| File name: | 1 (128) |
| Full analysis: | https://app.any.run/tasks/576e1c29-e037-4073-bcc0-efc73a885420 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 09:50:45 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 2F9651CF14E6E420D3953E436719F920 |
| SHA1: | 12D186E86973A8C61426F5F5CE2E4DA24C31BFF0 |
| SHA256: | AF5442A520F11F11251ECCC8F8E04998599C5990DB244134020CB0B9E1CBD2DB |
| SSDEEP: | 6144:RfIg/ULCKDwGA5cH16exRafx5dVrZp8GBV/SSVOAtk/8SwjwpyAvEhH+yX5t5t7a:RgqQMGA5w1VoV1+aV6SVOAjx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- 1 (128).exe (PID: 7380)
- Unicorn-19741.exe (PID: 7476)
- Unicorn-44172.exe (PID: 7876)
- Unicorn-23197.exe (PID: 7852)
- Unicorn-1323.exe (PID: 7244)
- Unicorn-25273.exe (PID: 7260)
- Unicorn-4852.exe (PID: 5576)
- Unicorn-43647.exe (PID: 7328)
- Unicorn-140.exe (PID: 4896)
- Unicorn-8863.exe (PID: 2236)
- Unicorn-28729.exe (PID: 920)
- Unicorn-16285.exe (PID: 6744)
- Unicorn-32356.exe (PID: 4696)
- Unicorn-6108.exe (PID: 7732)
- Unicorn-20861.exe (PID: 7848)
- Unicorn-7068.exe (PID: 8072)
- Unicorn-41779.exe (PID: 4428)
- Unicorn-23213.exe (PID: 5324)
- Unicorn-8208.exe (PID: 516)
- Unicorn-47717.exe (PID: 8152)
- Unicorn-47717.exe (PID: 8144)
- Unicorn-46955.exe (PID: 4112)
- Unicorn-44188.exe (PID: 6668)
- Unicorn-51650.exe (PID: 6740)
- Unicorn-49755.exe (PID: 6108)
- Unicorn-33794.exe (PID: 4688)
- Unicorn-48551.exe (PID: 6028)
- Unicorn-17349.exe (PID: 7428)
- Unicorn-20041.exe (PID: 7692)
- Unicorn-25517.exe (PID: 8016)
- Unicorn-37504.exe (PID: 8056)
- Unicorn-2858.exe (PID: 8048)
- Unicorn-56497.exe (PID: 6708)
- Unicorn-35605.exe (PID: 7824)
- Unicorn-42621.exe (PID: 6372)
- Unicorn-35605.exe (PID: 5112)
- Unicorn-47717.exe (PID: 8148)
- Unicorn-35605.exe (PID: 7956)
- Unicorn-27851.exe (PID: 8156)
- Unicorn-50964.exe (PID: 5984)
- Unicorn-5433.exe (PID: 1012)
- Unicorn-10908.exe (PID: 976)
- Unicorn-57094.exe (PID: 4068)
- Unicorn-63788.exe (PID: 8188)
- Unicorn-41858.exe (PID: 6272)
- Unicorn-10908.exe (PID: 4380)
- Unicorn-44328.exe (PID: 632)
- Unicorn-5433.exe (PID: 1180)
- Unicorn-42819.exe (PID: 7972)
- Unicorn-23161.exe (PID: 5084)
- Unicorn-27245.exe (PID: 2656)
- Unicorn-27245.exe (PID: 5964)
- Unicorn-23060.exe (PID: 3180)
- Unicorn-9325.exe (PID: 7340)
- Unicorn-43316.exe (PID: 7988)
- Unicorn-27245.exe (PID: 7764)
- Unicorn-59969.exe (PID: 1196)
- Unicorn-36337.exe (PID: 6700)
- Unicorn-22038.exe (PID: 7948)
- Unicorn-59969.exe (PID: 6724)
- Unicorn-36337.exe (PID: 6392)
- Unicorn-28531.exe (PID: 8172)
- Unicorn-52481.exe (PID: 1240)
- Unicorn-53892.exe (PID: 5024)
- Unicorn-52481.exe (PID: 3884)
- Unicorn-3088.exe (PID: 2316)
- Unicorn-53633.exe (PID: 5164)
- Unicorn-348.exe (PID: 2108)
- Unicorn-54681.exe (PID: 6248)
- Unicorn-57260.exe (PID: 2644)
- Unicorn-63839.exe (PID: 5988)
- Unicorn-4411.exe (PID: 2140)
- Unicorn-33021.exe (PID: 4424)
- Unicorn-16685.exe (PID: 8084)
- Unicorn-32445.exe (PID: 7012)
- Unicorn-40103.exe (PID: 2136)
- Unicorn-65309.exe (PID: 8008)
- Unicorn-18906.exe (PID: 8332)
- Unicorn-46980.exe (PID: 8384)
- Unicorn-5392.exe (PID: 8352)
- Unicorn-29897.exe (PID: 8408)
- Unicorn-23627.exe (PID: 8444)
- Unicorn-49393.exe (PID: 8428)
- Unicorn-40923.exe (PID: 8548)
- Unicorn-23566.exe (PID: 8508)
- Unicorn-27733.exe (PID: 8624)
- Unicorn-48153.exe (PID: 8644)
- Unicorn-64416.exe (PID: 8600)
- Unicorn-60789.exe (PID: 8556)
- Unicorn-28095.exe (PID: 8712)
- Unicorn-62443.exe (PID: 8680)
- Unicorn-25494.exe (PID: 8696)
- Unicorn-28693.exe (PID: 8788)
- Unicorn-39985.exe (PID: 8632)
- Unicorn-24609.exe (PID: 8780)
- Unicorn-13425.exe (PID: 8756)
- Unicorn-8827.exe (PID: 8796)
- Unicorn-12164.exe (PID: 8876)
- Unicorn-12719.exe (PID: 8940)
- Unicorn-61365.exe (PID: 8840)
- Unicorn-24417.exe (PID: 8932)
- Unicorn-275.exe (PID: 9060)
- Unicorn-14010.exe (PID: 9068)
- Unicorn-49113.exe (PID: 8848)
- Unicorn-24417.exe (PID: 8924)
- Unicorn-24225.exe (PID: 9032)
- Unicorn-12164.exe (PID: 8864)
- Unicorn-3042.exe (PID: 8984)
- Unicorn-21509.exe (PID: 8904)
- Unicorn-3572.exe (PID: 8992)
- Unicorn-53368.exe (PID: 9104)
- Unicorn-26283.exe (PID: 7940)
- Unicorn-4764.exe (PID: 9168)
- Unicorn-9325.exe (PID: 7696)
- Unicorn-680.exe (PID: 9148)
- Unicorn-49689.exe (PID: 9188)
- Unicorn-29823.exe (PID: 9204)
- Unicorn-44676.exe (PID: 5216)
- Unicorn-48132.exe (PID: 1852)
- Unicorn-24639.exe (PID: 4448)
- Unicorn-1043.exe (PID: 8204)
- Unicorn-20717.exe (PID: 5936)
- Unicorn-10502.exe (PID: 6156)
- Unicorn-17941.exe (PID: 8196)
- Unicorn-38553.exe (PID: 8228)
- Unicorn-47084.exe (PID: 9252)
- Unicorn-3642.exe (PID: 732)
- Unicorn-17941.exe (PID: 8200)
- Unicorn-20717.exe (PID: 672)
- Unicorn-30001.exe (PID: 9272)
- Unicorn-55060.exe (PID: 9356)
- Unicorn-49689.exe (PID: 9196)
- Unicorn-58589.exe (PID: 9304)
- Unicorn-58589.exe (PID: 9308)
- Unicorn-31707.exe (PID: 9392)
- Unicorn-24536.exe (PID: 2384)
- Unicorn-51573.exe (PID: 9396)
- Unicorn-458.exe (PID: 9364)
- Unicorn-13670.exe (PID: 9652)
- Unicorn-16662.exe (PID: 9468)
- Unicorn-35599.exe (PID: 9560)
- Unicorn-2927.exe (PID: 9476)
- Unicorn-38937.exe (PID: 9684)
- Unicorn-22143.exe (PID: 9732)
- Unicorn-55465.exe (PID: 9568)
- Unicorn-6627.exe (PID: 9740)
- Unicorn-24307.exe (PID: 9796)
- Unicorn-46211.exe (PID: 9776)
- Unicorn-1988.exe (PID: 9708)
- Unicorn-33891.exe (PID: 9700)
- Unicorn-23561.exe (PID: 9824)
- Unicorn-51957.exe (PID: 9900)
- Unicorn-24718.exe (PID: 8588)
- Unicorn-3503.exe (PID: 9880)
- Unicorn-60680.exe (PID: 9928)
- Unicorn-56233.exe (PID: 9856)
- Unicorn-27954.exe (PID: 9280)
- Unicorn-10467.exe (PID: 9968)
- Unicorn-11707.exe (PID: 9000)
- Unicorn-4987.exe (PID: 7816)
- Unicorn-41241.exe (PID: 10088)
- Unicorn-45325.exe (PID: 10096)
- Unicorn-51381.exe (PID: 9532)
- Unicorn-44239.exe (PID: 10172)
- Unicorn-39601.exe (PID: 8736)
- Unicorn-58153.exe (PID: 9512)
- Unicorn-43715.exe (PID: 9636)
- Unicorn-47245.exe (PID: 9604)
- Unicorn-6112.exe (PID: 472)
- Unicorn-17557.exe (PID: 9320)
- Unicorn-48899.exe (PID: 668)
- Unicorn-5444.exe (PID: 10136)
- Unicorn-63368.exe (PID: 10156)
- Unicorn-34395.exe (PID: 10200)
- Unicorn-24971.exe (PID: 8912)
- Unicorn-52445.exe (PID: 10452)
- Unicorn-56352.exe (PID: 10256)
- Unicorn-13834.exe (PID: 10352)
- Unicorn-6404.exe (PID: 10292)
- Unicorn-37815.exe (PID: 10520)
- Unicorn-52445.exe (PID: 10436)
- Unicorn-37815.exe (PID: 10524)
- Unicorn-6788.exe (PID: 7992)
- Unicorn-18094.exe (PID: 9016)
- Unicorn-20733.exe (PID: 10604)
- Unicorn-57681.exe (PID: 10536)
- Unicorn-312.exe (PID: 10576)
- Unicorn-28709.exe (PID: 10680)
- Unicorn-16649.exe (PID: 10592)
- Unicorn-20733.exe (PID: 10600)
- Unicorn-45429.exe (PID: 10492)
- Unicorn-12180.exe (PID: 10752)
- Unicorn-49684.exe (PID: 10776)
- Unicorn-12180.exe (PID: 10760)
- Unicorn-57297.exe (PID: 10732)
- Unicorn-20541.exe (PID: 10688)
- Unicorn-35616.exe (PID: 10844)
- Unicorn-31838.exe (PID: 10812)
- Unicorn-49321.exe (PID: 10652)
- Unicorn-58167.exe (PID: 8720)
- Unicorn-37431.exe (PID: 10724)
- Unicorn-63227.exe (PID: 10872)
- Unicorn-41921.exe (PID: 10964)
- Unicorn-35351.exe (PID: 10860)
Starts itself from another location
- 1 (128).exe (PID: 7380)
- Unicorn-19741.exe (PID: 7476)
- Unicorn-44172.exe (PID: 7876)
- Unicorn-4852.exe (PID: 5576)
- Unicorn-23197.exe (PID: 7852)
- Unicorn-1323.exe (PID: 7244)
- Unicorn-25273.exe (PID: 7260)
- Unicorn-43647.exe (PID: 7328)
- Unicorn-8208.exe (PID: 516)
- Unicorn-28729.exe (PID: 920)
- Unicorn-16285.exe (PID: 6744)
- Unicorn-41858.exe (PID: 6272)
- Unicorn-51650.exe (PID: 6740)
- Unicorn-32356.exe (PID: 4696)
- Unicorn-140.exe (PID: 4896)
- Unicorn-6108.exe (PID: 7732)
- Unicorn-20861.exe (PID: 7848)
- Unicorn-7068.exe (PID: 8072)
- Unicorn-8863.exe (PID: 2236)
- Unicorn-41779.exe (PID: 4428)
- Unicorn-23213.exe (PID: 5324)
- Unicorn-47717.exe (PID: 8148)
- Unicorn-27851.exe (PID: 8156)
- Unicorn-47717.exe (PID: 8152)
- Unicorn-47717.exe (PID: 8144)
- Unicorn-49755.exe (PID: 6108)
- Unicorn-59969.exe (PID: 1196)
- Unicorn-44188.exe (PID: 6668)
- Unicorn-59969.exe (PID: 6724)
- Unicorn-46955.exe (PID: 4112)
- Unicorn-63788.exe (PID: 8188)
- Unicorn-53892.exe (PID: 5024)
- Unicorn-48551.exe (PID: 6028)
- Unicorn-54681.exe (PID: 6248)
- Unicorn-17349.exe (PID: 7428)
- Unicorn-25517.exe (PID: 8016)
- Unicorn-20041.exe (PID: 7692)
- Unicorn-37504.exe (PID: 8056)
- Unicorn-56497.exe (PID: 6708)
- Unicorn-42621.exe (PID: 6372)
- Unicorn-2858.exe (PID: 8048)
- Unicorn-35605.exe (PID: 5112)
- Unicorn-35605.exe (PID: 7956)
- Unicorn-35605.exe (PID: 7824)
- Unicorn-57094.exe (PID: 4068)
- Unicorn-50964.exe (PID: 5984)
- Unicorn-5433.exe (PID: 1012)
- Unicorn-10908.exe (PID: 976)
- Unicorn-44328.exe (PID: 632)
- Unicorn-5433.exe (PID: 1180)
- Unicorn-42819.exe (PID: 7972)
- Unicorn-23161.exe (PID: 5084)
- Unicorn-27245.exe (PID: 2656)
- Unicorn-10908.exe (PID: 4380)
- Unicorn-23060.exe (PID: 3180)
- Unicorn-9325.exe (PID: 7340)
- Unicorn-43316.exe (PID: 7988)
- Unicorn-26283.exe (PID: 7940)
- Unicorn-27245.exe (PID: 7764)
- Unicorn-9325.exe (PID: 7696)
- Unicorn-27245.exe (PID: 5964)
- Unicorn-36337.exe (PID: 6392)
- Unicorn-36337.exe (PID: 6700)
- Unicorn-24639.exe (PID: 4448)
- Unicorn-33794.exe (PID: 4688)
- Unicorn-44676.exe (PID: 5216)
- Unicorn-52481.exe (PID: 1240)
- Unicorn-28531.exe (PID: 8172)
- Unicorn-4987.exe (PID: 7816)
- Unicorn-53633.exe (PID: 5164)
- Unicorn-48132.exe (PID: 1852)
- Unicorn-3088.exe (PID: 2316)
- Unicorn-57260.exe (PID: 2644)
- Unicorn-63839.exe (PID: 5988)
- Unicorn-348.exe (PID: 2108)
- Unicorn-16685.exe (PID: 8084)
- Unicorn-4411.exe (PID: 2140)
- Unicorn-33021.exe (PID: 4424)
- Unicorn-32445.exe (PID: 7012)
- Unicorn-65309.exe (PID: 8008)
- Unicorn-40103.exe (PID: 2136)
- Unicorn-46980.exe (PID: 8384)
- Unicorn-5392.exe (PID: 8352)
- Unicorn-18906.exe (PID: 8332)
- Unicorn-23627.exe (PID: 8444)
- Unicorn-29897.exe (PID: 8408)
- Unicorn-49393.exe (PID: 8428)
- Unicorn-23566.exe (PID: 8508)
- Unicorn-24718.exe (PID: 8588)
- Unicorn-27733.exe (PID: 8624)
- Unicorn-48153.exe (PID: 8644)
- Unicorn-60789.exe (PID: 8556)
- Unicorn-64416.exe (PID: 8600)
- Unicorn-25494.exe (PID: 8696)
- Unicorn-58167.exe (PID: 8720)
- Unicorn-28095.exe (PID: 8712)
- Unicorn-62443.exe (PID: 8680)
- Unicorn-39985.exe (PID: 8632)
- Unicorn-13425.exe (PID: 8756)
- Unicorn-28693.exe (PID: 8788)
- Unicorn-8827.exe (PID: 8796)
- Unicorn-24609.exe (PID: 8780)
- Unicorn-39601.exe (PID: 8736)
- Unicorn-61365.exe (PID: 8840)
- Unicorn-24417.exe (PID: 8932)
- Unicorn-12719.exe (PID: 8940)
- Unicorn-12164.exe (PID: 8876)
- Unicorn-24971.exe (PID: 8912)
- Unicorn-11707.exe (PID: 9000)
- Unicorn-275.exe (PID: 9060)
- Unicorn-24417.exe (PID: 8924)
- Unicorn-49113.exe (PID: 8848)
- Unicorn-21509.exe (PID: 8904)
- Unicorn-24225.exe (PID: 9032)
- Unicorn-18094.exe (PID: 9016)
- Unicorn-3042.exe (PID: 8984)
- Unicorn-14010.exe (PID: 9068)
- Unicorn-3572.exe (PID: 8992)
- Unicorn-12164.exe (PID: 8864)
- Unicorn-53368.exe (PID: 9104)
- Unicorn-680.exe (PID: 9148)
- Unicorn-29823.exe (PID: 9204)
- Unicorn-49689.exe (PID: 9188)
- Unicorn-22038.exe (PID: 7948)
- Unicorn-52481.exe (PID: 3884)
- Unicorn-38553.exe (PID: 8228)
- Unicorn-10502.exe (PID: 6156)
- Unicorn-17941.exe (PID: 8196)
- Unicorn-17941.exe (PID: 8200)
- Unicorn-20717.exe (PID: 672)
- Unicorn-47084.exe (PID: 9252)
- Unicorn-3642.exe (PID: 732)
- Unicorn-30001.exe (PID: 9272)
- Unicorn-17557.exe (PID: 9320)
- Unicorn-49689.exe (PID: 9196)
- Unicorn-55060.exe (PID: 9356)
- Unicorn-27954.exe (PID: 9280)
- Unicorn-58589.exe (PID: 9304)
- Unicorn-51573.exe (PID: 9396)
- Unicorn-458.exe (PID: 9364)
- Unicorn-31707.exe (PID: 9392)
- Unicorn-24536.exe (PID: 2384)
- Unicorn-58589.exe (PID: 9308)
- Unicorn-2927.exe (PID: 9476)
- Unicorn-13670.exe (PID: 9652)
- Unicorn-35599.exe (PID: 9560)
- Unicorn-51381.exe (PID: 9532)
- Unicorn-38937.exe (PID: 9684)
- Unicorn-55465.exe (PID: 9568)
- Unicorn-22143.exe (PID: 9732)
- Unicorn-33891.exe (PID: 9700)
- Unicorn-6627.exe (PID: 9740)
- Unicorn-24307.exe (PID: 9796)
- Unicorn-46211.exe (PID: 9776)
- Unicorn-1988.exe (PID: 9708)
- Unicorn-56233.exe (PID: 9856)
- Unicorn-40923.exe (PID: 8548)
- Unicorn-23561.exe (PID: 9824)
- Unicorn-51957.exe (PID: 9900)
- Unicorn-60680.exe (PID: 9928)
- Unicorn-3503.exe (PID: 9880)
Executes application which crashes
- Unicorn-24090.exe (PID: 7820)
INFO
Checks supported languages
- Unicorn-19741.exe (PID: 7476)
- 1 (128).exe (PID: 7380)
- Unicorn-23197.exe (PID: 7852)
- Unicorn-44172.exe (PID: 7876)
- Unicorn-4852.exe (PID: 5576)
- Unicorn-1323.exe (PID: 7244)
- Unicorn-43647.exe (PID: 7328)
- Unicorn-25273.exe (PID: 7260)
- Unicorn-41858.exe (PID: 6272)
- Unicorn-8208.exe (PID: 516)
- Unicorn-140.exe (PID: 4896)
- Unicorn-8863.exe (PID: 2236)
- Unicorn-28729.exe (PID: 920)
- Unicorn-16285.exe (PID: 6744)
- Unicorn-20861.exe (PID: 7848)
- Unicorn-6108.exe (PID: 7732)
- Unicorn-51650.exe (PID: 6740)
- Unicorn-32356.exe (PID: 4696)
- Unicorn-41779.exe (PID: 4428)
- Unicorn-47717.exe (PID: 8148)
- Unicorn-23213.exe (PID: 5324)
- Unicorn-63788.exe (PID: 8188)
- Unicorn-44188.exe (PID: 6668)
- Unicorn-59969.exe (PID: 6724)
- Unicorn-46955.exe (PID: 4112)
- Unicorn-17349.exe (PID: 7428)
- Unicorn-37504.exe (PID: 8056)
- Unicorn-42621.exe (PID: 6372)
- Unicorn-35605.exe (PID: 5112)
- Unicorn-23161.exe (PID: 5084)
- Unicorn-42819.exe (PID: 7972)
- Unicorn-27245.exe (PID: 5964)
- Unicorn-10908.exe (PID: 4380)
- Unicorn-43316.exe (PID: 7988)
- Unicorn-23060.exe (PID: 3180)
- Unicorn-36337.exe (PID: 6392)
- Unicorn-22038.exe (PID: 7948)
- Unicorn-36337.exe (PID: 6700)
- Unicorn-28531.exe (PID: 8172)
- Unicorn-24639.exe (PID: 4448)
- Unicorn-48132.exe (PID: 1852)
- Unicorn-26283.exe (PID: 7940)
- Unicorn-348.exe (PID: 2108)
- Unicorn-4987.exe (PID: 7816)
- Unicorn-57260.exe (PID: 2644)
- Unicorn-32445.exe (PID: 7012)
- Unicorn-24090.exe (PID: 7820)
- Unicorn-23627.exe (PID: 8444)
- Unicorn-18906.exe (PID: 8332)
- Unicorn-40923.exe (PID: 8548)
- Unicorn-64416.exe (PID: 8600)
- Unicorn-27733.exe (PID: 8624)
- Unicorn-48153.exe (PID: 8644)
- Unicorn-62443.exe (PID: 8680)
- Unicorn-28095.exe (PID: 8712)
- Unicorn-39601.exe (PID: 8736)
- Unicorn-13425.exe (PID: 8756)
- Unicorn-28693.exe (PID: 8788)
- Unicorn-24609.exe (PID: 8780)
- Unicorn-61365.exe (PID: 8840)
- Unicorn-12164.exe (PID: 8876)
- Unicorn-12164.exe (PID: 8864)
- Unicorn-24417.exe (PID: 8932)
- Unicorn-24971.exe (PID: 8912)
- Unicorn-12719.exe (PID: 8940)
- Unicorn-24225.exe (PID: 9032)
- Unicorn-18094.exe (PID: 9016)
- Unicorn-275.exe (PID: 9060)
- Unicorn-21509.exe (PID: 8904)
- Unicorn-4764.exe (PID: 9168)
- Unicorn-49689.exe (PID: 9188)
- Unicorn-10502.exe (PID: 6156)
- Unicorn-20717.exe (PID: 672)
- Unicorn-20717.exe (PID: 5936)
- Unicorn-17941.exe (PID: 8200)
- Unicorn-47084.exe (PID: 9252)
- Unicorn-16662.exe (PID: 9468)
- Unicorn-58589.exe (PID: 9304)
- Unicorn-58589.exe (PID: 9308)
- Unicorn-55060.exe (PID: 9356)
- Unicorn-458.exe (PID: 9364)
- Unicorn-38937.exe (PID: 9684)
- Unicorn-22143.exe (PID: 9732)
- Unicorn-23561.exe (PID: 9824)
- Unicorn-3503.exe (PID: 9880)
- Unicorn-1988.exe (PID: 9708)
- Unicorn-46211.exe (PID: 9776)
- Unicorn-24307.exe (PID: 9796)
- Unicorn-45325.exe (PID: 10096)
- Unicorn-5444.exe (PID: 10136)
- Unicorn-44239.exe (PID: 10172)
- Unicorn-63368.exe (PID: 10156)
- Unicorn-58153.exe (PID: 9512)
- Unicorn-47245.exe (PID: 9604)
- Unicorn-6112.exe (PID: 472)
- Unicorn-6788.exe (PID: 7992)
- Unicorn-52445.exe (PID: 10452)
- Unicorn-52445.exe (PID: 10436)
- Unicorn-45429.exe (PID: 10492)
- Unicorn-37815.exe (PID: 10520)
- Unicorn-37815.exe (PID: 10524)
- Unicorn-13834.exe (PID: 10352)
- Unicorn-16649.exe (PID: 10592)
- Unicorn-20733.exe (PID: 10600)
- Unicorn-20541.exe (PID: 10688)
- Unicorn-49321.exe (PID: 10652)
- Unicorn-12180.exe (PID: 10752)
- Unicorn-31838.exe (PID: 10812)
- Unicorn-52756.exe (PID: 10828)
- Unicorn-35351.exe (PID: 10860)
- Unicorn-35616.exe (PID: 10844)
- Unicorn-37431.exe (PID: 10724)
- Unicorn-63227.exe (PID: 10872)
- Unicorn-37837.exe (PID: 10988)
- Unicorn-17225.exe (PID: 11040)
- Unicorn-10902.exe (PID: 11168)
- Unicorn-33561.exe (PID: 11064)
- Unicorn-4588.exe (PID: 11232)
- Unicorn-37453.exe (PID: 11184)
- Unicorn-57873.exe (PID: 11200)
- Unicorn-16841.exe (PID: 11260)
- Unicorn-59772.exe (PID: 11280)
- Unicorn-24114.exe (PID: 11396)
- Unicorn-18185.exe (PID: 11308)
- Unicorn-30991.exe (PID: 11336)
- Unicorn-16841.exe (PID: 10060)
- Unicorn-50208.exe (PID: 11516)
- Unicorn-36175.exe (PID: 11496)
- Unicorn-63280.exe (PID: 11568)
- Unicorn-25512.exe (PID: 11532)
- Unicorn-61764.exe (PID: 11576)
- Unicorn-17376.exe (PID: 11552)
- Unicorn-34138.exe (PID: 11620)
- Unicorn-12822.exe (PID: 11640)
- Unicorn-38967.exe (PID: 11440)
- Unicorn-58833.exe (PID: 11432)
- Unicorn-2424.exe (PID: 11676)
- Unicorn-6679.exe (PID: 11764)
- Unicorn-56072.exe (PID: 11720)
- Unicorn-36803.exe (PID: 11812)
- Unicorn-65200.exe (PID: 11904)
- Unicorn-43576.exe (PID: 12016)
- Unicorn-23975.exe (PID: 12008)
- Unicorn-32549.exe (PID: 12204)
- Unicorn-61692.exe (PID: 12240)
- Unicorn-3768.exe (PID: 12252)
- Unicorn-9890.exe (PID: 12236)
- Unicorn-21182.exe (PID: 12056)
- Unicorn-28657.exe (PID: 12152)
- Unicorn-53332.exe (PID: 3396)
- Unicorn-46647.exe (PID: 6960)
- Unicorn-1530.exe (PID: 12312)
- Unicorn-52512.exe (PID: 5504)
- Unicorn-13643.exe (PID: 12380)
- Unicorn-62844.exe (PID: 12340)
- Unicorn-22746.exe (PID: 12500)
- Unicorn-4728.exe (PID: 12480)
- Unicorn-604.exe (PID: 12356)
- Unicorn-9004.exe (PID: 12368)
- Unicorn-32746.exe (PID: 12448)
- Unicorn-47240.exe (PID: 12608)
- Unicorn-11774.exe (PID: 12652)
- Unicorn-58937.exe (PID: 12636)
- Unicorn-58937.exe (PID: 12628)
- Unicorn-21605.exe (PID: 12820)
- Unicorn-63789.exe (PID: 12856)
- Unicorn-1760.exe (PID: 12904)
- Unicorn-44137.exe (PID: 12940)
- Unicorn-55548.exe (PID: 13148)
- Unicorn-18865.exe (PID: 13172)
- Unicorn-24847.exe (PID: 13280)
- Unicorn-2720.exe (PID: 13092)
- Unicorn-9610.exe (PID: 13344)
- Unicorn-48413.exe (PID: 13396)
- Unicorn-49684.exe (PID: 13876)
Reads the computer name
- 1 (128).exe (PID: 7380)
- Unicorn-19741.exe (PID: 7476)
- Unicorn-23197.exe (PID: 7852)
- Unicorn-44172.exe (PID: 7876)
- Unicorn-25273.exe (PID: 7260)
- Unicorn-4852.exe (PID: 5576)
- Unicorn-43647.exe (PID: 7328)
- Unicorn-1323.exe (PID: 7244)
- Unicorn-32356.exe (PID: 4696)
- Unicorn-8863.exe (PID: 2236)
- Unicorn-16285.exe (PID: 6744)
- Unicorn-51650.exe (PID: 6740)
- Unicorn-6108.exe (PID: 7732)
- Unicorn-140.exe (PID: 4896)
- Unicorn-7068.exe (PID: 8072)
- Unicorn-47717.exe (PID: 8152)
- Unicorn-47717.exe (PID: 8144)
- Unicorn-44188.exe (PID: 6668)
- Unicorn-53892.exe (PID: 5024)
- Unicorn-25517.exe (PID: 8016)
- Unicorn-42621.exe (PID: 6372)
- Unicorn-56497.exe (PID: 6708)
- Unicorn-5433.exe (PID: 1012)
- Unicorn-26283.exe (PID: 7940)
- Unicorn-10908.exe (PID: 976)
- Unicorn-10908.exe (PID: 4380)
- Unicorn-27245.exe (PID: 5964)
- Unicorn-36337.exe (PID: 6700)
- Unicorn-24639.exe (PID: 4448)
- Unicorn-52481.exe (PID: 1240)
- Unicorn-52481.exe (PID: 3884)
- Unicorn-3088.exe (PID: 2316)
- Unicorn-4987.exe (PID: 7816)
- Unicorn-57260.exe (PID: 2644)
- Unicorn-24090.exe (PID: 7820)
- Unicorn-4411.exe (PID: 2140)
- Unicorn-18906.exe (PID: 8332)
- Unicorn-29897.exe (PID: 8408)
- Unicorn-23566.exe (PID: 8508)
- Unicorn-23627.exe (PID: 8444)
- Unicorn-64416.exe (PID: 8600)
- Unicorn-27733.exe (PID: 8624)
- Unicorn-60789.exe (PID: 8556)
- Unicorn-12719.exe (PID: 8940)
- Unicorn-12164.exe (PID: 8876)
- Unicorn-24417.exe (PID: 8932)
- Unicorn-11707.exe (PID: 9000)
- Unicorn-24417.exe (PID: 8924)
- Unicorn-25494.exe (PID: 8696)
- Unicorn-62443.exe (PID: 8680)
- Unicorn-13425.exe (PID: 8756)
- Unicorn-28693.exe (PID: 8788)
- Unicorn-24225.exe (PID: 9032)
- Unicorn-29823.exe (PID: 9204)
- Unicorn-49689.exe (PID: 9188)
- Unicorn-4764.exe (PID: 9168)
- Unicorn-38553.exe (PID: 8228)
- Unicorn-24536.exe (PID: 2384)
- Unicorn-10502.exe (PID: 6156)
- Unicorn-30001.exe (PID: 9272)
- Unicorn-47084.exe (PID: 9252)
- Unicorn-3642.exe (PID: 732)
- Unicorn-17557.exe (PID: 9320)
- Unicorn-35599.exe (PID: 9560)
- Unicorn-16662.exe (PID: 9468)
- Unicorn-51381.exe (PID: 9532)
- Unicorn-38937.exe (PID: 9684)
- Unicorn-22143.exe (PID: 9732)
- Unicorn-1988.exe (PID: 9708)
- Unicorn-24307.exe (PID: 9796)
The sample compiled with chinese language support
- 1 (128).exe (PID: 7380)
- Unicorn-19741.exe (PID: 7476)
- Unicorn-23197.exe (PID: 7852)
- Unicorn-44172.exe (PID: 7876)
- Unicorn-4852.exe (PID: 5576)
- Unicorn-1323.exe (PID: 7244)
- Unicorn-43647.exe (PID: 7328)
- Unicorn-25273.exe (PID: 7260)
- Unicorn-140.exe (PID: 4896)
- Unicorn-8863.exe (PID: 2236)
- Unicorn-16285.exe (PID: 6744)
- Unicorn-32356.exe (PID: 4696)
- Unicorn-20861.exe (PID: 7848)
- Unicorn-7068.exe (PID: 8072)
- Unicorn-41779.exe (PID: 4428)
- Unicorn-23213.exe (PID: 5324)
- Unicorn-28729.exe (PID: 920)
- Unicorn-47717.exe (PID: 8152)
- Unicorn-47717.exe (PID: 8144)
- Unicorn-8208.exe (PID: 516)
- Unicorn-49755.exe (PID: 6108)
- Unicorn-44188.exe (PID: 6668)
- Unicorn-51650.exe (PID: 6740)
- Unicorn-46955.exe (PID: 4112)
- Unicorn-6108.exe (PID: 7732)
- Unicorn-48551.exe (PID: 6028)
- Unicorn-33794.exe (PID: 4688)
- Unicorn-20041.exe (PID: 7692)
- Unicorn-25517.exe (PID: 8016)
- Unicorn-37504.exe (PID: 8056)
- Unicorn-17349.exe (PID: 7428)
- Unicorn-42621.exe (PID: 6372)
- Unicorn-56497.exe (PID: 6708)
- Unicorn-35605.exe (PID: 7824)
- Unicorn-2858.exe (PID: 8048)
- Unicorn-35605.exe (PID: 7956)
- Unicorn-35605.exe (PID: 5112)
- Unicorn-47717.exe (PID: 8148)
- Unicorn-27851.exe (PID: 8156)
- Unicorn-57094.exe (PID: 4068)
- Unicorn-50964.exe (PID: 5984)
- Unicorn-5433.exe (PID: 1012)
- Unicorn-10908.exe (PID: 976)
- Unicorn-63788.exe (PID: 8188)
- Unicorn-41858.exe (PID: 6272)
- Unicorn-44328.exe (PID: 632)
- Unicorn-5433.exe (PID: 1180)
- Unicorn-42819.exe (PID: 7972)
- Unicorn-23161.exe (PID: 5084)
- Unicorn-27245.exe (PID: 2656)
- Unicorn-10908.exe (PID: 4380)
- Unicorn-23060.exe (PID: 3180)
- Unicorn-9325.exe (PID: 7340)
- Unicorn-43316.exe (PID: 7988)
- Unicorn-27245.exe (PID: 5964)
- Unicorn-27245.exe (PID: 7764)
- Unicorn-59969.exe (PID: 1196)
- Unicorn-36337.exe (PID: 6392)
- Unicorn-36337.exe (PID: 6700)
- Unicorn-22038.exe (PID: 7948)
- Unicorn-59969.exe (PID: 6724)
- Unicorn-52481.exe (PID: 3884)
- Unicorn-52481.exe (PID: 1240)
- Unicorn-28531.exe (PID: 8172)
- Unicorn-53892.exe (PID: 5024)
- Unicorn-3088.exe (PID: 2316)
- Unicorn-53633.exe (PID: 5164)
- Unicorn-54681.exe (PID: 6248)
- Unicorn-57260.exe (PID: 2644)
- Unicorn-63839.exe (PID: 5988)
- Unicorn-348.exe (PID: 2108)
- Unicorn-16685.exe (PID: 8084)
- Unicorn-33021.exe (PID: 4424)
- Unicorn-4411.exe (PID: 2140)
- Unicorn-32445.exe (PID: 7012)
- Unicorn-65309.exe (PID: 8008)
- Unicorn-40103.exe (PID: 2136)
- Unicorn-46980.exe (PID: 8384)
- Unicorn-5392.exe (PID: 8352)
- Unicorn-18906.exe (PID: 8332)
- Unicorn-23627.exe (PID: 8444)
- Unicorn-29897.exe (PID: 8408)
- Unicorn-49393.exe (PID: 8428)
- Unicorn-23566.exe (PID: 8508)
- Unicorn-40923.exe (PID: 8548)
- Unicorn-27733.exe (PID: 8624)
- Unicorn-48153.exe (PID: 8644)
- Unicorn-60789.exe (PID: 8556)
- Unicorn-25494.exe (PID: 8696)
- Unicorn-28095.exe (PID: 8712)
- Unicorn-62443.exe (PID: 8680)
- Unicorn-64416.exe (PID: 8600)
- Unicorn-39985.exe (PID: 8632)
- Unicorn-24609.exe (PID: 8780)
- Unicorn-13425.exe (PID: 8756)
- Unicorn-28693.exe (PID: 8788)
- Unicorn-8827.exe (PID: 8796)
- Unicorn-24417.exe (PID: 8932)
- Unicorn-12719.exe (PID: 8940)
- Unicorn-12164.exe (PID: 8876)
- Unicorn-61365.exe (PID: 8840)
- Unicorn-275.exe (PID: 9060)
- Unicorn-14010.exe (PID: 9068)
- Unicorn-24417.exe (PID: 8924)
- Unicorn-49113.exe (PID: 8848)
- Unicorn-21509.exe (PID: 8904)
- Unicorn-24225.exe (PID: 9032)
- Unicorn-3042.exe (PID: 8984)
- Unicorn-3572.exe (PID: 8992)
- Unicorn-53368.exe (PID: 9104)
- Unicorn-12164.exe (PID: 8864)
- Unicorn-26283.exe (PID: 7940)
- Unicorn-9325.exe (PID: 7696)
- Unicorn-680.exe (PID: 9148)
- Unicorn-49689.exe (PID: 9188)
- Unicorn-4764.exe (PID: 9168)
- Unicorn-29823.exe (PID: 9204)
- Unicorn-24639.exe (PID: 4448)
- Unicorn-44676.exe (PID: 5216)
- Unicorn-1043.exe (PID: 8204)
- Unicorn-48132.exe (PID: 1852)
- Unicorn-20717.exe (PID: 5936)
- Unicorn-10502.exe (PID: 6156)
- Unicorn-17941.exe (PID: 8196)
- Unicorn-38553.exe (PID: 8228)
- Unicorn-20717.exe (PID: 672)
- Unicorn-17941.exe (PID: 8200)
- Unicorn-47084.exe (PID: 9252)
- Unicorn-3642.exe (PID: 732)
- Unicorn-30001.exe (PID: 9272)
- Unicorn-49689.exe (PID: 9196)
- Unicorn-58589.exe (PID: 9304)
- Unicorn-58589.exe (PID: 9308)
- Unicorn-55060.exe (PID: 9356)
- Unicorn-458.exe (PID: 9364)
- Unicorn-31707.exe (PID: 9392)
- Unicorn-24536.exe (PID: 2384)
- Unicorn-51573.exe (PID: 9396)
- Unicorn-2927.exe (PID: 9476)
- Unicorn-13670.exe (PID: 9652)
- Unicorn-35599.exe (PID: 9560)
- Unicorn-16662.exe (PID: 9468)
- Unicorn-55465.exe (PID: 9568)
- Unicorn-38937.exe (PID: 9684)
- Unicorn-22143.exe (PID: 9732)
- Unicorn-24307.exe (PID: 9796)
- Unicorn-6627.exe (PID: 9740)
- Unicorn-46211.exe (PID: 9776)
- Unicorn-1988.exe (PID: 9708)
- Unicorn-33891.exe (PID: 9700)
- Unicorn-23561.exe (PID: 9824)
- Unicorn-3503.exe (PID: 9880)
- Unicorn-51957.exe (PID: 9900)
- Unicorn-24718.exe (PID: 8588)
- Unicorn-60680.exe (PID: 9928)
- Unicorn-56233.exe (PID: 9856)
- Unicorn-10467.exe (PID: 9968)
- Unicorn-11707.exe (PID: 9000)
- Unicorn-4987.exe (PID: 7816)
- Unicorn-27954.exe (PID: 9280)
- Unicorn-51381.exe (PID: 9532)
- Unicorn-41241.exe (PID: 10088)
- Unicorn-45325.exe (PID: 10096)
- Unicorn-44239.exe (PID: 10172)
- Unicorn-39601.exe (PID: 8736)
- Unicorn-34395.exe (PID: 10200)
- Unicorn-58153.exe (PID: 9512)
- Unicorn-17557.exe (PID: 9320)
- Unicorn-6112.exe (PID: 472)
- Unicorn-48899.exe (PID: 668)
- Unicorn-5444.exe (PID: 10136)
- Unicorn-63368.exe (PID: 10156)
- Unicorn-43715.exe (PID: 9636)
- Unicorn-47245.exe (PID: 9604)
- Unicorn-24971.exe (PID: 8912)
- Unicorn-6404.exe (PID: 10292)
- Unicorn-13834.exe (PID: 10352)
- Unicorn-52445.exe (PID: 10452)
- Unicorn-52445.exe (PID: 10436)
- Unicorn-37815.exe (PID: 10520)
- Unicorn-6788.exe (PID: 7992)
- Unicorn-56352.exe (PID: 10256)
- Unicorn-45429.exe (PID: 10492)
- Unicorn-57681.exe (PID: 10536)
- Unicorn-28709.exe (PID: 10680)
- Unicorn-20733.exe (PID: 10604)
- Unicorn-312.exe (PID: 10576)
- Unicorn-16649.exe (PID: 10592)
- Unicorn-31838.exe (PID: 10812)
- Unicorn-37815.exe (PID: 10524)
- Unicorn-20733.exe (PID: 10600)
- Unicorn-18094.exe (PID: 9016)
- Unicorn-58167.exe (PID: 8720)
- Unicorn-49684.exe (PID: 10776)
- Unicorn-12180.exe (PID: 10752)
- Unicorn-57297.exe (PID: 10732)
- Unicorn-12180.exe (PID: 10760)
- Unicorn-20541.exe (PID: 10688)
- Unicorn-49321.exe (PID: 10652)
- Unicorn-37431.exe (PID: 10724)
- Unicorn-35351.exe (PID: 10860)
- Unicorn-35616.exe (PID: 10844)
- Unicorn-63227.exe (PID: 10872)
- Unicorn-41921.exe (PID: 10964)
Create files in a temporary directory
- Unicorn-19741.exe (PID: 7476)
- 1 (128).exe (PID: 7380)
- Unicorn-44172.exe (PID: 7876)
- Unicorn-25273.exe (PID: 7260)
- Unicorn-43647.exe (PID: 7328)
- Unicorn-1323.exe (PID: 7244)
- Unicorn-23197.exe (PID: 7852)
- Unicorn-28729.exe (PID: 920)
- Unicorn-4852.exe (PID: 5576)
- Unicorn-8863.exe (PID: 2236)
- Unicorn-23213.exe (PID: 5324)
- Unicorn-16285.exe (PID: 6744)
- Unicorn-8208.exe (PID: 516)
- Unicorn-49755.exe (PID: 6108)
- Unicorn-32356.exe (PID: 4696)
- Unicorn-48551.exe (PID: 6028)
- Unicorn-20861.exe (PID: 7848)
- Unicorn-20041.exe (PID: 7692)
- Unicorn-7068.exe (PID: 8072)
- Unicorn-17349.exe (PID: 7428)
- Unicorn-35605.exe (PID: 7956)
- Unicorn-47717.exe (PID: 8152)
- Unicorn-57094.exe (PID: 4068)
- Unicorn-35605.exe (PID: 5112)
- Unicorn-47717.exe (PID: 8144)
- Unicorn-50964.exe (PID: 5984)
- Unicorn-63788.exe (PID: 8188)
- Unicorn-41858.exe (PID: 6272)
- Unicorn-23161.exe (PID: 5084)
- Unicorn-27245.exe (PID: 2656)
- Unicorn-23060.exe (PID: 3180)
- Unicorn-43316.exe (PID: 7988)
- Unicorn-51650.exe (PID: 6740)
- Unicorn-36337.exe (PID: 6392)
- Unicorn-36337.exe (PID: 6700)
- Unicorn-22038.exe (PID: 7948)
- Unicorn-59969.exe (PID: 6724)
- Unicorn-52481.exe (PID: 3884)
- Unicorn-28531.exe (PID: 8172)
- Unicorn-140.exe (PID: 4896)
- Unicorn-3088.exe (PID: 2316)
- Unicorn-53633.exe (PID: 5164)
- Unicorn-41779.exe (PID: 4428)
- Unicorn-25517.exe (PID: 8016)
- Unicorn-33021.exe (PID: 4424)
- Unicorn-2858.exe (PID: 8048)
- Unicorn-16685.exe (PID: 8084)
- Unicorn-32445.exe (PID: 7012)
- Unicorn-42621.exe (PID: 6372)
- Unicorn-35605.exe (PID: 7824)
- Unicorn-27851.exe (PID: 8156)
- Unicorn-48153.exe (PID: 8644)
- Unicorn-62443.exe (PID: 8680)
- Unicorn-5433.exe (PID: 1180)
- Unicorn-28693.exe (PID: 8788)
- Unicorn-39985.exe (PID: 8632)
- Unicorn-13425.exe (PID: 8756)
- Unicorn-42819.exe (PID: 7972)
- Unicorn-44328.exe (PID: 632)
- Unicorn-49113.exe (PID: 8848)
- Unicorn-46955.exe (PID: 4112)
- Unicorn-275.exe (PID: 9060)
- Unicorn-12164.exe (PID: 8864)
- Unicorn-44188.exe (PID: 6668)
- Unicorn-9325.exe (PID: 7340)
- Unicorn-53368.exe (PID: 9104)
- Unicorn-9325.exe (PID: 7696)
- Unicorn-27245.exe (PID: 7764)
- Unicorn-26283.exe (PID: 7940)
- Unicorn-680.exe (PID: 9148)
- Unicorn-49689.exe (PID: 9188)
- Unicorn-24639.exe (PID: 4448)
- Unicorn-33794.exe (PID: 4688)
- Unicorn-1043.exe (PID: 8204)
- Unicorn-6108.exe (PID: 7732)
- Unicorn-47084.exe (PID: 9252)
- Unicorn-63839.exe (PID: 5988)
- Unicorn-37504.exe (PID: 8056)
- Unicorn-65309.exe (PID: 8008)
- Unicorn-56497.exe (PID: 6708)
- Unicorn-18906.exe (PID: 8332)
- Unicorn-2927.exe (PID: 9476)
- Unicorn-22143.exe (PID: 9732)
- Unicorn-49393.exe (PID: 8428)
- Unicorn-47717.exe (PID: 8148)
- Unicorn-1988.exe (PID: 9708)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 4268)
- BackgroundTransferHost.exe (PID: 680)
- BackgroundTransferHost.exe (PID: 2656)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 680)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 680)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 680)
- WerFault.exe (PID: 9628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
522
Monitored processes
385
Malicious processes
52
Suspicious processes
53
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 472 | C:\Users\admin\AppData\Local\Temp\Unicorn-6112.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-6112.exe | Unicorn-27851.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 516 | C:\Users\admin\AppData\Local\Temp\Unicorn-8208.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8208.exe | Unicorn-19741.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 632 | C:\Users\admin\AppData\Local\Temp\Unicorn-44328.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-44328.exe | Unicorn-16285.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 668 | C:\Users\admin\AppData\Local\Temp\Unicorn-48899.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-48899.exe | Unicorn-47717.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 672 | C:\Users\admin\AppData\Local\Temp\Unicorn-20717.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20717.exe | Unicorn-44676.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 680 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 732 | C:\Users\admin\AppData\Local\Temp\Unicorn-3642.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3642.exe | Unicorn-7068.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 920 | C:\Users\admin\AppData\Local\Temp\Unicorn-28729.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-28729.exe | Unicorn-1323.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 976 | C:\Users\admin\AppData\Local\Temp\Unicorn-10908.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-10908.exe | Unicorn-63788.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1012 | C:\Users\admin\AppData\Local\Temp\Unicorn-5433.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5433.exe | Unicorn-8208.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
10 682
Read events
10 667
Write events
15
Delete events
0
Modification events
| (PID) Process: | (4268) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4268) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4268) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (680) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (680) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (680) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2656) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2656) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2656) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (5228) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
Executable files
1 029
Suspicious files
7
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 680 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\5bb26692-091b-43ec-8767-e41e16b68881.down_data | — | |
MD5:— | SHA256:— | |||
| 7380 | 1 (128).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-19741.exe | executable | |
MD5:B3B1A2BBB63C29C8D14DC8FDCC3EA3F1 | SHA256:211ED3A9CC6B2B18541143DAE44B470D11804C0DADA50F45B14820F9ADF92CE7 | |||
| 7380 | 1 (128).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-44172.exe | executable | |
MD5:127DE688672AC9CA80B161FCF04A0B60 | SHA256:595E02FC509F0CB09ECC46125099E0616217B1376FA89E74CBA3D7F672027802 | |||
| 7476 | Unicorn-19741.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-1323.exe | executable | |
MD5:FBFE416EF14534B0846DB305AF0FD6D3 | SHA256:4218D6477CC15371D192BB35A426C11FEE4D33CEDC433E2937B5A36EF78A2709 | |||
| 7476 | Unicorn-19741.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-23197.exe | executable | |
MD5:6FDAB5FEBFA568B82C6D8978BD9D9BA8 | SHA256:2DE6CA8DC6B7EBE5B0F8929F6D2FC1959ED4427EF19A461D8506C29838C95747 | |||
| 680 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
| 680 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:63BB6B2700BAF9138C127AA9BD3D6EA1 | SHA256:E8797CDBC28EF3189AFB1DD4A98A3A06B0A86865B9ACD6F2A7865BB19D599008 | |||
| 7380 | 1 (128).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-32356.exe | executable | |
MD5:E4BD6CCE1DEEF5FEA2072492C7901649 | SHA256:4730B16F4E3DA51617B4328132C4E83BC2A4383AC864CEF5283D150321F0EA5C | |||
| 5576 | Unicorn-4852.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-140.exe | executable | |
MD5:58867E339656A5C11BFEE03FE9BEFA56 | SHA256:F2C73D172527817DAE4B96B80855EBC3357A864BA4964DBEB281B5BA014E29D6 | |||
| 7876 | Unicorn-44172.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-51650.exe | executable | |
MD5:3B51E2643A32FE812ECBF5DBF742294B | SHA256:AA833AEEEF754586D0B0D333B76B35CED516E6FA0E303005C7804E9DC9CF9180 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
26
DNS requests
17
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
8196 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7416 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
8196 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
3216 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.159.71:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
5112 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2104 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
7416 | backgroundTaskHost.exe | 20.223.36.55:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
7416 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |