| File name: | 1 (177) |
| Full analysis: | https://app.any.run/tasks/ba849025-5671-4b5a-88b4-fdd2f8e462c6 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 16:37:55 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 3FD52AAFA8AA9146D70B0B8AC619C680 |
| SHA1: | E2BBF4C43CF7C3DD6AA8C5C39A5260DCACE331E1 |
| SHA256: | D24629BAEF5881F2D316A48B370F36A775AD19F98AD34905C28323F90CB5EA2D |
| SSDEEP: | 6144:cS9gJKsCaDlLA5cprGebwKfxbt38op8GBV/SyVOyUk/8SwjwpyAvEhSzFhyt5JYa:coYN5LA5yrZr3r+aV6yVOyDx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- Unicorn-32610.exe (PID: 4620)
- 1 (177).exe (PID: 5048)
- Unicorn-27862.exe (PID: 6564)
- Unicorn-32500.exe (PID: 5384)
- Unicorn-50778.exe (PID: 2096)
- Unicorn-50778.exe (PID: 5968)
- Unicorn-45454.exe (PID: 2320)
- Unicorn-54841.exe (PID: 6800)
- Unicorn-3039.exe (PID: 5972)
- Unicorn-20627.exe (PID: 1328)
- Unicorn-41370.exe (PID: 5984)
- Unicorn-39516.exe (PID: 6388)
- Unicorn-8697.exe (PID: 1164)
- Unicorn-45381.exe (PID: 2904)
- Unicorn-54369.exe (PID: 5280)
- Unicorn-8697.exe (PID: 2384)
- Unicorn-40166.exe (PID: 4336)
- Unicorn-24790.exe (PID: 6816)
- Unicorn-37788.exe (PID: 7196)
- Unicorn-4924.exe (PID: 536)
- Unicorn-18659.exe (PID: 780)
- Unicorn-41318.exe (PID: 7252)
- Unicorn-41318.exe (PID: 7236)
- Unicorn-36393.exe (PID: 7336)
- Unicorn-41318.exe (PID: 7244)
- Unicorn-39673.exe (PID: 7260)
- Unicorn-27727.exe (PID: 7320)
- Unicorn-62131.exe (PID: 7304)
- Unicorn-48396.exe (PID: 7340)
- Unicorn-48396.exe (PID: 7328)
- Unicorn-2724.exe (PID: 7312)
- Unicorn-47190.exe (PID: 7752)
- Unicorn-46759.exe (PID: 7896)
- Unicorn-36775.exe (PID: 7976)
- Unicorn-7418.exe (PID: 7856)
- Unicorn-93.exe (PID: 644)
- Unicorn-49774.exe (PID: 8008)
- Unicorn-16355.exe (PID: 8040)
- Unicorn-58155.exe (PID: 8064)
- Unicorn-47941.exe (PID: 8052)
- Unicorn-9146.exe (PID: 8088)
- Unicorn-11184.exe (PID: 8116)
- Unicorn-41746.exe (PID: 8144)
- Unicorn-25675.exe (PID: 8188)
- Unicorn-41435.exe (PID: 7484)
- Unicorn-12846.exe (PID: 6080)
- Unicorn-48726.exe (PID: 4008)
- Unicorn-49603.exe (PID: 7536)
- Unicorn-1170.exe (PID: 8172)
- Unicorn-28860.exe (PID: 616)
- Unicorn-45519.exe (PID: 7516)
- Unicorn-25845.exe (PID: 2040)
- Unicorn-29737.exe (PID: 7524)
- Unicorn-48726.exe (PID: 6644)
- Unicorn-7993.exe (PID: 5720)
- Unicorn-39581.exe (PID: 6740)
- Unicorn-39581.exe (PID: 4272)
- Unicorn-33194.exe (PID: 5504)
- Unicorn-48726.exe (PID: 4220)
- Unicorn-21761.exe (PID: 6112)
- Unicorn-48726.exe (PID: 7664)
- Unicorn-32696.exe (PID: 896)
- Unicorn-55394.exe (PID: 7964)
- Unicorn-46479.exe (PID: 7932)
- Unicorn-6790.exe (PID: 7788)
- Unicorn-5700.exe (PID: 7764)
- Unicorn-53177.exe (PID: 5868)
- Unicorn-34803.exe (PID: 7924)
- Unicorn-28393.exe (PID: 7844)
- Unicorn-55891.exe (PID: 7768)
- Unicorn-36509.exe (PID: 7416)
- Unicorn-5228.exe (PID: 7468)
- Unicorn-31487.exe (PID: 8224)
- Unicorn-62021.exe (PID: 7776)
- Unicorn-9094.exe (PID: 8336)
- Unicorn-30200.exe (PID: 8484)
- Unicorn-50667.exe (PID: 8556)
- Unicorn-9073.exe (PID: 8380)
- Unicorn-51222.exe (PID: 8532)
- Unicorn-45742.exe (PID: 8584)
- Unicorn-41046.exe (PID: 8604)
- Unicorn-15041.exe (PID: 8644)
- Unicorn-6245.exe (PID: 8716)
- Unicorn-31015.exe (PID: 8688)
- Unicorn-55519.exe (PID: 8672)
- Unicorn-21569.exe (PID: 7428)
- Unicorn-38607.exe (PID: 8740)
- Unicorn-29676.exe (PID: 8732)
- Unicorn-18379.exe (PID: 8788)
- Unicorn-18379.exe (PID: 8796)
- Unicorn-23017.exe (PID: 8764)
- Unicorn-60926.exe (PID: 8872)
- Unicorn-33716.exe (PID: 8244)
- Unicorn-30522.exe (PID: 8828)
- Unicorn-60371.exe (PID: 8856)
- Unicorn-42966.exe (PID: 8848)
- Unicorn-11917.exe (PID: 8912)
- Unicorn-7086.exe (PID: 8896)
- Unicorn-65202.exe (PID: 9000)
- Unicorn-19531.exe (PID: 9012)
- Unicorn-31783.exe (PID: 8920)
- Unicorn-31761.exe (PID: 9064)
- Unicorn-45497.exe (PID: 9056)
- Unicorn-39375.exe (PID: 9072)
- Unicorn-24007.exe (PID: 9080)
- Unicorn-19531.exe (PID: 9008)
- Unicorn-35483.exe (PID: 9156)
- Unicorn-32359.exe (PID: 8272)
- Unicorn-49442.exe (PID: 7972)
- Unicorn-43651.exe (PID: 9176)
- Unicorn-18955.exe (PID: 9132)
- Unicorn-22908.exe (PID: 9208)
- Unicorn-764.exe (PID: 8240)
- Unicorn-60907.exe (PID: 7452)
- Unicorn-6894.exe (PID: 6944)
- Unicorn-31290.exe (PID: 8016)
- Unicorn-39957.exe (PID: 8668)
- Unicorn-18955.exe (PID: 9124)
- Unicorn-29021.exe (PID: 7884)
- Unicorn-55009.exe (PID: 8292)
- Unicorn-19841.exe (PID: 8512)
- Unicorn-65415.exe (PID: 7748)
- Unicorn-10796.exe (PID: 8636)
- Unicorn-33105.exe (PID: 7852)
- Unicorn-59794.exe (PID: 9236)
- Unicorn-55201.exe (PID: 9052)
- Unicorn-34196.exe (PID: 9292)
Executable content was dropped or overwritten
- 1 (177).exe (PID: 5048)
- Unicorn-32610.exe (PID: 4620)
- Unicorn-27862.exe (PID: 6564)
- Unicorn-50778.exe (PID: 2096)
- Unicorn-32500.exe (PID: 5384)
- Unicorn-54841.exe (PID: 6800)
- Unicorn-50778.exe (PID: 5968)
- Unicorn-45454.exe (PID: 2320)
- Unicorn-41370.exe (PID: 5984)
- Unicorn-39516.exe (PID: 6388)
- Unicorn-20627.exe (PID: 1328)
- Unicorn-3039.exe (PID: 5972)
- Unicorn-45381.exe (PID: 2904)
- Unicorn-8697.exe (PID: 1164)
- Unicorn-40166.exe (PID: 4336)
- Unicorn-93.exe (PID: 644)
- Unicorn-24790.exe (PID: 6816)
- Unicorn-4924.exe (PID: 536)
- Unicorn-18659.exe (PID: 780)
- Unicorn-39673.exe (PID: 7260)
- Unicorn-37788.exe (PID: 7196)
- Unicorn-41318.exe (PID: 7252)
- Unicorn-41318.exe (PID: 7236)
- Unicorn-41318.exe (PID: 7244)
- Unicorn-36393.exe (PID: 7336)
- Unicorn-27727.exe (PID: 7320)
- Unicorn-8697.exe (PID: 2384)
- Unicorn-48396.exe (PID: 7340)
- Unicorn-54369.exe (PID: 5280)
- Unicorn-47190.exe (PID: 7752)
- Unicorn-28393.exe (PID: 7844)
- Unicorn-7418.exe (PID: 7856)
- Unicorn-36775.exe (PID: 7976)
- Unicorn-46759.exe (PID: 7896)
- Unicorn-16355.exe (PID: 8040)
- Unicorn-49774.exe (PID: 8008)
- Unicorn-47941.exe (PID: 8052)
- Unicorn-9146.exe (PID: 8088)
- Unicorn-58155.exe (PID: 8064)
- Unicorn-11184.exe (PID: 8116)
- Unicorn-41746.exe (PID: 8144)
- Unicorn-25675.exe (PID: 8188)
- Unicorn-41435.exe (PID: 7484)
- Unicorn-12846.exe (PID: 6080)
- Unicorn-48726.exe (PID: 4008)
- Unicorn-49603.exe (PID: 7536)
- Unicorn-21569.exe (PID: 7428)
- Unicorn-25845.exe (PID: 2040)
- Unicorn-45519.exe (PID: 7516)
- Unicorn-29737.exe (PID: 7524)
- Unicorn-7993.exe (PID: 5720)
- Unicorn-39581.exe (PID: 4272)
- Unicorn-48726.exe (PID: 7664)
- Unicorn-39581.exe (PID: 6740)
- Unicorn-33194.exe (PID: 5504)
- Unicorn-48726.exe (PID: 4220)
- Unicorn-21761.exe (PID: 6112)
- Unicorn-62131.exe (PID: 7304)
- Unicorn-32696.exe (PID: 896)
- Unicorn-48396.exe (PID: 7328)
- Unicorn-55394.exe (PID: 7964)
- Unicorn-46479.exe (PID: 7932)
- Unicorn-6790.exe (PID: 7788)
- Unicorn-5700.exe (PID: 7764)
- Unicorn-55891.exe (PID: 7768)
- Unicorn-62021.exe (PID: 7776)
- Unicorn-34803.exe (PID: 7924)
- Unicorn-53177.exe (PID: 5868)
- Unicorn-2724.exe (PID: 7312)
- Unicorn-5228.exe (PID: 7468)
- Unicorn-31487.exe (PID: 8224)
- Unicorn-36509.exe (PID: 7416)
- Unicorn-9094.exe (PID: 8336)
- Unicorn-9073.exe (PID: 8380)
- Unicorn-33716.exe (PID: 8244)
- Unicorn-30200.exe (PID: 8484)
- Unicorn-51222.exe (PID: 8532)
- Unicorn-50667.exe (PID: 8556)
- Unicorn-41046.exe (PID: 8604)
- Unicorn-45742.exe (PID: 8584)
- Unicorn-15041.exe (PID: 8644)
- Unicorn-6245.exe (PID: 8716)
- Unicorn-55519.exe (PID: 8672)
- Unicorn-28860.exe (PID: 616)
- Unicorn-48726.exe (PID: 6644)
- Unicorn-38607.exe (PID: 8740)
- Unicorn-29676.exe (PID: 8732)
- Unicorn-18379.exe (PID: 8788)
- Unicorn-23017.exe (PID: 8764)
- Unicorn-18379.exe (PID: 8796)
- Unicorn-60926.exe (PID: 8872)
- Unicorn-30522.exe (PID: 8828)
- Unicorn-42966.exe (PID: 8848)
- Unicorn-7086.exe (PID: 8896)
- Unicorn-11917.exe (PID: 8912)
- Unicorn-31783.exe (PID: 8920)
- Unicorn-65202.exe (PID: 9000)
- Unicorn-19531.exe (PID: 9012)
- Unicorn-19531.exe (PID: 9008)
- Unicorn-18955.exe (PID: 9124)
- Unicorn-32359.exe (PID: 8272)
- Unicorn-24007.exe (PID: 9080)
- Unicorn-45497.exe (PID: 9056)
- Unicorn-64263.exe (PID: 9184)
- Unicorn-18955.exe (PID: 9132)
- Unicorn-35483.exe (PID: 9156)
- Unicorn-43651.exe (PID: 9176)
- Unicorn-49442.exe (PID: 7972)
- Unicorn-31290.exe (PID: 8016)
- Unicorn-55009.exe (PID: 8292)
- Unicorn-764.exe (PID: 8240)
- Unicorn-6894.exe (PID: 6944)
- Unicorn-39957.exe (PID: 8668)
- Unicorn-29021.exe (PID: 7884)
- Unicorn-19841.exe (PID: 8512)
- Unicorn-10796.exe (PID: 8636)
- Unicorn-33105.exe (PID: 7852)
- Unicorn-65415.exe (PID: 7748)
- Unicorn-55201.exe (PID: 9052)
- Unicorn-59794.exe (PID: 9236)
- Unicorn-34196.exe (PID: 9292)
- Unicorn-41487.exe (PID: 9320)
- Unicorn-33297.exe (PID: 9364)
- Unicorn-5041.exe (PID: 9600)
- Unicorn-45187.exe (PID: 9504)
- Unicorn-41103.exe (PID: 9520)
- Unicorn-21237.exe (PID: 9480)
- Unicorn-57631.exe (PID: 9512)
- Unicorn-44995.exe (PID: 9392)
- Unicorn-30365.exe (PID: 9608)
- Unicorn-31848.exe (PID: 9560)
- Unicorn-29811.exe (PID: 9576)
- Unicorn-45882.exe (PID: 9592)
- Unicorn-10137.exe (PID: 9676)
- Unicorn-1414.exe (PID: 9704)
- Unicorn-31761.exe (PID: 9064)
- Unicorn-39375.exe (PID: 9072)
- Unicorn-35549.exe (PID: 9756)
- Unicorn-53355.exe (PID: 9460)
- Unicorn-29427.exe (PID: 9748)
- Unicorn-14797.exe (PID: 9844)
- Unicorn-10905.exe (PID: 9884)
- Unicorn-65327.exe (PID: 10132)
- Unicorn-40823.exe (PID: 10152)
- Unicorn-44886.exe (PID: 10076)
- Unicorn-33039.exe (PID: 10104)
- Unicorn-22908.exe (PID: 9208)
- Unicorn-45654.exe (PID: 10176)
- Unicorn-50890.exe (PID: 10220)
- Unicorn-33231.exe (PID: 9224)
- Unicorn-42286.exe (PID: 4268)
- Unicorn-43489.exe (PID: 9728)
- Unicorn-28444.exe (PID: 9656)
- Unicorn-23488.exe (PID: 9780)
- Unicorn-1990.exe (PID: 9860)
- Unicorn-62794.exe (PID: 9936)
- Unicorn-1170.exe (PID: 8172)
- Unicorn-60371.exe (PID: 8856)
- Unicorn-39597.exe (PID: 9816)
- Unicorn-54803.exe (PID: 3032)
- Unicorn-62971.exe (PID: 9824)
- Unicorn-13142.exe (PID: 10380)
- Unicorn-17860.exe (PID: 10060)
- Unicorn-31015.exe (PID: 8688)
- Unicorn-4953.exe (PID: 10432)
- Unicorn-64050.exe (PID: 4172)
- Unicorn-3054.exe (PID: 1600)
- Unicorn-19836.exe (PID: 10264)
- Unicorn-293.exe (PID: 8976)
- Unicorn-40387.exe (PID: 5232)
- Unicorn-13142.exe (PID: 10388)
- Unicorn-54154.exe (PID: 10472)
- Unicorn-27895.exe (PID: 10336)
- Unicorn-60907.exe (PID: 7452)
- Unicorn-38341.exe (PID: 4424)
- Unicorn-7012.exe (PID: 10372)
- Unicorn-9229.exe (PID: 10484)
- Unicorn-28524.exe (PID: 10312)
- Unicorn-22295.exe (PID: 10328)
- Unicorn-22964.exe (PID: 10492)
Executes application which crashes
- Unicorn-47033.exe (PID: 9356)
INFO
Reads the computer name
- 1 (177).exe (PID: 5048)
- Unicorn-27862.exe (PID: 6564)
- Unicorn-3039.exe (PID: 5972)
- Unicorn-50778.exe (PID: 5968)
- Unicorn-32500.exe (PID: 5384)
- Unicorn-50778.exe (PID: 2096)
- Unicorn-54841.exe (PID: 6800)
- Unicorn-41370.exe (PID: 5984)
- Unicorn-20627.exe (PID: 1328)
- Unicorn-45454.exe (PID: 2320)
- Unicorn-39516.exe (PID: 6388)
- Unicorn-8697.exe (PID: 2384)
- Unicorn-54369.exe (PID: 5280)
- Unicorn-8697.exe (PID: 1164)
- Unicorn-45381.exe (PID: 2904)
- Unicorn-40166.exe (PID: 4336)
- Unicorn-93.exe (PID: 644)
- Unicorn-24790.exe (PID: 6816)
- Unicorn-18659.exe (PID: 780)
- Unicorn-4924.exe (PID: 536)
- Unicorn-39673.exe (PID: 7260)
- Unicorn-41318.exe (PID: 7252)
- Unicorn-36393.exe (PID: 7336)
- Unicorn-41318.exe (PID: 7244)
- Unicorn-27727.exe (PID: 7320)
- Unicorn-62131.exe (PID: 7304)
- Unicorn-48396.exe (PID: 7340)
- Unicorn-2724.exe (PID: 7312)
- Unicorn-47190.exe (PID: 7752)
- Unicorn-28393.exe (PID: 7844)
- Unicorn-7418.exe (PID: 7856)
- Unicorn-46759.exe (PID: 7896)
- Unicorn-36775.exe (PID: 7976)
- Unicorn-49774.exe (PID: 8008)
- Unicorn-16355.exe (PID: 8040)
- Unicorn-58155.exe (PID: 8064)
- Unicorn-9146.exe (PID: 8088)
- Unicorn-41435.exe (PID: 7484)
- Unicorn-11184.exe (PID: 8116)
- Unicorn-41746.exe (PID: 8144)
- Unicorn-25675.exe (PID: 8188)
- Unicorn-1170.exe (PID: 8172)
- Unicorn-49603.exe (PID: 7536)
- Unicorn-12846.exe (PID: 6080)
- Unicorn-48726.exe (PID: 4008)
- Unicorn-21569.exe (PID: 7428)
- Unicorn-25845.exe (PID: 2040)
- Unicorn-45519.exe (PID: 7516)
- Unicorn-47941.exe (PID: 8052)
- Unicorn-21761.exe (PID: 6112)
- Unicorn-28860.exe (PID: 616)
- Unicorn-39581.exe (PID: 6740)
- Unicorn-39581.exe (PID: 4272)
- Unicorn-48726.exe (PID: 7664)
- Unicorn-33194.exe (PID: 5504)
- Unicorn-32696.exe (PID: 896)
- Unicorn-55394.exe (PID: 7964)
- Unicorn-6790.exe (PID: 7788)
- Unicorn-5700.exe (PID: 7764)
- Unicorn-46479.exe (PID: 7932)
- Unicorn-34803.exe (PID: 7924)
- Unicorn-53177.exe (PID: 5868)
- Unicorn-62021.exe (PID: 7776)
- Unicorn-55891.exe (PID: 7768)
- Unicorn-36509.exe (PID: 7416)
- Unicorn-5228.exe (PID: 7468)
- Unicorn-31487.exe (PID: 8224)
- Unicorn-33716.exe (PID: 8244)
- Unicorn-51222.exe (PID: 8532)
- Unicorn-30200.exe (PID: 8484)
- Unicorn-9094.exe (PID: 8336)
- Unicorn-9073.exe (PID: 8380)
- Unicorn-45742.exe (PID: 8584)
- Unicorn-41046.exe (PID: 8604)
- Unicorn-55519.exe (PID: 8672)
- Unicorn-6245.exe (PID: 8716)
- Unicorn-31015.exe (PID: 8688)
- Unicorn-38607.exe (PID: 8740)
- Unicorn-23017.exe (PID: 8764)
- Unicorn-29676.exe (PID: 8732)
- Unicorn-18379.exe (PID: 8788)
- Unicorn-18379.exe (PID: 8796)
- Unicorn-60926.exe (PID: 8872)
- Unicorn-42966.exe (PID: 8848)
- Unicorn-7086.exe (PID: 8896)
- Unicorn-30522.exe (PID: 8828)
- Unicorn-19531.exe (PID: 9012)
- Unicorn-18955.exe (PID: 9124)
- Unicorn-19531.exe (PID: 9008)
- Unicorn-31761.exe (PID: 9064)
- Unicorn-24007.exe (PID: 9080)
- Unicorn-39375.exe (PID: 9072)
- Unicorn-45497.exe (PID: 9056)
- Unicorn-65202.exe (PID: 9000)
- Unicorn-32359.exe (PID: 8272)
- Unicorn-35483.exe (PID: 9156)
- Unicorn-64263.exe (PID: 9184)
- Unicorn-22908.exe (PID: 9208)
- Unicorn-43651.exe (PID: 9176)
- Unicorn-60907.exe (PID: 7452)
- Unicorn-764.exe (PID: 8240)
- Unicorn-31290.exe (PID: 8016)
- Unicorn-19841.exe (PID: 8512)
- Unicorn-55009.exe (PID: 8292)
- Unicorn-29021.exe (PID: 7884)
- Unicorn-10796.exe (PID: 8636)
- Unicorn-39957.exe (PID: 8668)
- Unicorn-33105.exe (PID: 7852)
- Unicorn-55201.exe (PID: 9052)
- Unicorn-59794.exe (PID: 9236)
- Unicorn-41487.exe (PID: 9320)
- Unicorn-53355.exe (PID: 9460)
- Unicorn-34196.exe (PID: 9292)
- Unicorn-44995.exe (PID: 9392)
- Unicorn-21237.exe (PID: 9480)
- Unicorn-57631.exe (PID: 9512)
The sample compiled with chinese language support
- 1 (177).exe (PID: 5048)
- Unicorn-27862.exe (PID: 6564)
- Unicorn-32610.exe (PID: 4620)
- Unicorn-50778.exe (PID: 2096)
- Unicorn-50778.exe (PID: 5968)
- Unicorn-32500.exe (PID: 5384)
- Unicorn-54841.exe (PID: 6800)
- Unicorn-45454.exe (PID: 2320)
- Unicorn-20627.exe (PID: 1328)
- Unicorn-41370.exe (PID: 5984)
- Unicorn-39516.exe (PID: 6388)
- Unicorn-8697.exe (PID: 1164)
- Unicorn-45381.exe (PID: 2904)
- Unicorn-3039.exe (PID: 5972)
- Unicorn-40166.exe (PID: 4336)
- Unicorn-93.exe (PID: 644)
- Unicorn-24790.exe (PID: 6816)
- Unicorn-37788.exe (PID: 7196)
- Unicorn-4924.exe (PID: 536)
- Unicorn-18659.exe (PID: 780)
- Unicorn-39673.exe (PID: 7260)
- Unicorn-41318.exe (PID: 7252)
- Unicorn-41318.exe (PID: 7236)
- Unicorn-41318.exe (PID: 7244)
- Unicorn-36393.exe (PID: 7336)
- Unicorn-27727.exe (PID: 7320)
- Unicorn-8697.exe (PID: 2384)
- Unicorn-48396.exe (PID: 7340)
- Unicorn-54369.exe (PID: 5280)
- Unicorn-47190.exe (PID: 7752)
- Unicorn-28393.exe (PID: 7844)
- Unicorn-7418.exe (PID: 7856)
- Unicorn-46759.exe (PID: 7896)
- Unicorn-36775.exe (PID: 7976)
- Unicorn-49774.exe (PID: 8008)
- Unicorn-16355.exe (PID: 8040)
- Unicorn-58155.exe (PID: 8064)
Checks supported languages
- 1 (177).exe (PID: 5048)
- Unicorn-27862.exe (PID: 6564)
- Unicorn-32500.exe (PID: 5384)
- Unicorn-54841.exe (PID: 6800)
- Unicorn-50778.exe (PID: 2096)
- Unicorn-50778.exe (PID: 5968)
- Unicorn-3039.exe (PID: 5972)
- Unicorn-45454.exe (PID: 2320)
- Unicorn-20627.exe (PID: 1328)
- Unicorn-41370.exe (PID: 5984)
- Unicorn-8697.exe (PID: 2384)
- Unicorn-39516.exe (PID: 6388)
- Unicorn-8697.exe (PID: 1164)
- Unicorn-54369.exe (PID: 5280)
- Unicorn-45381.exe (PID: 2904)
- Unicorn-40166.exe (PID: 4336)
- Unicorn-24790.exe (PID: 6816)
- Unicorn-93.exe (PID: 644)
- Unicorn-18659.exe (PID: 780)
- Unicorn-4924.exe (PID: 536)
- Unicorn-37788.exe (PID: 7196)
- Unicorn-41318.exe (PID: 7252)
- Unicorn-41318.exe (PID: 7236)
- Unicorn-39673.exe (PID: 7260)
- Unicorn-27727.exe (PID: 7320)
- Unicorn-2724.exe (PID: 7312)
- Unicorn-41318.exe (PID: 7244)
- Unicorn-62131.exe (PID: 7304)
- Unicorn-48396.exe (PID: 7340)
- Unicorn-47190.exe (PID: 7752)
- Unicorn-7418.exe (PID: 7856)
- Unicorn-28393.exe (PID: 7844)
- Unicorn-49774.exe (PID: 8008)
- Unicorn-36775.exe (PID: 7976)
- Unicorn-11184.exe (PID: 8116)
- Unicorn-16355.exe (PID: 8040)
- Unicorn-47941.exe (PID: 8052)
- Unicorn-9146.exe (PID: 8088)
- Unicorn-41746.exe (PID: 8144)
- Unicorn-49603.exe (PID: 7536)
- Unicorn-1170.exe (PID: 8172)
- Unicorn-29737.exe (PID: 7524)
- Unicorn-21761.exe (PID: 6112)
- Unicorn-12846.exe (PID: 6080)
- Unicorn-48726.exe (PID: 4008)
- Unicorn-48726.exe (PID: 4220)
- Unicorn-48726.exe (PID: 6644)
- Unicorn-45519.exe (PID: 7516)
- Unicorn-7993.exe (PID: 5720)
- Unicorn-25845.exe (PID: 2040)
- Unicorn-33194.exe (PID: 5504)
- Unicorn-6790.exe (PID: 7788)
- Unicorn-39581.exe (PID: 6740)
- Unicorn-32696.exe (PID: 896)
- Unicorn-46479.exe (PID: 7932)
- Unicorn-55891.exe (PID: 7768)
- Unicorn-62021.exe (PID: 7776)
- Unicorn-5700.exe (PID: 7764)
- Unicorn-34803.exe (PID: 7924)
- Unicorn-53177.exe (PID: 5868)
- Unicorn-5228.exe (PID: 7468)
- Unicorn-36509.exe (PID: 7416)
- Unicorn-33716.exe (PID: 8244)
- Unicorn-30200.exe (PID: 8484)
- Unicorn-51222.exe (PID: 8532)
- Unicorn-50667.exe (PID: 8556)
- Unicorn-45742.exe (PID: 8584)
- Unicorn-55519.exe (PID: 8672)
- Unicorn-31015.exe (PID: 8688)
- Unicorn-6245.exe (PID: 8716)
- Unicorn-29676.exe (PID: 8732)
- Unicorn-38607.exe (PID: 8740)
- Unicorn-23017.exe (PID: 8764)
- Unicorn-15041.exe (PID: 8644)
- Unicorn-30522.exe (PID: 8828)
- Unicorn-18379.exe (PID: 8796)
- Unicorn-18379.exe (PID: 8788)
- Unicorn-42966.exe (PID: 8848)
- Unicorn-60371.exe (PID: 8856)
- Unicorn-7086.exe (PID: 8896)
- Unicorn-31783.exe (PID: 8920)
- Unicorn-19531.exe (PID: 9012)
- Unicorn-65202.exe (PID: 9000)
- Unicorn-60926.exe (PID: 8872)
- Unicorn-31761.exe (PID: 9064)
- Unicorn-39375.exe (PID: 9072)
- Unicorn-18955.exe (PID: 9124)
- Unicorn-35483.exe (PID: 9156)
- Unicorn-45497.exe (PID: 9056)
- Unicorn-24007.exe (PID: 9080)
- Unicorn-43651.exe (PID: 9176)
- Unicorn-64263.exe (PID: 9184)
- Unicorn-22908.exe (PID: 9208)
- Unicorn-6894.exe (PID: 6944)
- Unicorn-32359.exe (PID: 8272)
- Unicorn-764.exe (PID: 8240)
- Unicorn-60907.exe (PID: 7452)
- Unicorn-49442.exe (PID: 7972)
- Unicorn-55009.exe (PID: 8292)
- Unicorn-10796.exe (PID: 8636)
- Unicorn-33105.exe (PID: 7852)
- Unicorn-29021.exe (PID: 7884)
- Unicorn-31290.exe (PID: 8016)
- Unicorn-34196.exe (PID: 9292)
- Unicorn-47033.exe (PID: 9356)
- Unicorn-44995.exe (PID: 9392)
- Unicorn-65415.exe (PID: 7748)
- Unicorn-39957.exe (PID: 8668)
- Unicorn-55201.exe (PID: 9052)
- Unicorn-59794.exe (PID: 9236)
- Unicorn-21237.exe (PID: 9480)
- Unicorn-53355.exe (PID: 9460)
- Unicorn-41103.exe (PID: 9520)
- Unicorn-57631.exe (PID: 9512)
- Unicorn-31848.exe (PID: 9560)
- Unicorn-29811.exe (PID: 9576)
- Unicorn-10137.exe (PID: 9676)
- Unicorn-30365.exe (PID: 9608)
- Unicorn-1414.exe (PID: 9704)
- Unicorn-29427.exe (PID: 9748)
- Unicorn-45882.exe (PID: 9592)
- Unicorn-5041.exe (PID: 9600)
- Unicorn-23488.exe (PID: 9780)
- Unicorn-14797.exe (PID: 9844)
- Unicorn-10905.exe (PID: 9884)
- Unicorn-44886.exe (PID: 10076)
- Unicorn-1990.exe (PID: 9860)
- Unicorn-45654.exe (PID: 10176)
- Unicorn-28444.exe (PID: 9656)
- Unicorn-33231.exe (PID: 9224)
- Unicorn-25063.exe (PID: 10232)
- Unicorn-42286.exe (PID: 4268)
- Unicorn-50890.exe (PID: 10220)
- Unicorn-43489.exe (PID: 9728)
- Unicorn-62971.exe (PID: 9824)
- Unicorn-39597.exe (PID: 9816)
- Unicorn-17860.exe (PID: 10060)
- Unicorn-64050.exe (PID: 4172)
- Unicorn-3054.exe (PID: 1600)
- Unicorn-54803.exe (PID: 3032)
- Unicorn-38341.exe (PID: 4424)
- Unicorn-40387.exe (PID: 5232)
- Unicorn-293.exe (PID: 8976)
- Unicorn-19836.exe (PID: 10264)
- Unicorn-28524.exe (PID: 10312)
- Unicorn-22295.exe (PID: 10328)
- Unicorn-27895.exe (PID: 10336)
- Unicorn-7012.exe (PID: 10372)
- Unicorn-4953.exe (PID: 10432)
- Unicorn-4953.exe (PID: 10424)
- Unicorn-54154.exe (PID: 10472)
- Unicorn-45986.exe (PID: 10456)
- Unicorn-22964.exe (PID: 10492)
- Unicorn-18880.exe (PID: 10540)
- Unicorn-9229.exe (PID: 10484)
- Unicorn-13313.exe (PID: 10524)
- Unicorn-21481.exe (PID: 10560)
- Unicorn-13142.exe (PID: 10388)
- Unicorn-13142.exe (PID: 10380)
- Unicorn-23474.exe (PID: 10616)
- Unicorn-36333.exe (PID: 10656)
- Unicorn-22597.exe (PID: 10696)
- Unicorn-37210.exe (PID: 10632)
- Unicorn-42198.exe (PID: 10688)
- Unicorn-9214.exe (PID: 10852)
- Unicorn-40194.exe (PID: 10756)
- Unicorn-30957.exe (PID: 10736)
- Unicorn-52861.exe (PID: 10784)
- Unicorn-10345.exe (PID: 10744)
- Unicorn-47294.exe (PID: 10772)
- Unicorn-23474.exe (PID: 10624)
- Unicorn-62618.exe (PID: 10708)
- Unicorn-53180.exe (PID: 10956)
- Unicorn-4560.exe (PID: 10988)
- Unicorn-11444.exe (PID: 10972)
- Unicorn-48393.exe (PID: 11032)
- Unicorn-54523.exe (PID: 11040)
- Unicorn-52477.exe (PID: 11068)
- Unicorn-45593.exe (PID: 11024)
- Unicorn-33141.exe (PID: 11060)
- Unicorn-64206.exe (PID: 11088)
- Unicorn-2158.exe (PID: 11144)
- Unicorn-31258.exe (PID: 10892)
- Unicorn-50802.exe (PID: 10940)
- Unicorn-31258.exe (PID: 10876)
- Unicorn-17309.exe (PID: 10964)
- Unicorn-14066.exe (PID: 11164)
- Unicorn-2561.exe (PID: 11184)
- Unicorn-15218.exe (PID: 11228)
- Unicorn-51762.exe (PID: 11200)
- Unicorn-63350.exe (PID: 11216)
- Unicorn-11881.exe (PID: 456)
- Unicorn-54205.exe (PID: 5452)
- Unicorn-56422.exe (PID: 5164)
- Unicorn-31917.exe (PID: 11296)
- Unicorn-27585.exe (PID: 11320)
- Unicorn-27585.exe (PID: 11328)
- Unicorn-205.exe (PID: 11376)
- Unicorn-25232.exe (PID: 11352)
- Unicorn-1880.exe (PID: 11400)
- Unicorn-36827.exe (PID: 11416)
- Unicorn-36023.exe (PID: 11448)
- Unicorn-56422.exe (PID: 4040)
- Unicorn-54397.exe (PID: 4488)
- Unicorn-51518.exe (PID: 11288)
- Unicorn-14049.exe (PID: 11368)
- Unicorn-20433.exe (PID: 11512)
- Unicorn-14708.exe (PID: 11548)
- Unicorn-17226.exe (PID: 11424)
- Unicorn-23506.exe (PID: 11432)
- Unicorn-42337.exe (PID: 11480)
- Unicorn-20268.exe (PID: 11604)
- Unicorn-28815.exe (PID: 11656)
- Unicorn-45343.exe (PID: 11664)
- Unicorn-12862.exe (PID: 11572)
- Unicorn-12862.exe (PID: 11580)
- Unicorn-49811.exe (PID: 11612)
- Unicorn-55431.exe (PID: 11868)
- Unicorn-54471.exe (PID: 11716)
- Unicorn-43873.exe (PID: 11808)
- Unicorn-21991.exe (PID: 11888)
- Unicorn-17907.exe (PID: 11896)
- Unicorn-32196.exe (PID: 11904)
- Unicorn-46687.exe (PID: 11940)
- Unicorn-22183.exe (PID: 11956)
- Unicorn-22183.exe (PID: 11980)
- Unicorn-34112.exe (PID: 12020)
- Unicorn-42603.exe (PID: 11964)
- Unicorn-46879.exe (PID: 12000)
- Unicorn-23889.exe (PID: 12068)
- Unicorn-15559.exe (PID: 12116)
- Unicorn-2338.exe (PID: 12140)
- Unicorn-19229.exe (PID: 12104)
- Unicorn-6614.exe (PID: 12176)
- Unicorn-40957.exe (PID: 12232)
- Unicorn-54693.exe (PID: 12216)
- Unicorn-44679.exe (PID: 12264)
- Unicorn-32235.exe (PID: 12272)
- Unicorn-21882.exe (PID: 12160)
- Unicorn-40957.exe (PID: 12224)
- Unicorn-43341.exe (PID: 7708)
- Unicorn-11430.exe (PID: 7728)
- Unicorn-11430.exe (PID: 7732)
- Unicorn-31851.exe (PID: 7712)
- Unicorn-39946.exe (PID: 12308)
- Unicorn-19599.exe (PID: 11256)
- Unicorn-58585.exe (PID: 12340)
- Unicorn-32811.exe (PID: 12360)
- Unicorn-3838.exe (PID: 12416)
- Unicorn-57870.exe (PID: 12480)
- Unicorn-45255.exe (PID: 12372)
- Unicorn-20921.exe (PID: 12452)
- Unicorn-3136.exe (PID: 12584)
- Unicorn-9266.exe (PID: 12596)
- Unicorn-4714.exe (PID: 12652)
- Unicorn-3516.exe (PID: 12444)
- Unicorn-16283.exe (PID: 12496)
- Unicorn-54191.exe (PID: 12564)
- Unicorn-46023.exe (PID: 12544)
- Unicorn-30625.exe (PID: 12892)
- Unicorn-43475.exe (PID: 12936)
- Unicorn-18705.exe (PID: 12976)
- Unicorn-64642.exe (PID: 12968)
- Unicorn-45705.exe (PID: 13012)
- Unicorn-29303.exe (PID: 12724)
- Unicorn-28461.exe (PID: 13172)
- Unicorn-48062.exe (PID: 13188)
- Unicorn-29944.exe (PID: 13284)
- Unicorn-41128.exe (PID: 13236)
- Unicorn-25860.exe (PID: 13276)
- Unicorn-56422.exe (PID: 13328)
- Unicorn-26765.exe (PID: 13320)
- Unicorn-20899.exe (PID: 7720)
- Unicorn-4864.exe (PID: 13356)
- Unicorn-27258.exe (PID: 13464)
- Unicorn-41045.exe (PID: 13056)
- Unicorn-58658.exe (PID: 13092)
- Unicorn-59387.exe (PID: 13136)
- Unicorn-28461.exe (PID: 13176)
Create files in a temporary directory
- Unicorn-32610.exe (PID: 4620)
- 1 (177).exe (PID: 5048)
- Unicorn-27862.exe (PID: 6564)
- Unicorn-32500.exe (PID: 5384)
- Unicorn-54841.exe (PID: 6800)
- Unicorn-50778.exe (PID: 5968)
- Unicorn-50778.exe (PID: 2096)
- Unicorn-20627.exe (PID: 1328)
- Unicorn-41370.exe (PID: 5984)
- Unicorn-54369.exe (PID: 5280)
- Unicorn-3039.exe (PID: 5972)
- Unicorn-8697.exe (PID: 1164)
- Unicorn-45381.exe (PID: 2904)
- Unicorn-40166.exe (PID: 4336)
- Unicorn-93.exe (PID: 644)
- Unicorn-45454.exe (PID: 2320)
- Unicorn-37788.exe (PID: 7196)
- Unicorn-18659.exe (PID: 780)
- Unicorn-39673.exe (PID: 7260)
- Unicorn-41318.exe (PID: 7236)
- Unicorn-48396.exe (PID: 7340)
- Unicorn-47190.exe (PID: 7752)
- Unicorn-28393.exe (PID: 7844)
- Unicorn-7418.exe (PID: 7856)
- Unicorn-36775.exe (PID: 7976)
- Unicorn-24790.exe (PID: 6816)
- Unicorn-4924.exe (PID: 536)
- Unicorn-47941.exe (PID: 8052)
- Unicorn-9146.exe (PID: 8088)
- Unicorn-11184.exe (PID: 8116)
- Unicorn-41318.exe (PID: 7252)
- Unicorn-12846.exe (PID: 6080)
- Unicorn-49603.exe (PID: 7536)
- Unicorn-21569.exe (PID: 7428)
- Unicorn-45519.exe (PID: 7516)
- Unicorn-36393.exe (PID: 7336)
- Unicorn-25845.exe (PID: 2040)
- Unicorn-48726.exe (PID: 7664)
- Unicorn-7993.exe (PID: 5720)
- Unicorn-39581.exe (PID: 6740)
- Unicorn-39581.exe (PID: 4272)
- Unicorn-33194.exe (PID: 5504)
- Unicorn-8697.exe (PID: 2384)
- Unicorn-48726.exe (PID: 4220)
- Unicorn-21761.exe (PID: 6112)
- Unicorn-41318.exe (PID: 7244)
- Unicorn-39516.exe (PID: 6388)
- Unicorn-62131.exe (PID: 7304)
- Unicorn-48396.exe (PID: 7328)
- Unicorn-32696.exe (PID: 896)
- Unicorn-27727.exe (PID: 7320)
- Unicorn-55394.exe (PID: 7964)
- Unicorn-6790.exe (PID: 7788)
- Unicorn-5700.exe (PID: 7764)
- Unicorn-53177.exe (PID: 5868)
- Unicorn-62021.exe (PID: 7776)
- Unicorn-34803.exe (PID: 7924)
- Unicorn-55891.exe (PID: 7768)
- Unicorn-36509.exe (PID: 7416)
- Unicorn-2724.exe (PID: 7312)
- Unicorn-31487.exe (PID: 8224)
- Unicorn-46759.exe (PID: 7896)
- Unicorn-9073.exe (PID: 8380)
- Unicorn-49774.exe (PID: 8008)
- Unicorn-33716.exe (PID: 8244)
- Unicorn-58155.exe (PID: 8064)
- Unicorn-16355.exe (PID: 8040)
- Unicorn-50667.exe (PID: 8556)
- Unicorn-51222.exe (PID: 8532)
- Unicorn-15041.exe (PID: 8644)
- Unicorn-45742.exe (PID: 8584)
- Unicorn-41746.exe (PID: 8144)
- Unicorn-25675.exe (PID: 8188)
- Unicorn-6245.exe (PID: 8716)
- Unicorn-48726.exe (PID: 4008)
- Unicorn-29737.exe (PID: 7524)
- Unicorn-41435.exe (PID: 7484)
- Unicorn-48726.exe (PID: 6644)
- Unicorn-23017.exe (PID: 8764)
- Unicorn-18379.exe (PID: 8796)
- Unicorn-46479.exe (PID: 7932)
- Unicorn-5228.exe (PID: 7468)
- Unicorn-60926.exe (PID: 8872)
- Unicorn-30522.exe (PID: 8828)
- Unicorn-7086.exe (PID: 8896)
- Unicorn-11917.exe (PID: 8912)
- Unicorn-31783.exe (PID: 8920)
- Unicorn-42966.exe (PID: 8848)
- Unicorn-19531.exe (PID: 9008)
- Unicorn-19531.exe (PID: 9012)
- Unicorn-24007.exe (PID: 9080)
- Unicorn-45497.exe (PID: 9056)
- Unicorn-32359.exe (PID: 8272)
- Unicorn-9094.exe (PID: 8336)
- Unicorn-64263.exe (PID: 9184)
- Unicorn-43651.exe (PID: 9176)
- Unicorn-49442.exe (PID: 7972)
- Unicorn-764.exe (PID: 8240)
- Unicorn-31290.exe (PID: 8016)
- Unicorn-18955.exe (PID: 9124)
- Unicorn-29021.exe (PID: 7884)
- Unicorn-39957.exe (PID: 8668)
- Unicorn-33105.exe (PID: 7852)
- Unicorn-65415.exe (PID: 7748)
- Unicorn-10796.exe (PID: 8636)
- Unicorn-59794.exe (PID: 9236)
- Unicorn-55519.exe (PID: 8672)
- Unicorn-55201.exe (PID: 9052)
- Unicorn-28860.exe (PID: 616)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 4220)
- BackgroundTransferHost.exe (PID: 7584)
- BackgroundTransferHost.exe (PID: 8960)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 7584)
- WerFault.exe (PID: 9764)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 7584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
473
Monitored processes
339
Malicious processes
56
Suspicious processes
32
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 456 | C:\Users\admin\AppData\Local\Temp\Unicorn-11881.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-11881.exe | — | Unicorn-6790.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 536 | C:\Users\admin\AppData\Local\Temp\Unicorn-4924.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-4924.exe | Unicorn-50778.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 616 | C:\Users\admin\AppData\Local\Temp\Unicorn-28860.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-28860.exe | Unicorn-8697.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 644 | C:\Users\admin\AppData\Local\Temp\Unicorn-93.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-93.exe | Unicorn-20627.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 660 | C:\Users\admin\AppData\Local\Temp\Unicorn-40661.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-40661.exe | — | Unicorn-5700.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 780 | C:\Users\admin\AppData\Local\Temp\Unicorn-18659.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-18659.exe | Unicorn-32500.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 896 | C:\Users\admin\AppData\Local\Temp\Unicorn-32696.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-32696.exe | Unicorn-32610.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1164 | C:\Users\admin\AppData\Local\Temp\Unicorn-8697.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8697.exe | Unicorn-3039.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1328 | C:\Users\admin\AppData\Local\Temp\Unicorn-20627.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20627.exe | Unicorn-32500.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1600 | C:\Users\admin\AppData\Local\Temp\Unicorn-3054.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3054.exe | Unicorn-15041.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
10 025
Read events
10 010
Write events
15
Delete events
0
Modification events
| (PID) Process: | (4220) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4220) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4220) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7584) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7584) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7584) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7776) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7776) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7776) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7748) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
930
Suspicious files
8
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5048 | 1 (177).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-32500.exe | executable | |
MD5:AF5D957C3C9B24346DF80639A73242AD | SHA256:00BD8B9EB36A48D0A795B406F918AB71E67CED84A96A1AF9317C384DD30B34EB | |||
| 4620 | Unicorn-32610.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-39516.exe | executable | |
MD5:E76E0FE03AD67EA833F769600EC66A7C | SHA256:FC04469601223F9B76304CF08722B234C9BC6C0320E2EB23BFFC445FAB22A5C1 | |||
| 4620 | Unicorn-32610.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-54841.exe | executable | |
MD5:6F53576E53CC68BDA458D42FBB85EF61 | SHA256:FB1A891898A47715AA4C1CAB593527AAA01E3223AF3623AD500192EEE22C84E3 | |||
| 4620 | Unicorn-32610.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-27862.exe | executable | |
MD5:2D13CCB14FDE50715E49C8C564DC0931 | SHA256:1B4B2F3F21E3B1373B101556F582D21F57D8991BEC0FD0EB93E7AE6C48621F69 | |||
| 5968 | Unicorn-50778.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-45454.exe | executable | |
MD5:270E621353A39388B7633CCC9FF2B347 | SHA256:DDA38217A58E776A0971C307CF0B33C8D56208F6CDE22219CE3AAE9A9D3E6ADD | |||
| 2096 | Unicorn-50778.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-41370.exe | executable | |
MD5:0810A1DEB0E287A9D3352B2B077F8ED3 | SHA256:E4EB6B4438C3A7F00B4A553B3CF29B4CF6D53A94D69EB60B23559E5B8F4509E5 | |||
| 5048 | 1 (177).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3039.exe | executable | |
MD5:1016C5B4621B20BD9167B55C640A350B | SHA256:3A1EBB7B030830906B3962622815AD424E8B0A330BD621D6769040D41204C1A5 | |||
| 5384 | Unicorn-32500.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20627.exe | executable | |
MD5:43803AEBC4E634427FD5D72945845CD0 | SHA256:7A8F387861CC1F9AE28C28C0D1B74C277058B4CD01505C6460889DEE13C51ECF | |||
| 6564 | Unicorn-27862.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-54369.exe | executable | |
MD5:15E411F9881249E6E6F1E6CA453ADF5E | SHA256:5F955ADC7975BA0BF180918B6B6F7563BAB32473FDF2372F64DC5F62B77AF23A | |||
| 7584 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8529d792-856e-4910-afee-c72297022218.down_data | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
18
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.19.11.120:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
7584 | BackgroundTransferHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
4164 | backgroundTaskHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7948 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7948 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.19.11.120:80 | crl.microsoft.com | Elisa Oyj | NL | whitelisted |
3216 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 40.126.31.129:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
4164 | backgroundTaskHost.exe | 20.199.58.43:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
4164 | backgroundTaskHost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
7584 | BackgroundTransferHost.exe | 92.123.104.19:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |