| File name: | 1 (1124) |
| Full analysis: | https://app.any.run/tasks/8e642b1b-5c0d-4f4e-a80d-454fb69978b9 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 09:12:11 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 3936702D1361FABDF09D650E7123B0A0 |
| SHA1: | E117B54184E6D9DF5DEBD6D5A7265CC23C9A58A4 |
| SHA256: | 7746EAAA9C0DA399D0CE4BBC47DC2E4DFEA9B932511B5CAD747D78A587161B13 |
| SSDEEP: | 6144:hDNg57ItFDjHA5Cls7YR6mH5tBqlvJGB3/cyAeyTk/8SwjwpyAvEh1QZHLwn72xM:h5oMHHA56ss/BMha3EyAey+x4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- 1 (1124).exe (PID: 7488)
- Unicorn-4901.exe (PID: 720)
- Unicorn-8855.exe (PID: 7876)
- Unicorn-62825.exe (PID: 2316)
- Unicorn-33054.exe (PID: 7420)
- Unicorn-4465.exe (PID: 7428)
- Unicorn-936.exe (PID: 7412)
- Unicorn-55454.exe (PID: 4448)
- Unicorn-39176.exe (PID: 7448)
- Unicorn-55454.exe (PID: 7244)
- Unicorn-18506.exe (PID: 6028)
- Unicorn-64177.exe (PID: 6964)
- Unicorn-10892.exe (PID: 7648)
- Unicorn-42745.exe (PID: 7728)
- Unicorn-24627.exe (PID: 7688)
- Unicorn-1349.exe (PID: 6516)
- Unicorn-5433.exe (PID: 5384)
- Unicorn-55454.exe (PID: 7240)
- Unicorn-9517.exe (PID: 6512)
- Unicorn-5988.exe (PID: 5984)
- Unicorn-5988.exe (PID: 4068)
- Unicorn-62610.exe (PID: 4464)
- Unicorn-62610.exe (PID: 6592)
- Unicorn-13409.exe (PID: 2040)
- Unicorn-7279.exe (PID: 6576)
- Unicorn-21578.exe (PID: 7484)
- Unicorn-23615.exe (PID: 7440)
- Unicorn-29481.exe (PID: 5404)
- Unicorn-24899.exe (PID: 1072)
- Unicorn-9216.exe (PID: 7760)
- Unicorn-13409.exe (PID: 856)
- Unicorn-48941.exe (PID: 7260)
- Unicorn-4577.exe (PID: 7012)
- Unicorn-57478.exe (PID: 8180)
- Unicorn-45781.exe (PID: 6272)
- Unicorn-12361.exe (PID: 1280)
- Unicorn-1712.exe (PID: 5228)
- Unicorn-18483.exe (PID: 5892)
- Unicorn-13705.exe (PID: 1348)
- Unicorn-63600.exe (PID: 7744)
- Unicorn-26651.exe (PID: 5344)
- Unicorn-57286.exe (PID: 3888)
- Unicorn-40902.exe (PID: 7188)
- Unicorn-50462.exe (PID: 7212)
- Unicorn-58630.exe (PID: 2852)
- Unicorn-5345.exe (PID: 7252)
- Unicorn-59377.exe (PID: 6808)
- Unicorn-300.exe (PID: 7820)
- Unicorn-16835.exe (PID: 5936)
- Unicorn-5900.exe (PID: 7304)
- Unicorn-19635.exe (PID: 7708)
- Unicorn-5345.exe (PID: 6132)
- Unicorn-21416.exe (PID: 7180)
- Unicorn-50462.exe (PID: 4696)
- Unicorn-50462.exe (PID: 7224)
- Unicorn-25501.exe (PID: 7720)
- Unicorn-56829.exe (PID: 8152)
- Unicorn-5537.exe (PID: 7704)
- Unicorn-35662.exe (PID: 8088)
- Unicorn-36134.exe (PID: 7272)
- Unicorn-27110.exe (PID: 2432)
- Unicorn-40108.exe (PID: 8140)
- Unicorn-29147.exe (PID: 6876)
- Unicorn-6305.exe (PID: 4200)
- Unicorn-37700.exe (PID: 7956)
- Unicorn-39554.exe (PID: 7852)
- Unicorn-30107.exe (PID: 5064)
- Unicorn-45226.exe (PID: 7928)
- Unicorn-45153.exe (PID: 7868)
- Unicorn-26023.exe (PID: 7172)
- Unicorn-4312.exe (PID: 6344)
- Unicorn-24156.exe (PID: 7156)
- Unicorn-56274.exe (PID: 5800)
- Unicorn-22899.exe (PID: 8036)
- Unicorn-61702.exe (PID: 6540)
- Unicorn-3181.exe (PID: 5588)
- Unicorn-4888.exe (PID: 2268)
- Unicorn-50218.exe (PID: 8324)
- Unicorn-12044.exe (PID: 6724)
- Unicorn-44982.exe (PID: 8204)
- Unicorn-28838.exe (PID: 2772)
- Unicorn-44982.exe (PID: 8208)
- Unicorn-37176.exe (PID: 8276)
- Unicorn-3684.exe (PID: 8232)
- Unicorn-15936.exe (PID: 8268)
- Unicorn-47980.exe (PID: 8428)
- Unicorn-28454.exe (PID: 8284)
- Unicorn-63025.exe (PID: 8368)
- Unicorn-58194.exe (PID: 8436)
- Unicorn-17354.exe (PID: 8376)
- Unicorn-25330.exe (PID: 8488)
- Unicorn-32429.exe (PID: 8524)
- Unicorn-7732.exe (PID: 8596)
- Unicorn-41666.exe (PID: 8496)
- Unicorn-40405.exe (PID: 8632)
- Unicorn-7732.exe (PID: 8604)
- Unicorn-11302.exe (PID: 8652)
- Unicorn-32237.exe (PID: 8612)
- Unicorn-7410.exe (PID: 8516)
- Unicorn-53404.exe (PID: 8576)
- Unicorn-19199.exe (PID: 8480)
- Unicorn-7732.exe (PID: 8588)
- Unicorn-26217.exe (PID: 8728)
- Unicorn-1016.exe (PID: 8720)
- Unicorn-12371.exe (PID: 8644)
- Unicorn-13275.exe (PID: 8816)
- Unicorn-7732.exe (PID: 8696)
- Unicorn-26482.exe (PID: 8736)
- Unicorn-38734.exe (PID: 8752)
- Unicorn-43372.exe (PID: 8796)
- Unicorn-2340.exe (PID: 8824)
- Unicorn-33887.exe (PID: 8760)
- Unicorn-42586.exe (PID: 8788)
- Unicorn-36688.exe (PID: 8768)
- Unicorn-43913.exe (PID: 9000)
- Unicorn-63778.exe (PID: 9008)
- Unicorn-27022.exe (PID: 8964)
- Unicorn-51718.exe (PID: 8948)
- Unicorn-7570.exe (PID: 8976)
- Unicorn-31298.exe (PID: 8936)
- Unicorn-18470.exe (PID: 9052)
- Unicorn-4032.exe (PID: 9092)
- Unicorn-62195.exe (PID: 9032)
- Unicorn-22289.exe (PID: 9060)
- Unicorn-64738.exe (PID: 9108)
- Unicorn-40042.exe (PID: 9132)
- Unicorn-11261.exe (PID: 9160)
- Unicorn-45153.exe (PID: 6564)
- Unicorn-18972.exe (PID: 9200)
- Unicorn-20582.exe (PID: 7376)
- Unicorn-65101.exe (PID: 9168)
- Unicorn-49170.exe (PID: 8916)
- Unicorn-20390.exe (PID: 7672)
- Unicorn-65314.exe (PID: 9088)
- Unicorn-57701.exe (PID: 9224)
- Unicorn-16114.exe (PID: 9232)
- Unicorn-46740.exe (PID: 9308)
- Unicorn-18151.exe (PID: 9276)
- Unicorn-64420.exe (PID: 9356)
- Unicorn-64420.exe (PID: 9364)
- Unicorn-29061.exe (PID: 9440)
- Unicorn-62958.exe (PID: 9504)
- Unicorn-55153.exe (PID: 9540)
- Unicorn-1313.exe (PID: 9528)
- Unicorn-56326.exe (PID: 9644)
Executable content was dropped or overwritten
- 1 (1124).exe (PID: 7488)
- Unicorn-8855.exe (PID: 7876)
- Unicorn-4901.exe (PID: 720)
- Unicorn-62825.exe (PID: 2316)
- Unicorn-33054.exe (PID: 7420)
- Unicorn-39176.exe (PID: 7448)
- Unicorn-55454.exe (PID: 7244)
- Unicorn-55454.exe (PID: 4448)
- Unicorn-55454.exe (PID: 7240)
- Unicorn-4465.exe (PID: 7428)
- Unicorn-18506.exe (PID: 6028)
- Unicorn-10892.exe (PID: 7648)
- Unicorn-42745.exe (PID: 7728)
- Unicorn-1349.exe (PID: 6516)
- Unicorn-9517.exe (PID: 6512)
- Unicorn-5433.exe (PID: 5384)
- Unicorn-5988.exe (PID: 4068)
- Unicorn-5988.exe (PID: 5984)
- Unicorn-936.exe (PID: 7412)
- Unicorn-62610.exe (PID: 4464)
- Unicorn-62610.exe (PID: 6592)
- Unicorn-64177.exe (PID: 6964)
- Unicorn-13409.exe (PID: 2040)
- Unicorn-13409.exe (PID: 856)
- Unicorn-24899.exe (PID: 1072)
- Unicorn-24627.exe (PID: 7688)
- Unicorn-36134.exe (PID: 7272)
- Unicorn-48941.exe (PID: 7260)
- Unicorn-9216.exe (PID: 7760)
- Unicorn-45226.exe (PID: 7928)
- Unicorn-4577.exe (PID: 7012)
- Unicorn-57478.exe (PID: 8180)
- Unicorn-45781.exe (PID: 6272)
- Unicorn-63600.exe (PID: 7744)
- Unicorn-12361.exe (PID: 1280)
- Unicorn-57286.exe (PID: 3888)
- Unicorn-13705.exe (PID: 1348)
- Unicorn-59377.exe (PID: 6808)
- Unicorn-18483.exe (PID: 5892)
- Unicorn-40902.exe (PID: 7188)
- Unicorn-5345.exe (PID: 7252)
- Unicorn-50462.exe (PID: 7212)
- Unicorn-58630.exe (PID: 2852)
- Unicorn-23615.exe (PID: 7440)
- Unicorn-19635.exe (PID: 7708)
- Unicorn-300.exe (PID: 7820)
- Unicorn-5345.exe (PID: 6132)
- Unicorn-7279.exe (PID: 6576)
- Unicorn-50462.exe (PID: 4696)
- Unicorn-29481.exe (PID: 5404)
- Unicorn-50462.exe (PID: 7224)
- Unicorn-25501.exe (PID: 7720)
- Unicorn-21578.exe (PID: 7484)
- Unicorn-5537.exe (PID: 7704)
- Unicorn-56829.exe (PID: 8152)
- Unicorn-35662.exe (PID: 8088)
- Unicorn-37700.exe (PID: 7956)
- Unicorn-27110.exe (PID: 2432)
- Unicorn-40108.exe (PID: 8140)
- Unicorn-6305.exe (PID: 4200)
- Unicorn-4312.exe (PID: 6344)
- Unicorn-39554.exe (PID: 7852)
- Unicorn-29147.exe (PID: 6876)
- Unicorn-45153.exe (PID: 6564)
- Unicorn-30107.exe (PID: 5064)
- Unicorn-45153.exe (PID: 7868)
- Unicorn-26023.exe (PID: 7172)
- Unicorn-1712.exe (PID: 5228)
- Unicorn-61702.exe (PID: 6540)
- Unicorn-56274.exe (PID: 5800)
- Unicorn-22899.exe (PID: 8036)
- Unicorn-3181.exe (PID: 5588)
- Unicorn-24156.exe (PID: 7156)
- Unicorn-28838.exe (PID: 2772)
- Unicorn-50218.exe (PID: 8324)
- Unicorn-12044.exe (PID: 6724)
- Unicorn-44982.exe (PID: 8208)
- Unicorn-4888.exe (PID: 2268)
- Unicorn-44982.exe (PID: 8204)
- Unicorn-37176.exe (PID: 8276)
- Unicorn-26651.exe (PID: 5344)
- Unicorn-3684.exe (PID: 8232)
- Unicorn-15936.exe (PID: 8268)
- Unicorn-63025.exe (PID: 8368)
- Unicorn-47980.exe (PID: 8428)
- Unicorn-28454.exe (PID: 8284)
- Unicorn-58194.exe (PID: 8436)
- Unicorn-17354.exe (PID: 8376)
- Unicorn-25330.exe (PID: 8488)
- Unicorn-32429.exe (PID: 8524)
- Unicorn-7732.exe (PID: 8596)
- Unicorn-32237.exe (PID: 8612)
- Unicorn-7732.exe (PID: 8604)
- Unicorn-41666.exe (PID: 8496)
- Unicorn-40405.exe (PID: 8632)
- Unicorn-11302.exe (PID: 8652)
- Unicorn-53404.exe (PID: 8576)
- Unicorn-7732.exe (PID: 8588)
- Unicorn-26217.exe (PID: 8728)
- Unicorn-1016.exe (PID: 8720)
- Unicorn-16835.exe (PID: 5936)
- Unicorn-12371.exe (PID: 8644)
- Unicorn-19199.exe (PID: 8480)
- Unicorn-5900.exe (PID: 7304)
- Unicorn-7732.exe (PID: 8696)
- Unicorn-38734.exe (PID: 8752)
- Unicorn-13275.exe (PID: 8816)
- Unicorn-26482.exe (PID: 8736)
- Unicorn-36688.exe (PID: 8768)
- Unicorn-33887.exe (PID: 8760)
- Unicorn-42586.exe (PID: 8788)
- Unicorn-21416.exe (PID: 7180)
- Unicorn-43372.exe (PID: 8796)
- Unicorn-43913.exe (PID: 9000)
- Unicorn-27022.exe (PID: 8964)
- Unicorn-63778.exe (PID: 9008)
- Unicorn-31298.exe (PID: 8936)
- Unicorn-62195.exe (PID: 9032)
- Unicorn-51718.exe (PID: 8948)
- Unicorn-7570.exe (PID: 8976)
- Unicorn-18470.exe (PID: 9052)
- Unicorn-22289.exe (PID: 9060)
- Unicorn-4032.exe (PID: 9092)
- Unicorn-64738.exe (PID: 9108)
- Unicorn-40042.exe (PID: 9132)
- Unicorn-16092.exe (PID: 9124)
- Unicorn-11261.exe (PID: 9160)
- Unicorn-65101.exe (PID: 9168)
- Unicorn-18972.exe (PID: 9200)
- Unicorn-20582.exe (PID: 7376)
- Unicorn-49170.exe (PID: 8916)
- Unicorn-20390.exe (PID: 7672)
- Unicorn-24282.exe (PID: 9268)
- Unicorn-57701.exe (PID: 9224)
- Unicorn-16114.exe (PID: 9232)
- Unicorn-64420.exe (PID: 9356)
- Unicorn-18151.exe (PID: 9276)
- Unicorn-65314.exe (PID: 9088)
- Unicorn-64420.exe (PID: 9364)
- Unicorn-29061.exe (PID: 9440)
- Unicorn-29061.exe (PID: 9448)
- Unicorn-62958.exe (PID: 9504)
- Unicorn-55153.exe (PID: 9540)
- Unicorn-1313.exe (PID: 9528)
- Unicorn-7410.exe (PID: 8516)
- Unicorn-56326.exe (PID: 9644)
- Unicorn-56689.exe (PID: 9696)
- Unicorn-59569.exe (PID: 9748)
- Unicorn-31438.exe (PID: 9716)
- Unicorn-55750.exe (PID: 9740)
- Unicorn-36674.exe (PID: 9776)
- Unicorn-32952.exe (PID: 9840)
- Unicorn-28314.exe (PID: 9812)
- Unicorn-42412.exe (PID: 9876)
- Unicorn-20146.exe (PID: 9800)
- Unicorn-40736.exe (PID: 9944)
- Unicorn-46740.exe (PID: 9308)
- Unicorn-16232.exe (PID: 9904)
- Unicorn-4733.exe (PID: 9980)
- Unicorn-56253.exe (PID: 9932)
- Unicorn-25324.exe (PID: 10140)
- Unicorn-28854.exe (PID: 10116)
- Unicorn-40536.exe (PID: 10068)
- Unicorn-457.exe (PID: 10032)
- Unicorn-53550.exe (PID: 10080)
- Unicorn-12325.exe (PID: 10180)
- Unicorn-62870.exe (PID: 1616)
- Unicorn-27959.exe (PID: 8100)
- Unicorn-34090.exe (PID: 7548)
- Unicorn-50426.exe (PID: 2192)
- Unicorn-45580.exe (PID: 9576)
- Unicorn-25132.exe (PID: 10220)
- Unicorn-64716.exe (PID: 10244)
- Unicorn-34260.exe (PID: 10316)
- Unicorn-61724.exe (PID: 10284)
- Unicorn-33441.exe (PID: 10300)
- Unicorn-31568.exe (PID: 10324)
- Unicorn-47110.exe (PID: 10368)
- Unicorn-41682.exe (PID: 10348)
- Unicorn-42834.exe (PID: 10424)
- Unicorn-43580.exe (PID: 10388)
- Unicorn-2340.exe (PID: 8824)
- Unicorn-22030.exe (PID: 10540)
- Unicorn-35220.exe (PID: 10432)
- Unicorn-13861.exe (PID: 10520)
- Unicorn-7037.exe (PID: 10628)
- Unicorn-38366.exe (PID: 10572)
- Unicorn-58786.exe (PID: 10604)
- Unicorn-39710.exe (PID: 10680)
- Unicorn-46534.exe (PID: 10580)
- Unicorn-19652.exe (PID: 10764)
- Unicorn-60877.exe (PID: 10648)
- Unicorn-13861.exe (PID: 10528)
- Unicorn-47878.exe (PID: 10700)
- Unicorn-15205.exe (PID: 10656)
- Unicorn-56046.exe (PID: 10716)
- Unicorn-6196.exe (PID: 10984)
- Unicorn-19652.exe (PID: 10760)
- Unicorn-3316.exe (PID: 10736)
- Unicorn-35242.exe (PID: 10892)
- Unicorn-40072.exe (PID: 10828)
- Unicorn-12775.exe (PID: 10868)
- Unicorn-47494.exe (PID: 10932)
- Unicorn-49532.exe (PID: 10948)
- Unicorn-35988.exe (PID: 10820)
- Unicorn-60301.exe (PID: 11004)
- Unicorn-41364.exe (PID: 10924)
- Unicorn-51770.exe (PID: 10796)
- Unicorn-34287.exe (PID: 11048)
- Unicorn-22798.exe (PID: 11028)
- Unicorn-33387.exe (PID: 10776)
- Unicorn-15741.exe (PID: 11096)
- Unicorn-51386.exe (PID: 11068)
- Unicorn-15974.exe (PID: 11088)
- Unicorn-24142.exe (PID: 11108)
- Unicorn-44562.exe (PID: 11136)
- Unicorn-8168.exe (PID: 11220)
- Unicorn-65345.exe (PID: 7388)
- Unicorn-44562.exe (PID: 11144)
- Unicorn-61526.exe (PID: 10160)
- Unicorn-55853.exe (PID: 11192)
- Unicorn-52730.exe (PID: 11152)
- Unicorn-36756.exe (PID: 11240)
- Unicorn-31734.exe (PID: 11284)
- Unicorn-19482.exe (PID: 11268)
- Unicorn-48070.exe (PID: 11308)
- Unicorn-25795.exe (PID: 3024)
- Unicorn-51003.exe (PID: 924)
- Unicorn-21519.exe (PID: 11276)
- Unicorn-55469.exe (PID: 10472)
- Unicorn-19216.exe (PID: 4932)
- Unicorn-37162.exe (PID: 11388)
- Unicorn-49414.exe (PID: 11408)
- Unicorn-8573.exe (PID: 11356)
- Unicorn-47281.exe (PID: 10476)
- Unicorn-65293.exe (PID: 11456)
- Unicorn-45501.exe (PID: 11560)
- Unicorn-16550.exe (PID: 11432)
- Unicorn-25080.exe (PID: 11524)
- Unicorn-6143.exe (PID: 11480)
- Unicorn-4660.exe (PID: 11504)
- Unicorn-5693.exe (PID: 10488)
- Unicorn-57945.exe (PID: 11472)
- Unicorn-44946.exe (PID: 11532)
- Unicorn-53669.exe (PID: 11568)
- Unicorn-14119.exe (PID: 11588)
Executes application which crashes
- Unicorn-63357.exe (PID: 2772)
INFO
Checks supported languages
- Unicorn-62825.exe (PID: 2316)
- Unicorn-8855.exe (PID: 7876)
- 1 (1124).exe (PID: 7488)
- Unicorn-4901.exe (PID: 720)
- Unicorn-4465.exe (PID: 7428)
- Unicorn-936.exe (PID: 7412)
- Unicorn-55454.exe (PID: 7240)
- Unicorn-55454.exe (PID: 4448)
- Unicorn-18506.exe (PID: 6028)
- Unicorn-42745.exe (PID: 7728)
- Unicorn-9517.exe (PID: 6512)
- Unicorn-63357.exe (PID: 2772)
- Unicorn-21578.exe (PID: 7484)
- Unicorn-1712.exe (PID: 5228)
- Unicorn-7279.exe (PID: 6576)
- Unicorn-29481.exe (PID: 5404)
- Unicorn-9216.exe (PID: 7760)
- Unicorn-45226.exe (PID: 7928)
- Unicorn-57478.exe (PID: 8180)
- Unicorn-12361.exe (PID: 1280)
- Unicorn-39176.exe (PID: 7448)
- Unicorn-33054.exe (PID: 7420)
- Unicorn-26651.exe (PID: 5344)
- Unicorn-57286.exe (PID: 3888)
- Unicorn-13705.exe (PID: 1348)
- Unicorn-58630.exe (PID: 2852)
- Unicorn-5345.exe (PID: 7252)
- Unicorn-50462.exe (PID: 7224)
- Unicorn-25501.exe (PID: 7720)
- Unicorn-5345.exe (PID: 6132)
- Unicorn-300.exe (PID: 7820)
- Unicorn-40108.exe (PID: 8140)
- Unicorn-4312.exe (PID: 6344)
- Unicorn-35662.exe (PID: 8088)
- Unicorn-3181.exe (PID: 5588)
- Unicorn-24156.exe (PID: 7156)
- Unicorn-61702.exe (PID: 6540)
- Unicorn-26023.exe (PID: 7172)
- Unicorn-12044.exe (PID: 6724)
- Unicorn-44982.exe (PID: 8204)
- Unicorn-3684.exe (PID: 8232)
- Unicorn-50218.exe (PID: 8324)
- Unicorn-17354.exe (PID: 8376)
- Unicorn-63025.exe (PID: 8368)
- Unicorn-32429.exe (PID: 8524)
- Unicorn-53404.exe (PID: 8576)
- Unicorn-38734.exe (PID: 8752)
- Unicorn-7732.exe (PID: 8604)
- Unicorn-1016.exe (PID: 8720)
- Unicorn-26482.exe (PID: 8736)
- Unicorn-26217.exe (PID: 8728)
- Unicorn-7732.exe (PID: 8696)
- Unicorn-36688.exe (PID: 8768)
- Unicorn-2340.exe (PID: 8824)
- Unicorn-27022.exe (PID: 8964)
- Unicorn-16092.exe (PID: 9124)
- Unicorn-4032.exe (PID: 9092)
- Unicorn-22289.exe (PID: 9060)
- Unicorn-49170.exe (PID: 8916)
- Unicorn-20390.exe (PID: 7672)
- Unicorn-16114.exe (PID: 9232)
- Unicorn-22899.exe (PID: 8036)
- Unicorn-29061.exe (PID: 9448)
- Unicorn-64420.exe (PID: 9364)
- Unicorn-62958.exe (PID: 9504)
- Unicorn-55153.exe (PID: 9540)
- Unicorn-1313.exe (PID: 9528)
- Unicorn-4733.exe (PID: 9980)
- Unicorn-42412.exe (PID: 9876)
- Unicorn-56253.exe (PID: 9932)
- Unicorn-457.exe (PID: 10032)
- Unicorn-40536.exe (PID: 10068)
- Unicorn-61526.exe (PID: 10160)
- Unicorn-12325.exe (PID: 10180)
- Unicorn-34090.exe (PID: 7548)
- Unicorn-47110.exe (PID: 10368)
- Unicorn-64716.exe (PID: 10244)
- Unicorn-61724.exe (PID: 10284)
- Unicorn-41682.exe (PID: 10348)
- Unicorn-43580.exe (PID: 10388)
- Unicorn-35220.exe (PID: 10432)
- Unicorn-50426.exe (PID: 2192)
- Unicorn-47281.exe (PID: 10476)
- Unicorn-22030.exe (PID: 10540)
- Unicorn-58786.exe (PID: 10604)
- Unicorn-60877.exe (PID: 10648)
- Unicorn-15205.exe (PID: 10656)
- Unicorn-35242.exe (PID: 10892)
- Unicorn-60301.exe (PID: 11004)
- Unicorn-22798.exe (PID: 11028)
- Unicorn-51386.exe (PID: 11068)
- Unicorn-34287.exe (PID: 11048)
- Unicorn-51770.exe (PID: 10796)
- Unicorn-15741.exe (PID: 11096)
- Unicorn-44562.exe (PID: 11136)
- Unicorn-52730.exe (PID: 11152)
- Unicorn-55469.exe (PID: 10472)
- Unicorn-37162.exe (PID: 11388)
- Unicorn-36756.exe (PID: 11240)
- Unicorn-57945.exe (PID: 11472)
- Unicorn-4660.exe (PID: 11504)
- Unicorn-44946.exe (PID: 11532)
- Unicorn-20639.exe (PID: 11644)
- Unicorn-16550.exe (PID: 11432)
- Unicorn-25080.exe (PID: 11524)
- Unicorn-28418.exe (PID: 11596)
- Unicorn-4873.exe (PID: 11668)
- Unicorn-62605.exe (PID: 11704)
- Unicorn-61858.exe (PID: 11760)
- Unicorn-6025.exe (PID: 11768)
- Unicorn-2496.exe (PID: 11784)
- Unicorn-22532.exe (PID: 11896)
- Unicorn-51121.exe (PID: 11952)
- Unicorn-33299.exe (PID: 12004)
- Unicorn-47333.exe (PID: 12012)
- Unicorn-59658.exe (PID: 12088)
- Unicorn-50156.exe (PID: 12104)
- Unicorn-38091.exe (PID: 12160)
- Unicorn-38091.exe (PID: 12168)
- Unicorn-64510.exe (PID: 12236)
- Unicorn-52621.exe (PID: 6228)
- Unicorn-60108.exe (PID: 12576)
- Unicorn-30420.exe (PID: 12852)
- Unicorn-51033.exe (PID: 12820)
- Unicorn-54370.exe (PID: 12872)
- Unicorn-39932.exe (PID: 12916)
- Unicorn-41032.exe (PID: 13040)
- Unicorn-6143.exe (PID: 11480)
- Unicorn-27872.exe (PID: 12976)
- Unicorn-63180.exe (PID: 13496)
- Unicorn-26861.exe (PID: 13408)
- Unicorn-59990.exe (PID: 13336)
- Unicorn-38116.exe (PID: 13676)
- Unicorn-14711.exe (PID: 13744)
- Unicorn-5060.exe (PID: 13752)
- Unicorn-3991.exe (PID: 13784)
- Unicorn-62237.exe (PID: 13876)
- Unicorn-24732.exe (PID: 7888)
- Unicorn-5008.exe (PID: 14244)
- Unicorn-42584.exe (PID: 14344)
- Unicorn-44977.exe (PID: 13624)
- Unicorn-20993.exe (PID: 14508)
- Unicorn-24607.exe (PID: 14592)
- Unicorn-42725.exe (PID: 14608)
- Unicorn-63425.exe (PID: 13008)
- Unicorn-54568.exe (PID: 13080)
Reads the computer name
- Unicorn-8855.exe (PID: 7876)
- 1 (1124).exe (PID: 7488)
- Unicorn-62825.exe (PID: 2316)
- Unicorn-4901.exe (PID: 720)
- Unicorn-33054.exe (PID: 7420)
- Unicorn-39176.exe (PID: 7448)
- Unicorn-936.exe (PID: 7412)
- Unicorn-18506.exe (PID: 6028)
- Unicorn-42745.exe (PID: 7728)
- Unicorn-5433.exe (PID: 5384)
- Unicorn-62610.exe (PID: 4464)
- Unicorn-62610.exe (PID: 6592)
- Unicorn-23615.exe (PID: 7440)
- Unicorn-48941.exe (PID: 7260)
- Unicorn-36134.exe (PID: 7272)
- Unicorn-9216.exe (PID: 7760)
- Unicorn-21578.exe (PID: 7484)
- Unicorn-13409.exe (PID: 856)
- Unicorn-57478.exe (PID: 8180)
- Unicorn-63600.exe (PID: 7744)
- Unicorn-5900.exe (PID: 7304)
- Unicorn-21416.exe (PID: 7180)
- Unicorn-300.exe (PID: 7820)
- Unicorn-50462.exe (PID: 7224)
- Unicorn-40108.exe (PID: 8140)
- Unicorn-45153.exe (PID: 6564)
- Unicorn-56829.exe (PID: 8152)
- Unicorn-56274.exe (PID: 5800)
- Unicorn-28838.exe (PID: 2772)
- Unicorn-44982.exe (PID: 8208)
- Unicorn-22899.exe (PID: 8036)
- Unicorn-25330.exe (PID: 8488)
- Unicorn-32429.exe (PID: 8524)
- Unicorn-19199.exe (PID: 8480)
- Unicorn-7732.exe (PID: 8696)
- Unicorn-63778.exe (PID: 9008)
- Unicorn-36688.exe (PID: 8768)
- Unicorn-18470.exe (PID: 9052)
- Unicorn-18151.exe (PID: 9276)
- Unicorn-29061.exe (PID: 9448)
- Unicorn-55153.exe (PID: 9540)
- Unicorn-59569.exe (PID: 9748)
Create files in a temporary directory
- 1 (1124).exe (PID: 7488)
- Unicorn-8855.exe (PID: 7876)
- Unicorn-4901.exe (PID: 720)
- Unicorn-62825.exe (PID: 2316)
- Unicorn-33054.exe (PID: 7420)
- Unicorn-4465.exe (PID: 7428)
- Unicorn-42745.exe (PID: 7728)
- Unicorn-39176.exe (PID: 7448)
- Unicorn-24627.exe (PID: 7688)
- Unicorn-1349.exe (PID: 6516)
- Unicorn-5433.exe (PID: 5384)
- Unicorn-55454.exe (PID: 7240)
- Unicorn-5988.exe (PID: 5984)
- Unicorn-55454.exe (PID: 4448)
- Unicorn-5988.exe (PID: 4068)
- Unicorn-936.exe (PID: 7412)
- Unicorn-62610.exe (PID: 4464)
- Unicorn-36134.exe (PID: 7272)
- Unicorn-48941.exe (PID: 7260)
- Unicorn-9216.exe (PID: 7760)
- Unicorn-45226.exe (PID: 7928)
- Unicorn-13409.exe (PID: 856)
- Unicorn-55454.exe (PID: 7244)
- Unicorn-57478.exe (PID: 8180)
- Unicorn-63600.exe (PID: 7744)
- Unicorn-45781.exe (PID: 6272)
- Unicorn-62610.exe (PID: 6592)
- Unicorn-13705.exe (PID: 1348)
- Unicorn-59377.exe (PID: 6808)
- Unicorn-18483.exe (PID: 5892)
- Unicorn-18506.exe (PID: 6028)
- Unicorn-64177.exe (PID: 6964)
- Unicorn-58630.exe (PID: 2852)
- Unicorn-5345.exe (PID: 7252)
- Unicorn-50462.exe (PID: 4696)
- Unicorn-13409.exe (PID: 2040)
- Unicorn-7279.exe (PID: 6576)
- Unicorn-24899.exe (PID: 1072)
- Unicorn-29481.exe (PID: 5404)
- Unicorn-25501.exe (PID: 7720)
- Unicorn-21578.exe (PID: 7484)
- Unicorn-56829.exe (PID: 8152)
- Unicorn-5537.exe (PID: 7704)
- Unicorn-35662.exe (PID: 8088)
- Unicorn-6305.exe (PID: 4200)
- Unicorn-4312.exe (PID: 6344)
- Unicorn-39554.exe (PID: 7852)
- Unicorn-26023.exe (PID: 7172)
- Unicorn-3181.exe (PID: 5588)
- Unicorn-56274.exe (PID: 5800)
- Unicorn-22899.exe (PID: 8036)
- Unicorn-4888.exe (PID: 2268)
- Unicorn-50218.exe (PID: 8324)
- Unicorn-12361.exe (PID: 1280)
- Unicorn-3684.exe (PID: 8232)
- Unicorn-57286.exe (PID: 3888)
- Unicorn-17354.exe (PID: 8376)
- Unicorn-25330.exe (PID: 8488)
- Unicorn-11302.exe (PID: 8652)
- Unicorn-300.exe (PID: 7820)
- Unicorn-19199.exe (PID: 8480)
- Unicorn-19635.exe (PID: 7708)
- Unicorn-5900.exe (PID: 7304)
- Unicorn-38734.exe (PID: 8752)
- Unicorn-26482.exe (PID: 8736)
- Unicorn-33887.exe (PID: 8760)
- Unicorn-42586.exe (PID: 8788)
- Unicorn-43372.exe (PID: 8796)
- Unicorn-50462.exe (PID: 7224)
- Unicorn-7570.exe (PID: 8976)
- Unicorn-62195.exe (PID: 9032)
- Unicorn-37700.exe (PID: 7956)
- Unicorn-22289.exe (PID: 9060)
- Unicorn-64738.exe (PID: 9108)
- Unicorn-40042.exe (PID: 9132)
- Unicorn-4577.exe (PID: 7012)
- Unicorn-40902.exe (PID: 7188)
- Unicorn-29147.exe (PID: 6876)
- Unicorn-40108.exe (PID: 8140)
- Unicorn-65101.exe (PID: 9168)
- Unicorn-9517.exe (PID: 6512)
- Unicorn-18972.exe (PID: 9200)
- Unicorn-57701.exe (PID: 9224)
- Unicorn-16114.exe (PID: 9232)
- Unicorn-24156.exe (PID: 7156)
- Unicorn-30107.exe (PID: 5064)
- Unicorn-64420.exe (PID: 9364)
- Unicorn-61702.exe (PID: 6540)
- Unicorn-29061.exe (PID: 9440)
- Unicorn-44982.exe (PID: 8204)
- Unicorn-26651.exe (PID: 5344)
- Unicorn-63025.exe (PID: 8368)
- Unicorn-15936.exe (PID: 8268)
- Unicorn-44982.exe (PID: 8208)
- Unicorn-58194.exe (PID: 8436)
- Unicorn-55153.exe (PID: 9540)
- Unicorn-7732.exe (PID: 8596)
- Unicorn-7732.exe (PID: 8604)
- Unicorn-12371.exe (PID: 8644)
- Unicorn-5345.exe (PID: 6132)
- Unicorn-1016.exe (PID: 8720)
- Unicorn-23615.exe (PID: 7440)
- Unicorn-7732.exe (PID: 8696)
- Unicorn-36688.exe (PID: 8768)
The sample compiled with chinese language support
- 1 (1124).exe (PID: 7488)
- Unicorn-5345.exe (PID: 6132)
- Unicorn-24899.exe (PID: 1072)
- Unicorn-39176.exe (PID: 7448)
- Unicorn-7279.exe (PID: 6576)
- Unicorn-26482.exe (PID: 8736)
- Unicorn-7732.exe (PID: 8696)
- Unicorn-38734.exe (PID: 8752)
- Unicorn-43372.exe (PID: 8796)
- Unicorn-64177.exe (PID: 6964)
- Unicorn-42586.exe (PID: 8788)
- Unicorn-50462.exe (PID: 7224)
- Unicorn-21416.exe (PID: 7180)
- Unicorn-62825.exe (PID: 2316)
- Unicorn-8855.exe (PID: 7876)
- Unicorn-63778.exe (PID: 9008)
- Unicorn-27022.exe (PID: 8964)
- Unicorn-31298.exe (PID: 8936)
- Unicorn-31568.exe (PID: 10324)
- Unicorn-62195.exe (PID: 9032)
- Unicorn-47110.exe (PID: 10368)
- Unicorn-36134.exe (PID: 7272)
- Unicorn-25501.exe (PID: 7720)
- Unicorn-29481.exe (PID: 5404)
- Unicorn-21578.exe (PID: 7484)
- Unicorn-22289.exe (PID: 9060)
- Unicorn-56689.exe (PID: 9696)
- Unicorn-53404.exe (PID: 8576)
- Unicorn-4032.exe (PID: 9092)
- Unicorn-31438.exe (PID: 9716)
- Unicorn-35662.exe (PID: 8088)
- Unicorn-56829.exe (PID: 8152)
- Unicorn-43580.exe (PID: 10388)
- Unicorn-48941.exe (PID: 7260)
- Unicorn-11261.exe (PID: 9160)
- Unicorn-59569.exe (PID: 9748)
- Unicorn-40902.exe (PID: 7188)
- Unicorn-29147.exe (PID: 6876)
- Unicorn-40108.exe (PID: 8140)
- Unicorn-9216.exe (PID: 7760)
- Unicorn-2340.exe (PID: 8824)
- Unicorn-55454.exe (PID: 7240)
- Unicorn-42834.exe (PID: 10424)
- Unicorn-64738.exe (PID: 9108)
- Unicorn-4577.exe (PID: 7012)
- Unicorn-27110.exe (PID: 2432)
- Unicorn-40042.exe (PID: 9132)
- Unicorn-16092.exe (PID: 9124)
- Unicorn-45153.exe (PID: 6564)
- Unicorn-45153.exe (PID: 7868)
- Unicorn-5433.exe (PID: 5384)
- Unicorn-45226.exe (PID: 7928)
- Unicorn-9517.exe (PID: 6512)
- Unicorn-20582.exe (PID: 7376)
- Unicorn-1712.exe (PID: 5228)
- Unicorn-36674.exe (PID: 9776)
- Unicorn-6305.exe (PID: 4200)
- Unicorn-18972.exe (PID: 9200)
- Unicorn-4312.exe (PID: 6344)
- Unicorn-55750.exe (PID: 9740)
- Unicorn-65101.exe (PID: 9168)
- Unicorn-65314.exe (PID: 9088)
- Unicorn-3181.exe (PID: 5588)
- Unicorn-42412.exe (PID: 9876)
- Unicorn-24156.exe (PID: 7156)
- Unicorn-57478.exe (PID: 8180)
- Unicorn-35220.exe (PID: 10432)
- Unicorn-32952.exe (PID: 9840)
- Unicorn-49170.exe (PID: 8916)
- Unicorn-24627.exe (PID: 7688)
- Unicorn-20390.exe (PID: 7672)
- Unicorn-20146.exe (PID: 9800)
- Unicorn-24282.exe (PID: 9268)
- Unicorn-28314.exe (PID: 9812)
- Unicorn-40736.exe (PID: 9944)
- Unicorn-16114.exe (PID: 9232)
- Unicorn-18151.exe (PID: 9276)
- Unicorn-7037.exe (PID: 10628)
- Unicorn-16232.exe (PID: 9904)
- Unicorn-4733.exe (PID: 9980)
- Unicorn-13861.exe (PID: 10520)
- Unicorn-57701.exe (PID: 9224)
- Unicorn-457.exe (PID: 10032)
- Unicorn-64420.exe (PID: 9364)
- Unicorn-38366.exe (PID: 10572)
- Unicorn-56274.exe (PID: 5800)
- Unicorn-45781.exe (PID: 6272)
- Unicorn-64420.exe (PID: 9356)
- Unicorn-56253.exe (PID: 9932)
- Unicorn-30107.exe (PID: 5064)
- Unicorn-5693.exe (PID: 10488)
- Unicorn-22899.exe (PID: 8036)
- Unicorn-4888.exe (PID: 2268)
- Unicorn-40536.exe (PID: 10068)
- Unicorn-61702.exe (PID: 6540)
- Unicorn-55454.exe (PID: 4448)
- Unicorn-29061.exe (PID: 9440)
- Unicorn-50218.exe (PID: 8324)
- Unicorn-39710.exe (PID: 10680)
- Unicorn-46534.exe (PID: 10580)
- Unicorn-5988.exe (PID: 4068)
- Unicorn-12361.exe (PID: 1280)
- Unicorn-29061.exe (PID: 9448)
- Unicorn-60877.exe (PID: 10648)
- Unicorn-19652.exe (PID: 10764)
- Unicorn-63600.exe (PID: 7744)
- Unicorn-25324.exe (PID: 10140)
- Unicorn-5988.exe (PID: 5984)
- Unicorn-13705.exe (PID: 1348)
- Unicorn-12044.exe (PID: 6724)
- Unicorn-44982.exe (PID: 8204)
- Unicorn-33054.exe (PID: 7420)
- Unicorn-44982.exe (PID: 8208)
- Unicorn-62870.exe (PID: 1616)
- Unicorn-26023.exe (PID: 7172)
- Unicorn-15936.exe (PID: 8268)
- Unicorn-18483.exe (PID: 5892)
- Unicorn-63025.exe (PID: 8368)
- Unicorn-47980.exe (PID: 8428)
- Unicorn-13861.exe (PID: 10528)
- Unicorn-3684.exe (PID: 8232)
- Unicorn-47878.exe (PID: 10700)
- Unicorn-25132.exe (PID: 10220)
- Unicorn-62610.exe (PID: 4464)
- Unicorn-15205.exe (PID: 10656)
- Unicorn-62610.exe (PID: 6592)
- Unicorn-936.exe (PID: 7412)
- Unicorn-57286.exe (PID: 3888)
- Unicorn-34090.exe (PID: 7548)
- Unicorn-50426.exe (PID: 2192)
- Unicorn-45580.exe (PID: 9576)
- Unicorn-28454.exe (PID: 8284)
- Unicorn-62958.exe (PID: 9504)
- Unicorn-27959.exe (PID: 8100)
- Unicorn-4465.exe (PID: 7428)
- Unicorn-56046.exe (PID: 10716)
- Unicorn-58194.exe (PID: 8436)
- Unicorn-1313.exe (PID: 9528)
- Unicorn-64716.exe (PID: 10244)
- Unicorn-25330.exe (PID: 8488)
- Unicorn-18506.exe (PID: 6028)
- Unicorn-17354.exe (PID: 8376)
- Unicorn-50462.exe (PID: 7212)
- Unicorn-50462.exe (PID: 4696)
- Unicorn-41666.exe (PID: 8496)
- Unicorn-11302.exe (PID: 8652)
- Unicorn-12371.exe (PID: 8644)
- Unicorn-34260.exe (PID: 10316)
- Unicorn-7732.exe (PID: 8588)
- Unicorn-300.exe (PID: 7820)
- Unicorn-13409.exe (PID: 2040)
- Unicorn-59377.exe (PID: 6808)
- Unicorn-32429.exe (PID: 8524)
- Unicorn-7410.exe (PID: 8516)
- Unicorn-58630.exe (PID: 2852)
- Unicorn-61724.exe (PID: 10284)
- Unicorn-1016.exe (PID: 8720)
- Unicorn-19635.exe (PID: 7708)
- Unicorn-33441.exe (PID: 10300)
- Unicorn-13275.exe (PID: 8816)
- Unicorn-16835.exe (PID: 5936)
- Unicorn-23615.exe (PID: 7440)
- Unicorn-36688.exe (PID: 8768)
- Unicorn-41682.exe (PID: 10348)
- Unicorn-6196.exe (PID: 10984)
- Unicorn-26217.exe (PID: 8728)
- Unicorn-43913.exe (PID: 9000)
- Unicorn-4901.exe (PID: 720)
- Unicorn-42745.exe (PID: 7728)
- Unicorn-7570.exe (PID: 8976)
- Unicorn-37700.exe (PID: 7956)
- Unicorn-18470.exe (PID: 9052)
- Unicorn-3316.exe (PID: 10736)
- Unicorn-19652.exe (PID: 10760)
- Unicorn-56326.exe (PID: 9644)
- Unicorn-35988.exe (PID: 10820)
- Unicorn-12775.exe (PID: 10868)
- Unicorn-40072.exe (PID: 10828)
- Unicorn-1349.exe (PID: 6516)
- Unicorn-47494.exe (PID: 10932)
- Unicorn-35242.exe (PID: 10892)
- Unicorn-33387.exe (PID: 10776)
- Unicorn-60301.exe (PID: 11004)
- Unicorn-41364.exe (PID: 10924)
- Unicorn-51770.exe (PID: 10796)
- Unicorn-34287.exe (PID: 11048)
- Unicorn-49532.exe (PID: 10948)
- Unicorn-22798.exe (PID: 11028)
- Unicorn-51386.exe (PID: 11068)
- Unicorn-15741.exe (PID: 11096)
- Unicorn-15974.exe (PID: 11088)
- Unicorn-24142.exe (PID: 11108)
- Unicorn-53550.exe (PID: 10080)
- Unicorn-28838.exe (PID: 2772)
- Unicorn-44562.exe (PID: 11144)
- Unicorn-61526.exe (PID: 10160)
- Unicorn-12325.exe (PID: 10180)
- Unicorn-26651.exe (PID: 5344)
- Unicorn-37176.exe (PID: 8276)
- Unicorn-8168.exe (PID: 11220)
- Unicorn-55853.exe (PID: 11192)
- Unicorn-44562.exe (PID: 11136)
- Unicorn-22030.exe (PID: 10540)
- Unicorn-28854.exe (PID: 10116)
- Unicorn-19199.exe (PID: 8480)
- Unicorn-7732.exe (PID: 8604)
- Unicorn-52730.exe (PID: 11152)
- Unicorn-32237.exe (PID: 8612)
- Unicorn-7732.exe (PID: 8596)
- Unicorn-5900.exe (PID: 7304)
- Unicorn-36756.exe (PID: 11240)
- Unicorn-65345.exe (PID: 7388)
- Unicorn-33887.exe (PID: 8760)
- Unicorn-19482.exe (PID: 11268)
- Unicorn-31734.exe (PID: 11284)
- Unicorn-48070.exe (PID: 11308)
- Unicorn-25795.exe (PID: 3024)
- Unicorn-51718.exe (PID: 8948)
- Unicorn-51003.exe (PID: 924)
- Unicorn-5537.exe (PID: 7704)
- Unicorn-46740.exe (PID: 9308)
- Unicorn-21519.exe (PID: 11276)
- Unicorn-49414.exe (PID: 11408)
- Unicorn-55469.exe (PID: 10472)
- Unicorn-19216.exe (PID: 4932)
- Unicorn-13409.exe (PID: 856)
- Unicorn-10892.exe (PID: 7648)
- Unicorn-37162.exe (PID: 11388)
- Unicorn-8573.exe (PID: 11356)
- Unicorn-6143.exe (PID: 11480)
- Unicorn-4660.exe (PID: 11504)
- Unicorn-16550.exe (PID: 11432)
- Unicorn-55153.exe (PID: 9540)
- Unicorn-40405.exe (PID: 8632)
- Unicorn-45501.exe (PID: 11560)
- Unicorn-25080.exe (PID: 11524)
- Unicorn-58786.exe (PID: 10604)
- Unicorn-47281.exe (PID: 10476)
- Unicorn-65293.exe (PID: 11456)
- Unicorn-57945.exe (PID: 11472)
- Unicorn-44946.exe (PID: 11532)
- Unicorn-53669.exe (PID: 11568)
- Unicorn-14119.exe (PID: 11588)
- Unicorn-55454.exe (PID: 7244)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 6644)
- BackgroundTransferHost.exe (PID: 4688)
- BackgroundTransferHost.exe (PID: 5364)
- BackgroundTransferHost.exe (PID: 7792)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 6644)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 6644)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 6644)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
524
Monitored processes
390
Malicious processes
58
Suspicious processes
61
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 720 | C:\Users\admin\AppData\Local\Temp\Unicorn-4901.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-4901.exe | Unicorn-8855.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 856 | C:\Users\admin\AppData\Local\Temp\Unicorn-13409.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13409.exe | Unicorn-24627.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 924 | C:\Users\admin\AppData\Local\Temp\Unicorn-51003.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-51003.exe | 1 (1124).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1072 | C:\Users\admin\AppData\Local\Temp\Unicorn-24899.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24899.exe | 1 (1124).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1280 | C:\Users\admin\AppData\Local\Temp\Unicorn-12361.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-12361.exe | Unicorn-5988.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1348 | C:\Users\admin\AppData\Local\Temp\Unicorn-13705.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13705.exe | Unicorn-62610.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1616 | C:\Users\admin\AppData\Local\Temp\Unicorn-62870.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-62870.exe | Unicorn-15936.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2040 | C:\Users\admin\AppData\Local\Temp\Unicorn-13409.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13409.exe | Unicorn-10892.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2192 | C:\Users\admin\AppData\Local\Temp\Unicorn-50426.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-50426.exe | Unicorn-28454.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2268 | C:\Users\admin\AppData\Local\Temp\Unicorn-4888.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-4888.exe | Unicorn-5988.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
11 260
Read events
11 245
Write events
15
Delete events
0
Modification events
| (PID) Process: | (4688) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4688) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4688) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6644) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6644) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6644) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (5364) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (5364) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (5364) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7792) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
1 137
Suspicious files
8
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6644 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\12a1026d-7087-4aa5-a381-c144630cc0c5.down_data | — | |
MD5:— | SHA256:— | |||
| 720 | Unicorn-4901.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-4465.exe | executable | |
MD5:9D293FC64288C33CF714D302B56950EF | SHA256:E829D3B37D149C520E6885BB5A4200CC1662EAAACDB470A3B5DB904501495558 | |||
| 2316 | Unicorn-62825.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-33054.exe | executable | |
MD5:589F7E0B59D604B942FC4256701066C8 | SHA256:677C307E00F1EC4D45E251BFE264DD357696750A253AFF85475125BF56939249 | |||
| 7488 | 1 (1124).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-39176.exe | executable | |
MD5:686BB881BB4ED22812D5A9CDCF85051A | SHA256:2CF70713BBEB14A5BA1032FB92AE9E2539C2C1B493DD0AC55DE6310C5E8B9CBC | |||
| 7876 | Unicorn-8855.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24627.exe | executable | |
MD5:84F3C827769186556AE4628522A9F075 | SHA256:D0C33514327D24739CB37EF5D18F7CE66328231CCE8A04DA324EC8E437324B57 | |||
| 7876 | Unicorn-8855.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-4901.exe | executable | |
MD5:972E82539255EE8E09F1FB502475C480 | SHA256:3273C53DEB481F87F1B7F9359A4A66D689944FB4EA70FB0BD2D67FB41E77FC00 | |||
| 7488 | 1 (1124).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8855.exe | executable | |
MD5:3DA95FD85A91792895B8C09BCE8D7021 | SHA256:E2AE20DC8064EECB2A92B5CF610B88F95CD1AB2EB9E00369935B2E3283CEC75E | |||
| 7876 | Unicorn-8855.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-936.exe | executable | |
MD5:8DEA09FE3C0378E26C44E5CEA38D6759 | SHA256:8C3C5476E0A1111218D2AD61D6C7DFE7879654F4B13583001C2D2C197DFA8D79 | |||
| 6644 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
| 6644 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:9D3EE077D271C42CD514D55403611B42 | SHA256:42280E04F01B550F2DDE29CF8B1F1E66F553E58EDB218D6034D0E0184EC9B97D | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
15
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
— | — | GET | 200 | 23.48.23.168:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
8100 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | unknown |
8100 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | unknown |
6644 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | unknown |
7748 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:137 | — | — | — | unknown |
— | — | 23.48.23.168:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | unknown |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
6544 | svchost.exe | 20.190.160.22:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | unknown |
2104 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
7748 | backgroundTaskHost.exe | 20.31.169.57:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
7748 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| unknown |
settings-win.data.microsoft.com |
| unknown |
crl.microsoft.com |
| unknown |
client.wns.windows.com |
| unknown |
login.live.com |
| unknown |
ocsp.digicert.com |
| unknown |
arc.msn.com |
| unknown |
www.bing.com |
| unknown |
slscr.update.microsoft.com |
| unknown |
www.microsoft.com |
| unknown |