| File name: | 1 (600) |
| Full analysis: | https://app.any.run/tasks/fc53b9a4-e9bd-4ee1-8a36-f8019023e8e4 |
| Verdict: | Malicious activity |
| Analysis date: | March 25, 2025, 02:48:54 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 51FAE3B26F9F890C86982BFE69F54C60 |
| SHA1: | 43FB4298CA81461F78EDE05A62112784B4347674 |
| SHA256: | BCC6723CDC4598BD1086B2590980DC17D8A5C9EB7FACAA161F9A3DD61C56912C |
| SSDEEP: | 6144:jdNzisILGD5jA3lJ++Y8Tmax5tBql3JSBa/W0e9dTk/8SwjwpyAAEhJFIa3dV7Ja:jzObAjA3f+jyBM5+aO0e9dax4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- Unicorn-37721.exe (PID: 7740)
- Unicorn-64250.exe (PID: 7316)
- Unicorn-24915.exe (PID: 7732)
- 1 (600).exe (PID: 6988)
- Unicorn-44147.exe (PID: 7828)
- Unicorn-35403.exe (PID: 7848)
- Unicorn-56570.exe (PID: 7868)
- Unicorn-64960.exe (PID: 7888)
- Unicorn-65169.exe (PID: 8160)
- Unicorn-27282.exe (PID: 8180)
- Unicorn-1407.exe (PID: 8136)
- Unicorn-50966.exe (PID: 2240)
- Unicorn-7567.exe (PID: 4180)
- Unicorn-7567.exe (PID: 7188)
- Unicorn-24680.exe (PID: 1328)
- Unicorn-40658.exe (PID: 2384)
- Unicorn-10652.exe (PID: 5400)
- Unicorn-23056.exe (PID: 208)
- Unicorn-42682.exe (PID: 7380)
- Unicorn-52137.exe (PID: 5176)
- Unicorn-37398.exe (PID: 7212)
- Unicorn-17226.exe (PID: 5404)
- Unicorn-56169.exe (PID: 7560)
- Unicorn-4757.exe (PID: 7480)
- Unicorn-53839.exe (PID: 4756)
- Unicorn-56169.exe (PID: 7564)
- Unicorn-454.exe (PID: 5972)
- Unicorn-53839.exe (PID: 7412)
- Unicorn-41157.exe (PID: 7184)
- Unicorn-63191.exe (PID: 7428)
- Unicorn-11758.exe (PID: 5960)
- Unicorn-5878.exe (PID: 2152)
- Unicorn-47809.exe (PID: 7716)
- Unicorn-7456.exe (PID: 6816)
- Unicorn-46059.exe (PID: 6652)
- Unicorn-34068.exe (PID: 1324)
- Unicorn-60444.exe (PID: 7924)
- Unicorn-65095.exe (PID: 8016)
- Unicorn-40010.exe (PID: 8084)
- Unicorn-22256.exe (PID: 8108)
- Unicorn-35324.exe (PID: 8132)
- Unicorn-809.exe (PID: 7976)
- Unicorn-11151.exe (PID: 7948)
- Unicorn-14047.exe (PID: 7932)
- Unicorn-42863.exe (PID: 6644)
- Unicorn-60107.exe (PID: 5332)
- Unicorn-700.exe (PID: 6540)
- Unicorn-41192.exe (PID: 3332)
- Unicorn-24821.exe (PID: 6480)
- Unicorn-50970.exe (PID: 2320)
- Unicorn-8599.exe (PID: 2432)
- Unicorn-35978.exe (PID: 1240)
- Unicorn-35978.exe (PID: 7200)
- Unicorn-28748.exe (PID: 6752)
- Unicorn-20383.exe (PID: 7216)
- Unicorn-37286.exe (PID: 5392)
- Unicorn-36108.exe (PID: 6004)
- Unicorn-17420.exe (PID: 2284)
- Unicorn-9282.exe (PID: 5304)
- Unicorn-15385.exe (PID: 1764)
- Unicorn-15412.exe (PID: 3268)
- Unicorn-1472.exe (PID: 7804)
- Unicorn-40851.exe (PID: 2692)
- Unicorn-57706.exe (PID: 2140)
- Unicorn-1380.exe (PID: 7588)
- Unicorn-22028.exe (PID: 8052)
- Unicorn-15412.exe (PID: 6388)
- Unicorn-23232.exe (PID: 7824)
- Unicorn-14073.exe (PID: 7504)
- Unicorn-63274.exe (PID: 7516)
- Unicorn-43082.exe (PID: 7696)
- Unicorn-43347.exe (PID: 7644)
- Unicorn-59361.exe (PID: 6632)
- Unicorn-15151.exe (PID: 7952)
- Unicorn-18602.exe (PID: 6300)
- Unicorn-17014.exe (PID: 7700)
- Unicorn-62685.exe (PID: 872)
- Unicorn-14984.exe (PID: 8208)
- Unicorn-32154.exe (PID: 8224)
- Unicorn-33795.exe (PID: 8260)
- Unicorn-59795.exe (PID: 8300)
- Unicorn-55270.exe (PID: 8464)
- Unicorn-38493.exe (PID: 8412)
- Unicorn-44860.exe (PID: 8444)
- Unicorn-42525.exe (PID: 8512)
- Unicorn-47052.exe (PID: 7724)
- Unicorn-35047.exe (PID: 8496)
- Unicorn-31638.exe (PID: 8564)
- Unicorn-10567.exe (PID: 8540)
- Unicorn-1378.exe (PID: 8624)
- Unicorn-16707.exe (PID: 8608)
- Unicorn-19469.exe (PID: 8660)
- Unicorn-1871.exe (PID: 8680)
- Unicorn-34928.exe (PID: 8644)
- Unicorn-58617.exe (PID: 8820)
- Unicorn-10937.exe (PID: 8896)
- Unicorn-1139.exe (PID: 8744)
- Unicorn-51347.exe (PID: 8772)
- Unicorn-9292.exe (PID: 8920)
- Unicorn-40848.exe (PID: 8848)
- Unicorn-44269.exe (PID: 8976)
- Unicorn-20064.exe (PID: 8940)
- Unicorn-5546.exe (PID: 8200)
- Unicorn-56587.exe (PID: 9056)
- Unicorn-2213.exe (PID: 8336)
Executable content was dropped or overwritten
- Unicorn-24915.exe (PID: 7732)
- Unicorn-37721.exe (PID: 7740)
- Unicorn-64250.exe (PID: 7316)
- 1 (600).exe (PID: 6988)
- Unicorn-56570.exe (PID: 7868)
- Unicorn-35403.exe (PID: 7848)
- Unicorn-44147.exe (PID: 7828)
- Unicorn-65169.exe (PID: 8160)
- Unicorn-27282.exe (PID: 8180)
- Unicorn-24680.exe (PID: 1328)
- Unicorn-41157.exe (PID: 7184)
- Unicorn-7567.exe (PID: 7188)
- Unicorn-40658.exe (PID: 2384)
- Unicorn-1407.exe (PID: 8136)
- Unicorn-10652.exe (PID: 5400)
- Unicorn-23056.exe (PID: 208)
- Unicorn-52137.exe (PID: 5176)
- Unicorn-17226.exe (PID: 5404)
- Unicorn-37398.exe (PID: 7212)
- Unicorn-42682.exe (PID: 7380)
- Unicorn-4757.exe (PID: 7480)
- Unicorn-56169.exe (PID: 7560)
- Unicorn-53839.exe (PID: 4756)
- Unicorn-454.exe (PID: 5972)
- Unicorn-50966.exe (PID: 2240)
- Unicorn-7567.exe (PID: 4180)
- Unicorn-5878.exe (PID: 2152)
- Unicorn-53839.exe (PID: 7412)
- Unicorn-64960.exe (PID: 7888)
- Unicorn-63191.exe (PID: 7428)
- Unicorn-47809.exe (PID: 7716)
- Unicorn-46059.exe (PID: 6652)
- Unicorn-34068.exe (PID: 1324)
- Unicorn-7456.exe (PID: 6816)
- Unicorn-65095.exe (PID: 8016)
- Unicorn-60444.exe (PID: 7924)
- Unicorn-22256.exe (PID: 8108)
- Unicorn-35324.exe (PID: 8132)
- Unicorn-40010.exe (PID: 8084)
- Unicorn-809.exe (PID: 7976)
- Unicorn-14047.exe (PID: 7932)
- Unicorn-11151.exe (PID: 7948)
- Unicorn-60107.exe (PID: 5332)
- Unicorn-42863.exe (PID: 6644)
- Unicorn-700.exe (PID: 6540)
- Unicorn-41192.exe (PID: 3332)
- Unicorn-24821.exe (PID: 6480)
- Unicorn-50970.exe (PID: 2320)
- Unicorn-8599.exe (PID: 2432)
- Unicorn-35978.exe (PID: 1240)
- Unicorn-35978.exe (PID: 7200)
- Unicorn-56169.exe (PID: 7564)
- Unicorn-28748.exe (PID: 6752)
- Unicorn-37286.exe (PID: 5392)
- Unicorn-783.exe (PID: 2960)
- Unicorn-20383.exe (PID: 7216)
- Unicorn-9282.exe (PID: 5304)
- Unicorn-57706.exe (PID: 2140)
- Unicorn-40851.exe (PID: 2692)
- Unicorn-15412.exe (PID: 3268)
- Unicorn-1472.exe (PID: 7804)
- Unicorn-15412.exe (PID: 6388)
- Unicorn-23232.exe (PID: 7824)
- Unicorn-22028.exe (PID: 8052)
- Unicorn-11758.exe (PID: 5960)
- Unicorn-47052.exe (PID: 7724)
- Unicorn-63274.exe (PID: 7516)
- Unicorn-43082.exe (PID: 7696)
- Unicorn-14073.exe (PID: 7504)
- Unicorn-59361.exe (PID: 6632)
- Unicorn-15151.exe (PID: 7952)
- Unicorn-43347.exe (PID: 7644)
- Unicorn-18602.exe (PID: 6300)
- Unicorn-17014.exe (PID: 7700)
- Unicorn-62685.exe (PID: 872)
- Unicorn-32154.exe (PID: 8224)
- Unicorn-33795.exe (PID: 8260)
- Unicorn-14984.exe (PID: 8208)
- Unicorn-59795.exe (PID: 8300)
- Unicorn-2213.exe (PID: 8336)
- Unicorn-38493.exe (PID: 8412)
- Unicorn-55270.exe (PID: 8464)
- Unicorn-44860.exe (PID: 8444)
- Unicorn-15385.exe (PID: 1764)
- Unicorn-17420.exe (PID: 2284)
- Unicorn-42525.exe (PID: 8512)
- Unicorn-35047.exe (PID: 8496)
- Unicorn-31638.exe (PID: 8564)
- Unicorn-10567.exe (PID: 8540)
- Unicorn-16707.exe (PID: 8608)
- Unicorn-1378.exe (PID: 8624)
- Unicorn-19469.exe (PID: 8660)
- Unicorn-1871.exe (PID: 8680)
- Unicorn-34928.exe (PID: 8644)
- Unicorn-51347.exe (PID: 8772)
- Unicorn-1139.exe (PID: 8744)
- Unicorn-10937.exe (PID: 8896)
- Unicorn-58617.exe (PID: 8820)
- Unicorn-40848.exe (PID: 8848)
- Unicorn-46971.exe (PID: 8812)
- Unicorn-44269.exe (PID: 8976)
- Unicorn-20064.exe (PID: 8940)
- Unicorn-5546.exe (PID: 8200)
- Unicorn-41311.exe (PID: 9176)
- Unicorn-63869.exe (PID: 9144)
- Unicorn-7683.exe (PID: 9016)
- Unicorn-41311.exe (PID: 9164)
- Unicorn-36108.exe (PID: 6004)
- Unicorn-45421.exe (PID: 9116)
- Unicorn-33635.exe (PID: 8292)
- Unicorn-41311.exe (PID: 9156)
- Unicorn-14314.exe (PID: 8372)
- Unicorn-3724.exe (PID: 4932)
- Unicorn-20445.exe (PID: 8440)
- Unicorn-8284.exe (PID: 7704)
- Unicorn-56587.exe (PID: 9056)
- Unicorn-59681.exe (PID: 9092)
- Unicorn-49780.exe (PID: 8480)
- Unicorn-6028.exe (PID: 8804)
- Unicorn-59147.exe (PID: 4108)
- Unicorn-35088.exe (PID: 9256)
- Unicorn-38509.exe (PID: 8936)
- Unicorn-55037.exe (PID: 8872)
- Unicorn-50740.exe (PID: 9232)
- Unicorn-47643.exe (PID: 9284)
- Unicorn-3651.exe (PID: 9316)
- Unicorn-21597.exe (PID: 7036)
- Unicorn-20445.exe (PID: 8380)
- Unicorn-37860.exe (PID: 7708)
- Unicorn-55037.exe (PID: 2244)
- Unicorn-54689.exe (PID: 9264)
- Unicorn-35947.exe (PID: 7776)
- Unicorn-1351.exe (PID: 9372)
- Unicorn-31706.exe (PID: 9452)
- Unicorn-26806.exe (PID: 9580)
- Unicorn-47274.exe (PID: 9508)
- Unicorn-32365.exe (PID: 9544)
- Unicorn-11840.exe (PID: 9460)
- Unicorn-27408.exe (PID: 9496)
- Unicorn-33252.exe (PID: 9604)
- Unicorn-11050.exe (PID: 9596)
- Unicorn-51207.exe (PID: 9360)
- Unicorn-37776.exe (PID: 9324)
- Unicorn-4684.exe (PID: 9308)
- Unicorn-17495.exe (PID: 9400)
- Unicorn-9292.exe (PID: 8920)
- Unicorn-5893.exe (PID: 9416)
- Unicorn-25546.exe (PID: 9436)
- Unicorn-46205.exe (PID: 9488)
- Unicorn-16687.exe (PID: 9684)
- Unicorn-20061.exe (PID: 7624)
- Unicorn-23952.exe (PID: 9772)
- Unicorn-24301.exe (PID: 9700)
- Unicorn-37491.exe (PID: 9664)
- Unicorn-30422.exe (PID: 9692)
- Unicorn-57357.exe (PID: 9672)
- Unicorn-35001.exe (PID: 9788)
- Unicorn-38992.exe (PID: 9756)
- Unicorn-36536.exe (PID: 9804)
- Unicorn-59469.exe (PID: 9836)
- Unicorn-10304.exe (PID: 9852)
- Unicorn-56136.exe (PID: 9888)
- Unicorn-56792.exe (PID: 9560)
- Unicorn-64544.exe (PID: 9628)
- Unicorn-1380.exe (PID: 7588)
- Unicorn-2572.exe (PID: 9644)
- Unicorn-39882.exe (PID: 10020)
- Unicorn-52051.exe (PID: 9972)
- Unicorn-3488.exe (PID: 10036)
INFO
Checks supported languages
- 1 (600).exe (PID: 6988)
- Unicorn-64250.exe (PID: 7316)
- Unicorn-56570.exe (PID: 7868)
- Unicorn-37721.exe (PID: 7740)
- Unicorn-24915.exe (PID: 7732)
- Unicorn-44147.exe (PID: 7828)
- Unicorn-35403.exe (PID: 7848)
- Unicorn-1407.exe (PID: 8136)
- Unicorn-65169.exe (PID: 8160)
- Unicorn-27282.exe (PID: 8180)
- Unicorn-41157.exe (PID: 7184)
- Unicorn-24680.exe (PID: 1328)
- Unicorn-64960.exe (PID: 7888)
- Unicorn-7567.exe (PID: 7188)
- Unicorn-50966.exe (PID: 2240)
- Unicorn-7567.exe (PID: 4180)
- Unicorn-10652.exe (PID: 5400)
- Unicorn-23056.exe (PID: 208)
- Unicorn-52137.exe (PID: 5176)
- Unicorn-17226.exe (PID: 5404)
- Unicorn-40658.exe (PID: 2384)
- Unicorn-42682.exe (PID: 7380)
- Unicorn-37398.exe (PID: 7212)
- Unicorn-56169.exe (PID: 7560)
- Unicorn-4757.exe (PID: 7480)
- Unicorn-63191.exe (PID: 7428)
- Unicorn-56169.exe (PID: 7564)
- Unicorn-53839.exe (PID: 7412)
- Unicorn-454.exe (PID: 5972)
- Unicorn-53839.exe (PID: 4756)
- Unicorn-5878.exe (PID: 2152)
- Unicorn-11758.exe (PID: 5960)
- Unicorn-47809.exe (PID: 7716)
- Unicorn-46059.exe (PID: 6652)
- Unicorn-7456.exe (PID: 6816)
- Unicorn-60444.exe (PID: 7924)
- Unicorn-34068.exe (PID: 1324)
- Unicorn-65095.exe (PID: 8016)
- Unicorn-40010.exe (PID: 8084)
- Unicorn-22256.exe (PID: 8108)
- Unicorn-11151.exe (PID: 7948)
- Unicorn-14047.exe (PID: 7932)
- Unicorn-42863.exe (PID: 6644)
- Unicorn-35324.exe (PID: 8132)
- Unicorn-809.exe (PID: 7976)
- Unicorn-700.exe (PID: 6540)
- Unicorn-60107.exe (PID: 5332)
- Unicorn-50970.exe (PID: 2320)
- Unicorn-41192.exe (PID: 3332)
- Unicorn-35978.exe (PID: 1240)
- Unicorn-35978.exe (PID: 7200)
- Unicorn-8599.exe (PID: 2432)
- Unicorn-24821.exe (PID: 6480)
- Unicorn-28748.exe (PID: 6752)
- Unicorn-36108.exe (PID: 6004)
- Unicorn-783.exe (PID: 2960)
- Unicorn-20383.exe (PID: 7216)
- Unicorn-37286.exe (PID: 5392)
- Unicorn-15412.exe (PID: 3268)
- Unicorn-57706.exe (PID: 2140)
- Unicorn-15412.exe (PID: 6388)
- Unicorn-9282.exe (PID: 5304)
- Unicorn-17420.exe (PID: 2284)
- Unicorn-40851.exe (PID: 2692)
- Unicorn-1380.exe (PID: 7588)
- Unicorn-23232.exe (PID: 7824)
- Unicorn-47052.exe (PID: 7724)
- Unicorn-1472.exe (PID: 7804)
- Unicorn-22028.exe (PID: 8052)
- Unicorn-15385.exe (PID: 1764)
- Unicorn-14073.exe (PID: 7504)
- Unicorn-63274.exe (PID: 7516)
- Unicorn-43082.exe (PID: 7696)
- Unicorn-59361.exe (PID: 6632)
- Unicorn-43347.exe (PID: 7644)
- Unicorn-18602.exe (PID: 6300)
- Unicorn-17014.exe (PID: 7700)
- Unicorn-62685.exe (PID: 872)
- Unicorn-14984.exe (PID: 8208)
- Unicorn-15151.exe (PID: 7952)
- Unicorn-33795.exe (PID: 8260)
- Unicorn-59795.exe (PID: 8300)
- Unicorn-2213.exe (PID: 8336)
- Unicorn-32154.exe (PID: 8224)
- Unicorn-44860.exe (PID: 8444)
- Unicorn-55270.exe (PID: 8464)
- Unicorn-38493.exe (PID: 8412)
- Unicorn-10567.exe (PID: 8540)
- Unicorn-35047.exe (PID: 8496)
- Unicorn-42525.exe (PID: 8512)
- Unicorn-16707.exe (PID: 8608)
- Unicorn-1378.exe (PID: 8624)
- Unicorn-31638.exe (PID: 8564)
- Unicorn-1139.exe (PID: 8744)
- Unicorn-34928.exe (PID: 8644)
- Unicorn-19469.exe (PID: 8660)
- Unicorn-1871.exe (PID: 8680)
- Unicorn-46971.exe (PID: 8812)
- Unicorn-40848.exe (PID: 8848)
- Unicorn-10937.exe (PID: 8896)
- Unicorn-51347.exe (PID: 8772)
- Unicorn-58617.exe (PID: 8820)
- Unicorn-20064.exe (PID: 8940)
- Unicorn-44269.exe (PID: 8976)
- Unicorn-7683.exe (PID: 9016)
- Unicorn-56587.exe (PID: 9056)
- Unicorn-9292.exe (PID: 8920)
- Unicorn-45421.exe (PID: 9116)
- Unicorn-63869.exe (PID: 9144)
- Unicorn-59681.exe (PID: 9092)
- Unicorn-41311.exe (PID: 9164)
- Unicorn-41311.exe (PID: 9176)
- Unicorn-5546.exe (PID: 8200)
- Unicorn-33635.exe (PID: 8292)
- Unicorn-14314.exe (PID: 8372)
- Unicorn-8284.exe (PID: 7704)
- Unicorn-20445.exe (PID: 8440)
- Unicorn-41311.exe (PID: 9156)
- Unicorn-49780.exe (PID: 8480)
- Unicorn-59147.exe (PID: 4108)
- Unicorn-20061.exe (PID: 7624)
- Unicorn-3724.exe (PID: 4932)
- Unicorn-6028.exe (PID: 8804)
- Unicorn-20445.exe (PID: 8380)
- Unicorn-35947.exe (PID: 7776)
- Unicorn-55037.exe (PID: 8872)
- Unicorn-38509.exe (PID: 8936)
- Unicorn-55037.exe (PID: 2244)
- Unicorn-37860.exe (PID: 7708)
- Unicorn-21597.exe (PID: 7036)
- Unicorn-50740.exe (PID: 9232)
- Unicorn-35088.exe (PID: 9256)
- Unicorn-47643.exe (PID: 9284)
- Unicorn-54689.exe (PID: 9264)
- Unicorn-4684.exe (PID: 9308)
- Unicorn-3651.exe (PID: 9316)
- Unicorn-37776.exe (PID: 9324)
- Unicorn-1351.exe (PID: 9372)
- Unicorn-51207.exe (PID: 9360)
- Unicorn-5893.exe (PID: 9416)
- Unicorn-25546.exe (PID: 9436)
- Unicorn-11840.exe (PID: 9460)
- Unicorn-31706.exe (PID: 9452)
- Unicorn-17495.exe (PID: 9400)
- Unicorn-47274.exe (PID: 9508)
- Unicorn-46205.exe (PID: 9488)
- Unicorn-32365.exe (PID: 9544)
- Unicorn-56792.exe (PID: 9560)
- Unicorn-27408.exe (PID: 9496)
- Unicorn-2572.exe (PID: 9644)
- Unicorn-26806.exe (PID: 9580)
- Unicorn-11050.exe (PID: 9596)
- Unicorn-33252.exe (PID: 9604)
- Unicorn-64544.exe (PID: 9628)
- Unicorn-24301.exe (PID: 9700)
- Unicorn-30422.exe (PID: 9692)
- Unicorn-38992.exe (PID: 9756)
- Unicorn-23952.exe (PID: 9772)
- Unicorn-35001.exe (PID: 9788)
- Unicorn-36536.exe (PID: 9804)
- Unicorn-57357.exe (PID: 9672)
- Unicorn-37491.exe (PID: 9664)
- Unicorn-16687.exe (PID: 9684)
- Unicorn-59469.exe (PID: 9836)
- Unicorn-10304.exe (PID: 9852)
- Unicorn-39882.exe (PID: 10020)
- Unicorn-52051.exe (PID: 9972)
- Unicorn-3488.exe (PID: 10036)
- Unicorn-55480.exe (PID: 10076)
- Unicorn-59124.exe (PID: 10100)
- Unicorn-39216.exe (PID: 10132)
- Unicorn-56136.exe (PID: 9888)
- Unicorn-18086.exe (PID: 10212)
- Unicorn-4656.exe (PID: 10284)
- Unicorn-31818.exe (PID: 9240)
- Unicorn-20883.exe (PID: 3396)
- Unicorn-36835.exe (PID: 10256)
- Unicorn-21184.exe (PID: 10304)
- Unicorn-55201.exe (PID: 10376)
- Unicorn-3783.exe (PID: 10352)
- Unicorn-60961.exe (PID: 10408)
- Unicorn-55096.exe (PID: 10400)
- Unicorn-20970.exe (PID: 10420)
- Unicorn-19980.exe (PID: 10436)
- Unicorn-25823.exe (PID: 10152)
- Unicorn-60800.exe (PID: 10184)
- Unicorn-17619.exe (PID: 10584)
- Unicorn-26633.exe (PID: 10520)
- Unicorn-32493.exe (PID: 10508)
- Unicorn-24092.exe (PID: 10500)
- Unicorn-9258.exe (PID: 10564)
- Unicorn-60379.exe (PID: 10608)
- Unicorn-47137.exe (PID: 10628)
- Unicorn-30608.exe (PID: 10472)
- Unicorn-48180.exe (PID: 10740)
- Unicorn-48886.exe (PID: 10680)
- Unicorn-44973.exe (PID: 10704)
- Unicorn-12300.exe (PID: 10688)
- Unicorn-39372.exe (PID: 10712)
- Unicorn-33571.exe (PID: 10776)
- Unicorn-63835.exe (PID: 10768)
- Unicorn-33571.exe (PID: 10784)
- Unicorn-36836.exe (PID: 10792)
- Unicorn-3084.exe (PID: 10648)
- Unicorn-43562.exe (PID: 11032)
- Unicorn-34064.exe (PID: 10876)
- Unicorn-40224.exe (PID: 10980)
- Unicorn-29041.exe (PID: 10936)
- Unicorn-40224.exe (PID: 10972)
- Unicorn-40224.exe (PID: 10964)
- Unicorn-17034.exe (PID: 11064)
- Unicorn-29775.exe (PID: 11040)
- Unicorn-54916.exe (PID: 11080)
- Unicorn-5802.exe (PID: 11116)
- Unicorn-18334.exe (PID: 10840)
- Unicorn-36836.exe (PID: 10812)
- Unicorn-34064.exe (PID: 10884)
- Unicorn-34064.exe (PID: 10892)
- Unicorn-62212.exe (PID: 4056)
- Unicorn-18563.exe (PID: 11172)
- Unicorn-62897.exe (PID: 4152)
- Unicorn-7530.exe (PID: 11232)
- Unicorn-7530.exe (PID: 11224)
- Unicorn-13660.exe (PID: 11240)
- Unicorn-56347.exe (PID: 6728)
- Unicorn-9555.exe (PID: 11280)
- Unicorn-2810.exe (PID: 11128)
- Unicorn-54811.exe (PID: 11144)
- Unicorn-24163.exe (PID: 11180)
- Unicorn-34080.exe (PID: 11480)
- Unicorn-49924.exe (PID: 11436)
- Unicorn-17251.exe (PID: 11428)
- Unicorn-63659.exe (PID: 11444)
- Unicorn-44624.exe (PID: 11516)
- Unicorn-52877.exe (PID: 11500)
- Unicorn-60676.exe (PID: 11364)
- Unicorn-24826.exe (PID: 11388)
- Unicorn-5824.exe (PID: 11596)
- Unicorn-12426.exe (PID: 11612)
- Unicorn-36467.exe (PID: 11628)
- Unicorn-53764.exe (PID: 11680)
- Unicorn-1962.exe (PID: 11688)
- Unicorn-57905.exe (PID: 11712)
- Unicorn-52040.exe (PID: 11728)
- Unicorn-4563.exe (PID: 11736)
- Unicorn-13498.exe (PID: 11532)
- Unicorn-48667.exe (PID: 11580)
- Unicorn-35891.exe (PID: 11644)
- Unicorn-11091.exe (PID: 11396)
- Unicorn-62493.exe (PID: 11832)
- Unicorn-33313.exe (PID: 11848)
- Unicorn-64029.exe (PID: 11880)
- Unicorn-28787.exe (PID: 11864)
- Unicorn-12176.exe (PID: 11772)
- Unicorn-8314.exe (PID: 11788)
- Unicorn-38872.exe (PID: 11808)
- Unicorn-35316.exe (PID: 11960)
- Unicorn-41357.exe (PID: 11980)
- Unicorn-17517.exe (PID: 11896)
- Unicorn-46660.exe (PID: 11912)
- Unicorn-59819.exe (PID: 11936)
- Unicorn-24746.exe (PID: 12024)
- Unicorn-40013.exe (PID: 12032)
- Unicorn-38403.exe (PID: 12064)
- Unicorn-23219.exe (PID: 12148)
- Unicorn-8300.exe (PID: 11996)
- Unicorn-26282.exe (PID: 12088)
- Unicorn-34541.exe (PID: 12232)
- Unicorn-2179.exe (PID: 12200)
- Unicorn-17437.exe (PID: 12276)
- Unicorn-11306.exe (PID: 12268)
- Unicorn-381.exe (PID: 12108)
- Unicorn-6970.exe (PID: 12168)
- Unicorn-65224.exe (PID: 7308)
- Unicorn-19459.exe (PID: 12416)
- Unicorn-58438.exe (PID: 12388)
- Unicorn-38795.exe (PID: 12424)
- Unicorn-55624.exe (PID: 12488)
- Unicorn-30474.exe (PID: 6264)
- Unicorn-47131.exe (PID: 12308)
- Unicorn-1223.exe (PID: 12344)
Reads the computer name
- 1 (600).exe (PID: 6988)
- Unicorn-64250.exe (PID: 7316)
- Unicorn-24915.exe (PID: 7732)
- Unicorn-37721.exe (PID: 7740)
- Unicorn-44147.exe (PID: 7828)
- Unicorn-35403.exe (PID: 7848)
- Unicorn-64960.exe (PID: 7888)
- Unicorn-56570.exe (PID: 7868)
- Unicorn-1407.exe (PID: 8136)
- Unicorn-24680.exe (PID: 1328)
- Unicorn-65169.exe (PID: 8160)
- Unicorn-27282.exe (PID: 8180)
- Unicorn-7567.exe (PID: 7188)
- Unicorn-41157.exe (PID: 7184)
- Unicorn-50966.exe (PID: 2240)
- Unicorn-7567.exe (PID: 4180)
- Unicorn-40658.exe (PID: 2384)
- Unicorn-10652.exe (PID: 5400)
- Unicorn-23056.exe (PID: 208)
- Unicorn-52137.exe (PID: 5176)
- Unicorn-17226.exe (PID: 5404)
- Unicorn-42682.exe (PID: 7380)
- Unicorn-37398.exe (PID: 7212)
- Unicorn-53839.exe (PID: 7412)
- Unicorn-56169.exe (PID: 7564)
- Unicorn-454.exe (PID: 5972)
- Unicorn-4757.exe (PID: 7480)
- Unicorn-56169.exe (PID: 7560)
- Unicorn-53839.exe (PID: 4756)
- Unicorn-5878.exe (PID: 2152)
- Unicorn-47809.exe (PID: 7716)
- Unicorn-63191.exe (PID: 7428)
- Unicorn-11758.exe (PID: 5960)
- Unicorn-7456.exe (PID: 6816)
- Unicorn-46059.exe (PID: 6652)
- Unicorn-60444.exe (PID: 7924)
- Unicorn-34068.exe (PID: 1324)
- Unicorn-65095.exe (PID: 8016)
- Unicorn-40010.exe (PID: 8084)
- Unicorn-22256.exe (PID: 8108)
- Unicorn-35324.exe (PID: 8132)
- Unicorn-809.exe (PID: 7976)
- Unicorn-60107.exe (PID: 5332)
- Unicorn-42863.exe (PID: 6644)
- Unicorn-700.exe (PID: 6540)
- Unicorn-41192.exe (PID: 3332)
- Unicorn-14047.exe (PID: 7932)
- Unicorn-11151.exe (PID: 7948)
- Unicorn-8599.exe (PID: 2432)
- Unicorn-50970.exe (PID: 2320)
- Unicorn-24821.exe (PID: 6480)
- Unicorn-35978.exe (PID: 1240)
- Unicorn-35978.exe (PID: 7200)
- Unicorn-28748.exe (PID: 6752)
- Unicorn-20383.exe (PID: 7216)
- Unicorn-37286.exe (PID: 5392)
- Unicorn-36108.exe (PID: 6004)
- Unicorn-17420.exe (PID: 2284)
- Unicorn-783.exe (PID: 2960)
- Unicorn-15385.exe (PID: 1764)
- Unicorn-9282.exe (PID: 5304)
- Unicorn-1380.exe (PID: 7588)
- Unicorn-15412.exe (PID: 3268)
- Unicorn-57706.exe (PID: 2140)
- Unicorn-1472.exe (PID: 7804)
- Unicorn-40851.exe (PID: 2692)
- Unicorn-22028.exe (PID: 8052)
- Unicorn-15412.exe (PID: 6388)
- Unicorn-23232.exe (PID: 7824)
- Unicorn-47052.exe (PID: 7724)
- Unicorn-14073.exe (PID: 7504)
- Unicorn-63274.exe (PID: 7516)
- Unicorn-43347.exe (PID: 7644)
- Unicorn-59361.exe (PID: 6632)
- Unicorn-15151.exe (PID: 7952)
- Unicorn-43082.exe (PID: 7696)
- Unicorn-18602.exe (PID: 6300)
- Unicorn-62685.exe (PID: 872)
- Unicorn-17014.exe (PID: 7700)
- Unicorn-14984.exe (PID: 8208)
- Unicorn-32154.exe (PID: 8224)
- Unicorn-33795.exe (PID: 8260)
- Unicorn-59795.exe (PID: 8300)
- Unicorn-2213.exe (PID: 8336)
- Unicorn-55270.exe (PID: 8464)
- Unicorn-44860.exe (PID: 8444)
- Unicorn-38493.exe (PID: 8412)
- Unicorn-35047.exe (PID: 8496)
- Unicorn-10567.exe (PID: 8540)
- Unicorn-42525.exe (PID: 8512)
- Unicorn-31638.exe (PID: 8564)
- Unicorn-1378.exe (PID: 8624)
- Unicorn-16707.exe (PID: 8608)
- Unicorn-58617.exe (PID: 8820)
- Unicorn-19469.exe (PID: 8660)
- Unicorn-51347.exe (PID: 8772)
- Unicorn-34928.exe (PID: 8644)
- Unicorn-1871.exe (PID: 8680)
- Unicorn-1139.exe (PID: 8744)
- Unicorn-10937.exe (PID: 8896)
- Unicorn-46971.exe (PID: 8812)
- Unicorn-40848.exe (PID: 8848)
- Unicorn-9292.exe (PID: 8920)
- Unicorn-44269.exe (PID: 8976)
- Unicorn-20064.exe (PID: 8940)
- Unicorn-5546.exe (PID: 8200)
- Unicorn-56587.exe (PID: 9056)
- Unicorn-59681.exe (PID: 9092)
- Unicorn-7683.exe (PID: 9016)
- Unicorn-41311.exe (PID: 9164)
The sample compiled with chinese language support
- 1 (600).exe (PID: 6988)
- Unicorn-27282.exe (PID: 8180)
- Unicorn-44147.exe (PID: 7828)
- Unicorn-41157.exe (PID: 7184)
- Unicorn-7567.exe (PID: 7188)
- Unicorn-1407.exe (PID: 8136)
- Unicorn-56570.exe (PID: 7868)
- Unicorn-23056.exe (PID: 208)
- Unicorn-65169.exe (PID: 8160)
- Unicorn-42682.exe (PID: 7380)
- Unicorn-52137.exe (PID: 5176)
- Unicorn-24680.exe (PID: 1328)
- Unicorn-37398.exe (PID: 7212)
- Unicorn-17226.exe (PID: 5404)
- Unicorn-24915.exe (PID: 7732)
- Unicorn-35403.exe (PID: 7848)
- Unicorn-53839.exe (PID: 4756)
- Unicorn-64250.exe (PID: 7316)
- Unicorn-4757.exe (PID: 7480)
- Unicorn-56169.exe (PID: 7560)
- Unicorn-454.exe (PID: 5972)
- Unicorn-50966.exe (PID: 2240)
- Unicorn-5878.exe (PID: 2152)
- Unicorn-7567.exe (PID: 4180)
- Unicorn-53839.exe (PID: 7412)
- Unicorn-37721.exe (PID: 7740)
- Unicorn-64960.exe (PID: 7888)
- Unicorn-63191.exe (PID: 7428)
- Unicorn-47809.exe (PID: 7716)
- Unicorn-40658.exe (PID: 2384)
- Unicorn-46059.exe (PID: 6652)
- Unicorn-10652.exe (PID: 5400)
- Unicorn-7456.exe (PID: 6816)
- Unicorn-60444.exe (PID: 7924)
- Unicorn-65095.exe (PID: 8016)
- Unicorn-34068.exe (PID: 1324)
- Unicorn-22256.exe (PID: 8108)
- Unicorn-35324.exe (PID: 8132)
- Unicorn-40010.exe (PID: 8084)
- Unicorn-809.exe (PID: 7976)
- Unicorn-11151.exe (PID: 7948)
- Unicorn-14047.exe (PID: 7932)
- Unicorn-60107.exe (PID: 5332)
- Unicorn-42863.exe (PID: 6644)
- Unicorn-41192.exe (PID: 3332)
- Unicorn-700.exe (PID: 6540)
- Unicorn-24821.exe (PID: 6480)
- Unicorn-50970.exe (PID: 2320)
- Unicorn-8599.exe (PID: 2432)
- Unicorn-35978.exe (PID: 1240)
- Unicorn-35978.exe (PID: 7200)
- Unicorn-56169.exe (PID: 7564)
- Unicorn-28748.exe (PID: 6752)
- Unicorn-20383.exe (PID: 7216)
- Unicorn-37286.exe (PID: 5392)
- Unicorn-783.exe (PID: 2960)
- Unicorn-9282.exe (PID: 5304)
- Unicorn-57706.exe (PID: 2140)
- Unicorn-1472.exe (PID: 7804)
- Unicorn-15412.exe (PID: 3268)
- Unicorn-40851.exe (PID: 2692)
- Unicorn-15412.exe (PID: 6388)
- Unicorn-23232.exe (PID: 7824)
- Unicorn-22028.exe (PID: 8052)
- Unicorn-47052.exe (PID: 7724)
- Unicorn-11758.exe (PID: 5960)
- Unicorn-63274.exe (PID: 7516)
- Unicorn-43082.exe (PID: 7696)
- Unicorn-14073.exe (PID: 7504)
- Unicorn-43347.exe (PID: 7644)
- Unicorn-15151.exe (PID: 7952)
- Unicorn-59361.exe (PID: 6632)
- Unicorn-17014.exe (PID: 7700)
- Unicorn-62685.exe (PID: 872)
- Unicorn-18602.exe (PID: 6300)
- Unicorn-14984.exe (PID: 8208)
- Unicorn-32154.exe (PID: 8224)
- Unicorn-59795.exe (PID: 8300)
- Unicorn-2213.exe (PID: 8336)
Create files in a temporary directory
- Unicorn-37721.exe (PID: 7740)
- Unicorn-64250.exe (PID: 7316)
- Unicorn-24915.exe (PID: 7732)
- 1 (600).exe (PID: 6988)
- Unicorn-35403.exe (PID: 7848)
- Unicorn-56570.exe (PID: 7868)
- Unicorn-65169.exe (PID: 8160)
- Unicorn-27282.exe (PID: 8180)
- Unicorn-24680.exe (PID: 1328)
- Unicorn-1407.exe (PID: 8136)
- Unicorn-7567.exe (PID: 7188)
- Unicorn-40658.exe (PID: 2384)
- Unicorn-10652.exe (PID: 5400)
- Unicorn-44147.exe (PID: 7828)
- Unicorn-52137.exe (PID: 5176)
- Unicorn-37398.exe (PID: 7212)
- Unicorn-42682.exe (PID: 7380)
- Unicorn-17226.exe (PID: 5404)
- Unicorn-56169.exe (PID: 7560)
- Unicorn-4757.exe (PID: 7480)
- Unicorn-53839.exe (PID: 4756)
- Unicorn-454.exe (PID: 5972)
- Unicorn-53839.exe (PID: 7412)
- Unicorn-41157.exe (PID: 7184)
- Unicorn-50966.exe (PID: 2240)
- Unicorn-7567.exe (PID: 4180)
- Unicorn-5878.exe (PID: 2152)
- Unicorn-63191.exe (PID: 7428)
- Unicorn-64960.exe (PID: 7888)
- Unicorn-47809.exe (PID: 7716)
- Unicorn-7456.exe (PID: 6816)
- Unicorn-46059.exe (PID: 6652)
- Unicorn-34068.exe (PID: 1324)
- Unicorn-60444.exe (PID: 7924)
- Unicorn-23056.exe (PID: 208)
- Unicorn-65095.exe (PID: 8016)
- Unicorn-22256.exe (PID: 8108)
- Unicorn-35324.exe (PID: 8132)
- Unicorn-40010.exe (PID: 8084)
- Unicorn-14047.exe (PID: 7932)
- Unicorn-809.exe (PID: 7976)
- Unicorn-11151.exe (PID: 7948)
- Unicorn-60107.exe (PID: 5332)
- Unicorn-42863.exe (PID: 6644)
- Unicorn-41192.exe (PID: 3332)
- Unicorn-50970.exe (PID: 2320)
- Unicorn-700.exe (PID: 6540)
- Unicorn-24821.exe (PID: 6480)
- Unicorn-35978.exe (PID: 1240)
- Unicorn-8599.exe (PID: 2432)
- Unicorn-56169.exe (PID: 7564)
- Unicorn-28748.exe (PID: 6752)
- Unicorn-35978.exe (PID: 7200)
- Unicorn-20383.exe (PID: 7216)
- Unicorn-37286.exe (PID: 5392)
- Unicorn-783.exe (PID: 2960)
- Unicorn-15412.exe (PID: 3268)
- Unicorn-57706.exe (PID: 2140)
- Unicorn-1472.exe (PID: 7804)
- Unicorn-9282.exe (PID: 5304)
- Unicorn-40851.exe (PID: 2692)
- Unicorn-22028.exe (PID: 8052)
- Unicorn-23232.exe (PID: 7824)
- Unicorn-15412.exe (PID: 6388)
- Unicorn-47052.exe (PID: 7724)
- Unicorn-11758.exe (PID: 5960)
- Unicorn-14073.exe (PID: 7504)
- Unicorn-63274.exe (PID: 7516)
- Unicorn-43082.exe (PID: 7696)
- Unicorn-43347.exe (PID: 7644)
- Unicorn-59361.exe (PID: 6632)
- Unicorn-15151.exe (PID: 7952)
- Unicorn-17014.exe (PID: 7700)
- Unicorn-14984.exe (PID: 8208)
- Unicorn-62685.exe (PID: 872)
- Unicorn-18602.exe (PID: 6300)
- Unicorn-32154.exe (PID: 8224)
- Unicorn-33795.exe (PID: 8260)
- Unicorn-59795.exe (PID: 8300)
- Unicorn-2213.exe (PID: 8336)
- Unicorn-38493.exe (PID: 8412)
- Unicorn-55270.exe (PID: 8464)
- Unicorn-44860.exe (PID: 8444)
- Unicorn-17420.exe (PID: 2284)
- Unicorn-15385.exe (PID: 1764)
- Unicorn-42525.exe (PID: 8512)
- Unicorn-10567.exe (PID: 8540)
- Unicorn-35047.exe (PID: 8496)
- Unicorn-31638.exe (PID: 8564)
- Unicorn-1378.exe (PID: 8624)
- Unicorn-16707.exe (PID: 8608)
- Unicorn-34928.exe (PID: 8644)
- Unicorn-19469.exe (PID: 8660)
- Unicorn-1871.exe (PID: 8680)
- Unicorn-1139.exe (PID: 8744)
- Unicorn-10937.exe (PID: 8896)
- Unicorn-58617.exe (PID: 8820)
- Unicorn-51347.exe (PID: 8772)
- Unicorn-46971.exe (PID: 8812)
- Unicorn-40848.exe (PID: 8848)
- Unicorn-44269.exe (PID: 8976)
- Unicorn-20064.exe (PID: 8940)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 7948)
- BackgroundTransferHost.exe (PID: 6480)
- BackgroundTransferHost.exe (PID: 4224)
- BackgroundTransferHost.exe (PID: 5048)
- BackgroundTransferHost.exe (PID: 7376)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 6480)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 6480)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 6480)
- slui.exe (PID: 7256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
434
Monitored processes
301
Malicious processes
48
Suspicious processes
35
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\Users\admin\AppData\Local\Temp\Unicorn-23056.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-23056.exe | Unicorn-65169.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 872 | C:\Users\admin\AppData\Local\Temp\Unicorn-62685.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-62685.exe | Unicorn-52137.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1240 | C:\Users\admin\AppData\Local\Temp\Unicorn-35978.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-35978.exe | Unicorn-454.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1324 | C:\Users\admin\AppData\Local\Temp\Unicorn-34068.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-34068.exe | Unicorn-23056.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1328 | C:\Users\admin\AppData\Local\Temp\Unicorn-24680.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24680.exe | Unicorn-64250.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1764 | C:\Users\admin\AppData\Local\Temp\Unicorn-15385.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-15385.exe | 1 (600).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2140 | C:\Users\admin\AppData\Local\Temp\Unicorn-57706.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-57706.exe | Unicorn-63191.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2152 | C:\Users\admin\AppData\Local\Temp\Unicorn-5878.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5878.exe | Unicorn-64960.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2240 | C:\Users\admin\AppData\Local\Temp\Unicorn-50966.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-50966.exe | 1 (600).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2244 | C:\Users\admin\AppData\Local\Temp\Unicorn-55037.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-55037.exe | Unicorn-22028.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
8 041
Read events
8 026
Write events
15
Delete events
0
Modification events
| (PID) Process: | (7948) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7948) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7948) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6480) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6480) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6480) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (4224) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4224) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4224) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (5048) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
813
Suspicious files
4
Text files
0
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6480 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\299e2ea4-353f-46af-8347-f5cf79b98d2b.down_data | — | |
MD5:— | SHA256:— | |||
| 7316 | Unicorn-64250.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24915.exe | executable | |
MD5:35075B18FF8B2EC1C9D2047A134BEA08 | SHA256:E7040CCEEB51DB2013318134A1863DC1755AEA19E7106070EFDDD532896025BC | |||
| 7732 | Unicorn-24915.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-44147.exe | executable | |
MD5:C90CCCB7DD0868299345006C4B147FD3 | SHA256:DFB4C320FB6DD88CD8613E0F68C7D9183F3B6090211E044623E4014FA687633D | |||
| 7740 | Unicorn-37721.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-35403.exe | executable | |
MD5:32E19EA7DFF70C81BD0896CAE42D7D76 | SHA256:BBF7E8FDF6C58A4380A1FB8F21D4DE04D0CD0FA7EFE8A4174CB2C91FEBA20CE8 | |||
| 6988 | 1 (600).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-37721.exe | executable | |
MD5:09CE49C183E95971DF0B917952013FF2 | SHA256:2181544C1FA3FC96D0130971145AEB5D143CCF1293ABBC53B68E82632C65301E | |||
| 6988 | 1 (600).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-64250.exe | executable | |
MD5:FFC21A5E3FA486FC7CB2E4B245E9934E | SHA256:F4C54832A8396145EDD5C062DCAD39FBAB7DA324FC1F9709981651E49C44A0E3 | |||
| 6480 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
| 6988 | 1 (600).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-50966.exe | executable | |
MD5:1C4D2BAA58847BBC974FBDFBFCDA30ED | SHA256:2FEC98B895DEB83FF50FA6BE38AC65C6493158C6CECBA3A6595F548E3B9FA6C5 | |||
| 7848 | Unicorn-35403.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-27282.exe | executable | |
MD5:1196F9BFFBA4943982F8939540123EF5 | SHA256:57C202060E5EBF9A11A7FA35E8117210CCAFBD903883ACD2267A82F218071152 | |||
| 7316 | Unicorn-64250.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24680.exe | executable | |
MD5:7D66E915B334F4A5F1D9E6F4D5295DAA | SHA256:38597FF89619B5927AD048A0D09EB0C44DB9A3EC09A8E1E4FC1447A1C4BFCA07 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
26
DNS requests
18
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
2104 | svchost.exe | GET | 200 | 23.53.40.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5204 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
7696 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6480 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
7696 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2104 | svchost.exe | 23.53.40.176:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
6544 | svchost.exe | 20.190.159.128:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
— | — | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5496 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4024 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5204 | backgroundTaskHost.exe | 20.31.169.57:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5204 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |