| File name: | 1 (123) |
| Full analysis: | https://app.any.run/tasks/854042fa-4a73-40c5-afcb-695ed2002477 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 10:47:51 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 2F1BE42373290B3D2EB3D5D29AB0BB60 |
| SHA1: | 41885CB23FCFC5CE33ECA74A82FFFE00556E0018 |
| SHA256: | 95B65161400615EB837CDB40C6D4F92B34FBC2BC6ADF74EE0894E2FC5EFEDEAD |
| SSDEEP: | 6144:N7e8CUmdQDWTBiUj0e2RbSx+tPrlp8+BL/xUeOaykb8ScjwpyAvEhgGOYQ9sToxM:Na31FTBdj3ePh+SLJUeOa1x4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- 1 (123).exe (PID: 4812)
- Unicorn-27021.exe (PID: 6424)
- Unicorn-8520.exe (PID: 7340)
- Unicorn-50108.exe (PID: 7360)
- Unicorn-10632.exe (PID: 7812)
- Unicorn-45343.exe (PID: 7864)
- Unicorn-34814.exe (PID: 7832)
- Unicorn-47389.exe (PID: 7844)
- Unicorn-61909.exe (PID: 7916)
- Unicorn-2547.exe (PID: 7936)
- Unicorn-12006.exe (PID: 7968)
- Unicorn-46725.exe (PID: 7960)
- Unicorn-65199.exe (PID: 7952)
- Unicorn-10523.exe (PID: 7980)
- Unicorn-9511.exe (PID: 8032)
- Unicorn-53305.exe (PID: 8080)
- Unicorn-12080.exe (PID: 8116)
- Unicorn-4659.exe (PID: 8104)
- Unicorn-38623.exe (PID: 8140)
- Unicorn-26305.exe (PID: 7992)
- Unicorn-29377.exe (PID: 8176)
- Unicorn-4680.exe (PID: 8184)
- Unicorn-57965.exe (PID: 6872)
- Unicorn-331.exe (PID: 7264)
- Unicorn-29739.exe (PID: 6436)
- Unicorn-46268.exe (PID: 5408)
- Unicorn-596.exe (PID: 6028)
- Unicorn-16170.exe (PID: 904)
- Unicorn-37353.exe (PID: 4652)
- Unicorn-5235.exe (PID: 5528)
- Unicorn-18970.exe (PID: 1764)
- Unicorn-31431.exe (PID: 2136)
- Unicorn-2096.exe (PID: 5416)
- Unicorn-21622.exe (PID: 2600)
- Unicorn-61172.exe (PID: 920)
- Unicorn-54997.exe (PID: 5772)
- Unicorn-35921.exe (PID: 1324)
- Unicorn-19319.exe (PID: 960)
- Unicorn-27753.exe (PID: 6324)
- Unicorn-44665.exe (PID: 672)
- Unicorn-103.exe (PID: 7300)
- Unicorn-19755.exe (PID: 4880)
- Unicorn-32029.exe (PID: 7480)
- Unicorn-53004.exe (PID: 664)
- Unicorn-37457.exe (PID: 6048)
- Unicorn-42095.exe (PID: 7596)
- Unicorn-4400.exe (PID: 7520)
- Unicorn-12760.exe (PID: 7336)
- Unicorn-41711.exe (PID: 5384)
- Unicorn-12660.exe (PID: 7288)
- Unicorn-4400.exe (PID: 7676)
- Unicorn-12760.exe (PID: 7268)
- Unicorn-4400.exe (PID: 7176)
- Unicorn-30057.exe (PID: 5260)
- Unicorn-4400.exe (PID: 7576)
- Unicorn-4400.exe (PID: 7668)
- Unicorn-49880.exe (PID: 6512)
- Unicorn-23859.exe (PID: 6676)
- Unicorn-61312.exe (PID: 5968)
- Unicorn-52647.exe (PID: 7708)
- Unicorn-42309.exe (PID: 1012)
- Unicorn-45433.exe (PID: 7684)
- Unicorn-38779.exe (PID: 7764)
- Unicorn-48431.exe (PID: 1240)
- Unicorn-55447.exe (PID: 1128)
- Unicorn-63305.exe (PID: 5084)
- Unicorn-30633.exe (PID: 5328)
- Unicorn-18189.exe (PID: 7892)
- Unicorn-42885.exe (PID: 1280)
- Unicorn-62351.exe (PID: 2644)
- Unicorn-50788.exe (PID: 5304)
- Unicorn-18381.exe (PID: 4608)
- Unicorn-44923.exe (PID: 1348)
- Unicorn-46777.exe (PID: 7376)
- Unicorn-31187.exe (PID: 5072)
- Unicorn-24118.exe (PID: 7724)
- Unicorn-42693.exe (PID: 7444)
- Unicorn-51416.exe (PID: 4228)
- Unicorn-64265.exe (PID: 8216)
- Unicorn-59989.exe (PID: 8232)
- Unicorn-51364.exe (PID: 8252)
- Unicorn-190.exe (PID: 8324)
- Unicorn-55713.exe (PID: 8272)
- Unicorn-24711.exe (PID: 8368)
- Unicorn-60721.exe (PID: 8388)
- Unicorn-17450.exe (PID: 8416)
- Unicorn-33093.exe (PID: 8464)
- Unicorn-4867.exe (PID: 8496)
- Unicorn-37945.exe (PID: 8656)
- Unicorn-31622.exe (PID: 8664)
- Unicorn-59251.exe (PID: 8576)
- Unicorn-10892.exe (PID: 8804)
- Unicorn-27783.exe (PID: 8832)
- Unicorn-62641.exe (PID: 8768)
- Unicorn-63601.exe (PID: 8880)
- Unicorn-38905.exe (PID: 8944)
- Unicorn-56180.exe (PID: 8860)
- Unicorn-30737.exe (PID: 8920)
- Unicorn-22569.exe (PID: 8900)
- Unicorn-62707.exe (PID: 8972)
- Unicorn-23529.exe (PID: 9088)
- Unicorn-3108.exe (PID: 9052)
- Unicorn-32635.exe (PID: 8988)
- Unicorn-48417.exe (PID: 9004)
- Unicorn-64369.exe (PID: 9132)
- Unicorn-36335.exe (PID: 9116)
- Unicorn-52236.exe (PID: 8996)
- Unicorn-64561.exe (PID: 9064)
- Unicorn-40227.exe (PID: 9176)
- Unicorn-7000.exe (PID: 9160)
- Unicorn-31697.exe (PID: 9100)
- Unicorn-4068.exe (PID: 8208)
- Unicorn-14466.exe (PID: 3676)
- Unicorn-8344.exe (PID: 4008)
- Unicorn-23719.exe (PID: 8312)
- Unicorn-28381.exe (PID: 8412)
- Unicorn-17067.exe (PID: 4944)
- Unicorn-11474.exe (PID: 2852)
- Unicorn-3836.exe (PID: 3332)
- Unicorn-61053.exe (PID: 8632)
- Unicorn-36092.exe (PID: 8492)
- Unicorn-12599.exe (PID: 8336)
- Unicorn-3227.exe (PID: 8456)
- Unicorn-14082.exe (PID: 7392)
- Unicorn-57716.exe (PID: 8332)
- Unicorn-20789.exe (PID: 9336)
- Unicorn-57545.exe (PID: 9348)
- Unicorn-4452.exe (PID: 9308)
- Unicorn-41544.exe (PID: 9400)
- Unicorn-4260.exe (PID: 9356)
- Unicorn-33595.exe (PID: 9384)
- Unicorn-28957.exe (PID: 9328)
- Unicorn-25762.exe (PID: 9508)
- Unicorn-12955.exe (PID: 9428)
Executable content was dropped or overwritten
- 1 (123).exe (PID: 4812)
- Unicorn-50108.exe (PID: 7360)
- Unicorn-8520.exe (PID: 7340)
- Unicorn-27021.exe (PID: 6424)
- Unicorn-10632.exe (PID: 7812)
- Unicorn-47389.exe (PID: 7844)
- Unicorn-45343.exe (PID: 7864)
- Unicorn-34814.exe (PID: 7832)
- Unicorn-61909.exe (PID: 7916)
- Unicorn-2547.exe (PID: 7936)
- Unicorn-12006.exe (PID: 7968)
- Unicorn-65199.exe (PID: 7952)
- Unicorn-26305.exe (PID: 7992)
- Unicorn-9511.exe (PID: 8032)
- Unicorn-46725.exe (PID: 7960)
- Unicorn-53305.exe (PID: 8080)
- Unicorn-4659.exe (PID: 8104)
- Unicorn-12080.exe (PID: 8116)
- Unicorn-38623.exe (PID: 8140)
- Unicorn-29377.exe (PID: 8176)
- Unicorn-4680.exe (PID: 8184)
- Unicorn-57965.exe (PID: 6872)
- Unicorn-331.exe (PID: 7264)
- Unicorn-596.exe (PID: 6028)
- Unicorn-18970.exe (PID: 1764)
- Unicorn-10523.exe (PID: 7980)
- Unicorn-31431.exe (PID: 2136)
- Unicorn-2096.exe (PID: 5416)
- Unicorn-21622.exe (PID: 2600)
- Unicorn-61172.exe (PID: 920)
- Unicorn-54997.exe (PID: 5772)
- Unicorn-27753.exe (PID: 6324)
- Unicorn-35921.exe (PID: 1324)
- Unicorn-19319.exe (PID: 960)
- Unicorn-19755.exe (PID: 4880)
- Unicorn-103.exe (PID: 7300)
- Unicorn-32029.exe (PID: 7480)
- Unicorn-44665.exe (PID: 672)
- Unicorn-53004.exe (PID: 664)
- Unicorn-37457.exe (PID: 6048)
- Unicorn-42095.exe (PID: 7596)
- Unicorn-4400.exe (PID: 7520)
- Unicorn-12760.exe (PID: 7336)
- Unicorn-5235.exe (PID: 5528)
- Unicorn-29739.exe (PID: 6436)
- Unicorn-41711.exe (PID: 5384)
- Unicorn-12660.exe (PID: 7288)
- Unicorn-4400.exe (PID: 7676)
- Unicorn-12760.exe (PID: 7268)
- Unicorn-16170.exe (PID: 904)
- Unicorn-4400.exe (PID: 7176)
- Unicorn-30057.exe (PID: 5260)
- Unicorn-4400.exe (PID: 7668)
- Unicorn-49880.exe (PID: 6512)
- Unicorn-46268.exe (PID: 5408)
- Unicorn-4400.exe (PID: 7576)
- Unicorn-23859.exe (PID: 6676)
- Unicorn-61312.exe (PID: 5968)
- Unicorn-37353.exe (PID: 4652)
- Unicorn-52647.exe (PID: 7708)
- Unicorn-42309.exe (PID: 1012)
- Unicorn-45433.exe (PID: 7684)
- Unicorn-38779.exe (PID: 7764)
- Unicorn-63305.exe (PID: 5084)
- Unicorn-48431.exe (PID: 1240)
- Unicorn-55447.exe (PID: 1128)
- Unicorn-30633.exe (PID: 5328)
- Unicorn-18189.exe (PID: 7892)
- Unicorn-42885.exe (PID: 1280)
- Unicorn-18381.exe (PID: 4608)
- Unicorn-50788.exe (PID: 5304)
- Unicorn-24118.exe (PID: 7724)
- Unicorn-62351.exe (PID: 2644)
- Unicorn-44923.exe (PID: 1348)
- Unicorn-31187.exe (PID: 5072)
- Unicorn-46777.exe (PID: 7376)
- Unicorn-51416.exe (PID: 4228)
- Unicorn-64265.exe (PID: 8216)
- Unicorn-42693.exe (PID: 7444)
- Unicorn-59989.exe (PID: 8232)
- Unicorn-51364.exe (PID: 8252)
- Unicorn-190.exe (PID: 8324)
- Unicorn-55713.exe (PID: 8272)
- Unicorn-24711.exe (PID: 8368)
- Unicorn-60721.exe (PID: 8388)
- Unicorn-17450.exe (PID: 8416)
- Unicorn-33093.exe (PID: 8464)
- Unicorn-4867.exe (PID: 8496)
- Unicorn-59251.exe (PID: 8576)
- Unicorn-37945.exe (PID: 8656)
- Unicorn-31622.exe (PID: 8664)
- Unicorn-62641.exe (PID: 8768)
- Unicorn-10892.exe (PID: 8804)
- Unicorn-27783.exe (PID: 8832)
- Unicorn-63601.exe (PID: 8880)
- Unicorn-56180.exe (PID: 8860)
- Unicorn-38905.exe (PID: 8944)
- Unicorn-30737.exe (PID: 8920)
- Unicorn-22569.exe (PID: 8900)
- Unicorn-62707.exe (PID: 8972)
- Unicorn-48417.exe (PID: 9004)
- Unicorn-3108.exe (PID: 9052)
- Unicorn-32635.exe (PID: 8988)
- Unicorn-40611.exe (PID: 9040)
- Unicorn-36335.exe (PID: 9116)
- Unicorn-52236.exe (PID: 8996)
- Unicorn-64561.exe (PID: 9064)
- Unicorn-31697.exe (PID: 9100)
- Unicorn-40227.exe (PID: 9176)
- Unicorn-7000.exe (PID: 9160)
- Unicorn-40227.exe (PID: 9184)
- Unicorn-4068.exe (PID: 8208)
- Unicorn-14466.exe (PID: 3676)
- Unicorn-23719.exe (PID: 8312)
- Unicorn-28381.exe (PID: 8412)
- Unicorn-17067.exe (PID: 4944)
- Unicorn-11474.exe (PID: 2852)
- Unicorn-8344.exe (PID: 4008)
- Unicorn-3836.exe (PID: 3332)
- Unicorn-61053.exe (PID: 8632)
- Unicorn-36092.exe (PID: 8492)
- Unicorn-12599.exe (PID: 8336)
- Unicorn-57716.exe (PID: 8332)
- Unicorn-3227.exe (PID: 8456)
- Unicorn-14082.exe (PID: 7392)
- Unicorn-20789.exe (PID: 9336)
- Unicorn-57545.exe (PID: 9348)
- Unicorn-33595.exe (PID: 9384)
- Unicorn-4452.exe (PID: 9308)
- Unicorn-41544.exe (PID: 9400)
- Unicorn-4260.exe (PID: 9356)
- Unicorn-12955.exe (PID: 9428)
- Unicorn-28957.exe (PID: 9328)
- Unicorn-61964.exe (PID: 9440)
- Unicorn-65399.exe (PID: 9624)
- Unicorn-38014.exe (PID: 9452)
- Unicorn-18794.exe (PID: 9568)
- Unicorn-21486.exe (PID: 9472)
- Unicorn-15701.exe (PID: 9676)
- Unicorn-25762.exe (PID: 9508)
- Unicorn-36884.exe (PID: 9636)
- Unicorn-17542.exe (PID: 9712)
- Unicorn-64703.exe (PID: 9668)
- Unicorn-17616.exe (PID: 9744)
- Unicorn-7401.exe (PID: 9736)
- Unicorn-1087.exe (PID: 9768)
- Unicorn-15168.exe (PID: 9168)
- Unicorn-34506.exe (PID: 9776)
- Unicorn-41352.exe (PID: 9484)
- Unicorn-60110.exe (PID: 9884)
- Unicorn-51056.exe (PID: 9936)
- Unicorn-22084.exe (PID: 10008)
- Unicorn-39166.exe (PID: 9968)
- Unicorn-45826.exe (PID: 10028)
- Unicorn-19706.exe (PID: 10052)
- Unicorn-50843.exe (PID: 9752)
- Unicorn-59416.exe (PID: 9904)
- Unicorn-32364.exe (PID: 10120)
- Unicorn-1258.exe (PID: 9420)
- Unicorn-61699.exe (PID: 10140)
- Unicorn-35104.exe (PID: 10096)
- Unicorn-23529.exe (PID: 9088)
- Unicorn-64369.exe (PID: 9132)
- Unicorn-29741.exe (PID: 10168)
- Unicorn-46780.exe (PID: 9976)
- Unicorn-18886.exe (PID: 10076)
- Unicorn-12519.exe (PID: 10212)
- Unicorn-61071.exe (PID: 9224)
- Unicorn-843.exe (PID: 9704)
- Unicorn-23109.exe (PID: 9256)
- Unicorn-53936.exe (PID: 9608)
- Unicorn-55088.exe (PID: 9944)
- Unicorn-54823.exe (PID: 10016)
- Unicorn-24772.exe (PID: 10228)
- Unicorn-48679.exe (PID: 10188)
- Unicorn-57615.exe (PID: 6584)
- Unicorn-1227.exe (PID: 1748)
- Unicorn-18310.exe (PID: 7408)
- Unicorn-55555.exe (PID: 924)
- Unicorn-319.exe (PID: 9524)
Executes application which crashes
- Unicorn-29377.exe (PID: 8176)
- Unicorn-49185.exe (PID: 8304)
- Unicorn-44665.exe (PID: 672)
- Unicorn-64265.exe (PID: 8216)
INFO
Reads the computer name
- 1 (123).exe (PID: 4812)
- Unicorn-50108.exe (PID: 7360)
- Unicorn-27021.exe (PID: 6424)
- Unicorn-8520.exe (PID: 7340)
- Unicorn-61909.exe (PID: 7916)
- Unicorn-10632.exe (PID: 7812)
- Unicorn-45343.exe (PID: 7864)
- Unicorn-34814.exe (PID: 7832)
- Unicorn-47389.exe (PID: 7844)
- Unicorn-2547.exe (PID: 7936)
- Unicorn-46725.exe (PID: 7960)
- Unicorn-12006.exe (PID: 7968)
- Unicorn-10523.exe (PID: 7980)
- Unicorn-26305.exe (PID: 7992)
- Unicorn-53305.exe (PID: 8080)
- Unicorn-38623.exe (PID: 8140)
- Unicorn-4659.exe (PID: 8104)
- Unicorn-12080.exe (PID: 8116)
- Unicorn-9511.exe (PID: 8032)
- Unicorn-29377.exe (PID: 8176)
- Unicorn-331.exe (PID: 7264)
- Unicorn-16170.exe (PID: 904)
- Unicorn-5235.exe (PID: 5528)
- Unicorn-18970.exe (PID: 1764)
- Unicorn-37353.exe (PID: 4652)
- Unicorn-2096.exe (PID: 5416)
- Unicorn-21622.exe (PID: 2600)
- Unicorn-61172.exe (PID: 920)
- Unicorn-27753.exe (PID: 6324)
- Unicorn-35921.exe (PID: 1324)
- Unicorn-19319.exe (PID: 960)
- Unicorn-44665.exe (PID: 672)
- Unicorn-19755.exe (PID: 4880)
- Unicorn-42095.exe (PID: 7596)
- Unicorn-4400.exe (PID: 7520)
- Unicorn-41711.exe (PID: 5384)
- Unicorn-12660.exe (PID: 7288)
- Unicorn-4400.exe (PID: 7176)
- Unicorn-12760.exe (PID: 7268)
- Unicorn-4400.exe (PID: 7668)
- Unicorn-49880.exe (PID: 6512)
- Unicorn-52647.exe (PID: 7708)
- Unicorn-12760.exe (PID: 7336)
- Unicorn-4400.exe (PID: 7676)
- Unicorn-48431.exe (PID: 1240)
- Unicorn-55447.exe (PID: 1128)
- Unicorn-23859.exe (PID: 6676)
- Unicorn-45433.exe (PID: 7684)
- Unicorn-38779.exe (PID: 7764)
- Unicorn-63305.exe (PID: 5084)
- Unicorn-30633.exe (PID: 5328)
- Unicorn-50788.exe (PID: 5304)
- Unicorn-62351.exe (PID: 2644)
- Unicorn-42885.exe (PID: 1280)
- Unicorn-31187.exe (PID: 5072)
- Unicorn-42693.exe (PID: 7444)
- Unicorn-64265.exe (PID: 8216)
- Unicorn-59989.exe (PID: 8232)
- Unicorn-190.exe (PID: 8324)
- Unicorn-55713.exe (PID: 8272)
- Unicorn-60721.exe (PID: 8388)
- Unicorn-4867.exe (PID: 8496)
- Unicorn-37945.exe (PID: 8656)
- Unicorn-56180.exe (PID: 8860)
- Unicorn-38905.exe (PID: 8944)
- Unicorn-62707.exe (PID: 8972)
- Unicorn-48417.exe (PID: 9004)
- Unicorn-32635.exe (PID: 8988)
- Unicorn-64369.exe (PID: 9132)
- Unicorn-31697.exe (PID: 9100)
- Unicorn-14466.exe (PID: 3676)
- Unicorn-28381.exe (PID: 8412)
- Unicorn-11474.exe (PID: 2852)
- Unicorn-3836.exe (PID: 3332)
- Unicorn-36092.exe (PID: 8492)
- Unicorn-33595.exe (PID: 9384)
- Unicorn-4452.exe (PID: 9308)
- Unicorn-41544.exe (PID: 9400)
- Unicorn-25762.exe (PID: 9508)
- Unicorn-65399.exe (PID: 9624)
- Unicorn-38014.exe (PID: 9452)
- Unicorn-61964.exe (PID: 9440)
- Unicorn-21486.exe (PID: 9472)
- Unicorn-319.exe (PID: 9524)
- Unicorn-15701.exe (PID: 9676)
The sample compiled with chinese language support
- 1 (123).exe (PID: 4812)
- Unicorn-10632.exe (PID: 7812)
- Unicorn-8520.exe (PID: 7340)
- Unicorn-47389.exe (PID: 7844)
- Unicorn-34814.exe (PID: 7832)
- Unicorn-27021.exe (PID: 6424)
- Unicorn-50108.exe (PID: 7360)
- Unicorn-45343.exe (PID: 7864)
- Unicorn-61909.exe (PID: 7916)
- Unicorn-2547.exe (PID: 7936)
- Unicorn-12006.exe (PID: 7968)
- Unicorn-46725.exe (PID: 7960)
- Unicorn-65199.exe (PID: 7952)
- Unicorn-26305.exe (PID: 7992)
- Unicorn-9511.exe (PID: 8032)
- Unicorn-53305.exe (PID: 8080)
- Unicorn-4659.exe (PID: 8104)
- Unicorn-12080.exe (PID: 8116)
- Unicorn-38623.exe (PID: 8140)
- Unicorn-29377.exe (PID: 8176)
- Unicorn-4680.exe (PID: 8184)
- Unicorn-57965.exe (PID: 6872)
- Unicorn-331.exe (PID: 7264)
- Unicorn-596.exe (PID: 6028)
- Unicorn-18970.exe (PID: 1764)
- Unicorn-31431.exe (PID: 2136)
- Unicorn-2096.exe (PID: 5416)
- Unicorn-10523.exe (PID: 7980)
- Unicorn-21622.exe (PID: 2600)
- Unicorn-61172.exe (PID: 920)
- Unicorn-54997.exe (PID: 5772)
- Unicorn-27753.exe (PID: 6324)
- Unicorn-35921.exe (PID: 1324)
- Unicorn-19319.exe (PID: 960)
- Unicorn-19755.exe (PID: 4880)
- Unicorn-44665.exe (PID: 672)
- Unicorn-103.exe (PID: 7300)
- Unicorn-32029.exe (PID: 7480)
- Unicorn-53004.exe (PID: 664)
- Unicorn-37457.exe (PID: 6048)
- Unicorn-42095.exe (PID: 7596)
- Unicorn-4400.exe (PID: 7520)
- Unicorn-12760.exe (PID: 7336)
- Unicorn-5235.exe (PID: 5528)
- Unicorn-29739.exe (PID: 6436)
- Unicorn-12660.exe (PID: 7288)
- Unicorn-4400.exe (PID: 7676)
- Unicorn-12760.exe (PID: 7268)
- Unicorn-41711.exe (PID: 5384)
- Unicorn-16170.exe (PID: 904)
- Unicorn-4400.exe (PID: 7176)
- Unicorn-30057.exe (PID: 5260)
- Unicorn-4400.exe (PID: 7668)
- Unicorn-49880.exe (PID: 6512)
- Unicorn-4400.exe (PID: 7576)
- Unicorn-23859.exe (PID: 6676)
- Unicorn-61312.exe (PID: 5968)
- Unicorn-37353.exe (PID: 4652)
- Unicorn-46268.exe (PID: 5408)
- Unicorn-52647.exe (PID: 7708)
- Unicorn-42309.exe (PID: 1012)
- Unicorn-45433.exe (PID: 7684)
- Unicorn-38779.exe (PID: 7764)
- Unicorn-55447.exe (PID: 1128)
- Unicorn-63305.exe (PID: 5084)
- Unicorn-48431.exe (PID: 1240)
- Unicorn-30633.exe (PID: 5328)
- Unicorn-18189.exe (PID: 7892)
- Unicorn-42885.exe (PID: 1280)
- Unicorn-18381.exe (PID: 4608)
- Unicorn-44923.exe (PID: 1348)
- Unicorn-50788.exe (PID: 5304)
- Unicorn-24118.exe (PID: 7724)
- Unicorn-62351.exe (PID: 2644)
- Unicorn-46777.exe (PID: 7376)
- Unicorn-31187.exe (PID: 5072)
- Unicorn-42693.exe (PID: 7444)
- Unicorn-51416.exe (PID: 4228)
- Unicorn-64265.exe (PID: 8216)
- Unicorn-59989.exe (PID: 8232)
- Unicorn-51364.exe (PID: 8252)
- Unicorn-55713.exe (PID: 8272)
- Unicorn-190.exe (PID: 8324)
- Unicorn-24711.exe (PID: 8368)
- Unicorn-60721.exe (PID: 8388)
- Unicorn-17450.exe (PID: 8416)
- Unicorn-33093.exe (PID: 8464)
- Unicorn-4867.exe (PID: 8496)
- Unicorn-59251.exe (PID: 8576)
- Unicorn-37945.exe (PID: 8656)
- Unicorn-31622.exe (PID: 8664)
- Unicorn-62641.exe (PID: 8768)
- Unicorn-10892.exe (PID: 8804)
- Unicorn-27783.exe (PID: 8832)
- Unicorn-63601.exe (PID: 8880)
- Unicorn-38905.exe (PID: 8944)
- Unicorn-56180.exe (PID: 8860)
- Unicorn-30737.exe (PID: 8920)
- Unicorn-22569.exe (PID: 8900)
- Unicorn-62707.exe (PID: 8972)
- Unicorn-3108.exe (PID: 9052)
- Unicorn-32635.exe (PID: 8988)
- Unicorn-48417.exe (PID: 9004)
- Unicorn-36335.exe (PID: 9116)
- Unicorn-40611.exe (PID: 9040)
- Unicorn-52236.exe (PID: 8996)
- Unicorn-64561.exe (PID: 9064)
- Unicorn-40227.exe (PID: 9176)
- Unicorn-7000.exe (PID: 9160)
- Unicorn-31697.exe (PID: 9100)
- Unicorn-40227.exe (PID: 9184)
- Unicorn-4068.exe (PID: 8208)
- Unicorn-14466.exe (PID: 3676)
- Unicorn-23719.exe (PID: 8312)
- Unicorn-28381.exe (PID: 8412)
- Unicorn-17067.exe (PID: 4944)
- Unicorn-11474.exe (PID: 2852)
- Unicorn-8344.exe (PID: 4008)
- Unicorn-3836.exe (PID: 3332)
- Unicorn-36092.exe (PID: 8492)
- Unicorn-61053.exe (PID: 8632)
- Unicorn-57716.exe (PID: 8332)
- Unicorn-12599.exe (PID: 8336)
- Unicorn-3227.exe (PID: 8456)
- Unicorn-14082.exe (PID: 7392)
- Unicorn-20789.exe (PID: 9336)
- Unicorn-57545.exe (PID: 9348)
- Unicorn-4452.exe (PID: 9308)
- Unicorn-41544.exe (PID: 9400)
- Unicorn-12955.exe (PID: 9428)
- Unicorn-4260.exe (PID: 9356)
- Unicorn-33595.exe (PID: 9384)
- Unicorn-28957.exe (PID: 9328)
- Unicorn-25762.exe (PID: 9508)
- Unicorn-38014.exe (PID: 9452)
- Unicorn-61964.exe (PID: 9440)
- Unicorn-65399.exe (PID: 9624)
- Unicorn-18794.exe (PID: 9568)
- Unicorn-21486.exe (PID: 9472)
- Unicorn-41352.exe (PID: 9484)
- Unicorn-36884.exe (PID: 9636)
- Unicorn-7401.exe (PID: 9736)
- Unicorn-17616.exe (PID: 9744)
- Unicorn-1087.exe (PID: 9768)
- Unicorn-34506.exe (PID: 9776)
- Unicorn-15701.exe (PID: 9676)
- Unicorn-17542.exe (PID: 9712)
- Unicorn-64703.exe (PID: 9668)
- Unicorn-15168.exe (PID: 9168)
- Unicorn-59416.exe (PID: 9904)
- Unicorn-60110.exe (PID: 9884)
- Unicorn-51056.exe (PID: 9936)
- Unicorn-45826.exe (PID: 10028)
- Unicorn-22084.exe (PID: 10008)
- Unicorn-39166.exe (PID: 9968)
- Unicorn-50843.exe (PID: 9752)
- Unicorn-19706.exe (PID: 10052)
- Unicorn-32364.exe (PID: 10120)
- Unicorn-61699.exe (PID: 10140)
- Unicorn-1258.exe (PID: 9420)
- Unicorn-35104.exe (PID: 10096)
- Unicorn-23529.exe (PID: 9088)
- Unicorn-64369.exe (PID: 9132)
- Unicorn-46780.exe (PID: 9976)
- Unicorn-18886.exe (PID: 10076)
- Unicorn-48679.exe (PID: 10188)
- Unicorn-12519.exe (PID: 10212)
- Unicorn-843.exe (PID: 9704)
- Unicorn-61071.exe (PID: 9224)
- Unicorn-57615.exe (PID: 6584)
- Unicorn-23109.exe (PID: 9256)
- Unicorn-53936.exe (PID: 9608)
- Unicorn-55088.exe (PID: 9944)
- Unicorn-24772.exe (PID: 10228)
- Unicorn-29741.exe (PID: 10168)
- Unicorn-319.exe (PID: 9524)
- Unicorn-1227.exe (PID: 1748)
- Unicorn-18310.exe (PID: 7408)
- Unicorn-55555.exe (PID: 924)
- Unicorn-54823.exe (PID: 10016)
Checks supported languages
- 1 (123).exe (PID: 4812)
- Unicorn-8520.exe (PID: 7340)
- Unicorn-27021.exe (PID: 6424)
- Unicorn-50108.exe (PID: 7360)
- Unicorn-10632.exe (PID: 7812)
- Unicorn-34814.exe (PID: 7832)
- Unicorn-2547.exe (PID: 7936)
- Unicorn-61909.exe (PID: 7916)
- Unicorn-10523.exe (PID: 7980)
- Unicorn-26305.exe (PID: 7992)
- Unicorn-46725.exe (PID: 7960)
- Unicorn-12006.exe (PID: 7968)
- Unicorn-9511.exe (PID: 8032)
- Unicorn-53305.exe (PID: 8080)
- Unicorn-4659.exe (PID: 8104)
- Unicorn-12080.exe (PID: 8116)
- Unicorn-4680.exe (PID: 8184)
- Unicorn-57965.exe (PID: 6872)
- Unicorn-29377.exe (PID: 8176)
- Unicorn-5235.exe (PID: 5528)
- Unicorn-46268.exe (PID: 5408)
- Unicorn-29739.exe (PID: 6436)
- Unicorn-37353.exe (PID: 4652)
- Unicorn-18970.exe (PID: 1764)
- Unicorn-2096.exe (PID: 5416)
- Unicorn-31431.exe (PID: 2136)
- Unicorn-54997.exe (PID: 5772)
- Unicorn-21622.exe (PID: 2600)
- Unicorn-61172.exe (PID: 920)
- Unicorn-35921.exe (PID: 1324)
- Unicorn-19319.exe (PID: 960)
- Unicorn-44665.exe (PID: 672)
- Unicorn-103.exe (PID: 7300)
- Unicorn-32029.exe (PID: 7480)
- Unicorn-53004.exe (PID: 664)
- Unicorn-42095.exe (PID: 7596)
- Unicorn-12760.exe (PID: 7336)
- Unicorn-4400.exe (PID: 7676)
- Unicorn-4400.exe (PID: 7520)
- Unicorn-45433.exe (PID: 7684)
- Unicorn-12660.exe (PID: 7288)
- Unicorn-4400.exe (PID: 7576)
- Unicorn-41711.exe (PID: 5384)
- Unicorn-55447.exe (PID: 1128)
- Unicorn-61312.exe (PID: 5968)
- Unicorn-52647.exe (PID: 7708)
- Unicorn-42309.exe (PID: 1012)
- Unicorn-49880.exe (PID: 6512)
- Unicorn-48431.exe (PID: 1240)
- Unicorn-38779.exe (PID: 7764)
- Unicorn-30633.exe (PID: 5328)
- Unicorn-50788.exe (PID: 5304)
- Unicorn-18189.exe (PID: 7892)
- Unicorn-18381.exe (PID: 4608)
- Unicorn-42885.exe (PID: 1280)
- Unicorn-63305.exe (PID: 5084)
- Unicorn-31187.exe (PID: 5072)
- Unicorn-44923.exe (PID: 1348)
- Unicorn-51416.exe (PID: 4228)
- Unicorn-62351.exe (PID: 2644)
- Unicorn-46777.exe (PID: 7376)
- Unicorn-59989.exe (PID: 8232)
- Unicorn-64265.exe (PID: 8216)
- Unicorn-51364.exe (PID: 8252)
- Unicorn-24711.exe (PID: 8368)
- Unicorn-190.exe (PID: 8324)
- Unicorn-60721.exe (PID: 8388)
- Unicorn-55713.exe (PID: 8272)
- Unicorn-17450.exe (PID: 8416)
- Unicorn-4867.exe (PID: 8496)
- Unicorn-59251.exe (PID: 8576)
- Unicorn-37945.exe (PID: 8656)
- Unicorn-33093.exe (PID: 8464)
- Unicorn-10892.exe (PID: 8804)
- Unicorn-27783.exe (PID: 8832)
- Unicorn-30737.exe (PID: 8920)
- Unicorn-22569.exe (PID: 8900)
- Unicorn-56180.exe (PID: 8860)
- Unicorn-38905.exe (PID: 8944)
- Unicorn-48417.exe (PID: 9004)
- Unicorn-32635.exe (PID: 8988)
- Unicorn-62707.exe (PID: 8972)
- Unicorn-64561.exe (PID: 9064)
- Unicorn-23529.exe (PID: 9088)
- Unicorn-40611.exe (PID: 9040)
- Unicorn-3108.exe (PID: 9052)
- Unicorn-36335.exe (PID: 9116)
- Unicorn-64369.exe (PID: 9132)
- Unicorn-15168.exe (PID: 9168)
- Unicorn-7000.exe (PID: 9160)
- Unicorn-17067.exe (PID: 4944)
- Unicorn-14466.exe (PID: 3676)
- Unicorn-4068.exe (PID: 8208)
- Unicorn-23719.exe (PID: 8312)
- Unicorn-49185.exe (PID: 8304)
- Unicorn-28381.exe (PID: 8412)
- Unicorn-12599.exe (PID: 8336)
- Unicorn-57716.exe (PID: 8332)
- Unicorn-61053.exe (PID: 8632)
- Unicorn-3836.exe (PID: 3332)
- Unicorn-3227.exe (PID: 8456)
- Unicorn-4452.exe (PID: 9308)
- Unicorn-41544.exe (PID: 9400)
- Unicorn-33595.exe (PID: 9384)
- Unicorn-1258.exe (PID: 9420)
- Unicorn-57545.exe (PID: 9348)
- Unicorn-41352.exe (PID: 9484)
- Unicorn-12955.exe (PID: 9428)
- Unicorn-61964.exe (PID: 9440)
- Unicorn-25762.exe (PID: 9508)
- Unicorn-21486.exe (PID: 9472)
- Unicorn-319.exe (PID: 9524)
- Unicorn-18794.exe (PID: 9568)
- Unicorn-38014.exe (PID: 9452)
- Unicorn-15701.exe (PID: 9676)
- Unicorn-64703.exe (PID: 9668)
- Unicorn-17542.exe (PID: 9712)
- Unicorn-7401.exe (PID: 9736)
- Unicorn-65399.exe (PID: 9624)
- Unicorn-39166.exe (PID: 9968)
- Unicorn-50843.exe (PID: 9752)
- Unicorn-34506.exe (PID: 9776)
- Unicorn-60110.exe (PID: 9884)
- Unicorn-22084.exe (PID: 10008)
- Unicorn-18886.exe (PID: 10076)
- Unicorn-35104.exe (PID: 10096)
- Unicorn-48679.exe (PID: 10188)
- Unicorn-61699.exe (PID: 10140)
- Unicorn-29741.exe (PID: 10168)
- Unicorn-46780.exe (PID: 9976)
- Unicorn-19706.exe (PID: 10052)
- Unicorn-12519.exe (PID: 10212)
- Unicorn-61071.exe (PID: 9224)
- Unicorn-24772.exe (PID: 10228)
- Unicorn-57615.exe (PID: 6584)
- Unicorn-23109.exe (PID: 9256)
- Unicorn-18310.exe (PID: 7408)
- Unicorn-54823.exe (PID: 10016)
- Unicorn-55088.exe (PID: 9944)
- Unicorn-1227.exe (PID: 1748)
- Unicorn-55555.exe (PID: 924)
- Unicorn-53936.exe (PID: 9608)
- Unicorn-59394.exe (PID: 10464)
- Unicorn-20194.exe (PID: 10304)
- Unicorn-57911.exe (PID: 10556)
- Unicorn-25238.exe (PID: 10508)
- Unicorn-32011.exe (PID: 10660)
- Unicorn-13754.exe (PID: 10768)
- Unicorn-158.exe (PID: 10684)
- Unicorn-46566.exe (PID: 10740)
- Unicorn-56951.exe (PID: 10336)
- Unicorn-13754.exe (PID: 10760)
- Unicorn-54787.exe (PID: 10804)
- Unicorn-5394.exe (PID: 10868)
- Unicorn-39742.exe (PID: 10848)
- Unicorn-63862.exe (PID: 10984)
- Unicorn-29898.exe (PID: 10912)
- Unicorn-39550.exe (PID: 10944)
- Unicorn-45488.exe (PID: 11032)
- Unicorn-8307.exe (PID: 11068)
- Unicorn-59639.exe (PID: 11168)
- Unicorn-31701.exe (PID: 11152)
- Unicorn-56846.exe (PID: 11196)
- Unicorn-56846.exe (PID: 11188)
- Unicorn-4845.exe (PID: 3968)
- Unicorn-17262.exe (PID: 11044)
- Unicorn-21752.exe (PID: 2108)
- Unicorn-19182.exe (PID: 11284)
- Unicorn-18990.exe (PID: 11328)
- Unicorn-38856.exe (PID: 11344)
- Unicorn-18990.exe (PID: 11336)
- Unicorn-12305.exe (PID: 11356)
- Unicorn-35326.exe (PID: 11400)
- Unicorn-16197.exe (PID: 11436)
- Unicorn-38664.exe (PID: 11452)
- Unicorn-32533.exe (PID: 11444)
- Unicorn-52954.exe (PID: 11460)
- Unicorn-27756.exe (PID: 11480)
- Unicorn-59831.exe (PID: 11472)
- Unicorn-27756.exe (PID: 11488)
- Unicorn-23480.exe (PID: 11572)
- Unicorn-27158.exe (PID: 11532)
- Unicorn-43668.exe (PID: 11620)
- Unicorn-65389.exe (PID: 11636)
- Unicorn-49062.exe (PID: 11416)
- Unicorn-19204.exe (PID: 11676)
- Unicorn-26602.exe (PID: 11616)
- Unicorn-19396.exe (PID: 11588)
- Unicorn-43251.exe (PID: 11804)
- Unicorn-31818.exe (PID: 11784)
- Unicorn-61175.exe (PID: 11508)
- Unicorn-11782.exe (PID: 11564)
- Unicorn-22393.exe (PID: 11824)
- Unicorn-19012.exe (PID: 11816)
- Unicorn-27875.exe (PID: 12024)
- Unicorn-15888.exe (PID: 12048)
- Unicorn-61367.exe (PID: 12076)
- Unicorn-44284.exe (PID: 12100)
- Unicorn-33894.exe (PID: 12128)
- Unicorn-39624.exe (PID: 11660)
- Unicorn-28524.exe (PID: 11844)
- Unicorn-61736.exe (PID: 12232)
- Unicorn-52607.exe (PID: 6808)
- Unicorn-12535.exe (PID: 2800)
- Unicorn-15533.exe (PID: 11136)
- Unicorn-28680.exe (PID: 11740)
- Unicorn-62312.exe (PID: 12308)
- Unicorn-25364.exe (PID: 12352)
- Unicorn-61034.exe (PID: 12476)
- Unicorn-45082.exe (PID: 12436)
- Unicorn-17698.exe (PID: 12468)
- Unicorn-63470.exe (PID: 12576)
- Unicorn-31346.exe (PID: 12452)
- Unicorn-49550.exe (PID: 12608)
- Unicorn-41892.exe (PID: 12332)
- Unicorn-22432.exe (PID: 12460)
- Unicorn-36774.exe (PID: 12692)
- Unicorn-47194.exe (PID: 12816)
- Unicorn-11337.exe (PID: 12908)
- Unicorn-4294.exe (PID: 12640)
- Unicorn-23511.exe (PID: 12712)
- Unicorn-18213.exe (PID: 13008)
- Unicorn-65450.exe (PID: 13056)
Create files in a temporary directory
- Unicorn-8520.exe (PID: 7340)
- 1 (123).exe (PID: 4812)
- Unicorn-27021.exe (PID: 6424)
- Unicorn-47389.exe (PID: 7844)
- Unicorn-50108.exe (PID: 7360)
- Unicorn-10632.exe (PID: 7812)
- Unicorn-46725.exe (PID: 7960)
- Unicorn-61909.exe (PID: 7916)
- Unicorn-34814.exe (PID: 7832)
- Unicorn-4659.exe (PID: 8104)
- Unicorn-12080.exe (PID: 8116)
- Unicorn-38623.exe (PID: 8140)
- Unicorn-26305.exe (PID: 7992)
- Unicorn-29377.exe (PID: 8176)
- Unicorn-57965.exe (PID: 6872)
- Unicorn-65199.exe (PID: 7952)
- Unicorn-331.exe (PID: 7264)
- Unicorn-4680.exe (PID: 8184)
- Unicorn-18970.exe (PID: 1764)
- Unicorn-596.exe (PID: 6028)
- Unicorn-10523.exe (PID: 7980)
- Unicorn-31431.exe (PID: 2136)
- Unicorn-2096.exe (PID: 5416)
- Unicorn-53305.exe (PID: 8080)
- Unicorn-61172.exe (PID: 920)
- Unicorn-54997.exe (PID: 5772)
- Unicorn-19319.exe (PID: 960)
- Unicorn-19755.exe (PID: 4880)
- Unicorn-27753.exe (PID: 6324)
- Unicorn-35921.exe (PID: 1324)
- Unicorn-44665.exe (PID: 672)
- Unicorn-103.exe (PID: 7300)
- Unicorn-45343.exe (PID: 7864)
- Unicorn-32029.exe (PID: 7480)
- Unicorn-12006.exe (PID: 7968)
- Unicorn-53004.exe (PID: 664)
- Unicorn-37457.exe (PID: 6048)
- Unicorn-42095.exe (PID: 7596)
- Unicorn-12760.exe (PID: 7336)
- Unicorn-4400.exe (PID: 7520)
- Unicorn-41711.exe (PID: 5384)
- Unicorn-12660.exe (PID: 7288)
- Unicorn-4400.exe (PID: 7676)
- Unicorn-12760.exe (PID: 7268)
- Unicorn-16170.exe (PID: 904)
- Unicorn-4400.exe (PID: 7176)
- Unicorn-30057.exe (PID: 5260)
- Unicorn-4400.exe (PID: 7668)
- Unicorn-4400.exe (PID: 7576)
- Unicorn-23859.exe (PID: 6676)
- Unicorn-37353.exe (PID: 4652)
- Unicorn-45433.exe (PID: 7684)
- Unicorn-38779.exe (PID: 7764)
- Unicorn-42309.exe (PID: 1012)
- Unicorn-48431.exe (PID: 1240)
- Unicorn-18189.exe (PID: 7892)
- Unicorn-18381.exe (PID: 4608)
- Unicorn-42885.exe (PID: 1280)
- Unicorn-44923.exe (PID: 1348)
- Unicorn-21622.exe (PID: 2600)
- Unicorn-50788.exe (PID: 5304)
- Unicorn-62351.exe (PID: 2644)
- Unicorn-31187.exe (PID: 5072)
- Unicorn-2547.exe (PID: 7936)
- Unicorn-51416.exe (PID: 4228)
- Unicorn-59989.exe (PID: 8232)
- Unicorn-190.exe (PID: 8324)
- Unicorn-55713.exe (PID: 8272)
- Unicorn-17450.exe (PID: 8416)
- Unicorn-24711.exe (PID: 8368)
- Unicorn-60721.exe (PID: 8388)
- Unicorn-33093.exe (PID: 8464)
- Unicorn-4867.exe (PID: 8496)
- Unicorn-59251.exe (PID: 8576)
- Unicorn-37945.exe (PID: 8656)
- Unicorn-62641.exe (PID: 8768)
- Unicorn-5235.exe (PID: 5528)
- Unicorn-29739.exe (PID: 6436)
- Unicorn-9511.exe (PID: 8032)
- Unicorn-49880.exe (PID: 6512)
- Unicorn-46268.exe (PID: 5408)
- Unicorn-61312.exe (PID: 5968)
- Unicorn-52647.exe (PID: 7708)
- Unicorn-56180.exe (PID: 8860)
- Unicorn-38905.exe (PID: 8944)
- Unicorn-55447.exe (PID: 1128)
- Unicorn-30737.exe (PID: 8920)
- Unicorn-63305.exe (PID: 5084)
- Unicorn-30633.exe (PID: 5328)
- Unicorn-62707.exe (PID: 8972)
- Unicorn-24118.exe (PID: 7724)
- Unicorn-42693.exe (PID: 7444)
- Unicorn-40611.exe (PID: 9040)
- Unicorn-46777.exe (PID: 7376)
- Unicorn-64561.exe (PID: 9064)
- Unicorn-51364.exe (PID: 8252)
- Unicorn-28381.exe (PID: 8412)
- Unicorn-17067.exe (PID: 4944)
- Unicorn-12599.exe (PID: 8336)
- Unicorn-3836.exe (PID: 3332)
- Unicorn-20789.exe (PID: 9336)
- Unicorn-4452.exe (PID: 9308)
Creates files or folders in the user directory
- WerFault.exe (PID: 7508)
- WerFault.exe (PID: 8332)
- WerFault.exe (PID: 8440)
- WerFault.exe (PID: 9256)
- WerFault.exe (PID: 9848)
- WerFault.exe (PID: 12240)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
470
Monitored processes
329
Malicious processes
45
Suspicious processes
46
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 456 | C:\Users\admin\AppData\Local\Temp\Unicorn-4175.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-4175.exe | — | Unicorn-3836.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 664 | C:\Users\admin\AppData\Local\Temp\Unicorn-53004.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53004.exe | Unicorn-46725.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 672 | C:\Users\admin\AppData\Local\Temp\Unicorn-44665.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-44665.exe | Unicorn-29377.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Exit code: 3221225477 Version: 1.00 Modules
| |||||||||||||||
| 904 | C:\Users\admin\AppData\Local\Temp\Unicorn-16170.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-16170.exe | 1 (123).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 920 | C:\Users\admin\AppData\Local\Temp\Unicorn-61172.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-61172.exe | Unicorn-2547.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 924 | C:\Users\admin\AppData\Local\Temp\Unicorn-55555.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-55555.exe | Unicorn-65199.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 960 | C:\Users\admin\AppData\Local\Temp\Unicorn-19319.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-19319.exe | Unicorn-8520.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1012 | C:\Users\admin\AppData\Local\Temp\Unicorn-42309.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-42309.exe | Unicorn-2096.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1128 | C:\Users\admin\AppData\Local\Temp\Unicorn-55447.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-55447.exe | Unicorn-47389.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1240 | C:\Users\admin\AppData\Local\Temp\Unicorn-48431.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-48431.exe | Unicorn-61909.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
18 272
Read events
18 272
Write events
0
Delete events
0
Modification events
Executable files
962
Suspicious files
12
Text files
12
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6424 | Unicorn-27021.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8520.exe | executable | |
MD5:DC54108880379848171AF17B33066012 | SHA256:8F8A836DA36DC2FFC1490C82D80C69D871419E49F4E97A8047A376AF3CADE2A8 | |||
| 4812 | 1 (123).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-27021.exe | executable | |
MD5:7D66E8DFD45C6F151354AAE160ACBC0B | SHA256:DB297398C19A233A165E038FF090F418FB420C9C40CE80B54CA5D0CED0E0ED4F | |||
| 4812 | 1 (123).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-50108.exe | executable | |
MD5:6723C52700580AD739C755BC621C33D8 | SHA256:01CD8AAC4CC27DC80747DA95F2F074E02B609098A891E3365C144B5B4BB494C4 | |||
| 4812 | 1 (123).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-45343.exe | executable | |
MD5:E9CF0AF03A914617BEA5D2985C6FC10D | SHA256:ED08CC551E49AA85FAB0B836CAA030D9FA6D934BE3D35C279C336231403217D2 | |||
| 7360 | Unicorn-50108.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-47389.exe | executable | |
MD5:4FABE493888DB4558386774E692AF8E2 | SHA256:BAFC02B66785345D42BCB311F2C12490FF27D546491078617D2F99F10797329F | |||
| 7340 | Unicorn-8520.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-10632.exe | executable | |
MD5:35BBEDA3608EE498934D4C750CFA5FF8 | SHA256:E936C629D8EB01AEBE9BDE5BAEF1E65CF65EE7F8F11B5E4FA4DC6E288F4A21AA | |||
| 6424 | Unicorn-27021.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-34814.exe | executable | |
MD5:694330C5642D861840635BA92250C914 | SHA256:CE55547C36D7FE932E62EE29043AFA17842149BF81D304E23FFF163B8932177B | |||
| 7916 | Unicorn-61909.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53305.exe | executable | |
MD5:B2989C6F8722C10B61E28CEA1CF368DC | SHA256:150F1F03ACE7F3238EC13921F4219BC8EF42CB17353A9377F29D44DFA0452F1E | |||
| 7968 | Unicorn-12006.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-29377.exe | executable | |
MD5:F470A7A6552684E6CB6E3F85FBF9ED37 | SHA256:46C7355A24FD9F226A500BD9C7FBB87B0B638392156260C86E0419341C363BA7 | |||
| 4812 | 1 (123).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9511.exe | executable | |
MD5:57F4C73A8723EC7837706C6F9695FBE5 | SHA256:9D7D1337181C6BF3A6347C6875872BB99B0ABC0F2AF75F1B9A3274CA0E334FB3 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
23
DNS requests
18
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
8436 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
8436 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
4424 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 20.190.159.23:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5496 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4424 | backgroundTaskHost.exe | 20.223.36.55:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |