| File name: | 1 (277) |
| Full analysis: | https://app.any.run/tasks/5632d944-376a-43d4-96e4-e6d5cdab3912 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 18:17:05 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 5FB6EDB18905708D9FD0FD088C955750 |
| SHA1: | 15CD808839C9C0AD5D2A2EA3B3C37397157000F0 |
| SHA256: | 54E0387EED599E0A6611682232C3012CC970542F6DC1784869BAB4712A40D956 |
| SSDEEP: | 6144:R7Ig/VLCaDRCA5op16exRCfx5dVrZp8GBV/SSVOntk/8SwjwpyAvEhIdy/at56oa:Rkqh9CA521VIV1+aV6SVOn4x4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- 1 (277).exe (PID: 4944)
- Unicorn-1541.exe (PID: 7776)
- Unicorn-51111.exe (PID: 7848)
- Unicorn-49065.exe (PID: 7864)
- Unicorn-19399.exe (PID: 7908)
- Unicorn-17261.exe (PID: 7944)
- Unicorn-60239.exe (PID: 7976)
- Unicorn-33332.exe (PID: 8024)
- Unicorn-45055.exe (PID: 6572)
- Unicorn-2631.exe (PID: 2236)
- Unicorn-4022.exe (PID: 1056)
- Unicorn-41355.exe (PID: 5728)
- Unicorn-14712.exe (PID: 5800)
- Unicorn-18797.exe (PID: 4740)
- Unicorn-25429.exe (PID: 7964)
- Unicorn-64468.exe (PID: 4688)
- Unicorn-51561.exe (PID: 5956)
- Unicorn-18195.exe (PID: 7728)
- Unicorn-14665.exe (PID: 7352)
- Unicorn-56989.exe (PID: 7328)
- Unicorn-24225.exe (PID: 7308)
- Unicorn-48729.exe (PID: 1388)
- Unicorn-22087.exe (PID: 4068)
- Unicorn-26725.exe (PID: 5756)
- Unicorn-28863.exe (PID: 7796)
- Unicorn-10218.exe (PID: 8148)
- Unicorn-43467.exe (PID: 6040)
- Unicorn-6689.exe (PID: 8172)
- Unicorn-14712.exe (PID: 4696)
- Unicorn-43467.exe (PID: 5308)
- Unicorn-14712.exe (PID: 6744)
- Unicorn-7073.exe (PID: 3676)
- Unicorn-14686.exe (PID: 6476)
- Unicorn-33161.exe (PID: 8124)
- Unicorn-39937.exe (PID: 6456)
- Unicorn-2989.exe (PID: 2616)
- Unicorn-10602.exe (PID: 4268)
- Unicorn-10602.exe (PID: 7280)
- Unicorn-55619.exe (PID: 6712)
- Unicorn-33741.exe (PID: 7000)
- Unicorn-55619.exe (PID: 8068)
- Unicorn-10602.exe (PID: 8112)
- Unicorn-55619.exe (PID: 8072)
- Unicorn-9647.exe (PID: 7992)
- Unicorn-61484.exe (PID: 3900)
- Unicorn-33741.exe (PID: 300)
- Unicorn-17209.exe (PID: 6564)
- Unicorn-9595.exe (PID: 5392)
- Unicorn-56451.exe (PID: 3268)
- Unicorn-44199.exe (PID: 7344)
- Unicorn-35391.exe (PID: 7720)
- Unicorn-36585.exe (PID: 7416)
- Unicorn-35839.exe (PID: 7492)
- Unicorn-39923.exe (PID: 5384)
- Unicorn-2901.exe (PID: 7724)
- Unicorn-44562.exe (PID: 968)
- Unicorn-46045.exe (PID: 7516)
- Unicorn-9864.exe (PID: 7600)
- Unicorn-27671.exe (PID: 7664)
- Unicorn-3742.exe (PID: 1764)
- Unicorn-13280.exe (PID: 3008)
- Unicorn-48667.exe (PID: 7476)
- Unicorn-65003.exe (PID: 8200)
- Unicorn-6164.exe (PID: 8276)
- Unicorn-8189.exe (PID: 8228)
- Unicorn-4126.exe (PID: 8256)
- Unicorn-63249.exe (PID: 8324)
- Unicorn-37161.exe (PID: 8356)
- Unicorn-25101.exe (PID: 8300)
- Unicorn-63887.exe (PID: 4008)
- Unicorn-6518.exe (PID: 8088)
- Unicorn-33161.exe (PID: 8104)
- Unicorn-11116.exe (PID: 8720)
- Unicorn-13254.exe (PID: 8688)
- Unicorn-19285.exe (PID: 8736)
- Unicorn-19285.exe (PID: 8744)
- Unicorn-9070.exe (PID: 8728)
- Unicorn-39404.exe (PID: 8832)
- Unicorn-42419.exe (PID: 8876)
- Unicorn-17915.exe (PID: 8808)
- Unicorn-17915.exe (PID: 8816)
- Unicorn-48449.exe (PID: 8988)
- Unicorn-24499.exe (PID: 8956)
- Unicorn-9554.exe (PID: 8940)
- Unicorn-39404.exe (PID: 8824)
- Unicorn-48449.exe (PID: 8980)
- Unicorn-28583.exe (PID: 8972)
- Unicorn-62739.exe (PID: 9036)
- Unicorn-34059.exe (PID: 9028)
- Unicorn-17622.exe (PID: 9060)
- Unicorn-32232.exe (PID: 736)
- Unicorn-42538.exe (PID: 7500)
- Unicorn-62739.exe (PID: 9092)
- Unicorn-49004.exe (PID: 9100)
- Unicorn-7416.exe (PID: 9044)
- Unicorn-44920.exe (PID: 9008)
- Unicorn-62647.exe (PID: 9080)
- Unicorn-16715.exe (PID: 208)
- Unicorn-44749.exe (PID: 5964)
- Unicorn-7760.exe (PID: 8288)
- Unicorn-42538.exe (PID: 8224)
- Unicorn-9838.exe (PID: 8668)
- Unicorn-37764.exe (PID: 6268)
- Unicorn-48833.exe (PID: 7012)
- Unicorn-58952.exe (PID: 8132)
- Unicorn-43165.exe (PID: 7084)
- Unicorn-41411.exe (PID: 9188)
- Unicorn-57769.exe (PID: 9364)
- Unicorn-21013.exe (PID: 9320)
- Unicorn-27789.exe (PID: 9308)
- Unicorn-41552.exe (PID: 9496)
- Unicorn-2346.exe (PID: 9396)
- Unicorn-2346.exe (PID: 9404)
- Unicorn-46648.exe (PID: 9452)
- Unicorn-27619.exe (PID: 9436)
- Unicorn-48594.exe (PID: 9484)
- Unicorn-39871.exe (PID: 9464)
- Unicorn-49223.exe (PID: 9540)
- Unicorn-53254.exe (PID: 9656)
- Unicorn-41433.exe (PID: 9344)
- Unicorn-53254.exe (PID: 9648)
- Unicorn-46285.exe (PID: 9792)
- Unicorn-11666.exe (PID: 9700)
- Unicorn-7125.exe (PID: 9764)
- Unicorn-50369.exe (PID: 9808)
- Unicorn-44339.exe (PID: 9744)
- Unicorn-35163.exe (PID: 9924)
- Unicorn-19377.exe (PID: 9824)
- Unicorn-40155.exe (PID: 9784)
- Unicorn-59092.exe (PID: 9868)
- Unicorn-63176.exe (PID: 9876)
- Unicorn-48899.exe (PID: 9932)
- Unicorn-60099.exe (PID: 9616)
- Unicorn-2730.exe (PID: 9640)
- Unicorn-37633.exe (PID: 9580)
- Unicorn-23897.exe (PID: 9572)
- Unicorn-36171.exe (PID: 9720)
- Unicorn-46285.exe (PID: 9800)
- Unicorn-13996.exe (PID: 9980)
- Unicorn-59476.exe (PID: 10036)
- Unicorn-55029.exe (PID: 9972)
- Unicorn-34971.exe (PID: 10008)
- Unicorn-31101.exe (PID: 10192)
- Unicorn-8350.exe (PID: 10060)
- Unicorn-59397.exe (PID: 10120)
- Unicorn-26633.exe (PID: 10108)
- Unicorn-8734.exe (PID: 10148)
- Unicorn-39937.exe (PID: 6388)
- Unicorn-55532.exe (PID: 10168)
- Unicorn-48761.exe (PID: 6036)
- Unicorn-62926.exe (PID: 4112)
- Unicorn-24499.exe (PID: 8948)
- Unicorn-44920.exe (PID: 9016)
- Unicorn-59995.exe (PID: 7360)
- Unicorn-32497.exe (PID: 7892)
- Unicorn-51054.exe (PID: 9628)
- Unicorn-9366.exe (PID: 780)
- Unicorn-10872.exe (PID: 8344)
- Unicorn-62382.exe (PID: 10212)
- Unicorn-27453.exe (PID: 8772)
- Unicorn-15240.exe (PID: 8400)
- Unicorn-62211.exe (PID: 8404)
Starts itself from another location
- 1 (277).exe (PID: 4944)
- Unicorn-1541.exe (PID: 7776)
- Unicorn-51111.exe (PID: 7848)
- Unicorn-49065.exe (PID: 7864)
- Unicorn-19399.exe (PID: 7908)
- Unicorn-17261.exe (PID: 7944)
- Unicorn-25429.exe (PID: 7964)
- Unicorn-60239.exe (PID: 7976)
- Unicorn-33332.exe (PID: 8024)
- Unicorn-9647.exe (PID: 7992)
- Unicorn-45055.exe (PID: 6572)
- Unicorn-2631.exe (PID: 2236)
- Unicorn-4022.exe (PID: 1056)
- Unicorn-14712.exe (PID: 6744)
- Unicorn-14712.exe (PID: 5800)
- Unicorn-33741.exe (PID: 300)
- Unicorn-48761.exe (PID: 6036)
- Unicorn-14712.exe (PID: 4696)
- Unicorn-64468.exe (PID: 4688)
- Unicorn-33741.exe (PID: 7000)
- Unicorn-41355.exe (PID: 5728)
- Unicorn-18195.exe (PID: 7728)
- Unicorn-14665.exe (PID: 7352)
- Unicorn-56989.exe (PID: 7328)
- Unicorn-24225.exe (PID: 7308)
- Unicorn-48729.exe (PID: 1388)
- Unicorn-22087.exe (PID: 4068)
- Unicorn-26725.exe (PID: 5756)
- Unicorn-28863.exe (PID: 7796)
- Unicorn-10218.exe (PID: 8148)
- Unicorn-6689.exe (PID: 8172)
- Unicorn-43467.exe (PID: 6040)
- Unicorn-43467.exe (PID: 5308)
- Unicorn-7073.exe (PID: 3676)
- Unicorn-51561.exe (PID: 5956)
- Unicorn-14686.exe (PID: 6476)
- Unicorn-63887.exe (PID: 4008)
- Unicorn-33161.exe (PID: 8124)
- Unicorn-6518.exe (PID: 8088)
- Unicorn-39937.exe (PID: 6388)
- Unicorn-33161.exe (PID: 8104)
- Unicorn-10602.exe (PID: 7280)
- Unicorn-62926.exe (PID: 4112)
- Unicorn-55619.exe (PID: 6712)
- Unicorn-18797.exe (PID: 4740)
- Unicorn-55619.exe (PID: 8072)
- Unicorn-55619.exe (PID: 8068)
- Unicorn-10602.exe (PID: 8112)
- Unicorn-61484.exe (PID: 3900)
- Unicorn-17209.exe (PID: 6564)
- Unicorn-56451.exe (PID: 3268)
- Unicorn-44199.exe (PID: 7344)
- Unicorn-36585.exe (PID: 7416)
- Unicorn-10602.exe (PID: 4268)
- Unicorn-2901.exe (PID: 7724)
- Unicorn-59995.exe (PID: 7360)
- Unicorn-35839.exe (PID: 7492)
- Unicorn-39923.exe (PID: 5384)
- Unicorn-44562.exe (PID: 968)
- Unicorn-9864.exe (PID: 7600)
- Unicorn-46045.exe (PID: 7516)
- Unicorn-27671.exe (PID: 7664)
- Unicorn-3742.exe (PID: 1764)
- Unicorn-58952.exe (PID: 8132)
- Unicorn-13280.exe (PID: 3008)
- Unicorn-65003.exe (PID: 8200)
- Unicorn-8189.exe (PID: 8228)
- Unicorn-6164.exe (PID: 8276)
- Unicorn-4126.exe (PID: 8256)
- Unicorn-63249.exe (PID: 8324)
- Unicorn-37161.exe (PID: 8356)
- Unicorn-9595.exe (PID: 5392)
- Unicorn-25101.exe (PID: 8300)
- Unicorn-39937.exe (PID: 6456)
- Unicorn-2989.exe (PID: 2616)
- Unicorn-11116.exe (PID: 8720)
- Unicorn-13254.exe (PID: 8688)
- Unicorn-19285.exe (PID: 8736)
- Unicorn-48667.exe (PID: 7476)
- Unicorn-9070.exe (PID: 8728)
- Unicorn-27453.exe (PID: 8772)
- Unicorn-39404.exe (PID: 8832)
- Unicorn-42419.exe (PID: 8876)
- Unicorn-17915.exe (PID: 8808)
- Unicorn-17915.exe (PID: 8816)
- Unicorn-48449.exe (PID: 8988)
- Unicorn-24499.exe (PID: 8956)
- Unicorn-39404.exe (PID: 8824)
- Unicorn-9554.exe (PID: 8940)
- Unicorn-17622.exe (PID: 9060)
- Unicorn-48449.exe (PID: 8980)
- Unicorn-28583.exe (PID: 8972)
- Unicorn-62739.exe (PID: 9036)
- Unicorn-44920.exe (PID: 9016)
- Unicorn-34059.exe (PID: 9028)
- Unicorn-32232.exe (PID: 736)
- Unicorn-49004.exe (PID: 9100)
- Unicorn-62739.exe (PID: 9092)
- Unicorn-24499.exe (PID: 8948)
- Unicorn-44920.exe (PID: 9008)
- Unicorn-62647.exe (PID: 9080)
- Unicorn-32497.exe (PID: 7892)
- Unicorn-42538.exe (PID: 8224)
- Unicorn-16715.exe (PID: 208)
- Unicorn-44749.exe (PID: 5964)
- Unicorn-7760.exe (PID: 8288)
- Unicorn-48833.exe (PID: 7012)
- Unicorn-9838.exe (PID: 8668)
- Unicorn-43165.exe (PID: 7084)
- Unicorn-37764.exe (PID: 6268)
- Unicorn-7416.exe (PID: 9044)
- Unicorn-57769.exe (PID: 9364)
- Unicorn-21013.exe (PID: 9320)
INFO
Checks supported languages
- Unicorn-1541.exe (PID: 7776)
- Unicorn-49065.exe (PID: 7864)
- Unicorn-17261.exe (PID: 7944)
- Unicorn-51111.exe (PID: 7848)
- Unicorn-19399.exe (PID: 7908)
- Unicorn-60239.exe (PID: 7976)
- Unicorn-9647.exe (PID: 7992)
- Unicorn-33332.exe (PID: 8024)
- Unicorn-25429.exe (PID: 7964)
- Unicorn-45055.exe (PID: 6572)
- Unicorn-4022.exe (PID: 1056)
- Unicorn-2631.exe (PID: 2236)
- Unicorn-41355.exe (PID: 5728)
- Unicorn-14712.exe (PID: 4696)
- Unicorn-14712.exe (PID: 6744)
- Unicorn-14712.exe (PID: 5800)
- Unicorn-18797.exe (PID: 4740)
- Unicorn-33741.exe (PID: 300)
- Unicorn-33741.exe (PID: 7000)
- Unicorn-48761.exe (PID: 6036)
- Unicorn-51561.exe (PID: 5956)
- Unicorn-64468.exe (PID: 4688)
- Unicorn-18195.exe (PID: 7728)
- Unicorn-14665.exe (PID: 7352)
- Unicorn-56989.exe (PID: 7328)
- Unicorn-22087.exe (PID: 4068)
- Unicorn-24225.exe (PID: 7308)
- Unicorn-48729.exe (PID: 1388)
- Unicorn-28863.exe (PID: 7796)
- Unicorn-26725.exe (PID: 5756)
- Unicorn-10218.exe (PID: 8148)
- Unicorn-6689.exe (PID: 8172)
- Unicorn-43467.exe (PID: 6040)
- Unicorn-39937.exe (PID: 6456)
- Unicorn-43467.exe (PID: 5308)
- Unicorn-33161.exe (PID: 8124)
- Unicorn-63887.exe (PID: 4008)
- Unicorn-39937.exe (PID: 6388)
- Unicorn-10602.exe (PID: 8112)
- Unicorn-14686.exe (PID: 6476)
- Unicorn-2989.exe (PID: 2616)
- Unicorn-55619.exe (PID: 6712)
- Unicorn-33161.exe (PID: 8104)
- Unicorn-10602.exe (PID: 4268)
- Unicorn-61484.exe (PID: 3900)
- Unicorn-55619.exe (PID: 8068)
- Unicorn-10602.exe (PID: 7280)
- Unicorn-6518.exe (PID: 8088)
- Unicorn-17209.exe (PID: 6564)
- Unicorn-9595.exe (PID: 5392)
- Unicorn-59995.exe (PID: 7360)
- Unicorn-35391.exe (PID: 7720)
- Unicorn-2901.exe (PID: 7724)
- Unicorn-44199.exe (PID: 7344)
- Unicorn-56451.exe (PID: 3268)
- Unicorn-36585.exe (PID: 7416)
- Unicorn-27671.exe (PID: 7664)
- Unicorn-39923.exe (PID: 5384)
- Unicorn-58952.exe (PID: 8132)
- Unicorn-46045.exe (PID: 7516)
- Unicorn-13280.exe (PID: 3008)
- Unicorn-3742.exe (PID: 1764)
- Unicorn-35839.exe (PID: 7492)
- Unicorn-44562.exe (PID: 968)
- Unicorn-65003.exe (PID: 8200)
- Unicorn-8189.exe (PID: 8228)
- Unicorn-48667.exe (PID: 7476)
- Unicorn-4126.exe (PID: 8256)
- Unicorn-6164.exe (PID: 8276)
- Unicorn-25101.exe (PID: 8300)
- Unicorn-63249.exe (PID: 8324)
- Unicorn-37161.exe (PID: 8356)
- Unicorn-13254.exe (PID: 8688)
- Unicorn-62926.exe (PID: 4112)
- Unicorn-11116.exe (PID: 8720)
- Unicorn-9070.exe (PID: 8728)
- Unicorn-19285.exe (PID: 8736)
- Unicorn-27453.exe (PID: 8772)
- Unicorn-19285.exe (PID: 8744)
- Unicorn-17915.exe (PID: 8816)
- Unicorn-7073.exe (PID: 3676)
- Unicorn-17915.exe (PID: 8808)
- Unicorn-42419.exe (PID: 8876)
- Unicorn-24499.exe (PID: 8956)
- Unicorn-28583.exe (PID: 8972)
- Unicorn-39404.exe (PID: 8824)
- Unicorn-24499.exe (PID: 8948)
- Unicorn-34059.exe (PID: 9028)
- Unicorn-48449.exe (PID: 8980)
- Unicorn-48449.exe (PID: 8988)
- Unicorn-62739.exe (PID: 9036)
- Unicorn-44920.exe (PID: 9016)
- Unicorn-17622.exe (PID: 9060)
- Unicorn-49004.exe (PID: 9100)
- Unicorn-42538.exe (PID: 7500)
- Unicorn-44920.exe (PID: 9008)
- Unicorn-41411.exe (PID: 9188)
- Unicorn-42538.exe (PID: 8224)
- Unicorn-62647.exe (PID: 9080)
- Unicorn-7760.exe (PID: 8288)
- Unicorn-32232.exe (PID: 736)
- Unicorn-48833.exe (PID: 7012)
- Unicorn-32497.exe (PID: 7892)
- Unicorn-44749.exe (PID: 5964)
- Unicorn-9838.exe (PID: 8668)
- Unicorn-37764.exe (PID: 6268)
- Unicorn-21013.exe (PID: 9320)
- Unicorn-27789.exe (PID: 9308)
- Unicorn-41433.exe (PID: 9344)
- Unicorn-2346.exe (PID: 9404)
- Unicorn-27619.exe (PID: 9436)
- Unicorn-39871.exe (PID: 9464)
- Unicorn-41552.exe (PID: 9496)
- Unicorn-57769.exe (PID: 9364)
- Unicorn-2730.exe (PID: 9640)
- Unicorn-49223.exe (PID: 9540)
- Unicorn-37633.exe (PID: 9580)
- Unicorn-60099.exe (PID: 9616)
- Unicorn-53254.exe (PID: 9648)
- Unicorn-11666.exe (PID: 9700)
- Unicorn-53254.exe (PID: 9656)
- Unicorn-23897.exe (PID: 9572)
- Unicorn-36171.exe (PID: 9720)
- Unicorn-44339.exe (PID: 9744)
- Unicorn-7125.exe (PID: 9764)
- Unicorn-46285.exe (PID: 9792)
- Unicorn-40155.exe (PID: 9784)
- Unicorn-46285.exe (PID: 9800)
- Unicorn-59092.exe (PID: 9868)
- Unicorn-63176.exe (PID: 9876)
- Unicorn-48899.exe (PID: 9932)
- Unicorn-13996.exe (PID: 9980)
- Unicorn-55029.exe (PID: 9972)
- Unicorn-50369.exe (PID: 9808)
- Unicorn-19377.exe (PID: 9824)
- Unicorn-59476.exe (PID: 10036)
- Unicorn-26633.exe (PID: 10108)
- Unicorn-59397.exe (PID: 10120)
- Unicorn-8350.exe (PID: 10060)
- Unicorn-62382.exe (PID: 10212)
- Unicorn-15240.exe (PID: 8400)
- Unicorn-62211.exe (PID: 8404)
- Unicorn-9366.exe (PID: 780)
- Unicorn-10872.exe (PID: 8344)
- Unicorn-16715.exe (PID: 208)
- Unicorn-31101.exe (PID: 10192)
- Unicorn-25563.exe (PID: 10244)
- Unicorn-23425.exe (PID: 10272)
- Unicorn-47110.exe (PID: 10280)
- Unicorn-39761.exe (PID: 10340)
- Unicorn-31593.exe (PID: 10304)
- Unicorn-41707.exe (PID: 10368)
- Unicorn-45792.exe (PID: 10392)
- Unicorn-8956.exe (PID: 10508)
- Unicorn-25947.exe (PID: 10496)
- Unicorn-8956.exe (PID: 10512)
- Unicorn-34115.exe (PID: 10528)
- Unicorn-8956.exe (PID: 10504)
- Unicorn-45792.exe (PID: 10384)
- Unicorn-27317.exe (PID: 10444)
- Unicorn-41629.exe (PID: 10628)
- Unicorn-12683.exe (PID: 10604)
- Unicorn-13503.exe (PID: 10680)
- Unicorn-59746.exe (PID: 10664)
- Unicorn-58620.exe (PID: 10612)
- Unicorn-58620.exe (PID: 10620)
- Unicorn-31322.exe (PID: 10708)
- Unicorn-2456.exe (PID: 10936)
- Unicorn-65226.exe (PID: 10952)
- Unicorn-31322.exe (PID: 10700)
- Unicorn-27147.exe (PID: 10784)
- Unicorn-57058.exe (PID: 10928)
- Unicorn-22677.exe (PID: 11032)
- Unicorn-51962.exe (PID: 11048)
- Unicorn-48143.exe (PID: 11040)
- Unicorn-40067.exe (PID: 10944)
- Unicorn-65226.exe (PID: 10960)
- Unicorn-15470.exe (PID: 10968)
- Unicorn-27622.exe (PID: 11096)
- Unicorn-31615.exe (PID: 11188)
- Unicorn-7110.exe (PID: 11136)
- Unicorn-29477.exe (PID: 11236)
- Unicorn-25585.exe (PID: 11084)
- Unicorn-7110.exe (PID: 11128)
- Unicorn-15855.exe (PID: 5588)
- Unicorn-30053.exe (PID: 7596)
- Unicorn-27915.exe (PID: 7588)
- Unicorn-34329.exe (PID: 11244)
- Unicorn-40167.exe (PID: 5680)
- Unicorn-48335.exe (PID: 5064)
- Unicorn-8070.exe (PID: 11332)
- Unicorn-15562.exe (PID: 8384)
- Unicorn-40721.exe (PID: 11296)
- Unicorn-21693.exe (PID: 11284)
- Unicorn-34713.exe (PID: 11316)
- Unicorn-34713.exe (PID: 11352)
- Unicorn-20323.exe (PID: 11372)
- Unicorn-55133.exe (PID: 11384)
- Unicorn-457.exe (PID: 11364)
- Unicorn-24407.exe (PID: 11392)
- Unicorn-36659.exe (PID: 11440)
- Unicorn-47520.exe (PID: 11424)
- Unicorn-44827.exe (PID: 11476)
- Unicorn-61163.exe (PID: 11536)
- Unicorn-20131.exe (PID: 11584)
- Unicorn-61718.exe (PID: 11568)
- Unicorn-1848.exe (PID: 11432)
- Unicorn-61718.exe (PID: 11560)
- Unicorn-54755.exe (PID: 11744)
- Unicorn-47328.exe (PID: 11612)
- Unicorn-1656.exe (PID: 11624)
- Unicorn-37021.exe (PID: 11696)
- Unicorn-44635.exe (PID: 11664)
- Unicorn-50472.exe (PID: 11764)
- Unicorn-26737.exe (PID: 11800)
- Unicorn-18468.exe (PID: 11908)
- Unicorn-27291.exe (PID: 11868)
- Unicorn-7997.exe (PID: 11828)
- Unicorn-43627.exe (PID: 11944)
- Unicorn-24599.exe (PID: 11928)
- Unicorn-4733.exe (PID: 11916)
- Unicorn-37405.exe (PID: 12000)
- Unicorn-55880.exe (PID: 11980)
- Unicorn-2132.exe (PID: 11840)
- Unicorn-8262.exe (PID: 11848)
- Unicorn-28994.exe (PID: 12084)
- Unicorn-16244.exe (PID: 12032)
- Unicorn-5309.exe (PID: 12040)
- Unicorn-9393.exe (PID: 12076)
- Unicorn-51717.exe (PID: 12188)
- Unicorn-20990.exe (PID: 12204)
- Unicorn-32886.exe (PID: 5232)
- Unicorn-22845.exe (PID: 6656)
- Unicorn-20328.exe (PID: 12052)
- Unicorn-50618.exe (PID: 12324)
- Unicorn-28059.exe (PID: 12348)
- Unicorn-40068.exe (PID: 12376)
- Unicorn-16383.exe (PID: 12384)
- Unicorn-47547.exe (PID: 12484)
- Unicorn-41873.exe (PID: 1096)
- Unicorn-41873.exe (PID: 9536)
- Unicorn-27596.exe (PID: 12236)
- Unicorn-56185.exe (PID: 12300)
- Unicorn-50618.exe (PID: 12316)
- Unicorn-28443.exe (PID: 12464)
- Unicorn-50255.exe (PID: 12580)
Reads the computer name
- Unicorn-1541.exe (PID: 7776)
- Unicorn-19399.exe (PID: 7908)
- Unicorn-51111.exe (PID: 7848)
- Unicorn-49065.exe (PID: 7864)
- Unicorn-9647.exe (PID: 7992)
- Unicorn-17261.exe (PID: 7944)
- Unicorn-60239.exe (PID: 7976)
- Unicorn-2631.exe (PID: 2236)
- Unicorn-25429.exe (PID: 7964)
- Unicorn-4022.exe (PID: 1056)
- Unicorn-14712.exe (PID: 5800)
- Unicorn-41355.exe (PID: 5728)
- Unicorn-14712.exe (PID: 6744)
- Unicorn-51561.exe (PID: 5956)
- Unicorn-64468.exe (PID: 4688)
- Unicorn-14712.exe (PID: 4696)
- Unicorn-18797.exe (PID: 4740)
- Unicorn-48761.exe (PID: 6036)
- Unicorn-33332.exe (PID: 8024)
- Unicorn-45055.exe (PID: 6572)
- Unicorn-24225.exe (PID: 7308)
- Unicorn-56989.exe (PID: 7328)
- Unicorn-22087.exe (PID: 4068)
- Unicorn-48729.exe (PID: 1388)
- Unicorn-28863.exe (PID: 7796)
- Unicorn-26725.exe (PID: 5756)
- Unicorn-10218.exe (PID: 8148)
- Unicorn-6689.exe (PID: 8172)
- Unicorn-14665.exe (PID: 7352)
- Unicorn-43467.exe (PID: 6040)
- Unicorn-43467.exe (PID: 5308)
- Unicorn-7073.exe (PID: 3676)
- Unicorn-14686.exe (PID: 6476)
- Unicorn-2989.exe (PID: 2616)
- Unicorn-63887.exe (PID: 4008)
- Unicorn-39937.exe (PID: 6388)
- Unicorn-33161.exe (PID: 8124)
- Unicorn-39937.exe (PID: 6456)
- Unicorn-10602.exe (PID: 7280)
- Unicorn-10602.exe (PID: 4268)
- Unicorn-55619.exe (PID: 6712)
- Unicorn-55619.exe (PID: 8072)
- Unicorn-55619.exe (PID: 8068)
- Unicorn-10602.exe (PID: 8112)
- Unicorn-9595.exe (PID: 5392)
- Unicorn-17209.exe (PID: 6564)
- Unicorn-33161.exe (PID: 8104)
- Unicorn-56451.exe (PID: 3268)
- Unicorn-35391.exe (PID: 7720)
- Unicorn-44199.exe (PID: 7344)
- Unicorn-39923.exe (PID: 5384)
- Unicorn-59995.exe (PID: 7360)
- Unicorn-2901.exe (PID: 7724)
- Unicorn-46045.exe (PID: 7516)
- Unicorn-3742.exe (PID: 1764)
- Unicorn-27671.exe (PID: 7664)
- Unicorn-58952.exe (PID: 8132)
- Unicorn-48667.exe (PID: 7476)
- Unicorn-8189.exe (PID: 8228)
- Unicorn-4126.exe (PID: 8256)
- Unicorn-6164.exe (PID: 8276)
- Unicorn-25101.exe (PID: 8300)
- Unicorn-37161.exe (PID: 8356)
- Unicorn-63249.exe (PID: 8324)
- Unicorn-13254.exe (PID: 8688)
- Unicorn-9070.exe (PID: 8728)
- Unicorn-17915.exe (PID: 8816)
- Unicorn-19285.exe (PID: 8736)
- Unicorn-19285.exe (PID: 8744)
- Unicorn-27453.exe (PID: 8772)
- Unicorn-17915.exe (PID: 8808)
- Unicorn-48449.exe (PID: 8980)
- Unicorn-17622.exe (PID: 9060)
- Unicorn-28583.exe (PID: 8972)
- Unicorn-24499.exe (PID: 8956)
- Unicorn-34059.exe (PID: 9028)
- Unicorn-49004.exe (PID: 9100)
- Unicorn-62739.exe (PID: 9036)
- Unicorn-62739.exe (PID: 9092)
- Unicorn-42538.exe (PID: 7500)
- Unicorn-41411.exe (PID: 9188)
- Unicorn-7416.exe (PID: 9044)
- Unicorn-24499.exe (PID: 8948)
- Unicorn-44920.exe (PID: 9008)
- Unicorn-62647.exe (PID: 9080)
- Unicorn-32497.exe (PID: 7892)
- Unicorn-42538.exe (PID: 8224)
- Unicorn-9838.exe (PID: 8668)
- Unicorn-48833.exe (PID: 7012)
- Unicorn-37764.exe (PID: 6268)
- Unicorn-44749.exe (PID: 5964)
- Unicorn-43165.exe (PID: 7084)
- Unicorn-27789.exe (PID: 9308)
- Unicorn-41433.exe (PID: 9344)
The sample compiled with chinese language support
- 1 (277).exe (PID: 4944)
- Unicorn-34971.exe (PID: 10008)
- Unicorn-14712.exe (PID: 4696)
- Unicorn-53254.exe (PID: 9648)
- Unicorn-25429.exe (PID: 7964)
- Unicorn-10602.exe (PID: 7280)
- Unicorn-62382.exe (PID: 10212)
- Unicorn-9647.exe (PID: 7992)
- Unicorn-64468.exe (PID: 4688)
- Unicorn-55619.exe (PID: 8068)
- Unicorn-18797.exe (PID: 4740)
- Unicorn-62926.exe (PID: 4112)
- Unicorn-60239.exe (PID: 7976)
- Unicorn-35391.exe (PID: 7720)
- Unicorn-46285.exe (PID: 9792)
- Unicorn-13254.exe (PID: 8688)
- Unicorn-50369.exe (PID: 9808)
- Unicorn-51111.exe (PID: 7848)
- Unicorn-9595.exe (PID: 5392)
- Unicorn-27453.exe (PID: 8772)
- Unicorn-17209.exe (PID: 6564)
- Unicorn-49065.exe (PID: 7864)
- Unicorn-7125.exe (PID: 9764)
- Unicorn-33741.exe (PID: 300)
- Unicorn-19285.exe (PID: 8744)
- Unicorn-19377.exe (PID: 9824)
- Unicorn-40155.exe (PID: 9784)
- Unicorn-1541.exe (PID: 7776)
- Unicorn-18195.exe (PID: 7728)
- Unicorn-61484.exe (PID: 3900)
- Unicorn-45055.exe (PID: 6572)
- Unicorn-11116.exe (PID: 8720)
- Unicorn-44339.exe (PID: 9744)
- Unicorn-59092.exe (PID: 9868)
- Unicorn-35163.exe (PID: 9924)
- Unicorn-9554.exe (PID: 8940)
- Unicorn-14686.exe (PID: 6476)
- Unicorn-17915.exe (PID: 8808)
- Unicorn-9366.exe (PID: 780)
- Unicorn-48449.exe (PID: 8988)
- Unicorn-24499.exe (PID: 8956)
- Unicorn-17622.exe (PID: 9060)
- Unicorn-33161.exe (PID: 8104)
- Unicorn-56451.exe (PID: 3268)
- Unicorn-10602.exe (PID: 4268)
- Unicorn-62739.exe (PID: 9036)
- Unicorn-44199.exe (PID: 7344)
- Unicorn-63176.exe (PID: 9876)
- Unicorn-42419.exe (PID: 8876)
- Unicorn-17915.exe (PID: 8816)
- Unicorn-44920.exe (PID: 9016)
- Unicorn-2901.exe (PID: 7724)
- Unicorn-36585.exe (PID: 7416)
- Unicorn-49004.exe (PID: 9100)
- Unicorn-62739.exe (PID: 9092)
- Unicorn-32497.exe (PID: 7892)
- Unicorn-24499.exe (PID: 8948)
- Unicorn-35839.exe (PID: 7492)
- Unicorn-13996.exe (PID: 9980)
- Unicorn-39923.exe (PID: 5384)
- Unicorn-7760.exe (PID: 8288)
- Unicorn-56989.exe (PID: 7328)
- Unicorn-14665.exe (PID: 7352)
- Unicorn-19399.exe (PID: 7908)
- Unicorn-28583.exe (PID: 8972)
- Unicorn-32232.exe (PID: 736)
- Unicorn-48899.exe (PID: 9932)
- Unicorn-16715.exe (PID: 208)
- Unicorn-27671.exe (PID: 7664)
- Unicorn-28863.exe (PID: 7796)
- Unicorn-44749.exe (PID: 5964)
- Unicorn-48833.exe (PID: 7012)
- Unicorn-58952.exe (PID: 8132)
- Unicorn-3742.exe (PID: 1764)
- Unicorn-48729.exe (PID: 1388)
- Unicorn-22087.exe (PID: 4068)
- Unicorn-55029.exe (PID: 9972)
- Unicorn-44562.exe (PID: 968)
- Unicorn-24225.exe (PID: 7308)
- Unicorn-2631.exe (PID: 2236)
- Unicorn-9864.exe (PID: 7600)
- Unicorn-46045.exe (PID: 7516)
- Unicorn-19285.exe (PID: 8736)
- Unicorn-39404.exe (PID: 8832)
- Unicorn-43165.exe (PID: 7084)
- Unicorn-41411.exe (PID: 9188)
- Unicorn-10218.exe (PID: 8148)
- Unicorn-15240.exe (PID: 8400)
- Unicorn-7416.exe (PID: 9044)
- Unicorn-44920.exe (PID: 9008)
- Unicorn-6164.exe (PID: 8276)
- Unicorn-41355.exe (PID: 5728)
- Unicorn-8350.exe (PID: 10060)
- Unicorn-4126.exe (PID: 8256)
- Unicorn-17261.exe (PID: 7944)
- Unicorn-4022.exe (PID: 1056)
- Unicorn-65003.exe (PID: 8200)
- Unicorn-48667.exe (PID: 7476)
- Unicorn-6689.exe (PID: 8172)
- Unicorn-59476.exe (PID: 10036)
- Unicorn-13280.exe (PID: 3008)
- Unicorn-26633.exe (PID: 10108)
- Unicorn-27789.exe (PID: 9308)
- Unicorn-41433.exe (PID: 9344)
- Unicorn-37161.exe (PID: 8356)
- Unicorn-14712.exe (PID: 5800)
- Unicorn-63249.exe (PID: 8324)
- Unicorn-2346.exe (PID: 9396)
- Unicorn-10872.exe (PID: 8344)
- Unicorn-43467.exe (PID: 5308)
- Unicorn-14712.exe (PID: 6744)
- Unicorn-2346.exe (PID: 9404)
- Unicorn-46648.exe (PID: 9452)
- Unicorn-57769.exe (PID: 9364)
- Unicorn-59397.exe (PID: 10120)
- Unicorn-21013.exe (PID: 9320)
- Unicorn-25101.exe (PID: 8300)
- Unicorn-43467.exe (PID: 6040)
- Unicorn-8734.exe (PID: 10148)
- Unicorn-55532.exe (PID: 10168)
- Unicorn-53254.exe (PID: 9656)
- Unicorn-60099.exe (PID: 9616)
- Unicorn-7073.exe (PID: 3676)
- Unicorn-55619.exe (PID: 8072)
- Unicorn-63887.exe (PID: 4008)
- Unicorn-51054.exe (PID: 9628)
- Unicorn-33332.exe (PID: 8024)
- Unicorn-31101.exe (PID: 10192)
- Unicorn-36171.exe (PID: 9720)
- Unicorn-39937.exe (PID: 6388)
- Unicorn-39937.exe (PID: 6456)
- Unicorn-48761.exe (PID: 6036)
- Unicorn-41552.exe (PID: 9496)
- Unicorn-48594.exe (PID: 9484)
- Unicorn-9838.exe (PID: 8668)
- Unicorn-37764.exe (PID: 6268)
- Unicorn-8189.exe (PID: 8228)
- Unicorn-51561.exe (PID: 5956)
- Unicorn-33741.exe (PID: 7000)
- Unicorn-55619.exe (PID: 6712)
- Unicorn-48449.exe (PID: 8980)
- Unicorn-42538.exe (PID: 8224)
Create files in a temporary directory
- 1 (277).exe (PID: 4944)
- Unicorn-51111.exe (PID: 7848)
- Unicorn-49065.exe (PID: 7864)
- Unicorn-1541.exe (PID: 7776)
- Unicorn-2631.exe (PID: 2236)
- Unicorn-17261.exe (PID: 7944)
- Unicorn-14712.exe (PID: 5800)
- Unicorn-18797.exe (PID: 4740)
- Unicorn-51561.exe (PID: 5956)
- Unicorn-25429.exe (PID: 7964)
- Unicorn-60239.exe (PID: 7976)
- Unicorn-33332.exe (PID: 8024)
- Unicorn-64468.exe (PID: 4688)
- Unicorn-45055.exe (PID: 6572)
- Unicorn-24225.exe (PID: 7308)
- Unicorn-19399.exe (PID: 7908)
- Unicorn-28863.exe (PID: 7796)
- Unicorn-4022.exe (PID: 1056)
- Unicorn-22087.exe (PID: 4068)
- Unicorn-26725.exe (PID: 5756)
- Unicorn-10218.exe (PID: 8148)
- Unicorn-41355.exe (PID: 5728)
- Unicorn-43467.exe (PID: 6040)
- Unicorn-43467.exe (PID: 5308)
- Unicorn-14712.exe (PID: 6744)
- Unicorn-7073.exe (PID: 3676)
- Unicorn-33161.exe (PID: 8124)
- Unicorn-39937.exe (PID: 6456)
- Unicorn-2989.exe (PID: 2616)
- Unicorn-55619.exe (PID: 6712)
- Unicorn-14712.exe (PID: 4696)
- Unicorn-55619.exe (PID: 8072)
- Unicorn-55619.exe (PID: 8068)
- Unicorn-10602.exe (PID: 8112)
- Unicorn-9647.exe (PID: 7992)
- Unicorn-61484.exe (PID: 3900)
- Unicorn-33741.exe (PID: 300)
- Unicorn-17209.exe (PID: 6564)
- Unicorn-18195.exe (PID: 7728)
- Unicorn-10602.exe (PID: 4268)
- Unicorn-9595.exe (PID: 5392)
- Unicorn-56451.exe (PID: 3268)
- Unicorn-44199.exe (PID: 7344)
- Unicorn-36585.exe (PID: 7416)
- Unicorn-14686.exe (PID: 6476)
- Unicorn-35839.exe (PID: 7492)
- Unicorn-56989.exe (PID: 7328)
- Unicorn-39923.exe (PID: 5384)
- Unicorn-14665.exe (PID: 7352)
- Unicorn-2901.exe (PID: 7724)
- Unicorn-9864.exe (PID: 7600)
- Unicorn-46045.exe (PID: 7516)
- Unicorn-3742.exe (PID: 1764)
- Unicorn-13280.exe (PID: 3008)
- Unicorn-27671.exe (PID: 7664)
- Unicorn-48729.exe (PID: 1388)
- Unicorn-48667.exe (PID: 7476)
- Unicorn-65003.exe (PID: 8200)
- Unicorn-8189.exe (PID: 8228)
- Unicorn-4126.exe (PID: 8256)
- Unicorn-6689.exe (PID: 8172)
- Unicorn-37161.exe (PID: 8356)
- Unicorn-63249.exe (PID: 8324)
- Unicorn-63887.exe (PID: 4008)
- Unicorn-6518.exe (PID: 8088)
- Unicorn-62926.exe (PID: 4112)
- Unicorn-10602.exe (PID: 7280)
- Unicorn-33161.exe (PID: 8104)
- Unicorn-13254.exe (PID: 8688)
- Unicorn-33741.exe (PID: 7000)
- Unicorn-11116.exe (PID: 8720)
- Unicorn-19285.exe (PID: 8744)
- Unicorn-9070.exe (PID: 8728)
- Unicorn-35391.exe (PID: 7720)
- Unicorn-42419.exe (PID: 8876)
- Unicorn-17915.exe (PID: 8816)
- Unicorn-39404.exe (PID: 8824)
- Unicorn-48449.exe (PID: 8988)
- Unicorn-9554.exe (PID: 8940)
- Unicorn-62739.exe (PID: 9036)
- Unicorn-34059.exe (PID: 9028)
- Unicorn-32232.exe (PID: 736)
- Unicorn-17622.exe (PID: 9060)
- Unicorn-49004.exe (PID: 9100)
- Unicorn-62739.exe (PID: 9092)
- Unicorn-7416.exe (PID: 9044)
- Unicorn-44920.exe (PID: 9008)
- Unicorn-7760.exe (PID: 8288)
- Unicorn-62647.exe (PID: 9080)
- Unicorn-16715.exe (PID: 208)
- Unicorn-42538.exe (PID: 8224)
- Unicorn-9838.exe (PID: 8668)
- Unicorn-48833.exe (PID: 7012)
- Unicorn-43165.exe (PID: 7084)
- Unicorn-58952.exe (PID: 8132)
- Unicorn-6164.exe (PID: 8276)
- Unicorn-41411.exe (PID: 9188)
- Unicorn-25101.exe (PID: 8300)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 8080)
- BackgroundTransferHost.exe (PID: 1812)
- BackgroundTransferHost.exe (PID: 7496)
- BackgroundTransferHost.exe (PID: 7808)
- BackgroundTransferHost.exe (PID: 8616)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 1812)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 1812)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 1812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
434
Monitored processes
288
Malicious processes
35
Suspicious processes
41
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\Users\admin\AppData\Local\Temp\Unicorn-16715.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-16715.exe | Unicorn-33741.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 300 | C:\Users\admin\AppData\Local\Temp\Unicorn-33741.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-33741.exe | Unicorn-51111.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 736 | C:\Users\admin\AppData\Local\Temp\Unicorn-32232.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-32232.exe | Unicorn-49065.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 780 | C:\Users\admin\AppData\Local\Temp\Unicorn-9366.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9366.exe | Unicorn-14712.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 968 | C:\Users\admin\AppData\Local\Temp\Unicorn-44562.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-44562.exe | Unicorn-41639.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1056 | C:\Users\admin\AppData\Local\Temp\Unicorn-4022.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-4022.exe | Unicorn-11785.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1096 | C:\Users\admin\AppData\Local\Temp\Unicorn-41873.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-41873.exe | — | Unicorn-48667.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1276 | C:\Users\admin\AppData\Local\Temp\Unicorn-27020.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-27020.exe | — | Unicorn-22087.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1388 | C:\Users\admin\AppData\Local\Temp\Unicorn-48729.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-48729.exe | Unicorn-4022.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1764 | C:\Users\admin\AppData\Local\Temp\Unicorn-3742.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3742.exe | Unicorn-26725.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
7 420
Read events
7 405
Write events
15
Delete events
0
Modification events
| (PID) Process: | (8080) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (8080) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (8080) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (1812) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (1812) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (1812) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7496) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7496) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7496) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7808) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
914
Suspicious files
5
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1812 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\9f00265d-3b2b-4b76-9530-73bfb288c805.down_data | — | |
MD5:— | SHA256:— | |||
| 7776 | Unicorn-1541.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-51111.exe | executable | |
MD5:59B749251A2BE45E912BE5305E9A1ACC | SHA256:7F71BA235CDDC506E578A387F4694DC198FB2E7A417952AD23887343FE404B32 | |||
| 4944 | 1 (277).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49065.exe | executable | |
MD5:2D9D2DA44AEA0789DEC5F0A81F985092 | SHA256:5E2512E44CC713C8443C0C4684B6C3D5ADEB97FE6B5579FF738FCA1149DE47AB | |||
| 7776 | Unicorn-1541.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-51561.exe | executable | |
MD5:06E4FC21695BC814DE9692C41FE0E975 | SHA256:E5CE5B460212495078975E5F28F0A9A889F7840AC73C8B05FF02BDEF4B0EE715 | |||
| 4944 | 1 (277).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-29985.exe | executable | |
MD5:4B59011187AB8C7300E7BFC037877D67 | SHA256:E60C0538D4E191354371296C44B99623CA1ABCD0666BF657CDBE25B35213C21E | |||
| 4944 | 1 (277).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-48761.exe | executable | |
MD5:959B7E26CA963C8514653AABB37F1099 | SHA256:472DF7D31E92BCEF17F736BA139B923917B25E8AB1075CE6C6AF7AC4910F38C4 | |||
| 8024 | Unicorn-33332.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-18797.exe | executable | |
MD5:ECF8EA5A3F11324323401A9C1BE1A887 | SHA256:6C3745E6CE3EA599D172A24F1FF7027ED7B73251F47D9E6427AF41558A1AD750 | |||
| 1812 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:9FB2DEB97258D6F38857624430E3F7CC | SHA256:99FE8E0B22F5E0E88DE2A76D6270D21CE318EAC3A969E137A76707D2270BCC6B | |||
| 1812 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
| 1812 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\9f00265d-3b2b-4b76-9530-73bfb288c805.008ac729-1a88-4212-9b23-9923a56a916e.down_meta | binary | |
MD5:AC72EB0087B97478517CBC31CC8BF771 | SHA256:EC119B46C091CC104408915F9B1C95243358F792D596329F1BE9D63825190FC5 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
18
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 95.101.54.128:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6668 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
1812 | BackgroundTransferHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
8344 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
8344 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 95.101.54.128:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 40.126.32.68:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
6544 | svchost.exe | 40.126.32.68:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6668 | backgroundTaskHost.exe | 20.199.58.43:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6668 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |