| File name: | 1 (1107) |
| Full analysis: | https://app.any.run/tasks/41704552-9d49-4b57-9ed9-8dd4dc5f28a2 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 09:30:13 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 827751ADC9AB1BB32EA66F834C85B4A0 |
| SHA1: | 9DCDF9208156D1F6DA3FAB3F38519551D70F335C |
| SHA256: | 6E6E12B441656B7A5C24B15019C5C57C81319D9A0EBAFA600256F16B6D160335 |
| SSDEEP: | 6144:97w8nV9PQDceA5LjFgeHH5jx5wPq5p8GBf/Wy1OZ5k/8SwjwpyAvEhvgkPTMstLa:9sOzFeA5/FbGP0+afOy1OZNx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- 1 (1107).exe (PID: 6032)
- Unicorn-20619.exe (PID: 6240)
- Unicorn-55299.exe (PID: 5544)
- Unicorn-17089.exe (PID: 6476)
- Unicorn-63763.exe (PID: 5116)
- Unicorn-60234.exe (PID: 660)
- Unicorn-17578.exe (PID: 680)
- Unicorn-32936.exe (PID: 4920)
- Unicorn-21505.exe (PID: 7020)
- Unicorn-24843.exe (PID: 3268)
- Unicorn-14628.exe (PID: 3676)
- Unicorn-20951.exe (PID: 5408)
- Unicorn-31677.exe (PID: 2240)
- Unicorn-41179.exe (PID: 1660)
- Unicorn-49347.exe (PID: 2772)
- Unicorn-29481.exe (PID: 6676)
- Unicorn-34956.exe (PID: 7180)
- Unicorn-3575.exe (PID: 7204)
- Unicorn-9705.exe (PID: 7212)
- Unicorn-48875.exe (PID: 7276)
- Unicorn-43722.exe (PID: 7296)
- Unicorn-59975.exe (PID: 208)
- Unicorn-45346.exe (PID: 7320)
- Unicorn-7577.exe (PID: 7332)
- Unicorn-20649.exe (PID: 7376)
- Unicorn-32347.exe (PID: 7360)
- Unicorn-42553.exe (PID: 7444)
- Unicorn-40515.exe (PID: 7396)
- Unicorn-40515.exe (PID: 7404)
- Unicorn-40515.exe (PID: 7388)
- Unicorn-39753.exe (PID: 7436)
- Unicorn-28817.exe (PID: 7412)
- Unicorn-22591.exe (PID: 8000)
- Unicorn-1978.exe (PID: 8060)
- Unicorn-5740.exe (PID: 8032)
- Unicorn-34651.exe (PID: 8092)
- Unicorn-8100.exe (PID: 8084)
- Unicorn-50987.exe (PID: 8124)
- Unicorn-61905.exe (PID: 8156)
- Unicorn-42304.exe (PID: 8148)
- Unicorn-18206.exe (PID: 7352)
- Unicorn-14998.exe (PID: 5608)
- Unicorn-40249.exe (PID: 2040)
- Unicorn-56586.exe (PID: 2984)
- Unicorn-60115.exe (PID: 5360)
- Unicorn-11883.exe (PID: 5344)
- Unicorn-10914.exe (PID: 1040)
- Unicorn-26544.exe (PID: 7572)
- Unicorn-19859.exe (PID: 7532)
- Unicorn-14806.exe (PID: 2088)
- Unicorn-31143.exe (PID: 3096)
- Unicorn-25990.exe (PID: 7524)
- Unicorn-22975.exe (PID: 4428)
- Unicorn-48034.exe (PID: 7512)
- Unicorn-25990.exe (PID: 7740)
- Unicorn-33196.exe (PID: 7796)
- Unicorn-25990.exe (PID: 7540)
- Unicorn-22975.exe (PID: 1852)
- Unicorn-4400.exe (PID: 7816)
- Unicorn-25990.exe (PID: 7504)
- Unicorn-26544.exe (PID: 7564)
- Unicorn-56202.exe (PID: 7772)
- Unicorn-58397.exe (PID: 7804)
- Unicorn-34584.exe (PID: 6424)
- Unicorn-41099.exe (PID: 8184)
- Unicorn-41653.exe (PID: 7240)
- Unicorn-22193.exe (PID: 7736)
- Unicorn-25723.exe (PID: 7744)
- Unicorn-49158.exe (PID: 7748)
- Unicorn-49158.exe (PID: 5868)
- Unicorn-32630.exe (PID: 8056)
- Unicorn-41602.exe (PID: 7948)
- Unicorn-57881.exe (PID: 8008)
- Unicorn-12126.exe (PID: 6080)
- Unicorn-39629.exe (PID: 6436)
- Unicorn-8240.exe (PID: 1052)
- Unicorn-48966.exe (PID: 8180)
- Unicorn-13278.exe (PID: 7976)
- Unicorn-12764.exe (PID: 6540)
- Unicorn-4617.exe (PID: 8252)
- Unicorn-26661.exe (PID: 8280)
- Unicorn-53417.exe (PID: 8492)
- Unicorn-14430.exe (PID: 8548)
- Unicorn-2562.exe (PID: 8344)
- Unicorn-63501.exe (PID: 8400)
- Unicorn-11093.exe (PID: 8468)
- Unicorn-40014.exe (PID: 8612)
- Unicorn-55463.exe (PID: 8500)
- Unicorn-10346.exe (PID: 8528)
- Unicorn-8161.exe (PID: 8600)
- Unicorn-7414.exe (PID: 8648)
- Unicorn-44171.exe (PID: 8672)
- Unicorn-17251.exe (PID: 5728)
- Unicorn-46224.exe (PID: 8716)
- Unicorn-43988.exe (PID: 8580)
- Unicorn-10922.exe (PID: 8884)
- Unicorn-2754.exe (PID: 8832)
- Unicorn-20112.exe (PID: 8940)
- Unicorn-11114.exe (PID: 8780)
- Unicorn-38826.exe (PID: 8744)
- Unicorn-39978.exe (PID: 8948)
- Unicorn-4984.exe (PID: 8772)
- Unicorn-10922.exe (PID: 8848)
- Unicorn-4098.exe (PID: 8964)
- Unicorn-19920.exe (PID: 9072)
- Unicorn-4845.exe (PID: 8908)
- Unicorn-10922.exe (PID: 8856)
- Unicorn-24519.exe (PID: 9008)
- Unicorn-19920.exe (PID: 9056)
- Unicorn-45131.exe (PID: 8920)
- Unicorn-16713.exe (PID: 9132)
- Unicorn-50869.exe (PID: 9168)
- Unicorn-10922.exe (PID: 8868)
- Unicorn-38425.exe (PID: 9188)
- Unicorn-64845.exe (PID: 9152)
- Unicorn-47487.exe (PID: 8420)
- Unicorn-6428.exe (PID: 7716)
- Unicorn-20735.exe (PID: 6068)
- Unicorn-19920.exe (PID: 9064)
- Unicorn-16277.exe (PID: 8896)
- Unicorn-19920.exe (PID: 9048)
- Unicorn-11120.exe (PID: 8460)
- Unicorn-1514.exe (PID: 6272)
- Unicorn-28179.exe (PID: 9160)
- Unicorn-63313.exe (PID: 9096)
- Unicorn-39786.exe (PID: 9120)
- Unicorn-43979.exe (PID: 8736)
- Unicorn-22812.exe (PID: 9264)
- Unicorn-33118.exe (PID: 9228)
- Unicorn-39521.exe (PID: 9144)
- Unicorn-40855.exe (PID: 9024)
- Unicorn-18811.exe (PID: 9376)
- Unicorn-41047.exe (PID: 8928)
- Unicorn-33803.exe (PID: 9348)
- Unicorn-62858.exe (PID: 9368)
- Unicorn-6729.exe (PID: 9504)
- Unicorn-62474.exe (PID: 9480)
- Unicorn-62474.exe (PID: 9488)
- Unicorn-51291.exe (PID: 9440)
- Unicorn-51291.exe (PID: 9432)
- Unicorn-45161.exe (PID: 9448)
- Unicorn-62474.exe (PID: 9472)
- Unicorn-28349.exe (PID: 9620)
- Unicorn-3605.exe (PID: 9664)
- Unicorn-11965.exe (PID: 9640)
- Unicorn-7689.exe (PID: 9656)
- Unicorn-15857.exe (PID: 9680)
- Unicorn-22764.exe (PID: 9724)
- Unicorn-22708.exe (PID: 9692)
- Unicorn-50502.exe (PID: 8444)
- Unicorn-40502.exe (PID: 9772)
- Unicorn-40767.exe (PID: 9780)
- Unicorn-18124.exe (PID: 9816)
- Unicorn-3635.exe (PID: 9740)
Executable content was dropped or overwritten
- 1 (1107).exe (PID: 6032)
- Unicorn-55299.exe (PID: 5544)
- Unicorn-20619.exe (PID: 6240)
- Unicorn-17089.exe (PID: 6476)
- Unicorn-63763.exe (PID: 5116)
- Unicorn-17578.exe (PID: 680)
- Unicorn-60234.exe (PID: 660)
- Unicorn-32936.exe (PID: 4920)
- Unicorn-20951.exe (PID: 5408)
- Unicorn-14628.exe (PID: 3676)
- Unicorn-21505.exe (PID: 7020)
- Unicorn-24843.exe (PID: 3268)
- Unicorn-49347.exe (PID: 2772)
- Unicorn-59975.exe (PID: 208)
- Unicorn-41179.exe (PID: 1660)
- Unicorn-34956.exe (PID: 7180)
- Unicorn-3575.exe (PID: 7204)
- Unicorn-9705.exe (PID: 7212)
- Unicorn-48875.exe (PID: 7276)
- Unicorn-43722.exe (PID: 7296)
- Unicorn-45346.exe (PID: 7320)
- Unicorn-7577.exe (PID: 7332)
- Unicorn-20649.exe (PID: 7376)
- Unicorn-40515.exe (PID: 7396)
- Unicorn-40515.exe (PID: 7404)
- Unicorn-42553.exe (PID: 7444)
- Unicorn-31677.exe (PID: 2240)
- Unicorn-22591.exe (PID: 8000)
- Unicorn-5740.exe (PID: 8032)
- Unicorn-1978.exe (PID: 8060)
- Unicorn-8100.exe (PID: 8084)
- Unicorn-50987.exe (PID: 8124)
- Unicorn-42304.exe (PID: 8148)
- Unicorn-10914.exe (PID: 1040)
- Unicorn-61905.exe (PID: 8156)
- Unicorn-14998.exe (PID: 5608)
- Unicorn-40249.exe (PID: 2040)
- Unicorn-56586.exe (PID: 2984)
- Unicorn-60115.exe (PID: 5360)
- Unicorn-11883.exe (PID: 5344)
- Unicorn-18206.exe (PID: 7352)
- Unicorn-17251.exe (PID: 5728)
- Unicorn-26544.exe (PID: 7572)
- Unicorn-19859.exe (PID: 7532)
- Unicorn-14806.exe (PID: 2088)
- Unicorn-31143.exe (PID: 3096)
- Unicorn-25990.exe (PID: 7524)
- Unicorn-22975.exe (PID: 1852)
- Unicorn-48034.exe (PID: 7512)
- Unicorn-25990.exe (PID: 7740)
- Unicorn-25990.exe (PID: 7540)
- Unicorn-33196.exe (PID: 7796)
- Unicorn-26544.exe (PID: 7564)
- Unicorn-56202.exe (PID: 7772)
- Unicorn-40515.exe (PID: 7388)
- Unicorn-39753.exe (PID: 7436)
- Unicorn-58397.exe (PID: 7804)
- Unicorn-41099.exe (PID: 8184)
- Unicorn-41653.exe (PID: 7240)
- Unicorn-34584.exe (PID: 6424)
- Unicorn-29481.exe (PID: 6676)
- Unicorn-25723.exe (PID: 7744)
- Unicorn-22193.exe (PID: 7736)
- Unicorn-49158.exe (PID: 7748)
- Unicorn-48966.exe (PID: 8180)
- Unicorn-41602.exe (PID: 7948)
- Unicorn-12126.exe (PID: 6080)
- Unicorn-34651.exe (PID: 8092)
- Unicorn-12764.exe (PID: 6540)
- Unicorn-8240.exe (PID: 1052)
- Unicorn-4617.exe (PID: 8252)
- Unicorn-13278.exe (PID: 7976)
- Unicorn-26661.exe (PID: 8280)
- Unicorn-47487.exe (PID: 8420)
- Unicorn-2562.exe (PID: 8344)
- Unicorn-50502.exe (PID: 8444)
- Unicorn-63501.exe (PID: 8400)
- Unicorn-53417.exe (PID: 8492)
- Unicorn-14430.exe (PID: 8548)
- Unicorn-11093.exe (PID: 8468)
- Unicorn-40014.exe (PID: 8612)
- Unicorn-55463.exe (PID: 8500)
- Unicorn-10346.exe (PID: 8528)
- Unicorn-8161.exe (PID: 8600)
- Unicorn-44171.exe (PID: 8672)
- Unicorn-46224.exe (PID: 8716)
- Unicorn-43979.exe (PID: 8736)
- Unicorn-43988.exe (PID: 8580)
- Unicorn-7414.exe (PID: 8648)
- Unicorn-38826.exe (PID: 8744)
- Unicorn-2754.exe (PID: 8832)
- Unicorn-20112.exe (PID: 8940)
- Unicorn-10922.exe (PID: 8884)
- Unicorn-4984.exe (PID: 8772)
- Unicorn-41047.exe (PID: 8928)
- Unicorn-10922.exe (PID: 8856)
- Unicorn-10922.exe (PID: 8848)
- Unicorn-39978.exe (PID: 8948)
- Unicorn-22975.exe (PID: 4428)
- Unicorn-28817.exe (PID: 7412)
- Unicorn-19920.exe (PID: 9072)
- Unicorn-4845.exe (PID: 8908)
- Unicorn-32347.exe (PID: 7360)
- Unicorn-10922.exe (PID: 8868)
- Unicorn-4098.exe (PID: 8964)
- Unicorn-19920.exe (PID: 9056)
- Unicorn-16713.exe (PID: 9132)
- Unicorn-45131.exe (PID: 8920)
- Unicorn-50869.exe (PID: 9168)
- Unicorn-38425.exe (PID: 9188)
- Unicorn-64845.exe (PID: 9152)
- Unicorn-19920.exe (PID: 9048)
- Unicorn-6428.exe (PID: 7716)
- Unicorn-20735.exe (PID: 6068)
- Unicorn-19920.exe (PID: 9064)
- Unicorn-16277.exe (PID: 8896)
- Unicorn-1514.exe (PID: 6272)
- Unicorn-39786.exe (PID: 9120)
- Unicorn-39521.exe (PID: 9144)
- Unicorn-11120.exe (PID: 8460)
- Unicorn-28179.exe (PID: 9160)
- Unicorn-22812.exe (PID: 9264)
- Unicorn-33118.exe (PID: 9228)
- Unicorn-40855.exe (PID: 9024)
- Unicorn-33803.exe (PID: 9348)
- Unicorn-53081.exe (PID: 9312)
- Unicorn-45733.exe (PID: 9336)
- Unicorn-62858.exe (PID: 9368)
- Unicorn-39629.exe (PID: 6436)
- Unicorn-18811.exe (PID: 9376)
- Unicorn-62474.exe (PID: 9488)
- Unicorn-51291.exe (PID: 9440)
- Unicorn-6729.exe (PID: 9504)
- Unicorn-62474.exe (PID: 9472)
- Unicorn-45161.exe (PID: 9448)
- Unicorn-51291.exe (PID: 9432)
- Unicorn-62474.exe (PID: 9480)
- Unicorn-28349.exe (PID: 9620)
- Unicorn-3605.exe (PID: 9664)
- Unicorn-15857.exe (PID: 9680)
- Unicorn-11965.exe (PID: 9640)
- Unicorn-7689.exe (PID: 9656)
- Unicorn-22708.exe (PID: 9692)
- Unicorn-22764.exe (PID: 9724)
- Unicorn-40767.exe (PID: 9780)
- Unicorn-40502.exe (PID: 9772)
- Unicorn-18124.exe (PID: 9816)
- Unicorn-11114.exe (PID: 8780)
- Unicorn-3635.exe (PID: 9740)
- Unicorn-25990.exe (PID: 7504)
- Unicorn-57679.exe (PID: 9936)
- Unicorn-33175.exe (PID: 9888)
- Unicorn-16324.exe (PID: 9908)
- Unicorn-63313.exe (PID: 9096)
- Unicorn-59333.exe (PID: 9976)
- Unicorn-45598.exe (PID: 9984)
- Unicorn-14290.exe (PID: 10036)
- Unicorn-45510.exe (PID: 10196)
- Unicorn-10569.exe (PID: 10076)
- Unicorn-29976.exe (PID: 9836)
- Unicorn-57881.exe (PID: 8008)
- Unicorn-13584.exe (PID: 10096)
- Unicorn-44202.exe (PID: 8372)
- Unicorn-36740.exe (PID: 10236)
- Unicorn-56868.exe (PID: 8844)
- Unicorn-24519.exe (PID: 9008)
- Unicorn-41897.exe (PID: 9920)
- Unicorn-31203.exe (PID: 8892)
- Unicorn-11633.exe (PID: 10172)
- Unicorn-11898.exe (PID: 10192)
- Unicorn-49158.exe (PID: 5868)
- Unicorn-4400.exe (PID: 7816)
- Unicorn-63683.exe (PID: 6800)
- Unicorn-28235.exe (PID: 10256)
- Unicorn-20429.exe (PID: 10344)
- Unicorn-40295.exe (PID: 10356)
- Unicorn-62753.exe (PID: 10388)
- Unicorn-5599.exe (PID: 10452)
- Unicorn-56439.exe (PID: 10496)
- Unicorn-2469.exe (PID: 10304)
- Unicorn-43995.exe (PID: 10564)
- Unicorn-24129.exe (PID: 10556)
- Unicorn-56994.exe (PID: 10528)
- Unicorn-61675.exe (PID: 10604)
- Unicorn-30.exe (PID: 10672)
- Unicorn-39209.exe (PID: 10596)
- Unicorn-32630.exe (PID: 10648)
- Unicorn-20813.exe (PID: 10708)
- Unicorn-37616.exe (PID: 10732)
- Unicorn-58359.exe (PID: 10784)
- Unicorn-33663.exe (PID: 10800)
- Unicorn-8734.exe (PID: 10828)
- Unicorn-50637.exe (PID: 10944)
- Unicorn-35526.exe (PID: 10720)
- Unicorn-25386.exe (PID: 10956)
- Unicorn-5842.exe (PID: 10980)
- Unicorn-9661.exe (PID: 10992)
- Unicorn-59490.exe (PID: 11092)
- Unicorn-46683.exe (PID: 11040)
- Unicorn-4176.exe (PID: 10908)
- Unicorn-4176.exe (PID: 10900)
- Unicorn-13056.exe (PID: 11128)
- Unicorn-1566.exe (PID: 11076)
- Unicorn-26263.exe (PID: 11016)
- Unicorn-12235.exe (PID: 11208)
- Unicorn-17196.exe (PID: 10492)
- Unicorn-28108.exe (PID: 11152)
- Unicorn-25970.exe (PID: 11216)
- Unicorn-59490.exe (PID: 11084)
- Unicorn-55406.exe (PID: 11120)
- Unicorn-17388.exe (PID: 11224)
- Unicorn-59895.exe (PID: 2288)
- Unicorn-55406.exe (PID: 11112)
- Unicorn-25880.exe (PID: 11252)
- Unicorn-59298.exe (PID: 11232)
- Unicorn-35007.exe (PID: 11380)
- Unicorn-62634.exe (PID: 11476)
- Unicorn-9734.exe (PID: 11104)
- Unicorn-43559.exe (PID: 5508)
- Unicorn-29260.exe (PID: 10028)
- Unicorn-61218.exe (PID: 11660)
- Unicorn-2453.exe (PID: 10612)
Executes application which crashes
- Unicorn-46086.exe (PID: 10028)
- Unicorn-35156.exe (PID: 9256)
- Unicorn-63501.exe (PID: 8400)
INFO
Create files in a temporary directory
- 1 (1107).exe (PID: 6032)
- Unicorn-20619.exe (PID: 6240)
- Unicorn-55299.exe (PID: 5544)
- Unicorn-63763.exe (PID: 5116)
- Unicorn-17089.exe (PID: 6476)
- Unicorn-32936.exe (PID: 4920)
- Unicorn-24843.exe (PID: 3268)
- Unicorn-14628.exe (PID: 3676)
- Unicorn-17578.exe (PID: 680)
- Unicorn-59975.exe (PID: 208)
- Unicorn-20951.exe (PID: 5408)
- Unicorn-3575.exe (PID: 7204)
- Unicorn-9705.exe (PID: 7212)
- Unicorn-21505.exe (PID: 7020)
- Unicorn-48875.exe (PID: 7276)
- Unicorn-43722.exe (PID: 7296)
- Unicorn-40515.exe (PID: 7396)
- Unicorn-42553.exe (PID: 7444)
- Unicorn-49347.exe (PID: 2772)
- Unicorn-22591.exe (PID: 8000)
- Unicorn-41179.exe (PID: 1660)
- Unicorn-8100.exe (PID: 8084)
- Unicorn-5740.exe (PID: 8032)
- Unicorn-42304.exe (PID: 8148)
- Unicorn-18206.exe (PID: 7352)
- Unicorn-61905.exe (PID: 8156)
- Unicorn-40249.exe (PID: 2040)
- Unicorn-45346.exe (PID: 7320)
- Unicorn-11883.exe (PID: 5344)
- Unicorn-56586.exe (PID: 2984)
- Unicorn-60115.exe (PID: 5360)
- Unicorn-60234.exe (PID: 660)
- Unicorn-19859.exe (PID: 7532)
- Unicorn-31143.exe (PID: 3096)
- Unicorn-25990.exe (PID: 7524)
- Unicorn-17251.exe (PID: 5728)
- Unicorn-48034.exe (PID: 7512)
- Unicorn-40515.exe (PID: 7404)
- Unicorn-33196.exe (PID: 7796)
- Unicorn-31677.exe (PID: 2240)
- Unicorn-39753.exe (PID: 7436)
- Unicorn-29481.exe (PID: 6676)
- Unicorn-41099.exe (PID: 8184)
- Unicorn-34584.exe (PID: 6424)
- Unicorn-12126.exe (PID: 6080)
- Unicorn-34956.exe (PID: 7180)
- Unicorn-8240.exe (PID: 1052)
- Unicorn-12764.exe (PID: 6540)
- Unicorn-1978.exe (PID: 8060)
- Unicorn-13278.exe (PID: 7976)
- Unicorn-50502.exe (PID: 8444)
- Unicorn-63501.exe (PID: 8400)
- Unicorn-14430.exe (PID: 8548)
- Unicorn-14998.exe (PID: 5608)
- Unicorn-10914.exe (PID: 1040)
- Unicorn-40014.exe (PID: 8612)
- Unicorn-10922.exe (PID: 8848)
- Unicorn-56202.exe (PID: 7772)
- Unicorn-19920.exe (PID: 9072)
- Unicorn-10922.exe (PID: 8868)
- Unicorn-16713.exe (PID: 9132)
- Unicorn-38425.exe (PID: 9188)
- Unicorn-19920.exe (PID: 9048)
- Unicorn-41653.exe (PID: 7240)
- Unicorn-22193.exe (PID: 7736)
- Unicorn-49158.exe (PID: 7748)
- Unicorn-41602.exe (PID: 7948)
- Unicorn-34651.exe (PID: 8092)
- Unicorn-50987.exe (PID: 8124)
- Unicorn-62858.exe (PID: 9368)
- Unicorn-62474.exe (PID: 9472)
- Unicorn-11965.exe (PID: 9640)
- Unicorn-55463.exe (PID: 8500)
Reads the computer name
- 1 (1107).exe (PID: 6032)
- Unicorn-55299.exe (PID: 5544)
- Unicorn-20619.exe (PID: 6240)
- Unicorn-63763.exe (PID: 5116)
- Unicorn-17089.exe (PID: 6476)
- Unicorn-20951.exe (PID: 5408)
- Unicorn-32936.exe (PID: 4920)
- Unicorn-49347.exe (PID: 2772)
- Unicorn-31677.exe (PID: 2240)
- Unicorn-59975.exe (PID: 208)
- Unicorn-48875.exe (PID: 7276)
- Unicorn-40515.exe (PID: 7396)
- Unicorn-28817.exe (PID: 7412)
- Unicorn-22591.exe (PID: 8000)
- Unicorn-61905.exe (PID: 8156)
- Unicorn-10914.exe (PID: 1040)
- Unicorn-14998.exe (PID: 5608)
- Unicorn-60115.exe (PID: 5360)
- Unicorn-11883.exe (PID: 5344)
- Unicorn-40249.exe (PID: 2040)
- Unicorn-19859.exe (PID: 7532)
- Unicorn-22975.exe (PID: 1852)
- Unicorn-25990.exe (PID: 7740)
- Unicorn-33196.exe (PID: 7796)
- Unicorn-56202.exe (PID: 7772)
- Unicorn-17251.exe (PID: 5728)
- Unicorn-41653.exe (PID: 7240)
- Unicorn-25723.exe (PID: 7744)
- Unicorn-13278.exe (PID: 7976)
- Unicorn-32630.exe (PID: 8056)
- Unicorn-63501.exe (PID: 8400)
- Unicorn-47487.exe (PID: 8420)
- Unicorn-2562.exe (PID: 8344)
- Unicorn-46224.exe (PID: 8716)
- Unicorn-43979.exe (PID: 8736)
- Unicorn-10922.exe (PID: 8884)
- Unicorn-10922.exe (PID: 8856)
- Unicorn-16713.exe (PID: 9132)
- Unicorn-50869.exe (PID: 9168)
- Unicorn-4984.exe (PID: 8772)
- Unicorn-1514.exe (PID: 6272)
- Unicorn-64845.exe (PID: 9152)
- Unicorn-3605.exe (PID: 9664)
The sample compiled with chinese language support
- 1 (1107).exe (PID: 6032)
- Unicorn-41047.exe (PID: 8928)
- Unicorn-11883.exe (PID: 5344)
- Unicorn-56586.exe (PID: 2984)
- Unicorn-8161.exe (PID: 8600)
- Unicorn-43988.exe (PID: 8580)
- Unicorn-60115.exe (PID: 5360)
- Unicorn-7577.exe (PID: 7332)
- Unicorn-45510.exe (PID: 10196)
- Unicorn-10569.exe (PID: 10076)
- Unicorn-36740.exe (PID: 10236)
- Unicorn-14628.exe (PID: 3676)
- Unicorn-13584.exe (PID: 10096)
- Unicorn-7414.exe (PID: 8648)
- Unicorn-44171.exe (PID: 8672)
- Unicorn-18124.exe (PID: 9816)
- Unicorn-26544.exe (PID: 7572)
- Unicorn-46224.exe (PID: 8716)
- Unicorn-11114.exe (PID: 8780)
- Unicorn-38826.exe (PID: 8744)
- Unicorn-43722.exe (PID: 7296)
- Unicorn-55299.exe (PID: 5544)
- Unicorn-14806.exe (PID: 2088)
- Unicorn-20112.exe (PID: 8940)
- Unicorn-29976.exe (PID: 9836)
- Unicorn-39978.exe (PID: 8948)
- Unicorn-4984.exe (PID: 8772)
- Unicorn-56868.exe (PID: 8844)
- Unicorn-20649.exe (PID: 7376)
- Unicorn-22975.exe (PID: 1852)
- Unicorn-44202.exe (PID: 8372)
- Unicorn-31143.exe (PID: 3096)
- Unicorn-10922.exe (PID: 8884)
- Unicorn-41179.exe (PID: 1660)
- Unicorn-2754.exe (PID: 8832)
- Unicorn-10922.exe (PID: 8848)
- Unicorn-17578.exe (PID: 680)
- Unicorn-57679.exe (PID: 9936)
- Unicorn-58397.exe (PID: 7804)
- Unicorn-28817.exe (PID: 7412)
- Unicorn-26544.exe (PID: 7564)
- Unicorn-24519.exe (PID: 9008)
- Unicorn-42553.exe (PID: 7444)
- Unicorn-4098.exe (PID: 8964)
- Unicorn-39753.exe (PID: 7436)
- Unicorn-32936.exe (PID: 4920)
- Unicorn-25990.exe (PID: 7504)
- Unicorn-40515.exe (PID: 7404)
- Unicorn-48034.exe (PID: 7512)
- Unicorn-31677.exe (PID: 2240)
- Unicorn-33175.exe (PID: 9888)
- Unicorn-19920.exe (PID: 9072)
- Unicorn-4845.exe (PID: 8908)
- Unicorn-41897.exe (PID: 9920)
- Unicorn-32347.exe (PID: 7360)
- Unicorn-19920.exe (PID: 9056)
- Unicorn-45131.exe (PID: 8920)
- Unicorn-17089.exe (PID: 6476)
- Unicorn-64845.exe (PID: 9152)
- Unicorn-31203.exe (PID: 8892)
- Unicorn-6428.exe (PID: 7716)
- Unicorn-17251.exe (PID: 5728)
- Unicorn-56202.exe (PID: 7772)
- Unicorn-10922.exe (PID: 8856)
- Unicorn-49347.exe (PID: 2772)
- Unicorn-29481.exe (PID: 6676)
- Unicorn-19920.exe (PID: 9064)
- Unicorn-41099.exe (PID: 8184)
- Unicorn-22193.exe (PID: 7736)
- Unicorn-63313.exe (PID: 9096)
- Unicorn-41653.exe (PID: 7240)
- Unicorn-40855.exe (PID: 9024)
- Unicorn-59975.exe (PID: 208)
- Unicorn-22812.exe (PID: 9264)
- Unicorn-34584.exe (PID: 6424)
- Unicorn-20951.exe (PID: 5408)
- Unicorn-11633.exe (PID: 10172)
- Unicorn-5740.exe (PID: 8032)
- Unicorn-59333.exe (PID: 9976)
- Unicorn-20735.exe (PID: 6068)
- Unicorn-47487.exe (PID: 8420)
- Unicorn-22591.exe (PID: 8000)
- Unicorn-25990.exe (PID: 7540)
- Unicorn-25990.exe (PID: 7740)
- Unicorn-25723.exe (PID: 7744)
- Unicorn-57881.exe (PID: 8008)
- Unicorn-63683.exe (PID: 6800)
- Unicorn-34956.exe (PID: 7180)
- Unicorn-11898.exe (PID: 10192)
- Unicorn-1978.exe (PID: 8060)
- Unicorn-49158.exe (PID: 5868)
- Unicorn-18811.exe (PID: 9376)
- Unicorn-39629.exe (PID: 6436)
- Unicorn-4400.exe (PID: 7816)
- Unicorn-33118.exe (PID: 9228)
- Unicorn-45733.exe (PID: 9336)
- Unicorn-10922.exe (PID: 8868)
- Unicorn-62858.exe (PID: 9368)
- Unicorn-45598.exe (PID: 9984)
- Unicorn-3575.exe (PID: 7204)
- Unicorn-53081.exe (PID: 9312)
- Unicorn-63763.exe (PID: 5116)
- Unicorn-28235.exe (PID: 10256)
- Unicorn-61905.exe (PID: 8156)
- Unicorn-21505.exe (PID: 7020)
- Unicorn-12764.exe (PID: 6540)
- Unicorn-16324.exe (PID: 9908)
- Unicorn-33803.exe (PID: 9348)
- Unicorn-34651.exe (PID: 8092)
- Unicorn-8100.exe (PID: 8084)
- Unicorn-20619.exe (PID: 6240)
- Unicorn-22975.exe (PID: 4428)
- Unicorn-20429.exe (PID: 10344)
- Unicorn-51291.exe (PID: 9432)
- Unicorn-62474.exe (PID: 9472)
- Unicorn-4617.exe (PID: 8252)
- Unicorn-48966.exe (PID: 8180)
- Unicorn-26661.exe (PID: 8280)
- Unicorn-13278.exe (PID: 7976)
- Unicorn-28349.exe (PID: 9620)
- Unicorn-18206.exe (PID: 7352)
- Unicorn-48875.exe (PID: 7276)
- Unicorn-62474.exe (PID: 9480)
- Unicorn-62474.exe (PID: 9488)
- Unicorn-51291.exe (PID: 9440)
- Unicorn-9705.exe (PID: 7212)
- Unicorn-6729.exe (PID: 9504)
- Unicorn-3605.exe (PID: 9664)
- Unicorn-62753.exe (PID: 10388)
- Unicorn-2562.exe (PID: 8344)
- Unicorn-40295.exe (PID: 10356)
- Unicorn-5599.exe (PID: 10452)
- Unicorn-56439.exe (PID: 10496)
- Unicorn-10914.exe (PID: 1040)
- Unicorn-22764.exe (PID: 9724)
- Unicorn-14998.exe (PID: 5608)
- Unicorn-22708.exe (PID: 9692)
- Unicorn-2469.exe (PID: 10304)
- Unicorn-7689.exe (PID: 9656)
- Unicorn-45161.exe (PID: 9448)
- Unicorn-45346.exe (PID: 7320)
- Unicorn-40249.exe (PID: 2040)
- Unicorn-14430.exe (PID: 8548)
- Unicorn-14290.exe (PID: 10036)
- Unicorn-53417.exe (PID: 8492)
- Unicorn-40502.exe (PID: 9772)
- Unicorn-40767.exe (PID: 9780)
- Unicorn-24129.exe (PID: 10556)
- Unicorn-24843.exe (PID: 3268)
- Unicorn-43995.exe (PID: 10564)
- Unicorn-11093.exe (PID: 8468)
- Unicorn-50502.exe (PID: 8444)
- Unicorn-3635.exe (PID: 9740)
- Unicorn-56994.exe (PID: 10528)
- Unicorn-61675.exe (PID: 10604)
- Unicorn-32630.exe (PID: 10648)
- Unicorn-39209.exe (PID: 10596)
- Unicorn-16277.exe (PID: 8896)
- Unicorn-40515.exe (PID: 7396)
- Unicorn-20813.exe (PID: 10708)
- Unicorn-19920.exe (PID: 9048)
- Unicorn-39786.exe (PID: 9120)
- Unicorn-43979.exe (PID: 8736)
- Unicorn-55463.exe (PID: 8500)
- Unicorn-60234.exe (PID: 660)
- Unicorn-30.exe (PID: 10672)
- Unicorn-40515.exe (PID: 7388)
- Unicorn-49158.exe (PID: 7748)
- Unicorn-37616.exe (PID: 10732)
- Unicorn-58359.exe (PID: 10784)
- Unicorn-11965.exe (PID: 9640)
- Unicorn-8734.exe (PID: 10828)
- Unicorn-33663.exe (PID: 10800)
- Unicorn-50637.exe (PID: 10944)
- Unicorn-40014.exe (PID: 8612)
- Unicorn-28179.exe (PID: 9160)
- Unicorn-39521.exe (PID: 9144)
- Unicorn-35526.exe (PID: 10720)
- Unicorn-42304.exe (PID: 8148)
- Unicorn-9661.exe (PID: 10992)
- Unicorn-5842.exe (PID: 10980)
- Unicorn-4176.exe (PID: 10900)
- Unicorn-38425.exe (PID: 9188)
- Unicorn-19859.exe (PID: 7532)
- Unicorn-59490.exe (PID: 11092)
- Unicorn-25386.exe (PID: 10956)
- Unicorn-1514.exe (PID: 6272)
- Unicorn-12126.exe (PID: 6080)
- Unicorn-50987.exe (PID: 8124)
- Unicorn-10346.exe (PID: 8528)
- Unicorn-4176.exe (PID: 10908)
- Unicorn-17196.exe (PID: 10492)
- Unicorn-59490.exe (PID: 11084)
- Unicorn-15857.exe (PID: 9680)
- Unicorn-26263.exe (PID: 11016)
- Unicorn-1566.exe (PID: 11076)
- Unicorn-25990.exe (PID: 7524)
- Unicorn-12235.exe (PID: 11208)
- Unicorn-25970.exe (PID: 11216)
- Unicorn-28108.exe (PID: 11152)
- Unicorn-46683.exe (PID: 11040)
- Unicorn-13056.exe (PID: 11128)
- Unicorn-59895.exe (PID: 2288)
- Unicorn-55406.exe (PID: 11120)
- Unicorn-17388.exe (PID: 11224)
- Unicorn-55406.exe (PID: 11112)
- Unicorn-59298.exe (PID: 11232)
- Unicorn-50869.exe (PID: 9168)
- Unicorn-25880.exe (PID: 11252)
- Unicorn-35007.exe (PID: 11380)
- Unicorn-9734.exe (PID: 11104)
- Unicorn-2453.exe (PID: 10612)
- Unicorn-61218.exe (PID: 11660)
- Unicorn-29260.exe (PID: 10028)
- Unicorn-62634.exe (PID: 11476)
- Unicorn-43559.exe (PID: 5508)
Checks supported languages
- 1 (1107).exe (PID: 6032)
- Unicorn-55299.exe (PID: 5544)
- Unicorn-20619.exe (PID: 6240)
- Unicorn-17089.exe (PID: 6476)
- Unicorn-17578.exe (PID: 680)
- Unicorn-32936.exe (PID: 4920)
- Unicorn-21505.exe (PID: 7020)
- Unicorn-14628.exe (PID: 3676)
- Unicorn-29481.exe (PID: 6676)
- Unicorn-49347.exe (PID: 2772)
- Unicorn-31677.exe (PID: 2240)
- Unicorn-34956.exe (PID: 7180)
- Unicorn-59975.exe (PID: 208)
- Unicorn-48875.exe (PID: 7276)
- Unicorn-43722.exe (PID: 7296)
- Unicorn-9705.exe (PID: 7212)
- Unicorn-42553.exe (PID: 7444)
- Unicorn-39753.exe (PID: 7436)
- Unicorn-45346.exe (PID: 7320)
- Unicorn-7577.exe (PID: 7332)
- Unicorn-40515.exe (PID: 7388)
- Unicorn-22591.exe (PID: 8000)
- Unicorn-1978.exe (PID: 8060)
- Unicorn-56586.exe (PID: 2984)
- Unicorn-60115.exe (PID: 5360)
- Unicorn-11883.exe (PID: 5344)
- Unicorn-14998.exe (PID: 5608)
- Unicorn-17251.exe (PID: 5728)
- Unicorn-19859.exe (PID: 7532)
- Unicorn-25990.exe (PID: 7524)
- Unicorn-22975.exe (PID: 1852)
- Unicorn-48034.exe (PID: 7512)
- Unicorn-25990.exe (PID: 7504)
- Unicorn-41099.exe (PID: 8184)
- Unicorn-22975.exe (PID: 4428)
- Unicorn-34584.exe (PID: 6424)
- Unicorn-25723.exe (PID: 7744)
- Unicorn-22193.exe (PID: 7736)
- Unicorn-39629.exe (PID: 6436)
- Unicorn-41602.exe (PID: 7948)
- Unicorn-32630.exe (PID: 8056)
- Unicorn-10346.exe (PID: 8528)
- Unicorn-44171.exe (PID: 8672)
- Unicorn-7414.exe (PID: 8648)
- Unicorn-10922.exe (PID: 8848)
- Unicorn-16277.exe (PID: 8896)
- Unicorn-40855.exe (PID: 9024)
- Unicorn-39978.exe (PID: 8948)
- Unicorn-45131.exe (PID: 8920)
- Unicorn-24519.exe (PID: 9008)
- Unicorn-10922.exe (PID: 8884)
- Unicorn-10922.exe (PID: 8856)
- Unicorn-19920.exe (PID: 9056)
- Unicorn-39521.exe (PID: 9144)
- Unicorn-16713.exe (PID: 9132)
- Unicorn-38425.exe (PID: 9188)
- Unicorn-19920.exe (PID: 9064)
- Unicorn-28179.exe (PID: 9160)
- Unicorn-50869.exe (PID: 9168)
- Unicorn-6428.exe (PID: 7716)
- Unicorn-53081.exe (PID: 9312)
- Unicorn-35156.exe (PID: 9256)
- Unicorn-22812.exe (PID: 9264)
- Unicorn-62474.exe (PID: 9480)
- Unicorn-28349.exe (PID: 9620)
- Unicorn-11965.exe (PID: 9640)
- Unicorn-15857.exe (PID: 9680)
- Unicorn-7689.exe (PID: 9656)
- Unicorn-3605.exe (PID: 9664)
- Unicorn-22708.exe (PID: 9692)
- Unicorn-45161.exe (PID: 9448)
- Unicorn-3635.exe (PID: 9740)
- Unicorn-59333.exe (PID: 9976)
- Unicorn-57679.exe (PID: 9936)
- Unicorn-13584.exe (PID: 10096)
- Unicorn-44202.exe (PID: 8372)
- Unicorn-31203.exe (PID: 8892)
- Unicorn-10569.exe (PID: 10076)
- Unicorn-11898.exe (PID: 10192)
- Unicorn-28235.exe (PID: 10256)
- Unicorn-20429.exe (PID: 10344)
- Unicorn-62753.exe (PID: 10388)
- Unicorn-2469.exe (PID: 10304)
- Unicorn-30.exe (PID: 10672)
- Unicorn-35526.exe (PID: 10720)
- Unicorn-24129.exe (PID: 10556)
- Unicorn-39209.exe (PID: 10596)
- Unicorn-58359.exe (PID: 10784)
- Unicorn-33663.exe (PID: 10800)
- Unicorn-50637.exe (PID: 10944)
- Unicorn-5842.exe (PID: 10980)
- Unicorn-9661.exe (PID: 10992)
- Unicorn-17388.exe (PID: 11224)
- Unicorn-55406.exe (PID: 11112)
- Unicorn-25970.exe (PID: 11216)
- Unicorn-6013.exe (PID: 10284)
- Unicorn-17196.exe (PID: 10492)
- Unicorn-2453.exe (PID: 10612)
- Unicorn-28108.exe (PID: 11152)
- Unicorn-29260.exe (PID: 10028)
- Unicorn-59895.exe (PID: 2288)
- Unicorn-10694.exe (PID: 10044)
- Unicorn-29260.exe (PID: 10032)
- Unicorn-22755.exe (PID: 11364)
- Unicorn-35391.exe (PID: 3332)
- Unicorn-3486.exe (PID: 11552)
- Unicorn-26922.exe (PID: 11592)
- Unicorn-62634.exe (PID: 11476)
- Unicorn-35007.exe (PID: 11380)
- Unicorn-28545.exe (PID: 11612)
- Unicorn-61218.exe (PID: 11652)
- Unicorn-64747.exe (PID: 11644)
- Unicorn-61218.exe (PID: 11660)
- Unicorn-38982.exe (PID: 11748)
- Unicorn-33728.exe (PID: 11780)
- Unicorn-26328.exe (PID: 12108)
- Unicorn-58094.exe (PID: 11876)
- Unicorn-57347.exe (PID: 11932)
- Unicorn-3548.exe (PID: 12012)
- Unicorn-15552.exe (PID: 11976)
- Unicorn-45266.exe (PID: 12092)
- Unicorn-4425.exe (PID: 12100)
- Unicorn-33346.exe (PID: 12172)
- Unicorn-24410.exe (PID: 11888)
- Unicorn-17829.exe (PID: 12212)
- Unicorn-8649.exe (PID: 12272)
- Unicorn-746.exe (PID: 12240)
- Unicorn-52909.exe (PID: 12348)
- Unicorn-28733.exe (PID: 12432)
- Unicorn-6330.exe (PID: 12576)
- Unicorn-49994.exe (PID: 12760)
- Unicorn-51639.exe (PID: 13080)
- Unicorn-17684.exe (PID: 12780)
- Unicorn-20695.exe (PID: 12696)
- Unicorn-4996.exe (PID: 12756)
- Unicorn-58219.exe (PID: 13416)
- Unicorn-51566.exe (PID: 13688)
- Unicorn-12588.exe (PID: 13476)
- Unicorn-1488.exe (PID: 13620)
- Unicorn-48965.exe (PID: 13644)
- Unicorn-43041.exe (PID: 13788)
- Unicorn-63659.exe (PID: 12520)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 3008)
- BackgroundTransferHost.exe (PID: 7512)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 7512)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 7512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
500
Monitored processes
363
Malicious processes
52
Suspicious processes
49
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\Users\admin\AppData\Local\Temp\Unicorn-59975.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-59975.exe | Unicorn-20951.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 660 | C:\Users\admin\AppData\Local\Temp\Unicorn-60234.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-60234.exe | Unicorn-55299.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 680 | C:\Users\admin\AppData\Local\Temp\Unicorn-17578.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-17578.exe | Unicorn-17089.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 872 | C:\Users\admin\AppData\Local\Temp\Unicorn-56366.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56366.exe | — | Unicorn-56202.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1040 | C:\Users\admin\AppData\Local\Temp\Unicorn-10914.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-10914.exe | Unicorn-45346.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1052 | C:\Users\admin\AppData\Local\Temp\Unicorn-8240.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8240.exe | Unicorn-20619.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1324 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 9256 -s 520 | C:\Windows\SysWOW64\WerFault.exe | — | Unicorn-35156.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1324 | C:\Users\admin\AppData\Local\Temp\Unicorn-12806.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-12806.exe | — | Unicorn-45733.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1660 | C:\Users\admin\AppData\Local\Temp\Unicorn-41179.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-41179.exe | Unicorn-17578.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1852 | C:\Users\admin\AppData\Local\Temp\Unicorn-22975.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-22975.exe | Unicorn-40515.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
15 598
Read events
15 583
Write events
15
Delete events
0
Modification events
| (PID) Process: | (3008) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (3008) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (3008) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7512) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7512) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7512) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7728) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7728) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7728) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7960) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
1 063
Suspicious files
14
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6032 | 1 (1107).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-55299.exe | executable | |
MD5:A9DAEB528F645CC7E35930DD5C95B239 | SHA256:12863DA26D1CF9F9BD69231BD56CDBF5BF60761621C58A10266EB14FF80D1B84 | |||
| 5544 | Unicorn-55299.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-14628.exe | executable | |
MD5:B84E9A3A27264A48620AC8B88F384288 | SHA256:0700A97D4AD4ADB4BCFF68324E09BD1122BF437887B79A1817A9EA785A1ACE24 | |||
| 660 | Unicorn-60234.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24843.exe | executable | |
MD5:FDFD30CB775BCAC5844849FF5D5BAC6B | SHA256:6E01A4231A08EADCA333A29A1360EE16C4CBF91FACFA78D052F1EA04532AEA94 | |||
| 680 | Unicorn-17578.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-41179.exe | executable | |
MD5:DF398E1D5ED8AAA6EEA5D4FFCF3D1AD2 | SHA256:8EB9C759AD8988EA388951062936DD2C672700CF89740E81B5DACCBC292979BC | |||
| 5116 | Unicorn-63763.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20951.exe | executable | |
MD5:2FEF88D2512F5EE8EC206684A00DA254 | SHA256:2249E9D724C12C698E6AD2E637033189773FB1399D7A202970B91A230050DBED | |||
| 6032 | 1 (1107).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-31677.exe | executable | |
MD5:9C8C43C94D69D76023808D68B3785885 | SHA256:DC60082500CED43ADDB91FC97C474D714FD9E64E1557259599DD61FE5D147732 | |||
| 3268 | Unicorn-24843.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-48875.exe | executable | |
MD5:CCC3A289A7FEA7542E35AE38CC69B4AB | SHA256:09A464073770255B8BE2E7DB3836B86B7B9C2B3B5AAE6BA202EDC7FB9828FEDD | |||
| 4920 | Unicorn-32936.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49347.exe | executable | |
MD5:A4208734B9A2C0AB2A776E4FD8DA4797 | SHA256:C646435E993C5605DDE7509ADE701B5C598315116F216ECD912B9AD19FE89779 | |||
| 6476 | Unicorn-17089.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-29481.exe | executable | |
MD5:21D17A1F97BB053C984D165E5BD83D9A | SHA256:3CD60208B3ADD4CA4AD37D363EC59BCF9A97DA98895BC53F5EA88E8CFD8160D9 | |||
| 7020 | Unicorn-21505.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9705.exe | executable | |
MD5:2F7B468F686D8F2B05CCC036406DF651 | SHA256:8F8135265C464F5BC0FBD37F8C1F328509AE3204242F7CB153952AB6570E4F92 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
26
DNS requests
18
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.16.164.9:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.16.164.9:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
3888 | backgroundTaskHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
7512 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
8812 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
8812 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 2.16.164.9:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2112 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 40.126.32.68:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |