| File name: | 1 (1282) |
| Full analysis: | https://app.any.run/tasks/b1849a12-a208-4d48-9136-80e997cc9c11 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 13:38:39 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | B75FAB393C758D8C0E19900619B39D90 |
| SHA1: | 81E26300CFF060437ADBA9043B1215EEC845B778 |
| SHA256: | 52FEA37F908EE778D310C22CBDD178352326E4F0E115D194CE530A058392339A |
| SSDEEP: | 3072:cW+3Dth/pDWCVupEDkSNWX4I66HuL+msfpfu4hwRLcBuI6:cW+3DthxDEiYSPI+yzfpfu4hwRLcBuI |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- 1 (1282).exe (PID: 2136)
- Unicorn-22247.exe (PID: 976)
- Unicorn-1753.exe (PID: 2096)
- Unicorn-23503.exe (PID: 7340)
- Unicorn-50591.exe (PID: 960)
- Unicorn-2380.exe (PID: 7396)
- Unicorn-56367.exe (PID: 7360)
- Unicorn-28333.exe (PID: 7376)
- Unicorn-46419.exe (PID: 7436)
- Unicorn-60015.exe (PID: 7472)
- Unicorn-15453.exe (PID: 7456)
- Unicorn-31981.exe (PID: 7488)
- Unicorn-22610.exe (PID: 7552)
- Unicorn-51847.exe (PID: 7496)
- Unicorn-866.exe (PID: 7796)
- Unicorn-37431.exe (PID: 7848)
- Unicorn-23132.exe (PID: 7856)
- Unicorn-29817.exe (PID: 7968)
- Unicorn-10404.exe (PID: 8012)
- Unicorn-10404.exe (PID: 8020)
- Unicorn-15427.exe (PID: 7904)
- Unicorn-35293.exe (PID: 7912)
- Unicorn-57851.exe (PID: 7936)
- Unicorn-9013.exe (PID: 8028)
- Unicorn-23726.exe (PID: 7992)
- Unicorn-26959.exe (PID: 7540)
- Unicorn-43553.exe (PID: 7976)
- Unicorn-28996.exe (PID: 7520)
- Unicorn-27255.exe (PID: 6148)
- Unicorn-23461.exe (PID: 7984)
- Unicorn-19948.exe (PID: 8004)
- Unicorn-30201.exe (PID: 7824)
- Unicorn-17123.exe (PID: 4844)
- Unicorn-64779.exe (PID: 1040)
- Unicorn-52262.exe (PID: 2040)
- Unicorn-23917.exe (PID: 1228)
- Unicorn-37535.exe (PID: 7724)
- Unicorn-33067.exe (PID: 7740)
- Unicorn-54234.exe (PID: 7776)
- Unicorn-6516.exe (PID: 7768)
- Unicorn-53679.exe (PID: 7648)
- Unicorn-41981.exe (PID: 7884)
- Unicorn-45511.exe (PID: 7620)
- Unicorn-32875.exe (PID: 5212)
- Unicorn-12646.exe (PID: 7784)
- Unicorn-58126.exe (PID: 1628)
- Unicorn-62624.exe (PID: 6768)
- Unicorn-62624.exe (PID: 1188)
- Unicorn-13631.exe (PID: 1760)
- Unicorn-32875.exe (PID: 2108)
- Unicorn-24598.exe (PID: 7252)
- Unicorn-30166.exe (PID: 7208)
- Unicorn-57851.exe (PID: 7944)
- Unicorn-5417.exe (PID: 5936)
- Unicorn-19231.exe (PID: 5640)
- Unicorn-30664.exe (PID: 732)
- Unicorn-36658.exe (PID: 7416)
- Unicorn-45511.exe (PID: 7628)
- Unicorn-19231.exe (PID: 1660)
- Unicorn-24580.exe (PID: 6512)
- Unicorn-33954.exe (PID: 7712)
- Unicorn-5822.exe (PID: 2772)
- Unicorn-7794.exe (PID: 6068)
- Unicorn-29432.exe (PID: 8140)
- Unicorn-11058.exe (PID: 5400)
- Unicorn-31287.exe (PID: 2420)
- Unicorn-15578.exe (PID: 5360)
- Unicorn-2073.exe (PID: 8396)
- Unicorn-10796.exe (PID: 8424)
- Unicorn-63718.exe (PID: 8448)
- Unicorn-32560.exe (PID: 8484)
- Unicorn-48562.exe (PID: 5260)
- Unicorn-19973.exe (PID: 4068)
- Unicorn-47958.exe (PID: 8596)
- Unicorn-31430.exe (PID: 8636)
- Unicorn-48150.exe (PID: 8680)
- Unicorn-48150.exe (PID: 8688)
- Unicorn-15020.exe (PID: 8800)
- Unicorn-58126.exe (PID: 6540)
- Unicorn-3588.exe (PID: 8828)
- Unicorn-33467.exe (PID: 8656)
- Unicorn-45773.exe (PID: 8972)
- Unicorn-3588.exe (PID: 8836)
- Unicorn-16438.exe (PID: 8992)
- Unicorn-53679.exe (PID: 7656)
- Unicorn-32875.exe (PID: 8172)
- Unicorn-12454.exe (PID: 2656)
- Unicorn-9731.exe (PID: 9112)
- Unicorn-23707.exe (PID: 9068)
- Unicorn-18192.exe (PID: 9196)
- Unicorn-45026.exe (PID: 9032)
- Unicorn-51532.exe (PID: 8620)
- Unicorn-49795.exe (PID: 8392)
- Unicorn-38180.exe (PID: 8576)
- Unicorn-29458.exe (PID: 8440)
- Unicorn-44832.exe (PID: 472)
- Unicorn-16054.exe (PID: 8300)
- Unicorn-18192.exe (PID: 9188)
- Unicorn-53578.exe (PID: 5200)
- Unicorn-57086.exe (PID: 8476)
- Unicorn-41435.exe (PID: 6656)
- Unicorn-29458.exe (PID: 8456)
- Unicorn-19375.exe (PID: 8340)
- Unicorn-43748.exe (PID: 8520)
- Unicorn-45410.exe (PID: 9424)
- Unicorn-37242.exe (PID: 9400)
- Unicorn-40293.exe (PID: 8380)
- Unicorn-30012.exe (PID: 4300)
- Unicorn-11651.exe (PID: 9496)
- Unicorn-37220.exe (PID: 3900)
- Unicorn-43748.exe (PID: 8504)
- Unicorn-4932.exe (PID: 9156)
- Unicorn-49795.exe (PID: 8372)
- Unicorn-21569.exe (PID: 8940)
- Unicorn-38512.exe (PID: 8356)
- Unicorn-40293.exe (PID: 8560)
- Unicorn-24776.exe (PID: 8364)
- Unicorn-54133.exe (PID: 8968)
- Unicorn-45511.exe (PID: 7636)
- Unicorn-9923.exe (PID: 1196)
- Unicorn-41435.exe (PID: 9204)
- Unicorn-46855.exe (PID: 7644)
- Unicorn-6276.exe (PID: 9676)
- Unicorn-30034.exe (PID: 9508)
- Unicorn-7759.exe (PID: 9644)
- Unicorn-54657.exe (PID: 9560)
- Unicorn-54922.exe (PID: 9576)
- Unicorn-19905.exe (PID: 9212)
- Unicorn-1637.exe (PID: 9616)
- Unicorn-6276.exe (PID: 9668)
- Unicorn-34672.exe (PID: 9800)
- Unicorn-13505.exe (PID: 9848)
- Unicorn-37242.exe (PID: 9416)
- Unicorn-33734.exe (PID: 9768)
- Unicorn-1253.exe (PID: 9828)
- Unicorn-59369.exe (PID: 9468)
- Unicorn-676.exe (PID: 9660)
- Unicorn-43923.exe (PID: 6676)
- Unicorn-33734.exe (PID: 9776)
- Unicorn-22228.exe (PID: 9876)
- Unicorn-45284.exe (PID: 9896)
- Unicorn-39162.exe (PID: 9940)
- Unicorn-43416.exe (PID: 9964)
- Unicorn-42862.exe (PID: 10012)
- Unicorn-48653.exe (PID: 10032)
- Unicorn-60660.exe (PID: 9820)
- Unicorn-24148.exe (PID: 10164)
- Unicorn-15425.exe (PID: 10128)
- Unicorn-14849.exe (PID: 8268)
- Unicorn-51228.exe (PID: 8632)
- Unicorn-31570.exe (PID: 10060)
- Unicorn-27486.exe (PID: 10052)
- Unicorn-39738.exe (PID: 10076)
- Unicorn-11341.exe (PID: 10120)
- Unicorn-8077.exe (PID: 8912)
- Unicorn-60158.exe (PID: 9024)
- Unicorn-31113.exe (PID: 9988)
- Unicorn-25247.exe (PID: 8232)
- Unicorn-27294.exe (PID: 8252)
- Unicorn-38460.exe (PID: 10272)
- Unicorn-24724.exe (PID: 10288)
- Unicorn-19946.exe (PID: 9128)
- Unicorn-3365.exe (PID: 10352)
- Unicorn-28424.exe (PID: 10392)
- Unicorn-14188.exe (PID: 6324)
- Unicorn-4304.exe (PID: 10256)
- Unicorn-1895.exe (PID: 10324)
- Unicorn-33816.exe (PID: 10512)
- Unicorn-28913.exe (PID: 10576)
- Unicorn-29178.exe (PID: 10568)
- Unicorn-8736.exe (PID: 10608)
- Unicorn-24340.exe (PID: 10380)
- Unicorn-12649.exe (PID: 10536)
- Unicorn-50433.exe (PID: 5596)
- Unicorn-8851.exe (PID: 9476)
- Unicorn-8373.exe (PID: 10628)
- Unicorn-59089.exe (PID: 10660)
- Unicorn-61170.exe (PID: 8128)
- Unicorn-63453.exe (PID: 9488)
- Unicorn-37242.exe (PID: 9408)
- Unicorn-47309.exe (PID: 9600)
- Unicorn-31932.exe (PID: 10188)
- Unicorn-7759.exe (PID: 9628)
- Unicorn-39241.exe (PID: 8100)
- Unicorn-60158.exe (PID: 8608)
Executable content was dropped or overwritten
- 1 (1282).exe (PID: 2136)
- Unicorn-23503.exe (PID: 7340)
- Unicorn-22247.exe (PID: 976)
- Unicorn-50591.exe (PID: 960)
- Unicorn-1753.exe (PID: 2096)
- Unicorn-28333.exe (PID: 7376)
- Unicorn-2380.exe (PID: 7396)
- Unicorn-56367.exe (PID: 7360)
- Unicorn-15453.exe (PID: 7456)
- Unicorn-60015.exe (PID: 7472)
- Unicorn-46419.exe (PID: 7436)
- Unicorn-51847.exe (PID: 7496)
- Unicorn-28996.exe (PID: 7520)
- Unicorn-22610.exe (PID: 7552)
- Unicorn-866.exe (PID: 7796)
- Unicorn-30201.exe (PID: 7824)
- Unicorn-37431.exe (PID: 7848)
- Unicorn-23132.exe (PID: 7856)
- Unicorn-57851.exe (PID: 7944)
- Unicorn-15427.exe (PID: 7904)
- Unicorn-35293.exe (PID: 7912)
- Unicorn-57851.exe (PID: 7936)
- Unicorn-9013.exe (PID: 8028)
- Unicorn-26959.exe (PID: 7540)
- Unicorn-43553.exe (PID: 7976)
- Unicorn-23917.exe (PID: 1228)
- Unicorn-27255.exe (PID: 6148)
- Unicorn-19948.exe (PID: 8004)
- Unicorn-7794.exe (PID: 6068)
- Unicorn-64779.exe (PID: 1040)
- Unicorn-17123.exe (PID: 4844)
- Unicorn-15578.exe (PID: 5360)
- Unicorn-52262.exe (PID: 2040)
- Unicorn-33067.exe (PID: 7740)
- Unicorn-54234.exe (PID: 7776)
- Unicorn-6516.exe (PID: 7768)
- Unicorn-53679.exe (PID: 7648)
- Unicorn-37535.exe (PID: 7724)
- Unicorn-53679.exe (PID: 7656)
- Unicorn-45511.exe (PID: 7620)
- Unicorn-41981.exe (PID: 7884)
- Unicorn-32875.exe (PID: 5212)
- Unicorn-10404.exe (PID: 8020)
- Unicorn-32875.exe (PID: 8172)
- Unicorn-58126.exe (PID: 1628)
- Unicorn-62624.exe (PID: 6768)
- Unicorn-30664.exe (PID: 732)
- Unicorn-23461.exe (PID: 7984)
- Unicorn-31981.exe (PID: 7488)
- Unicorn-23726.exe (PID: 7992)
- Unicorn-19231.exe (PID: 1660)
- Unicorn-45511.exe (PID: 7636)
- Unicorn-32875.exe (PID: 2108)
- Unicorn-24598.exe (PID: 7252)
- Unicorn-36658.exe (PID: 7416)
- Unicorn-19231.exe (PID: 5640)
- Unicorn-58126.exe (PID: 6540)
- Unicorn-10404.exe (PID: 8012)
- Unicorn-46855.exe (PID: 7644)
- Unicorn-33954.exe (PID: 7712)
- Unicorn-29432.exe (PID: 8140)
- Unicorn-11058.exe (PID: 5400)
- Unicorn-24580.exe (PID: 6512)
- Unicorn-19973.exe (PID: 4068)
- Unicorn-43923.exe (PID: 6676)
- Unicorn-2073.exe (PID: 8396)
- Unicorn-63718.exe (PID: 8448)
- Unicorn-32560.exe (PID: 8484)
- Unicorn-31287.exe (PID: 2420)
- Unicorn-31430.exe (PID: 8636)
- Unicorn-33467.exe (PID: 8656)
- Unicorn-48150.exe (PID: 8680)
- Unicorn-48150.exe (PID: 8688)
- Unicorn-15020.exe (PID: 8800)
- Unicorn-3588.exe (PID: 8828)
- Unicorn-47958.exe (PID: 8596)
- Unicorn-3588.exe (PID: 8836)
- Unicorn-8077.exe (PID: 8912)
- Unicorn-7693.exe (PID: 9092)
- Unicorn-29817.exe (PID: 7968)
- Unicorn-57470.exe (PID: 8948)
- Unicorn-12454.exe (PID: 2656)
- Unicorn-9731.exe (PID: 9112)
- Unicorn-45026.exe (PID: 9032)
- Unicorn-23707.exe (PID: 9068)
- Unicorn-62624.exe (PID: 1188)
- Unicorn-18192.exe (PID: 9196)
- Unicorn-61170.exe (PID: 8128)
- Unicorn-53578.exe (PID: 5200)
- Unicorn-19946.exe (PID: 9128)
- Unicorn-29458.exe (PID: 8440)
- Unicorn-51532.exe (PID: 8620)
- Unicorn-44832.exe (PID: 472)
- Unicorn-49795.exe (PID: 8392)
- Unicorn-16054.exe (PID: 8300)
- Unicorn-37242.exe (PID: 9400)
- Unicorn-57086.exe (PID: 8476)
- Unicorn-50433.exe (PID: 5596)
- Unicorn-29458.exe (PID: 8456)
- Unicorn-41435.exe (PID: 6656)
- Unicorn-19375.exe (PID: 8340)
- Unicorn-43748.exe (PID: 8520)
- Unicorn-45410.exe (PID: 9424)
- Unicorn-11651.exe (PID: 9496)
- Unicorn-40293.exe (PID: 8380)
- Unicorn-43748.exe (PID: 8504)
- Unicorn-5417.exe (PID: 5936)
- Unicorn-37220.exe (PID: 3900)
- Unicorn-37242.exe (PID: 9408)
- Unicorn-24776.exe (PID: 8364)
- Unicorn-54133.exe (PID: 8968)
- Unicorn-54657.exe (PID: 9560)
- Unicorn-9923.exe (PID: 1196)
- Unicorn-40293.exe (PID: 8560)
- Unicorn-19905.exe (PID: 9212)
- Unicorn-7759.exe (PID: 9628)
- Unicorn-32701.exe (PID: 9316)
- Unicorn-30034.exe (PID: 9508)
- Unicorn-54922.exe (PID: 9568)
- Unicorn-14188.exe (PID: 6324)
- Unicorn-34672.exe (PID: 9800)
- Unicorn-676.exe (PID: 9660)
- Unicorn-59369.exe (PID: 9468)
- Unicorn-1637.exe (PID: 9608)
- Unicorn-6276.exe (PID: 9668)
- Unicorn-33734.exe (PID: 9776)
- Unicorn-47309.exe (PID: 9600)
- Unicorn-33734.exe (PID: 9768)
- Unicorn-10796.exe (PID: 8424)
- Unicorn-60660.exe (PID: 9820)
- Unicorn-1253.exe (PID: 9828)
- Unicorn-39162.exe (PID: 9940)
- Unicorn-48653.exe (PID: 10032)
- Unicorn-42862.exe (PID: 10012)
- Unicorn-43416.exe (PID: 9964)
- Unicorn-31570.exe (PID: 10060)
- Unicorn-22228.exe (PID: 9876)
- Unicorn-45284.exe (PID: 9896)
- Unicorn-24148.exe (PID: 10164)
- Unicorn-15425.exe (PID: 10128)
- Unicorn-11341.exe (PID: 10120)
- Unicorn-51228.exe (PID: 8632)
- Unicorn-27486.exe (PID: 10052)
- Unicorn-31932.exe (PID: 10188)
- Unicorn-60158.exe (PID: 9024)
- Unicorn-45773.exe (PID: 8972)
- Unicorn-25247.exe (PID: 8232)
- Unicorn-27294.exe (PID: 8260)
- Unicorn-60158.exe (PID: 8608)
- Unicorn-31113.exe (PID: 9988)
- Unicorn-27294.exe (PID: 8252)
- Unicorn-24724.exe (PID: 10280)
- Unicorn-1895.exe (PID: 10324)
- Unicorn-24724.exe (PID: 10288)
- Unicorn-3365.exe (PID: 10352)
- Unicorn-28424.exe (PID: 10392)
- Unicorn-4304.exe (PID: 10256)
- Unicorn-33816.exe (PID: 10512)
- Unicorn-12649.exe (PID: 10536)
- Unicorn-8736.exe (PID: 10608)
- Unicorn-29178.exe (PID: 10568)
- Unicorn-8373.exe (PID: 10628)
- Unicorn-24340.exe (PID: 10380)
- Unicorn-28913.exe (PID: 10576)
- Unicorn-18192.exe (PID: 9188)
- Unicorn-49795.exe (PID: 8372)
- Unicorn-59089.exe (PID: 10660)
- Unicorn-30012.exe (PID: 4300)
- Unicorn-5822.exe (PID: 2772)
- Unicorn-41435.exe (PID: 9204)
- Unicorn-54922.exe (PID: 9576)
- Unicorn-30166.exe (PID: 7208)
- Unicorn-38512.exe (PID: 8356)
- Unicorn-59006.exe (PID: 9584)
- Unicorn-9015.exe (PID: 10732)
- Unicorn-39738.exe (PID: 10076)
- Unicorn-14849.exe (PID: 8268)
- Unicorn-37242.exe (PID: 9416)
- Unicorn-9909.exe (PID: 10708)
- Unicorn-39241.exe (PID: 8100)
- Unicorn-16438.exe (PID: 8992)
- Unicorn-1637.exe (PID: 9616)
- Unicorn-38460.exe (PID: 10272)
- Unicorn-21569.exe (PID: 8940)
- Unicorn-6276.exe (PID: 9676)
- Unicorn-63453.exe (PID: 9488)
- Unicorn-12646.exe (PID: 7784)
- Unicorn-38180.exe (PID: 8576)
- Unicorn-45511.exe (PID: 7628)
- Unicorn-4932.exe (PID: 9156)
- Unicorn-7759.exe (PID: 9644)
- Unicorn-13631.exe (PID: 1760)
- Unicorn-48562.exe (PID: 5260)
- Unicorn-42286.exe (PID: 9548)
- Unicorn-13505.exe (PID: 9848)
Executes application which crashes
- Unicorn-65254.exe (PID: 8220)
- Unicorn-293.exe (PID: 4988)
INFO
Reads the computer name
- 1 (1282).exe (PID: 2136)
- Unicorn-50591.exe (PID: 960)
- Unicorn-22247.exe (PID: 976)
- Unicorn-1753.exe (PID: 2096)
- Unicorn-2380.exe (PID: 7396)
- Unicorn-56367.exe (PID: 7360)
- Unicorn-23503.exe (PID: 7340)
- Unicorn-15453.exe (PID: 7456)
- Unicorn-28996.exe (PID: 7520)
- Unicorn-51847.exe (PID: 7496)
- Unicorn-31981.exe (PID: 7488)
- Unicorn-46419.exe (PID: 7436)
- Unicorn-866.exe (PID: 7796)
- Unicorn-26959.exe (PID: 7540)
- Unicorn-22610.exe (PID: 7552)
- Unicorn-29817.exe (PID: 7968)
- Unicorn-9013.exe (PID: 8028)
- Unicorn-10404.exe (PID: 8020)
- Unicorn-10404.exe (PID: 8012)
- Unicorn-23132.exe (PID: 7856)
- Unicorn-57851.exe (PID: 7944)
- Unicorn-23461.exe (PID: 7984)
- Unicorn-15578.exe (PID: 5360)
- Unicorn-64779.exe (PID: 1040)
- Unicorn-17123.exe (PID: 4844)
- Unicorn-30664.exe (PID: 732)
- Unicorn-53679.exe (PID: 7656)
- Unicorn-45511.exe (PID: 7620)
- Unicorn-62624.exe (PID: 1188)
- Unicorn-36658.exe (PID: 7416)
- Unicorn-45511.exe (PID: 7636)
- Unicorn-31287.exe (PID: 2420)
- Unicorn-10796.exe (PID: 8424)
- Unicorn-31430.exe (PID: 8636)
- Unicorn-29458.exe (PID: 8456)
- Unicorn-63453.exe (PID: 9488)
- Unicorn-33734.exe (PID: 9776)
- Unicorn-24724.exe (PID: 10280)
- Unicorn-29178.exe (PID: 10568)
- Unicorn-8373.exe (PID: 10628)
Checks supported languages
- Unicorn-22247.exe (PID: 976)
- 1 (1282).exe (PID: 2136)
- Unicorn-50591.exe (PID: 960)
- Unicorn-1753.exe (PID: 2096)
- Unicorn-23503.exe (PID: 7340)
- Unicorn-28333.exe (PID: 7376)
- Unicorn-46419.exe (PID: 7436)
- Unicorn-56367.exe (PID: 7360)
- Unicorn-2380.exe (PID: 7396)
- Unicorn-60015.exe (PID: 7472)
- Unicorn-31981.exe (PID: 7488)
- Unicorn-28996.exe (PID: 7520)
- Unicorn-26959.exe (PID: 7540)
- Unicorn-22610.exe (PID: 7552)
- Unicorn-15453.exe (PID: 7456)
- Unicorn-37431.exe (PID: 7848)
- Unicorn-30201.exe (PID: 7824)
- Unicorn-866.exe (PID: 7796)
- Unicorn-23132.exe (PID: 7856)
- Unicorn-57851.exe (PID: 7944)
- Unicorn-57851.exe (PID: 7936)
- Unicorn-29817.exe (PID: 7968)
- Unicorn-23461.exe (PID: 7984)
- Unicorn-9013.exe (PID: 8028)
- Unicorn-10404.exe (PID: 8020)
- Unicorn-23726.exe (PID: 7992)
- Unicorn-10404.exe (PID: 8012)
- Unicorn-19948.exe (PID: 8004)
- Unicorn-15427.exe (PID: 7904)
- Unicorn-35293.exe (PID: 7912)
- Unicorn-43553.exe (PID: 7976)
- Unicorn-7794.exe (PID: 6068)
- Unicorn-52262.exe (PID: 2040)
- Unicorn-17123.exe (PID: 4844)
- Unicorn-41981.exe (PID: 7884)
- Unicorn-45511.exe (PID: 7636)
- Unicorn-62624.exe (PID: 1188)
- Unicorn-62624.exe (PID: 6768)
- Unicorn-32875.exe (PID: 8172)
- Unicorn-5417.exe (PID: 5936)
- Unicorn-32875.exe (PID: 5212)
- Unicorn-5822.exe (PID: 2772)
- Unicorn-46855.exe (PID: 7644)
- Unicorn-11058.exe (PID: 5400)
- Unicorn-14188.exe (PID: 6324)
- Unicorn-47958.exe (PID: 8596)
- Unicorn-10796.exe (PID: 8424)
- Unicorn-31430.exe (PID: 8636)
- Unicorn-7693.exe (PID: 9092)
- Unicorn-48150.exe (PID: 8680)
- Unicorn-8851.exe (PID: 9476)
- Unicorn-29458.exe (PID: 8440)
- Unicorn-42286.exe (PID: 9548)
- Unicorn-7759.exe (PID: 9628)
- Unicorn-7759.exe (PID: 9644)
- Unicorn-33734.exe (PID: 9776)
- Unicorn-1253.exe (PID: 9828)
- Unicorn-60660.exe (PID: 9820)
- Unicorn-33816.exe (PID: 10512)
- Unicorn-25247.exe (PID: 8232)
- Unicorn-9015.exe (PID: 10732)
- Unicorn-8736.exe (PID: 10608)
- Unicorn-18758.exe (PID: 2064)
- Unicorn-35094.exe (PID: 11504)
- Unicorn-51430.exe (PID: 11536)
- Unicorn-26542.exe (PID: 11460)
- Unicorn-10397.exe (PID: 11636)
- Unicorn-10397.exe (PID: 11668)
- Unicorn-62596.exe (PID: 11912)
- Unicorn-46003.exe (PID: 11628)
- Unicorn-21563.exe (PID: 12060)
- Unicorn-30818.exe (PID: 11792)
- Unicorn-16188.exe (PID: 11776)
- Unicorn-11357.exe (PID: 11968)
- Unicorn-3381.exe (PID: 12196)
- Unicorn-3381.exe (PID: 11500)
- Unicorn-64237.exe (PID: 11676)
- Unicorn-62596.exe (PID: 11920)
- Unicorn-23972.exe (PID: 12324)
- Unicorn-60174.exe (PID: 12528)
- Unicorn-31129.exe (PID: 12644)
- Unicorn-23972.exe (PID: 12340)
- Unicorn-64258.exe (PID: 12448)
- Unicorn-15249.exe (PID: 12796)
- Unicorn-60921.exe (PID: 12832)
- Unicorn-37568.exe (PID: 13116)
- Unicorn-11165.exe (PID: 12760)
- Unicorn-24378.exe (PID: 13092)
- Unicorn-4149.exe (PID: 13180)
- Unicorn-20220.exe (PID: 13188)
- Unicorn-47988.exe (PID: 13520)
- Unicorn-4917.exe (PID: 13584)
- Unicorn-57818.exe (PID: 13700)
- Unicorn-18108.exe (PID: 13864)
- Unicorn-20683.exe (PID: 13976)
- Unicorn-51378.exe (PID: 14136)
- Unicorn-54030.exe (PID: 14700)
- Unicorn-8456.exe (PID: 2244)
- Unicorn-47656.exe (PID: 15852)
- Unicorn-42664.exe (PID: 15652)
- Unicorn-26328.exe (PID: 15624)
- Unicorn-53957.exe (PID: 6388)
- Unicorn-50972.exe (PID: 7244)
- Unicorn-48359.exe (PID: 15996)
- Unicorn-47656.exe (PID: 15816)
- Unicorn-58425.exe (PID: 15980)
- Unicorn-16764.exe (PID: 16440)
- Unicorn-14652.exe (PID: 16468)
- Unicorn-49470.exe (PID: 15888)
- Unicorn-3823.exe (PID: 15956)
- Unicorn-6623.exe (PID: 15944)
- Unicorn-28711.exe (PID: 16188)
- Unicorn-54898.exe (PID: 16828)
- Unicorn-61252.exe (PID: 16852)
- Unicorn-43432.exe (PID: 16804)
- Unicorn-59193.exe (PID: 17136)
- Unicorn-59193.exe (PID: 17128)
- Unicorn-56033.exe (PID: 17748)
- Unicorn-59873.exe (PID: 18044)
- Unicorn-40272.exe (PID: 18052)
- Unicorn-46032.exe (PID: 18180)
The sample compiled with chinese language support
- 1 (1282).exe (PID: 2136)
- Unicorn-25247.exe (PID: 8232)
- Unicorn-60158.exe (PID: 9024)
- Unicorn-41435.exe (PID: 9204)
- Unicorn-29817.exe (PID: 7968)
- Unicorn-7759.exe (PID: 9644)
- Unicorn-27294.exe (PID: 8252)
- Unicorn-38460.exe (PID: 10272)
- Unicorn-12646.exe (PID: 7784)
- Unicorn-53679.exe (PID: 7656)
- Unicorn-57851.exe (PID: 7944)
- Unicorn-38512.exe (PID: 8356)
- Unicorn-12454.exe (PID: 2656)
- Unicorn-31113.exe (PID: 9988)
- Unicorn-60015.exe (PID: 7472)
- Unicorn-1895.exe (PID: 10324)
- Unicorn-24724.exe (PID: 10288)
- Unicorn-9731.exe (PID: 9112)
- Unicorn-45026.exe (PID: 9032)
- Unicorn-51847.exe (PID: 7496)
- Unicorn-32875.exe (PID: 5212)
- Unicorn-19946.exe (PID: 9128)
- Unicorn-58126.exe (PID: 1628)
- Unicorn-3365.exe (PID: 10352)
- Unicorn-19231.exe (PID: 1660)
- Unicorn-28424.exe (PID: 10392)
- Unicorn-27294.exe (PID: 8260)
- Unicorn-14188.exe (PID: 6324)
- Unicorn-4304.exe (PID: 10256)
- Unicorn-9013.exe (PID: 8028)
- Unicorn-28333.exe (PID: 7376)
- Unicorn-24724.exe (PID: 10280)
- Unicorn-57470.exe (PID: 8948)
- Unicorn-41981.exe (PID: 7884)
- Unicorn-45511.exe (PID: 7620)
- Unicorn-45773.exe (PID: 8972)
- Unicorn-23707.exe (PID: 9068)
- Unicorn-31287.exe (PID: 2420)
- Unicorn-12649.exe (PID: 10536)
- Unicorn-29178.exe (PID: 10568)
- Unicorn-43923.exe (PID: 6676)
- Unicorn-45284.exe (PID: 9896)
- Unicorn-10404.exe (PID: 8020)
- Unicorn-24340.exe (PID: 10380)
- Unicorn-33816.exe (PID: 10512)
- Unicorn-51532.exe (PID: 8620)
- Unicorn-16054.exe (PID: 8300)
- Unicorn-19375.exe (PID: 8340)
- Unicorn-37242.exe (PID: 9400)
- Unicorn-29458.exe (PID: 8456)
- Unicorn-22610.exe (PID: 7552)
- Unicorn-8736.exe (PID: 10608)
- Unicorn-8373.exe (PID: 10628)
- Unicorn-59089.exe (PID: 10660)
- Unicorn-16438.exe (PID: 8992)
- Unicorn-18192.exe (PID: 9196)
- Unicorn-53578.exe (PID: 5200)
- Unicorn-62624.exe (PID: 1188)
- Unicorn-57086.exe (PID: 8476)
- Unicorn-49795.exe (PID: 8392)
- Unicorn-18192.exe (PID: 9188)
- Unicorn-24598.exe (PID: 7252)
- Unicorn-11651.exe (PID: 9496)
- Unicorn-28913.exe (PID: 10576)
- Unicorn-26959.exe (PID: 7540)
- Unicorn-50591.exe (PID: 960)
- Unicorn-32875.exe (PID: 2108)
- Unicorn-40293.exe (PID: 8560)
- Unicorn-30664.exe (PID: 732)
- Unicorn-24580.exe (PID: 6512)
- Unicorn-28996.exe (PID: 7520)
- Unicorn-10404.exe (PID: 8012)
- Unicorn-866.exe (PID: 7796)
- Unicorn-27255.exe (PID: 6148)
- Unicorn-23461.exe (PID: 7984)
- Unicorn-22247.exe (PID: 976)
- Unicorn-62624.exe (PID: 6768)
- Unicorn-23726.exe (PID: 7992)
- Unicorn-1753.exe (PID: 2096)
- Unicorn-13631.exe (PID: 1760)
- Unicorn-54133.exe (PID: 8968)
- Unicorn-48562.exe (PID: 5260)
- Unicorn-15453.exe (PID: 7456)
- Unicorn-7794.exe (PID: 6068)
- Unicorn-37242.exe (PID: 9416)
- Unicorn-23503.exe (PID: 7340)
- Unicorn-29432.exe (PID: 8140)
- Unicorn-30201.exe (PID: 7824)
- Unicorn-59369.exe (PID: 9468)
- Unicorn-42286.exe (PID: 9548)
- Unicorn-13505.exe (PID: 9848)
- Unicorn-33954.exe (PID: 7712)
- Unicorn-1637.exe (PID: 9616)
- Unicorn-39241.exe (PID: 8100)
- Unicorn-9923.exe (PID: 1196)
- Unicorn-46419.exe (PID: 7436)
- Unicorn-5822.exe (PID: 2772)
- Unicorn-59006.exe (PID: 9584)
- Unicorn-64779.exe (PID: 1040)
- Unicorn-54657.exe (PID: 9560)
- Unicorn-52262.exe (PID: 2040)
- Unicorn-9909.exe (PID: 10708)
- Unicorn-35293.exe (PID: 7912)
- Unicorn-42862.exe (PID: 10012)
- Unicorn-43416.exe (PID: 9964)
- Unicorn-2073.exe (PID: 8396)
- Unicorn-39162.exe (PID: 9940)
- Unicorn-9015.exe (PID: 10732)
- Unicorn-23132.exe (PID: 7856)
- Unicorn-27486.exe (PID: 10052)
- Unicorn-2380.exe (PID: 7396)
- Unicorn-39738.exe (PID: 10076)
- Unicorn-29458.exe (PID: 8440)
- Unicorn-15425.exe (PID: 10128)
- Unicorn-31430.exe (PID: 8636)
- Unicorn-3588.exe (PID: 8836)
- Unicorn-6516.exe (PID: 7768)
- Unicorn-51228.exe (PID: 8632)
- Unicorn-4932.exe (PID: 9156)
- Unicorn-43748.exe (PID: 8504)
- Unicorn-8077.exe (PID: 8912)
- Unicorn-56367.exe (PID: 7360)
- Unicorn-24776.exe (PID: 8364)
- Unicorn-32560.exe (PID: 8484)
- Unicorn-37535.exe (PID: 7724)
- Unicorn-48653.exe (PID: 10032)
- Unicorn-47958.exe (PID: 8596)
- Unicorn-22228.exe (PID: 9876)
- Unicorn-3588.exe (PID: 8828)
- Unicorn-31932.exe (PID: 10188)
- Unicorn-46855.exe (PID: 7644)
- Unicorn-31981.exe (PID: 7488)
- Unicorn-57851.exe (PID: 7936)
- Unicorn-60660.exe (PID: 9820)
- Unicorn-40293.exe (PID: 8380)
- Unicorn-30012.exe (PID: 4300)
- Unicorn-30166.exe (PID: 7208)
- Unicorn-41435.exe (PID: 6656)
- Unicorn-37242.exe (PID: 9408)
- Unicorn-36658.exe (PID: 7416)
- Unicorn-21569.exe (PID: 8940)
- Unicorn-45511.exe (PID: 7636)
- Unicorn-32701.exe (PID: 9316)
- Unicorn-17123.exe (PID: 4844)
- Unicorn-23917.exe (PID: 1228)
- Unicorn-37431.exe (PID: 7848)
- Unicorn-6276.exe (PID: 9668)
- Unicorn-43553.exe (PID: 7976)
- Unicorn-34672.exe (PID: 9800)
- Unicorn-58126.exe (PID: 6540)
- Unicorn-15578.exe (PID: 5360)
- Unicorn-11058.exe (PID: 5400)
- Unicorn-48150.exe (PID: 8688)
- Unicorn-33467.exe (PID: 8656)
- Unicorn-6276.exe (PID: 9676)
- Unicorn-11341.exe (PID: 10120)
- Unicorn-15427.exe (PID: 7904)
- Unicorn-31570.exe (PID: 10060)
- Unicorn-47309.exe (PID: 9600)
- Unicorn-45511.exe (PID: 7628)
- Unicorn-48150.exe (PID: 8680)
- Unicorn-49795.exe (PID: 8372)
- Unicorn-33067.exe (PID: 7740)
- Unicorn-60158.exe (PID: 8608)
- Unicorn-15020.exe (PID: 8800)
- Unicorn-7693.exe (PID: 9092)
- Unicorn-32875.exe (PID: 8172)
Create files in a temporary directory
- 1 (1282).exe (PID: 2136)
- Unicorn-23503.exe (PID: 7340)
- Unicorn-50591.exe (PID: 960)
- Unicorn-22247.exe (PID: 976)
- Unicorn-2380.exe (PID: 7396)
- Unicorn-1753.exe (PID: 2096)
- Unicorn-46419.exe (PID: 7436)
- Unicorn-15453.exe (PID: 7456)
- Unicorn-60015.exe (PID: 7472)
- Unicorn-28996.exe (PID: 7520)
- Unicorn-866.exe (PID: 7796)
- Unicorn-37431.exe (PID: 7848)
- Unicorn-57851.exe (PID: 7944)
- Unicorn-9013.exe (PID: 8028)
- Unicorn-15427.exe (PID: 7904)
- Unicorn-35293.exe (PID: 7912)
- Unicorn-27255.exe (PID: 6148)
- Unicorn-30201.exe (PID: 7824)
- Unicorn-52262.exe (PID: 2040)
- Unicorn-37535.exe (PID: 7724)
- Unicorn-33067.exe (PID: 7740)
- Unicorn-53679.exe (PID: 7648)
- Unicorn-57851.exe (PID: 7936)
- Unicorn-32875.exe (PID: 5212)
- Unicorn-10404.exe (PID: 8020)
- Unicorn-51847.exe (PID: 7496)
- Unicorn-56367.exe (PID: 7360)
- Unicorn-19231.exe (PID: 5640)
- Unicorn-32875.exe (PID: 2108)
- Unicorn-31981.exe (PID: 7488)
- Unicorn-19948.exe (PID: 8004)
- Unicorn-30664.exe (PID: 732)
- Unicorn-23461.exe (PID: 7984)
- Unicorn-24598.exe (PID: 7252)
- Unicorn-23917.exe (PID: 1228)
- Unicorn-7794.exe (PID: 6068)
- Unicorn-29432.exe (PID: 8140)
- Unicorn-24580.exe (PID: 6512)
- Unicorn-15578.exe (PID: 5360)
- Unicorn-31430.exe (PID: 8636)
- Unicorn-47958.exe (PID: 8596)
- Unicorn-48150.exe (PID: 8680)
- Unicorn-12454.exe (PID: 2656)
- Unicorn-57086.exe (PID: 8476)
- Unicorn-62624.exe (PID: 6768)
- Unicorn-43748.exe (PID: 8504)
- Unicorn-28333.exe (PID: 7376)
- Unicorn-22610.exe (PID: 7552)
- Unicorn-23726.exe (PID: 7992)
- Unicorn-24776.exe (PID: 8364)
- Unicorn-45284.exe (PID: 9896)
- Unicorn-24148.exe (PID: 10164)
- Unicorn-3588.exe (PID: 8828)
- Unicorn-25247.exe (PID: 8232)
- Unicorn-27294.exe (PID: 8260)
- Unicorn-58126.exe (PID: 1628)
- Unicorn-45026.exe (PID: 9032)
- Unicorn-12649.exe (PID: 10536)
- Unicorn-18192.exe (PID: 9188)
- Unicorn-29458.exe (PID: 8440)
- Unicorn-43416.exe (PID: 9964)
- Unicorn-15020.exe (PID: 8800)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 7636)
- BackgroundTransferHost.exe (PID: 8112)
- BackgroundTransferHost.exe (PID: 7316)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 8112)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 8112)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 8112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:04:26 10:28:09+00:00 |
| ImageFileCharacteristics: | Executable, No line numbers, No symbols, [6], Bytes reversed lo, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 8192 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13b0 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | aaaa |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
694
Monitored processes
556
Malicious processes
74
Suspicious processes
72
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 472 | C:\Users\admin\AppData\Local\Temp\Unicorn-44832.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-44832.exe | Unicorn-22247.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 732 | C:\Users\admin\AppData\Local\Temp\Unicorn-30664.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-30664.exe | Unicorn-1753.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 960 | C:\Users\admin\AppData\Local\Temp\Unicorn-50591.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-50591.exe | Unicorn-22247.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 976 | C:\Users\admin\AppData\Local\Temp\Unicorn-22247.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-22247.exe | 1 (1282).exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1040 | C:\Users\admin\AppData\Local\Temp\Unicorn-64779.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-64779.exe | Unicorn-37431.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1188 | C:\Users\admin\AppData\Local\Temp\Unicorn-62624.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-62624.exe | Unicorn-28333.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1196 | C:\Users\admin\AppData\Local\Temp\Unicorn-9923.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9923.exe | Unicorn-31981.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1228 | C:\Users\admin\AppData\Local\Temp\Unicorn-23917.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-23917.exe | Unicorn-46419.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1628 | C:\Users\admin\AppData\Local\Temp\Unicorn-58126.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-58126.exe | Unicorn-31981.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1660 | C:\Users\admin\AppData\Local\Temp\Unicorn-19231.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-19231.exe | Unicorn-22610.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
Total events
16 252
Read events
16 237
Write events
15
Delete events
0
Modification events
| (PID) Process: | (7636) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7636) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7636) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (8112) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (8112) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (8112) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6676) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6676) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6676) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7316) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
998
Suspicious files
11
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 976 | Unicorn-22247.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-28333.exe | executable | |
MD5:D08B5FD04015F19EC97CF523C2571468 | SHA256:2B397B004D8740B78441ED2B6952EDD2D26AADDC14097A71D2BFEF693311E07E | |||
| 976 | Unicorn-22247.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-50591.exe | executable | |
MD5:DF389AFF8C7A92FC5271DF6D1404244A | SHA256:50BEDBAC75D90D760309C3AD805D3EA3D1BB6B5E7541498B7FE521FCEDAFA48D | |||
| 2136 | 1 (1282).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-1753.exe | executable | |
MD5:7CBBBEF5C020F5256DC64768664AC96B | SHA256:F14C98694F3FF94FE1914F794A3DD0CFACB6198126D340BF18F5612430373133 | |||
| 2136 | 1 (1282).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-22610.exe | executable | |
MD5:26F0BCBFEA37AE8639CC0268DA3527F5 | SHA256:F8A311DF23240DDD64C578A8AE80C4464C1019B86B717E2BFCF469D9A04CA98F | |||
| 2096 | Unicorn-1753.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56367.exe | executable | |
MD5:BB7A2596563A6FCC694CD5D4BBC9FDAD | SHA256:1337307AAD0EB3C4E27D920068549509EC927E0DEE03BA5C41908DC6B3CE2C17 | |||
| 7436 | Unicorn-46419.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-866.exe | executable | |
MD5:37EDE50C23C80D5EDC725754AC8CEC58 | SHA256:F39D143D34296CA627E2B4270BD731CAEDEC91EA8113AB63DBE0652444F99622 | |||
| 7360 | Unicorn-56367.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-60015.exe | executable | |
MD5:AB4EA61ED6550B9D8D147097FC6A8FAD | SHA256:8902433E7B262C2CC20826CD1585FFF9959C52E2CDCE1C5490351BCB3B05ED87 | |||
| 2096 | Unicorn-1753.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-31981.exe | executable | |
MD5:DC26DCFC6A13564231D1FC00FCD265E1 | SHA256:B651024C4D60F24E39BC534ED088FC3E936638AD9952DA997432202D78732A3C | |||
| 960 | Unicorn-50591.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-23503.exe | executable | |
MD5:FB6E10CC5932583B28D90F07DCB0A5C8 | SHA256:9DC44DC92C8A0613B3868A00D03497D32484A98595AF073501DC2C2551AA0091 | |||
| 2136 | 1 (1282).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-2380.exe | executable | |
MD5:773D22EC64F5F51574F9F2EB73CF66FE | SHA256:49EDDB772EC28A3701750F503684A0E5ADE6E10468D584A17F796A167BAD00FF | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
18
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.143:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
8112 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
8568 | SIHClient.exe | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
8568 | SIHClient.exe | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.48.23.143:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4380 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 40.126.32.134:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |