| File name: | 1 (156) |
| Full analysis: | https://app.any.run/tasks/36105127-c2cc-404a-9273-4cd5c39fba00 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 17:10:28 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | 3D546D5A9C69378B59BB1B74D953FD40 |
| SHA1: | 72C79E59ACC4A3616002282F2F03A9807D6E3B78 |
| SHA256: | E5038CC91BD467E78452FE4E06E7D8C847A164BC3F78FD8B7B36903E5C991BD2 |
| SSDEEP: | 6144:p7KP27I3lDJHA5l2Suevjofx/tBqlvJGBV/xyeO92k/8SwjwpyAvEhqEfDD0/m9a:p++M/HA5sSBoBMhaVJyeO9Sx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- Unicorn-62470.exe (PID: 1056)
- 1 (156).exe (PID: 4380)
- Unicorn-38843.exe (PID: 1676)
- Unicorn-33135.exe (PID: 5640)
- Unicorn-39501.exe (PID: 4932)
- Unicorn-63451.exe (PID: 3888)
- Unicorn-36901.exe (PID: 6388)
- Unicorn-51090.exe (PID: 4040)
- Unicorn-10166.exe (PID: 6272)
- Unicorn-39859.exe (PID: 6132)
- Unicorn-25107.exe (PID: 2692)
- Unicorn-46186.exe (PID: 2504)
- Unicorn-7509.exe (PID: 6972)
- Unicorn-64825.exe (PID: 664)
- Unicorn-33275.exe (PID: 516)
- Unicorn-42367.exe (PID: 6572)
- Unicorn-32973.exe (PID: 6964)
- Unicorn-36503.exe (PID: 1912)
- Unicorn-65091.exe (PID: 5048)
- Unicorn-15699.exe (PID: 4068)
- Unicorn-24059.exe (PID: 2552)
- Unicorn-16445.exe (PID: 1012)
- Unicorn-55662.exe (PID: 5400)
- Unicorn-49258.exe (PID: 5964)
- Unicorn-53607.exe (PID: 5164)
- Unicorn-9237.exe (PID: 856)
- Unicorn-40593.exe (PID: 6080)
- Unicorn-49523.exe (PID: 2040)
- Unicorn-22012.exe (PID: 1096)
- Unicorn-38807.exe (PID: 1228)
- Unicorn-64058.exe (PID: 2092)
- Unicorn-64965.exe (PID: 6108)
- Unicorn-26747.exe (PID: 1300)
- Unicorn-55314.exe (PID: 6876)
- Unicorn-18579.exe (PID: 3896)
- Unicorn-6710.exe (PID: 7216)
- Unicorn-36311.exe (PID: 5436)
- Unicorn-31599.exe (PID: 7240)
- Unicorn-35107.exe (PID: 7256)
- Unicorn-23409.exe (PID: 7264)
- Unicorn-30452.exe (PID: 7312)
- Unicorn-47551.exe (PID: 7288)
- Unicorn-17405.exe (PID: 5392)
- Unicorn-40861.exe (PID: 7324)
- Unicorn-213.exe (PID: 7380)
- Unicorn-18224.exe (PID: 7584)
- Unicorn-65003.exe (PID: 7344)
- Unicorn-55719.exe (PID: 7304)
- Unicorn-41843.exe (PID: 7656)
- Unicorn-47826.exe (PID: 7424)
- Unicorn-213.exe (PID: 7388)
- Unicorn-8210.exe (PID: 7628)
- Unicorn-4297.exe (PID: 7372)
- Unicorn-29326.exe (PID: 7700)
- Unicorn-20546.exe (PID: 7756)
- Unicorn-40691.exe (PID: 7576)
- Unicorn-13948.exe (PID: 7364)
- Unicorn-35839.exe (PID: 7416)
- Unicorn-63010.exe (PID: 7716)
- Unicorn-50203.exe (PID: 7736)
- Unicorn-9341.exe (PID: 7788)
- Unicorn-17339.exe (PID: 7708)
- Unicorn-36415.exe (PID: 7352)
- Unicorn-62573.exe (PID: 7456)
- Unicorn-432.exe (PID: 7764)
- Unicorn-37183.exe (PID: 7532)
- Unicorn-25624.exe (PID: 7448)
- Unicorn-981.exe (PID: 7568)
- Unicorn-65143.exe (PID: 8300)
- Unicorn-59523.exe (PID: 8044)
- Unicorn-39414.exe (PID: 8116)
- Unicorn-45543.exe (PID: 7780)
- Unicorn-46029.exe (PID: 8716)
- Unicorn-35600.exe (PID: 8284)
- Unicorn-27619.exe (PID: 8172)
- Unicorn-54790.exe (PID: 8388)
- Unicorn-213.exe (PID: 7396)
- Unicorn-48091.exe (PID: 7440)
- Unicorn-353.exe (PID: 8336)
- Unicorn-38084.exe (PID: 7464)
- Unicorn-11282.exe (PID: 6300)
- Unicorn-54650.exe (PID: 7832)
- Unicorn-1001.exe (PID: 7892)
- Unicorn-1386.exe (PID: 7924)
- Unicorn-11666.exe (PID: 8104)
- Unicorn-41651.exe (PID: 7816)
- Unicorn-41569.exe (PID: 8452)
- Unicorn-46185.exe (PID: 8060)
- Unicorn-22361.exe (PID: 7908)
- Unicorn-13062.exe (PID: 7840)
- Unicorn-11592.exe (PID: 7916)
- Unicorn-38911.exe (PID: 8032)
- Unicorn-42715.exe (PID: 8696)
- Unicorn-44073.exe (PID: 7744)
- Unicorn-19503.exe (PID: 7432)
- Unicorn-31873.exe (PID: 8012)
- Unicorn-41141.exe (PID: 8052)
- Unicorn-26637.exe (PID: 7932)
- Unicorn-55610.exe (PID: 7864)
- Unicorn-14873.exe (PID: 8292)
- Unicorn-38158.exe (PID: 7184)
- Unicorn-46887.exe (PID: 7884)
- Unicorn-56695.exe (PID: 9044)
- Unicorn-42139.exe (PID: 8564)
- Unicorn-49430.exe (PID: 8584)
- Unicorn-34931.exe (PID: 8616)
- Unicorn-62626.exe (PID: 7808)
- Unicorn-1682.exe (PID: 8500)
- Unicorn-37540.exe (PID: 8540)
- Unicorn-3005.exe (PID: 8668)
- Unicorn-9938.exe (PID: 7872)
- Unicorn-54666.exe (PID: 8680)
- Unicorn-57141.exe (PID: 8532)
- Unicorn-566.exe (PID: 8344)
- Unicorn-15205.exe (PID: 9660)
- Unicorn-35071.exe (PID: 9668)
- Unicorn-51276.exe (PID: 8548)
- Unicorn-6024.exe (PID: 9676)
- Unicorn-20603.exe (PID: 8272)
- Unicorn-14053.exe (PID: 5304)
- Unicorn-15205.exe (PID: 9652)
- Unicorn-10706.exe (PID: 7964)
- Unicorn-51822.exe (PID: 8948)
- Unicorn-18189.exe (PID: 8556)
- Unicorn-3336.exe (PID: 8592)
- Unicorn-34111.exe (PID: 7980)
- Unicorn-60779.exe (PID: 9036)
- Unicorn-15781.exe (PID: 8976)
- Unicorn-42279.exe (PID: 7988)
- Unicorn-35050.exe (PID: 9084)
- Unicorn-30847.exe (PID: 8604)
- Unicorn-37131.exe (PID: 8408)
- Unicorn-53934.exe (PID: 9568)
- Unicorn-862.exe (PID: 9220)
- Unicorn-43763.exe (PID: 8124)
- Unicorn-21348.exe (PID: 9608)
- Unicorn-52346.exe (PID: 9028)
- Unicorn-57079.exe (PID: 9232)
- Unicorn-56674.exe (PID: 9004)
- Unicorn-43291.exe (PID: 8656)
- Unicorn-15034.exe (PID: 9520)
- Unicorn-41703.exe (PID: 6584)
- Unicorn-478.exe (PID: 9092)
- Unicorn-5413.exe (PID: 10260)
- Unicorn-13181.exe (PID: 8400)
- Unicorn-1874.exe (PID: 8728)
- Unicorn-51023.exe (PID: 10840)
- Unicorn-31645.exe (PID: 10860)
- Unicorn-60203.exe (PID: 9188)
- Unicorn-45678.exe (PID: 10132)
- Unicorn-49959.exe (PID: 8364)
- Unicorn-56311.exe (PID: 9624)
- Unicorn-5413.exe (PID: 10292)
- Unicorn-53187.exe (PID: 9240)
- Unicorn-54458.exe (PID: 7796)
- Unicorn-14192.exe (PID: 8988)
- Unicorn-47354.exe (PID: 10828)
- Unicorn-42279.exe (PID: 7960)
- Unicorn-10737.exe (PID: 8940)
- Unicorn-59466.exe (PID: 10984)
- Unicorn-52523.exe (PID: 9788)
- Unicorn-27287.exe (PID: 9512)
- Unicorn-12014.exe (PID: 11048)
- Unicorn-17264.exe (PID: 9596)
- Unicorn-42815.exe (PID: 9316)
- Unicorn-8558.exe (PID: 10012)
- Unicorn-50198.exe (PID: 12248)
- Unicorn-3184.exe (PID: 12236)
- Unicorn-55844.exe (PID: 6828)
- Unicorn-30603.exe (PID: 9340)
- Unicorn-12813.exe (PID: 10108)
- Unicorn-43255.exe (PID: 11396)
- Unicorn-17612.exe (PID: 10076)
- Unicorn-60151.exe (PID: 9552)
- Unicorn-39939.exe (PID: 11656)
- Unicorn-1276.exe (PID: 9980)
- Unicorn-36777.exe (PID: 9472)
- Unicorn-46945.exe (PID: 9480)
- Unicorn-23232.exe (PID: 10252)
- Unicorn-56415.exe (PID: 9892)
- Unicorn-32435.exe (PID: 11056)
- Unicorn-17775.exe (PID: 2320)
- Unicorn-25419.exe (PID: 11108)
- Unicorn-5413.exe (PID: 10276)
- Unicorn-50146.exe (PID: 10044)
- Unicorn-29564.exe (PID: 8576)
- Unicorn-2066.exe (PID: 9488)
- Unicorn-5448.exe (PID: 9020)
- Unicorn-28107.exe (PID: 9056)
- Unicorn-58646.exe (PID: 11004)
- Unicorn-10160.exe (PID: 13836)
- Unicorn-63439.exe (PID: 13852)
- Unicorn-64762.exe (PID: 13844)
- Unicorn-53815.exe (PID: 11040)
- Unicorn-45766.exe (PID: 9196)
- Unicorn-25227.exe (PID: 11020)
- Unicorn-6809.exe (PID: 12412)
- Unicorn-25536.exe (PID: 10796)
- Unicorn-29987.exe (PID: 9348)
- Unicorn-30816.exe (PID: 11584)
- Unicorn-37147.exe (PID: 10000)
- Unicorn-61983.exe (PID: 11200)
- Unicorn-19148.exe (PID: 10244)
- Unicorn-4209.exe (PID: 10036)
- Unicorn-24488.exe (PID: 11560)
- Unicorn-5413.exe (PID: 10300)
- Unicorn-18956.exe (PID: 10196)
- Unicorn-54562.exe (PID: 11072)
- Unicorn-17856.exe (PID: 15076)
- Unicorn-45406.exe (PID: 15048)
- Unicorn-37240.exe (PID: 8188)
- Unicorn-34524.exe (PID: 10052)
- Unicorn-61586.exe (PID: 15152)
- Unicorn-38823.exe (PID: 9504)
- Unicorn-48783.exe (PID: 10100)
- Unicorn-56119.exe (PID: 9580)
- Unicorn-20432.exe (PID: 10284)
- Unicorn-24628.exe (PID: 12436)
- Unicorn-20619.exe (PID: 9952)
- Unicorn-3877.exe (PID: 9968)
- Unicorn-40425.exe (PID: 9396)
- Unicorn-35730.exe (PID: 9920)
- Unicorn-47126.exe (PID: 11228)
- Unicorn-46577.exe (PID: 16156)
- Unicorn-61829.exe (PID: 16164)
- Unicorn-52178.exe (PID: 16172)
- Unicorn-7961.exe (PID: 9900)
- Unicorn-26535.exe (PID: 11520)
- Unicorn-49783.exe (PID: 6940)
- Unicorn-47759.exe (PID: 9456)
- Unicorn-34791.exe (PID: 10616)
- Unicorn-9194.exe (PID: 13484)
Executable content was dropped or overwritten
- Unicorn-38843.exe (PID: 1676)
- 1 (156).exe (PID: 4380)
- Unicorn-33135.exe (PID: 5640)
- Unicorn-62470.exe (PID: 1056)
- Unicorn-63451.exe (PID: 3888)
- Unicorn-36901.exe (PID: 6388)
- Unicorn-10166.exe (PID: 6272)
- Unicorn-39501.exe (PID: 4932)
- Unicorn-7509.exe (PID: 6972)
- Unicorn-51090.exe (PID: 4040)
- Unicorn-25107.exe (PID: 2692)
- Unicorn-46186.exe (PID: 2504)
- Unicorn-64825.exe (PID: 664)
- Unicorn-39859.exe (PID: 6132)
- Unicorn-42367.exe (PID: 6572)
- Unicorn-33275.exe (PID: 516)
- Unicorn-65091.exe (PID: 5048)
- Unicorn-32973.exe (PID: 6964)
- Unicorn-36503.exe (PID: 1912)
- Unicorn-15699.exe (PID: 4068)
- Unicorn-24059.exe (PID: 2552)
- Unicorn-55662.exe (PID: 5400)
- Unicorn-36311.exe (PID: 5436)
- Unicorn-49258.exe (PID: 5964)
- Unicorn-53607.exe (PID: 5164)
- Unicorn-49523.exe (PID: 2040)
- Unicorn-40593.exe (PID: 6080)
- Unicorn-22012.exe (PID: 1096)
- Unicorn-9237.exe (PID: 856)
- Unicorn-64058.exe (PID: 2092)
- Unicorn-64965.exe (PID: 6108)
- Unicorn-26747.exe (PID: 1300)
- Unicorn-55314.exe (PID: 6876)
- Unicorn-38807.exe (PID: 1228)
- Unicorn-18579.exe (PID: 3896)
- Unicorn-38158.exe (PID: 7184)
- Unicorn-6710.exe (PID: 7216)
- Unicorn-31599.exe (PID: 7240)
- Unicorn-16445.exe (PID: 1012)
- Unicorn-23409.exe (PID: 7264)
- Unicorn-30452.exe (PID: 7312)
- Unicorn-17405.exe (PID: 5392)
- Unicorn-47551.exe (PID: 7288)
- Unicorn-35107.exe (PID: 7256)
- Unicorn-55719.exe (PID: 7304)
- Unicorn-213.exe (PID: 7380)
- Unicorn-40861.exe (PID: 7324)
- Unicorn-18224.exe (PID: 7584)
- Unicorn-65003.exe (PID: 7344)
- Unicorn-213.exe (PID: 7388)
- Unicorn-8210.exe (PID: 7628)
- Unicorn-41843.exe (PID: 7656)
- Unicorn-47826.exe (PID: 7424)
- Unicorn-13948.exe (PID: 7364)
- Unicorn-4297.exe (PID: 7372)
- Unicorn-20546.exe (PID: 7756)
- Unicorn-29326.exe (PID: 7700)
- Unicorn-40691.exe (PID: 7576)
- Unicorn-35839.exe (PID: 7416)
- Unicorn-63010.exe (PID: 7716)
- Unicorn-50203.exe (PID: 7736)
- Unicorn-36415.exe (PID: 7352)
- Unicorn-17339.exe (PID: 7708)
- Unicorn-9341.exe (PID: 7788)
- Unicorn-62573.exe (PID: 7456)
- Unicorn-432.exe (PID: 7764)
- Unicorn-37183.exe (PID: 7532)
- Unicorn-11666.exe (PID: 8104)
- Unicorn-41651.exe (PID: 7816)
- Unicorn-25624.exe (PID: 7448)
- Unicorn-981.exe (PID: 7568)
- Unicorn-65143.exe (PID: 8300)
- Unicorn-59523.exe (PID: 8044)
- Unicorn-39414.exe (PID: 8116)
- Unicorn-45543.exe (PID: 7780)
- Unicorn-213.exe (PID: 7396)
- Unicorn-46029.exe (PID: 8716)
- Unicorn-1874.exe (PID: 8728)
- Unicorn-353.exe (PID: 8336)
- Unicorn-27619.exe (PID: 8172)
- Unicorn-41141.exe (PID: 8052)
- Unicorn-38084.exe (PID: 7464)
- Unicorn-54790.exe (PID: 8388)
- Unicorn-48091.exe (PID: 7440)
- Unicorn-11282.exe (PID: 6300)
- Unicorn-54650.exe (PID: 7832)
- Unicorn-46185.exe (PID: 8060)
- Unicorn-41569.exe (PID: 8452)
- Unicorn-22361.exe (PID: 7908)
- Unicorn-1001.exe (PID: 7892)
- Unicorn-10737.exe (PID: 8940)
- Unicorn-44073.exe (PID: 7744)
- Unicorn-1386.exe (PID: 7924)
- Unicorn-38911.exe (PID: 8032)
- Unicorn-11592.exe (PID: 7916)
- Unicorn-14873.exe (PID: 8292)
- Unicorn-42715.exe (PID: 8696)
- Unicorn-13062.exe (PID: 7840)
- Unicorn-31873.exe (PID: 8012)
- Unicorn-26637.exe (PID: 7932)
- Unicorn-19503.exe (PID: 7432)
- Unicorn-37131.exe (PID: 8408)
- Unicorn-49430.exe (PID: 8584)
- Unicorn-46887.exe (PID: 7884)
- Unicorn-29564.exe (PID: 8576)
- Unicorn-42139.exe (PID: 8564)
- Unicorn-56695.exe (PID: 9044)
- Unicorn-54666.exe (PID: 8680)
- Unicorn-34931.exe (PID: 8616)
- Unicorn-1682.exe (PID: 8500)
- Unicorn-37540.exe (PID: 8540)
- Unicorn-3005.exe (PID: 8668)
- Unicorn-9938.exe (PID: 7872)
- Unicorn-62626.exe (PID: 7808)
- Unicorn-57141.exe (PID: 8532)
- Unicorn-566.exe (PID: 8344)
- Unicorn-15205.exe (PID: 9652)
- Unicorn-10706.exe (PID: 7964)
- Unicorn-15205.exe (PID: 9660)
- Unicorn-35071.exe (PID: 9668)
- Unicorn-43291.exe (PID: 8656)
- Unicorn-6024.exe (PID: 9676)
- Unicorn-51276.exe (PID: 8548)
- Unicorn-20603.exe (PID: 8272)
- Unicorn-22221.exe (PID: 4448)
- Unicorn-14053.exe (PID: 5304)
- Unicorn-38439.exe (PID: 8480)
- Unicorn-51822.exe (PID: 8948)
- Unicorn-18189.exe (PID: 8556)
- Unicorn-34111.exe (PID: 7980)
- Unicorn-60779.exe (PID: 9036)
- Unicorn-42279.exe (PID: 7988)
- Unicorn-862.exe (PID: 9220)
- Unicorn-35050.exe (PID: 9084)
- Unicorn-30847.exe (PID: 8604)
- Unicorn-43763.exe (PID: 8124)
- Unicorn-53934.exe (PID: 9568)
- Unicorn-15781.exe (PID: 8976)
- Unicorn-21348.exe (PID: 9608)
- Unicorn-52346.exe (PID: 9028)
- Unicorn-56674.exe (PID: 9004)
- Unicorn-57079.exe (PID: 9232)
- Unicorn-15034.exe (PID: 9520)
- Unicorn-13181.exe (PID: 8400)
- Unicorn-478.exe (PID: 9092)
- Unicorn-42279.exe (PID: 7960)
- Unicorn-60203.exe (PID: 9188)
- Unicorn-41703.exe (PID: 6584)
- Unicorn-51023.exe (PID: 10840)
- Unicorn-35600.exe (PID: 8284)
- Unicorn-54458.exe (PID: 7796)
- Unicorn-45678.exe (PID: 10132)
- Unicorn-28107.exe (PID: 9056)
- Unicorn-31645.exe (PID: 10860)
- Unicorn-56311.exe (PID: 9624)
- Unicorn-5448.exe (PID: 9020)
- Unicorn-53187.exe (PID: 9240)
- Unicorn-5413.exe (PID: 10292)
- Unicorn-14192.exe (PID: 8988)
- Unicorn-49959.exe (PID: 8364)
- Unicorn-47354.exe (PID: 10828)
- Unicorn-45766.exe (PID: 9196)
- Unicorn-37147.exe (PID: 10000)
- Unicorn-25536.exe (PID: 10796)
- Unicorn-59466.exe (PID: 10984)
- Unicorn-30603.exe (PID: 9340)
- Unicorn-52523.exe (PID: 9788)
- Unicorn-27287.exe (PID: 9512)
- Unicorn-12014.exe (PID: 11048)
- Unicorn-17264.exe (PID: 9596)
- Unicorn-3184.exe (PID: 12236)
- Unicorn-55844.exe (PID: 6828)
- Unicorn-43255.exe (PID: 11396)
- Unicorn-42815.exe (PID: 9316)
- Unicorn-8558.exe (PID: 10012)
- Unicorn-12813.exe (PID: 10108)
- Unicorn-56415.exe (PID: 9892)
- Unicorn-17612.exe (PID: 10076)
- Unicorn-60151.exe (PID: 9552)
- Unicorn-1276.exe (PID: 9980)
- Unicorn-46945.exe (PID: 9480)
- Unicorn-23232.exe (PID: 10252)
- Unicorn-2066.exe (PID: 9488)
- Unicorn-39939.exe (PID: 11656)
- Unicorn-36777.exe (PID: 9472)
- Unicorn-17775.exe (PID: 2320)
- Unicorn-50146.exe (PID: 10044)
- Unicorn-25419.exe (PID: 11108)
- Unicorn-5413.exe (PID: 10276)
- Unicorn-32435.exe (PID: 11056)
- Unicorn-58646.exe (PID: 11004)
- Unicorn-10160.exe (PID: 13836)
- Unicorn-64762.exe (PID: 13844)
- Unicorn-53815.exe (PID: 11040)
- Unicorn-5413.exe (PID: 10260)
- Unicorn-48783.exe (PID: 10100)
- Unicorn-29987.exe (PID: 9348)
- Unicorn-30816.exe (PID: 11584)
- Unicorn-6809.exe (PID: 12412)
- Unicorn-18956.exe (PID: 10196)
- Unicorn-61983.exe (PID: 11200)
- Unicorn-25227.exe (PID: 11020)
- Unicorn-50198.exe (PID: 12248)
- Unicorn-5413.exe (PID: 10300)
- Unicorn-19148.exe (PID: 10244)
- Unicorn-54562.exe (PID: 11072)
- Unicorn-24488.exe (PID: 11560)
- Unicorn-4209.exe (PID: 10036)
- Unicorn-34524.exe (PID: 10052)
- Unicorn-45406.exe (PID: 15048)
- Unicorn-17856.exe (PID: 15076)
- Unicorn-24628.exe (PID: 12436)
- Unicorn-37240.exe (PID: 8188)
- Unicorn-61586.exe (PID: 15152)
- Unicorn-38823.exe (PID: 9504)
- Unicorn-56119.exe (PID: 9580)
- Unicorn-20432.exe (PID: 10284)
- Unicorn-3877.exe (PID: 9968)
- Unicorn-40425.exe (PID: 9396)
- Unicorn-20619.exe (PID: 9952)
- Unicorn-47126.exe (PID: 11228)
- Unicorn-7961.exe (PID: 9900)
- Unicorn-64235.exe (PID: 9560)
- Unicorn-35730.exe (PID: 9920)
- Unicorn-49783.exe (PID: 6940)
- Unicorn-34791.exe (PID: 10616)
- Unicorn-47759.exe (PID: 9456)
- Unicorn-9710.exe (PID: 10588)
- Unicorn-63439.exe (PID: 13852)
- Unicorn-26535.exe (PID: 11520)
- Unicorn-9194.exe (PID: 13484)
- Unicorn-9941.exe (PID: 13504)
- Unicorn-6394.exe (PID: 10688)
- Unicorn-57759.exe (PID: 10028)
- Unicorn-32256.exe (PID: 9356)
- Unicorn-12258.exe (PID: 10120)
- Unicorn-61829.exe (PID: 16164)
- Unicorn-41911.exe (PID: 4164)
- Unicorn-46577.exe (PID: 16156)
- Unicorn-63113.exe (PID: 16224)
- Unicorn-57825.exe (PID: 10648)
- Unicorn-6586.exe (PID: 11476)
- Unicorn-28351.exe (PID: 11064)
- Unicorn-44638.exe (PID: 14784)
- Unicorn-28787.exe (PID: 9928)
- Unicorn-16293.exe (PID: 17600)
- Unicorn-14129.exe (PID: 17592)
- Unicorn-30575.exe (PID: 13684)
- Unicorn-30795.exe (PID: 9332)
- Unicorn-12952.exe (PID: 15524)
- Unicorn-46254.exe (PID: 12500)
- Unicorn-32910.exe (PID: 15396)
- Unicorn-55610.exe (PID: 7864)
- Unicorn-32319.exe (PID: 16268)
- Unicorn-21688.exe (PID: 11568)
- Unicorn-61385.exe (PID: 15560)
- Unicorn-3336.exe (PID: 8592)
- Unicorn-26815.exe (PID: 10624)
- Unicorn-37149.exe (PID: 616)
- Unicorn-22983.exe (PID: 13804)
- Unicorn-36955.exe (PID: 9936)
- Unicorn-64238.exe (PID: 14928)
- Unicorn-6802.exe (PID: 17316)
- Unicorn-27199.exe (PID: 10672)
- Unicorn-47354.exe (PID: 10820)
- Unicorn-52178.exe (PID: 16172)
- Unicorn-40390.exe (PID: 10060)
INFO
The sample compiled with chinese language support
- 1 (156).exe (PID: 4380)
Reads the computer name
- 1 (156).exe (PID: 4380)
- Unicorn-38843.exe (PID: 1676)
- Unicorn-62470.exe (PID: 1056)
- Unicorn-33135.exe (PID: 5640)
- Unicorn-10166.exe (PID: 6272)
- Unicorn-39501.exe (PID: 4932)
- Unicorn-7509.exe (PID: 6972)
- Unicorn-64825.exe (PID: 664)
- Unicorn-51090.exe (PID: 4040)
- Unicorn-46186.exe (PID: 2504)
- Unicorn-36901.exe (PID: 6388)
- Unicorn-33275.exe (PID: 516)
- Unicorn-42367.exe (PID: 6572)
- Unicorn-65091.exe (PID: 5048)
- Unicorn-34648.exe (PID: 1328)
- Unicorn-36311.exe (PID: 5436)
- Unicorn-55662.exe (PID: 5400)
- Unicorn-9237.exe (PID: 856)
- Unicorn-26747.exe (PID: 1300)
- Unicorn-23409.exe (PID: 7264)
- Unicorn-55719.exe (PID: 7304)
- Unicorn-213.exe (PID: 7380)
- Unicorn-47826.exe (PID: 7424)
- Unicorn-13948.exe (PID: 7364)
- Unicorn-8210.exe (PID: 7628)
- Unicorn-20546.exe (PID: 7756)
- Unicorn-63010.exe (PID: 7716)
- Unicorn-50203.exe (PID: 7736)
- Unicorn-17339.exe (PID: 7708)
- Unicorn-62573.exe (PID: 7456)
- Unicorn-41651.exe (PID: 7816)
- Unicorn-9341.exe (PID: 7788)
- Unicorn-11666.exe (PID: 8104)
- Unicorn-45543.exe (PID: 7780)
- Unicorn-27619.exe (PID: 8172)
- Unicorn-353.exe (PID: 8336)
- Unicorn-42139.exe (PID: 8564)
- Unicorn-34931.exe (PID: 8616)
- Unicorn-1682.exe (PID: 8500)
- Unicorn-20603.exe (PID: 8272)
- Unicorn-22221.exe (PID: 4448)
- Unicorn-56311.exe (PID: 9624)
- Unicorn-52346.exe (PID: 9028)
- Unicorn-45678.exe (PID: 10132)
- Unicorn-3184.exe (PID: 12236)
- Unicorn-2066.exe (PID: 9488)
- Unicorn-32435.exe (PID: 11056)
- Unicorn-26535.exe (PID: 11520)
- Unicorn-19148.exe (PID: 10244)
- Unicorn-53815.exe (PID: 11040)
- Unicorn-30816.exe (PID: 11584)
- Unicorn-34524.exe (PID: 10052)
- Unicorn-3877.exe (PID: 9968)
- Unicorn-52178.exe (PID: 16172)
- Unicorn-35730.exe (PID: 9920)
- Unicorn-37149.exe (PID: 616)
Checks supported languages
- 1 (156).exe (PID: 4380)
- Unicorn-38843.exe (PID: 1676)
- Unicorn-33135.exe (PID: 5640)
- Unicorn-62470.exe (PID: 1056)
- Unicorn-10166.exe (PID: 6272)
- Unicorn-63451.exe (PID: 3888)
- Unicorn-39501.exe (PID: 4932)
- Unicorn-64825.exe (PID: 664)
- Unicorn-51090.exe (PID: 4040)
- Unicorn-46186.exe (PID: 2504)
- Unicorn-33275.exe (PID: 516)
- Unicorn-42367.exe (PID: 6572)
- Unicorn-7509.exe (PID: 6972)
- Unicorn-55662.exe (PID: 5400)
- Unicorn-22012.exe (PID: 1096)
- Unicorn-16445.exe (PID: 1012)
- Unicorn-36311.exe (PID: 5436)
- Unicorn-24059.exe (PID: 2552)
- Unicorn-49258.exe (PID: 5964)
- Unicorn-17405.exe (PID: 5392)
- Unicorn-53607.exe (PID: 5164)
- Unicorn-38158.exe (PID: 7184)
- Unicorn-26747.exe (PID: 1300)
- Unicorn-64965.exe (PID: 6108)
- Unicorn-38807.exe (PID: 1228)
- Unicorn-18579.exe (PID: 3896)
- Unicorn-23409.exe (PID: 7264)
- Unicorn-35107.exe (PID: 7256)
- Unicorn-4297.exe (PID: 7372)
- Unicorn-36415.exe (PID: 7352)
- Unicorn-13948.exe (PID: 7364)
- Unicorn-213.exe (PID: 7388)
- Unicorn-48091.exe (PID: 7440)
- Unicorn-25624.exe (PID: 7448)
- Unicorn-18224.exe (PID: 7584)
- Unicorn-37183.exe (PID: 7532)
- Unicorn-29326.exe (PID: 7700)
- Unicorn-17339.exe (PID: 7708)
- Unicorn-50203.exe (PID: 7736)
- Unicorn-41651.exe (PID: 7816)
- Unicorn-13062.exe (PID: 7840)
- Unicorn-31873.exe (PID: 8012)
- Unicorn-59523.exe (PID: 8044)
- Unicorn-1386.exe (PID: 7924)
- Unicorn-46185.exe (PID: 8060)
- Unicorn-65143.exe (PID: 8300)
- Unicorn-43763.exe (PID: 8124)
- Unicorn-37131.exe (PID: 8408)
- Unicorn-41569.exe (PID: 8452)
- Unicorn-38439.exe (PID: 8480)
- Unicorn-10737.exe (PID: 8940)
- Unicorn-29564.exe (PID: 8576)
- Unicorn-56674.exe (PID: 9004)
- Unicorn-862.exe (PID: 9220)
- Unicorn-41703.exe (PID: 6584)
- Unicorn-35071.exe (PID: 9668)
- Unicorn-34111.exe (PID: 7980)
- Unicorn-14053.exe (PID: 5304)
- Unicorn-53934.exe (PID: 9568)
- Unicorn-35050.exe (PID: 9084)
- Unicorn-45766.exe (PID: 9196)
- Unicorn-8366.exe (PID: 9944)
- Unicorn-34524.exe (PID: 10052)
- Unicorn-40390.exe (PID: 10060)
- Unicorn-29987.exe (PID: 9348)
- Unicorn-20619.exe (PID: 9952)
- Unicorn-23232.exe (PID: 10252)
- Unicorn-5413.exe (PID: 10260)
- Unicorn-20432.exe (PID: 10284)
- Unicorn-5413.exe (PID: 10276)
- Unicorn-31645.exe (PID: 10860)
- Unicorn-64235.exe (PID: 9560)
- Unicorn-10353.exe (PID: 9416)
- Unicorn-23203.exe (PID: 9536)
- Unicorn-56119.exe (PID: 9580)
- Unicorn-31402.exe (PID: 10804)
- Unicorn-43919.exe (PID: 10764)
- Unicorn-58911.exe (PID: 10572)
- Unicorn-50041.exe (PID: 10780)
- Unicorn-7354.exe (PID: 10712)
- Unicorn-37240.exe (PID: 8188)
- Unicorn-2066.exe (PID: 9488)
- Unicorn-58646.exe (PID: 11004)
- Unicorn-25959.exe (PID: 11220)
- Unicorn-59015.exe (PID: 4776)
- Unicorn-22621.exe (PID: 11236)
- Unicorn-47126.exe (PID: 11228)
- Unicorn-56238.exe (PID: 11256)
- Unicorn-20004.exe (PID: 9408)
- Unicorn-12014.exe (PID: 11048)
- Unicorn-54562.exe (PID: 11072)
- Unicorn-21688.exe (PID: 11568)
- Unicorn-10753.exe (PID: 11548)
- Unicorn-47759.exe (PID: 9456)
- Unicorn-46742.exe (PID: 2084)
- Unicorn-23411.exe (PID: 11596)
- Unicorn-39939.exe (PID: 11656)
- Unicorn-13388.exe (PID: 11668)
- Unicorn-51807.exe (PID: 11724)
- Unicorn-25419.exe (PID: 11108)
- Unicorn-43815.exe (PID: 11184)
- Unicorn-7458.exe (PID: 12140)
- Unicorn-52574.exe (PID: 5036)
- Unicorn-6586.exe (PID: 11476)
- Unicorn-6809.exe (PID: 12396)
- Unicorn-24187.exe (PID: 12828)
- Unicorn-10893.exe (PID: 12452)
- Unicorn-36305.exe (PID: 12476)
- Unicorn-44473.exe (PID: 12484)
- Unicorn-21631.exe (PID: 11880)
- Unicorn-17856.exe (PID: 15076)
- Unicorn-4726.exe (PID: 13604)
- Unicorn-58898.exe (PID: 13672)
- Unicorn-60559.exe (PID: 12876)
- Unicorn-36385.exe (PID: 15788)
- Unicorn-41985.exe (PID: 15732)
- Unicorn-55721.exe (PID: 15708)
- Unicorn-17799.exe (PID: 15608)
- Unicorn-4778.exe (PID: 15552)
- Unicorn-32910.exe (PID: 4784)
- Unicorn-36385.exe (PID: 15676)
- Unicorn-41985.exe (PID: 15668)
- Unicorn-15752.exe (PID: 15532)
- Unicorn-32910.exe (PID: 15396)
- Unicorn-14129.exe (PID: 16544)
- Unicorn-61385.exe (PID: 15560)
- Unicorn-58373.exe (PID: 14860)
- Unicorn-59029.exe (PID: 16076)
- Unicorn-61829.exe (PID: 16100)
- Unicorn-2157.exe (PID: 16068)
- Unicorn-2157.exe (PID: 16084)
- Unicorn-2785.exe (PID: 14876)
- Unicorn-30133.exe (PID: 16464)
- Unicorn-3922.exe (PID: 16396)
- Unicorn-20605.exe (PID: 16528)
- Unicorn-63113.exe (PID: 16192)
- Unicorn-7902.exe (PID: 15020)
- Unicorn-44969.exe (PID: 14720)
- Unicorn-48722.exe (PID: 14796)
- Unicorn-44638.exe (PID: 14812)
- Unicorn-32887.exe (PID: 14496)
- Unicorn-14129.exe (PID: 17592)
- Unicorn-14129.exe (PID: 17608)
- Unicorn-5665.exe (PID: 13464)
- Unicorn-60279.exe (PID: 17780)
- Unicorn-35510.exe (PID: 17804)
- Unicorn-9438.exe (PID: 15448)
- Unicorn-51497.exe (PID: 13008)
Create files in a temporary directory
- Unicorn-62470.exe (PID: 1056)
- 1 (156).exe (PID: 4380)
- Unicorn-33135.exe (PID: 5640)
- Unicorn-38843.exe (PID: 1676)
- Unicorn-36901.exe (PID: 6388)
- Unicorn-39859.exe (PID: 6132)
- Unicorn-51090.exe (PID: 4040)
- Unicorn-25107.exe (PID: 2692)
- Unicorn-63451.exe (PID: 3888)
- Unicorn-65091.exe (PID: 5048)
- Unicorn-64825.exe (PID: 664)
- Unicorn-32973.exe (PID: 6964)
- Unicorn-36503.exe (PID: 1912)
- Unicorn-49258.exe (PID: 5964)
- Unicorn-36311.exe (PID: 5436)
- Unicorn-55662.exe (PID: 5400)
- Unicorn-40593.exe (PID: 6080)
- Unicorn-39501.exe (PID: 4932)
- Unicorn-22012.exe (PID: 1096)
- Unicorn-9237.exe (PID: 856)
- Unicorn-7509.exe (PID: 6972)
- Unicorn-64965.exe (PID: 6108)
- Unicorn-26747.exe (PID: 1300)
- Unicorn-10166.exe (PID: 6272)
- Unicorn-55314.exe (PID: 6876)
- Unicorn-38807.exe (PID: 1228)
- Unicorn-6710.exe (PID: 7216)
- Unicorn-38158.exe (PID: 7184)
- Unicorn-15699.exe (PID: 4068)
- Unicorn-31599.exe (PID: 7240)
- Unicorn-24059.exe (PID: 2552)
- Unicorn-18579.exe (PID: 3896)
- Unicorn-16445.exe (PID: 1012)
- Unicorn-30452.exe (PID: 7312)
- Unicorn-17405.exe (PID: 5392)
- Unicorn-213.exe (PID: 7380)
- Unicorn-40861.exe (PID: 7324)
- Unicorn-65003.exe (PID: 7344)
- Unicorn-55719.exe (PID: 7304)
- Unicorn-8210.exe (PID: 7628)
- Unicorn-47826.exe (PID: 7424)
- Unicorn-13948.exe (PID: 7364)
- Unicorn-53607.exe (PID: 5164)
- Unicorn-4297.exe (PID: 7372)
- Unicorn-29326.exe (PID: 7700)
- Unicorn-40691.exe (PID: 7576)
- Unicorn-63010.exe (PID: 7716)
- Unicorn-9341.exe (PID: 7788)
- Unicorn-36415.exe (PID: 7352)
- Unicorn-17339.exe (PID: 7708)
- Unicorn-64058.exe (PID: 2092)
- Unicorn-62573.exe (PID: 7456)
- Unicorn-41651.exe (PID: 7816)
- Unicorn-11666.exe (PID: 8104)
- Unicorn-45543.exe (PID: 7780)
- Unicorn-981.exe (PID: 7568)
- Unicorn-39414.exe (PID: 8116)
- Unicorn-41141.exe (PID: 8052)
- Unicorn-18224.exe (PID: 7584)
- Unicorn-213.exe (PID: 7396)
- Unicorn-42367.exe (PID: 6572)
- Unicorn-35839.exe (PID: 7416)
- Unicorn-27619.exe (PID: 8172)
- Unicorn-41843.exe (PID: 7656)
- Unicorn-46029.exe (PID: 8716)
- Unicorn-48091.exe (PID: 7440)
- Unicorn-22361.exe (PID: 7908)
- Unicorn-38084.exe (PID: 7464)
- Unicorn-353.exe (PID: 8336)
- Unicorn-54790.exe (PID: 8388)
- Unicorn-46185.exe (PID: 8060)
- Unicorn-1001.exe (PID: 7892)
- Unicorn-41569.exe (PID: 8452)
- Unicorn-37183.exe (PID: 7532)
- Unicorn-11282.exe (PID: 6300)
- Unicorn-10737.exe (PID: 8940)
- Unicorn-44073.exe (PID: 7744)
- Unicorn-1386.exe (PID: 7924)
- Unicorn-213.exe (PID: 7388)
- Unicorn-49523.exe (PID: 2040)
- Unicorn-14873.exe (PID: 8292)
- Unicorn-42715.exe (PID: 8696)
- Unicorn-11592.exe (PID: 7916)
- Unicorn-13062.exe (PID: 7840)
- Unicorn-38911.exe (PID: 8032)
- Unicorn-37131.exe (PID: 8408)
- Unicorn-432.exe (PID: 7764)
- Unicorn-26637.exe (PID: 7932)
- Unicorn-31873.exe (PID: 8012)
- Unicorn-46887.exe (PID: 7884)
- Unicorn-62626.exe (PID: 7808)
- Unicorn-49430.exe (PID: 8584)
- Unicorn-47551.exe (PID: 7288)
- Unicorn-42139.exe (PID: 8564)
- Unicorn-56695.exe (PID: 9044)
- Unicorn-54666.exe (PID: 8680)
- Unicorn-37540.exe (PID: 8540)
- Unicorn-46186.exe (PID: 2504)
- Unicorn-35107.exe (PID: 7256)
- Unicorn-9938.exe (PID: 7872)
- Unicorn-15205.exe (PID: 9652)
- Unicorn-23409.exe (PID: 7264)
- Unicorn-566.exe (PID: 8344)
- Unicorn-20546.exe (PID: 7756)
- Unicorn-20603.exe (PID: 8272)
- Unicorn-51276.exe (PID: 8548)
- Unicorn-38439.exe (PID: 8480)
- Unicorn-51822.exe (PID: 8948)
- Unicorn-42279.exe (PID: 7988)
- Unicorn-862.exe (PID: 9220)
- Unicorn-15781.exe (PID: 8976)
- Unicorn-22221.exe (PID: 4448)
- Unicorn-59523.exe (PID: 8044)
- Unicorn-21348.exe (PID: 9608)
- Unicorn-56674.exe (PID: 9004)
- Unicorn-41703.exe (PID: 6584)
- Unicorn-13181.exe (PID: 8400)
- Unicorn-43291.exe (PID: 8656)
- Unicorn-478.exe (PID: 9092)
- Unicorn-28107.exe (PID: 9056)
- Unicorn-35600.exe (PID: 8284)
- Unicorn-60203.exe (PID: 9188)
- Unicorn-1874.exe (PID: 8728)
- Unicorn-56311.exe (PID: 9624)
- Unicorn-5413.exe (PID: 10292)
- Unicorn-10706.exe (PID: 7964)
- Unicorn-42279.exe (PID: 7960)
- Unicorn-25536.exe (PID: 10796)
- Unicorn-17264.exe (PID: 9596)
- Unicorn-52523.exe (PID: 9788)
- Unicorn-12014.exe (PID: 11048)
- Unicorn-27287.exe (PID: 9512)
- Unicorn-50203.exe (PID: 7736)
- Unicorn-1682.exe (PID: 8500)
- Unicorn-12813.exe (PID: 10108)
- Unicorn-35071.exe (PID: 9668)
- Unicorn-15205.exe (PID: 9660)
- Unicorn-49959.exe (PID: 8364)
- Unicorn-45678.exe (PID: 10132)
- Unicorn-45766.exe (PID: 9196)
- Unicorn-17775.exe (PID: 2320)
- Unicorn-25624.exe (PID: 7448)
- Unicorn-58646.exe (PID: 11004)
- Unicorn-5413.exe (PID: 10260)
- Unicorn-50146.exe (PID: 10044)
- Unicorn-53187.exe (PID: 9240)
- Unicorn-29987.exe (PID: 9348)
- Unicorn-18189.exe (PID: 8556)
- Unicorn-50198.exe (PID: 12248)
- Unicorn-54562.exe (PID: 11072)
- Unicorn-55844.exe (PID: 6828)
- Unicorn-17856.exe (PID: 15076)
- Unicorn-23232.exe (PID: 10252)
- Unicorn-47759.exe (PID: 9456)
- Unicorn-34791.exe (PID: 10616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
758
Monitored processes
625
Malicious processes
93
Suspicious processes
79
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 516 | C:\Users\admin\AppData\Local\Temp\Unicorn-33275.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-33275.exe | Unicorn-63451.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 616 | C:\Users\admin\AppData\Local\Temp\Unicorn-37149.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-37149.exe | Unicorn-60151.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 664 | C:\Users\admin\AppData\Local\Temp\Unicorn-64825.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-64825.exe | Unicorn-38843.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 720 | C:\Users\admin\AppData\Local\Temp\Unicorn-38285.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-38285.exe | — | Unicorn-51023.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 856 | C:\Users\admin\AppData\Local\Temp\Unicorn-9237.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9237.exe | Unicorn-36901.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1012 | C:\Users\admin\AppData\Local\Temp\Unicorn-16445.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-16445.exe | Unicorn-39501.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1056 | C:\Users\admin\AppData\Local\Temp\Unicorn-62470.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-62470.exe | 1 (156).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1096 | C:\Users\admin\AppData\Local\Temp\Unicorn-22012.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-22012.exe | Unicorn-62470.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1228 | C:\Users\admin\AppData\Local\Temp\Unicorn-38807.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-38807.exe | Unicorn-65091.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1300 | C:\Users\admin\AppData\Local\Temp\Unicorn-26747.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-26747.exe | Unicorn-36503.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
12 095
Read events
12 095
Write events
0
Delete events
0
Modification events
Executable files
881
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5640 | Unicorn-33135.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-10166.exe | executable | |
MD5:4167C2569306F2197D3790E156982621 | SHA256:34E968F2ED493699F057AB5A2FAD34861281563B109AF3BD77B49ED08E511C8E | |||
| 1676 | Unicorn-38843.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-33135.exe | executable | |
MD5:665037A371E950899811CBE1BC5DF4AC | SHA256:A3802E4B2E1C7134A28EB921DFF773744DDF953E686C6E87C43CD3979C0A13EF | |||
| 1056 | Unicorn-62470.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63451.exe | executable | |
MD5:BD43F70D4DE9C8A5D90808365C3EA3E4 | SHA256:28C41D44BCDF4708B313E0B9C887C7BEA7CDE9F98C63AA1B20A12090ADFA2352 | |||
| 6272 | Unicorn-10166.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-7509.exe | executable | |
MD5:030DA49626B147F1AD0C905C233E13C3 | SHA256:2A42C618C32088A1078585BFCFAF2DACECA332185D4D75F3F6C67E58C94AD2E5 | |||
| 5640 | Unicorn-33135.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-39859.exe | executable | |
MD5:82160B35C8A404B177527D23A5CE555D | SHA256:5E807E65655178FF98950D70E93BD5D7E9D1F92C783450BD22F1AE5FFCE60CBC | |||
| 1676 | Unicorn-38843.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-39501.exe | executable | |
MD5:817C30DA3F53A4DF1F62BDCC34FFB695 | SHA256:5538D4EFB00A976E6F1B17004E2EF4E1E7BCE9D46D12596A79A40118AB92E735 | |||
| 4932 | Unicorn-39501.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-25107.exe | executable | |
MD5:D73E167C879598E65F79D67F7FEC14D1 | SHA256:46132FC582E69EBB9AA7E0580EEAC91685777E2168CE04B274A23F487C91C567 | |||
| 1676 | Unicorn-38843.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-64825.exe | executable | |
MD5:206F5855120C3832C0E88BCB7A6175A0 | SHA256:A02C898194038EB7EFD81457155CC9FA780C098400A363A2E2B78BF6EFF6B307 | |||
| 1056 | Unicorn-62470.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-51090.exe | executable | |
MD5:E11306318669DC9E8AD78E96BA4779F0 | SHA256:FF64F3D55008B5F5B355D6F1CA965F1449C17F870A829BB59CA3EE736E7762CB | |||
| 4380 | 1 (156).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-38843.exe | executable | |
MD5:514E7DC7DEC3828FF76F351DE602A6CB | SHA256:5C646095F1334AD08D5CEC96522A15A7ADB1E355EDB699C958091BBD4DB3B25D | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
15
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.53.40.178:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.53.40.178:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
6544 | svchost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
6872 | backgroundTaskHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | unknown |
8160 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | unknown |
8160 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
4 | System | 192.168.100.255:137 | — | — | — | unknown |
— | — | 23.53.40.178:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
5496 | MoUsoCoreWorker.exe | 23.53.40.178:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | unknown |
5496 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
3216 | svchost.exe | 20.198.162.78:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | SG | unknown |
6544 | svchost.exe | 40.126.31.130:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
6544 | svchost.exe | 23.54.109.203:80 | ocsp.digicert.com | AKAMAI-AS | DE | unknown |
2104 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| unknown |
settings-win.data.microsoft.com |
| unknown |
crl.microsoft.com |
| unknown |
client.wns.windows.com |
| unknown |
login.live.com |
| unknown |
ocsp.digicert.com |
| unknown |
arc.msn.com |
| unknown |
slscr.update.microsoft.com |
| unknown |
www.microsoft.com |
| unknown |
fe3cr.delivery.mp.microsoft.com |
| unknown |