Unicorn-35229.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-35229.exe | — | Unicorn-44722.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 660 | C:\Users\admin\AppData\Local\Temp\Unicorn-10028.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-10028.exe | — | Unicorn-12786.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 736 | C:\Users\admin\AppData\Local\Temp\Unicorn-57467.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-57467.exe | Unicorn-43797.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 900 | C:\Users\admin\AppData\Local\Temp\Unicorn-47621.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-47621.exe | — | Unicorn-59472.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 924 | C:\Users\admin\AppData\Local\Temp\Unicorn-59472.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-59472.exe | Unicorn-27255.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 976 | "C:\Users\admin\AppData\Local\Temp\1 (1478).exe" | C:\Users\admin\AppData\Local\Temp\1 (1478).exe | explorer.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1188 | C:\Users\admin\AppData\Local\Temp\Unicorn-38037.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-38037.exe | Unicorn-53715.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1240 | C:\Users\admin\AppData\Local\Temp\Unicorn-45215.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-45215.exe | Unicorn-41759.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
10 730
Read events
10 730
Write events
0
Delete events
0
Modification events
Executable files
818
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5116 | Unicorn-53715.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-11094.exe | executable | |
MD5:D9B2C0BA3C456C23AA4E3E1E49B4AF45 | SHA256:DE0CB9FE71A92A99D1125BE4FC6DA7CCB5083E8442B568768BD600099BC12D05 | |||
| 976 | 1 (1478).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-43051.exe | executable | |
MD5:AF8C8C39C7571920BE0794EFD39ED2D5 | SHA256:FCB91738B062577B0E9A72352499866B087511EDE2418A082320A6C18CCD9087 | |||
| 976 | 1 (1478).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-17513.exe | executable | |
MD5:821AD0D99AF863A3800E188DCD1972BD | SHA256:31A0A3131C8E97E4F4F8EEAFEDFDFA3E51A6108D321BA87EDC649432FCF70DF4 | |||
| 976 | 1 (1478).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-33134.exe | executable | |
MD5:AD966BEA05DA43596F7051F9F18CB5CC | SHA256:F63890B7872D23A04028C040D05FD8EE66742327F586CBBA7FA3A9F06E022F1B | |||
| 4120 | Unicorn-43051.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-36345.exe | executable | |
MD5:9350B6C292F56A5BAC80A66DFF86A140 | SHA256:820F0D363046A0E7D70324C07D57643D71196EBCA19B28ADFF3A160667C1A76D | |||
| 5116 | Unicorn-53715.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-38037.exe | executable | |
MD5:99D1DF8A2DA5A9FA2A3C1641B0A20BC8 | SHA256:32F46CD8E5DFD0FA01EA6742F55CA910254B43849A7BD5CF587AD83735582D50 | |||
| 2600 | Unicorn-17513.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-30061.exe | executable | |
MD5:449773D8DD9C7BE1EB37D5E929D2CEE3 | SHA256:0C418731E8BE8D39D843C1CB975633DB7AE9CD90569D95AB5B1A906A531D2715 | |||
| 4120 | Unicorn-43051.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-43797.exe | executable | |
MD5:93EAAD726E7A1D45044866966E88D858 | SHA256:4DE4CB18F0804973C0D96DA8F61575365DECA91C254DA98B506AA3A25605E42D | |||
| 2600 | Unicorn-17513.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-43191.exe | executable | |
MD5:8A39C39A871238798717975E1F7681AB | SHA256:BED000DB04B2167AA3786E35CD68A789DAB871831104C8056E3DBB0AEBCE02F9 | |||
| 1912 | Unicorn-37061.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53819.exe | executable | |
MD5:8A7D507A3B383B53F3AF91993467A116 | SHA256:072DC85094AEE10449BEF0D82842196CA04751656B1C130E0EF5E77C693CA91E | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
23
DNS requests
15
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 95.101.54.122:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4400 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
8108 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
8108 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 4.231.128.59:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 95.101.54.122:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2112 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.160.132:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
4400 | backgroundTaskHost.exe | 20.31.169.57:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |