| File name: | 1 (180) |
| Full analysis: | https://app.any.run/tasks/15692662-cc23-474a-b3d7-40e59cec5dbd |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 16:40:25 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | 4A2D3C385D2060E64001639C8C154970 |
| SHA1: | 3AFB998880B5FB56DCCB4816995891F037E5E6D5 |
| SHA256: | E7325DE586B047365073391F902D47019E8778740E423D085B8FB4F89FD699B4 |
| SSDEEP: | 6144:n7K8I76feDNHA5olnse/1Afx/tHQlOJGBW/WyeOFHk/8SwjwpyAvEhZTsAW+sZwa:n+1ekHA5mnPaHmmaWOyeOFZx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- Unicorn-38765.exe (PID: 4756)
- Unicorn-31151.exe (PID: 7152)
- 1 (180).exe (PID: 7548)
- Unicorn-23057.exe (PID: 7728)
- Unicorn-8360.exe (PID: 5956)
- Unicorn-13191.exe (PID: 2140)
- Unicorn-53569.exe (PID: 4880)
- Unicorn-56528.exe (PID: 1348)
- Unicorn-24889.exe (PID: 2384)
- Unicorn-64141.exe (PID: 7540)
- Unicorn-60036.exe (PID: 7316)
- Unicorn-30893.exe (PID: 3900)
- Unicorn-33005.exe (PID: 2152)
- Unicorn-37015.exe (PID: 7460)
- Unicorn-25391.exe (PID: 5156)
- Unicorn-24837.exe (PID: 1660)
- Unicorn-6454.exe (PID: 1188)
- Unicorn-30037.exe (PID: 5416)
- Unicorn-63565.exe (PID: 1272)
- Unicorn-5532.exe (PID: 6644)
- Unicorn-46964.exe (PID: 1616)
- Unicorn-43227.exe (PID: 1056)
- Unicorn-9232.exe (PID: 6240)
- Unicorn-11654.exe (PID: 1052)
- Unicorn-6196.exe (PID: 7292)
- Unicorn-26123.exe (PID: 5800)
- Unicorn-4883.exe (PID: 5204)
- Unicorn-17955.exe (PID: 5720)
- Unicorn-25569.exe (PID: 920)
- Unicorn-9569.exe (PID: 1676)
- Unicorn-12667.exe (PID: 7180)
- Unicorn-4386.exe (PID: 6540)
- Unicorn-36425.exe (PID: 5408)
- Unicorn-59075.exe (PID: 4428)
- Unicorn-44785.exe (PID: 7184)
- Unicorn-24173.exe (PID: 4224)
- Unicorn-46108.exe (PID: 5596)
- Unicorn-8028.exe (PID: 7232)
- Unicorn-24941.exe (PID: 5868)
- Unicorn-8604.exe (PID: 7696)
- Unicorn-3368.exe (PID: 7264)
- Unicorn-50960.exe (PID: 8024)
- Unicorn-49040.exe (PID: 7252)
- Unicorn-60161.exe (PID: 6036)
- Unicorn-8339.exe (PID: 7708)
- Unicorn-32917.exe (PID: 2148)
- Unicorn-27245.exe (PID: 8124)
- Unicorn-56964.exe (PID: 7208)
- Unicorn-57613.exe (PID: 6404)
- Unicorn-53529.exe (PID: 8068)
- Unicorn-64193.exe (PID: 8048)
- Unicorn-49803.exe (PID: 8052)
- Unicorn-40893.exe (PID: 6132)
- Unicorn-51920.exe (PID: 7888)
- Unicorn-28898.exe (PID: 7012)
- Unicorn-42045.exe (PID: 6964)
- Unicorn-49643.exe (PID: 6640)
- Unicorn-30870.exe (PID: 7860)
- Unicorn-48397.exe (PID: 7792)
- Unicorn-58272.exe (PID: 7896)
- Unicorn-36491.exe (PID: 7852)
- Unicorn-44405.exe (PID: 5984)
- Unicorn-38921.exe (PID: 7380)
- Unicorn-50535.exe (PID: 6512)
- Unicorn-15340.exe (PID: 1568)
- Unicorn-64695.exe (PID: 8160)
- Unicorn-56217.exe (PID: 8080)
- Unicorn-37275.exe (PID: 2564)
- Unicorn-36351.exe (PID: 8076)
- Unicorn-48787.exe (PID: 8176)
- Unicorn-51853.exe (PID: 8492)
- Unicorn-6440.exe (PID: 4200)
- Unicorn-49808.exe (PID: 2096)
- Unicorn-2963.exe (PID: 8608)
- Unicorn-19962.exe (PID: 7872)
- Unicorn-3280.exe (PID: 7780)
- Unicorn-40037.exe (PID: 7796)
- Unicorn-60597.exe (PID: 8592)
- Unicorn-34012.exe (PID: 8984)
- Unicorn-37977.exe (PID: 9048)
- Unicorn-38641.exe (PID: 8340)
- Unicorn-37913.exe (PID: 632)
- Unicorn-10694.exe (PID: 8952)
- Unicorn-43611.exe (PID: 8204)
- Unicorn-47276.exe (PID: 9012)
- Unicorn-13155.exe (PID: 8172)
- Unicorn-13560.exe (PID: 8376)
- Unicorn-58795.exe (PID: 6676)
- Unicorn-7675.exe (PID: 8712)
- Unicorn-6907.exe (PID: 8512)
- Unicorn-31499.exe (PID: 7400)
- Unicorn-32829.exe (PID: 7924)
- Unicorn-51640.exe (PID: 8348)
- Unicorn-7675.exe (PID: 8720)
- Unicorn-39793.exe (PID: 8688)
- Unicorn-65376.exe (PID: 7200)
- Unicorn-1308.exe (PID: 8436)
- Unicorn-55863.exe (PID: 8220)
- Unicorn-41765.exe (PID: 2644)
- Unicorn-38537.exe (PID: 7844)
- Unicorn-62159.exe (PID: 8648)
- Unicorn-50270.exe (PID: 2772)
- Unicorn-19949.exe (PID: 8788)
- Unicorn-60213.exe (PID: 8656)
- Unicorn-52865.exe (PID: 2552)
- Unicorn-30665.exe (PID: 8500)
- Unicorn-29928.exe (PID: 8976)
- Unicorn-27276.exe (PID: 8696)
- Unicorn-19949.exe (PID: 8780)
- Unicorn-49336.exe (PID: 1040)
- Unicorn-31603.exe (PID: 8532)
- Unicorn-3670.exe (PID: 7944)
- Unicorn-53005.exe (PID: 8836)
- Unicorn-7504.exe (PID: 8628)
- Unicorn-18797.exe (PID: 8468)
- Unicorn-17571.exe (PID: 8444)
- Unicorn-64711.exe (PID: 9076)
- Unicorn-8101.exe (PID: 5436)
- Unicorn-58677.exe (PID: 8388)
- Unicorn-61203.exe (PID: 8408)
- Unicorn-41085.exe (PID: 7856)
- Unicorn-222.exe (PID: 8540)
- Unicorn-7675.exe (PID: 8704)
- Unicorn-33819.exe (PID: 9896)
- Unicorn-48361.exe (PID: 9904)
- Unicorn-54069.exe (PID: 9404)
- Unicorn-18302.exe (PID: 10080)
- Unicorn-36316.exe (PID: 9920)
- Unicorn-28413.exe (PID: 9836)
- Unicorn-24411.exe (PID: 9864)
- Unicorn-48921.exe (PID: 8844)
- Unicorn-54135.exe (PID: 9644)
- Unicorn-7587.exe (PID: 8752)
- Unicorn-14577.exe (PID: 9428)
- Unicorn-25363.exe (PID: 8728)
- Unicorn-34291.exe (PID: 8908)
- Unicorn-4567.exe (PID: 10072)
- Unicorn-7120.exe (PID: 9092)
- Unicorn-14816.exe (PID: 6584)
- Unicorn-55216.exe (PID: 11220)
- Unicorn-24625.exe (PID: 9940)
- Unicorn-16073.exe (PID: 10096)
- Unicorn-32025.exe (PID: 9872)
- Unicorn-27291.exe (PID: 10788)
- Unicorn-53405.exe (PID: 9984)
- Unicorn-60613.exe (PID: 9888)
- Unicorn-28901.exe (PID: 10000)
- Unicorn-8603.exe (PID: 8008)
- Unicorn-50893.exe (PID: 8316)
- Unicorn-53545.exe (PID: 11172)
- Unicorn-64209.exe (PID: 9272)
- Unicorn-17713.exe (PID: 11208)
- Unicorn-24255.exe (PID: 5228)
- Unicorn-11775.exe (PID: 12880)
- Unicorn-11775.exe (PID: 12872)
- Unicorn-18635.exe (PID: 7828)
- Unicorn-41027.exe (PID: 10732)
- Unicorn-55855.exe (PID: 9552)
- Unicorn-48797.exe (PID: 11916)
- Unicorn-30878.exe (PID: 12864)
- Unicorn-47925.exe (PID: 10896)
- Unicorn-41013.exe (PID: 12420)
- Unicorn-24986.exe (PID: 10196)
- Unicorn-11427.exe (PID: 9520)
- Unicorn-623.exe (PID: 10932)
- Unicorn-43929.exe (PID: 9628)
- Unicorn-1531.exe (PID: 9448)
- Unicorn-40385.exe (PID: 9728)
- Unicorn-12808.exe (PID: 12372)
- Unicorn-12054.exe (PID: 10544)
- Unicorn-31729.exe (PID: 5360)
- Unicorn-15791.exe (PID: 14288)
- Unicorn-15791.exe (PID: 14296)
- Unicorn-55849.exe (PID: 684)
- Unicorn-13423.exe (PID: 15356)
- Unicorn-13423.exe (PID: 15348)
- Unicorn-50052.exe (PID: 13380)
- Unicorn-40089.exe (PID: 8816)
- Unicorn-23207.exe (PID: 10708)
- Unicorn-42915.exe (PID: 8680)
- Unicorn-34552.exe (PID: 11384)
- Unicorn-2943.exe (PID: 13108)
- Unicorn-47431.exe (PID: 13168)
- Unicorn-12564.exe (PID: 9992)
- Unicorn-63412.exe (PID: 13196)
- Unicorn-58449.exe (PID: 10208)
- Unicorn-33644.exe (PID: 11052)
- Unicorn-26959.exe (PID: 12820)
- Unicorn-14515.exe (PID: 12756)
- Unicorn-8916.exe (PID: 12528)
- Unicorn-20401.exe (PID: 12412)
- Unicorn-3640.exe (PID: 12000)
- Unicorn-31708.exe (PID: 10852)
- Unicorn-15008.exe (PID: 9248)
- Unicorn-11116.exe (PID: 9576)
- Unicorn-10623.exe (PID: 12812)
- Unicorn-30556.exe (PID: 10772)
- Unicorn-20541.exe (PID: 9948)
- Unicorn-41343.exe (PID: 10888)
- Unicorn-41375.exe (PID: 11976)
- Unicorn-22186.exe (PID: 3396)
- Unicorn-42011.exe (PID: 15304)
- Unicorn-35881.exe (PID: 13096)
- Unicorn-15827.exe (PID: 11160)
- Unicorn-9383.exe (PID: 11988)
- Unicorn-42357.exe (PID: 12476)
- Unicorn-32985.exe (PID: 9976)
- Unicorn-46197.exe (PID: 10200)
- Unicorn-32327.exe (PID: 15272)
- Unicorn-32770.exe (PID: 16756)
- Unicorn-42203.exe (PID: 14888)
- Unicorn-9028.exe (PID: 16832)
- Unicorn-60151.exe (PID: 11112)
- Unicorn-58229.exe (PID: 16808)
Executable content was dropped or overwritten
- Unicorn-31151.exe (PID: 7152)
- Unicorn-38765.exe (PID: 4756)
- 1 (180).exe (PID: 7548)
- Unicorn-23057.exe (PID: 7728)
- Unicorn-8360.exe (PID: 5956)
- Unicorn-24889.exe (PID: 2384)
- Unicorn-13191.exe (PID: 2140)
- Unicorn-64141.exe (PID: 7540)
- Unicorn-53569.exe (PID: 4880)
- Unicorn-60036.exe (PID: 7316)
- Unicorn-6196.exe (PID: 7292)
- Unicorn-56528.exe (PID: 1348)
- Unicorn-46964.exe (PID: 1616)
- Unicorn-33005.exe (PID: 2152)
- Unicorn-30893.exe (PID: 3900)
- Unicorn-24837.exe (PID: 1660)
- Unicorn-25391.exe (PID: 5156)
- Unicorn-6454.exe (PID: 1188)
- Unicorn-30037.exe (PID: 5416)
- Unicorn-5532.exe (PID: 6644)
- Unicorn-11654.exe (PID: 1052)
- Unicorn-43227.exe (PID: 1056)
- Unicorn-9232.exe (PID: 6240)
- Unicorn-4883.exe (PID: 5204)
- Unicorn-17955.exe (PID: 5720)
- Unicorn-25569.exe (PID: 920)
- Unicorn-4386.exe (PID: 6540)
- Unicorn-37015.exe (PID: 7460)
- Unicorn-26123.exe (PID: 5800)
- Unicorn-60161.exe (PID: 6036)
- Unicorn-12667.exe (PID: 7180)
- Unicorn-36425.exe (PID: 5408)
- Unicorn-59075.exe (PID: 4428)
- Unicorn-44785.exe (PID: 7184)
- Unicorn-24173.exe (PID: 4224)
- Unicorn-46108.exe (PID: 5596)
- Unicorn-63565.exe (PID: 1272)
- Unicorn-56964.exe (PID: 7208)
- Unicorn-24941.exe (PID: 5868)
- Unicorn-65376.exe (PID: 7200)
- Unicorn-8604.exe (PID: 7696)
- Unicorn-3368.exe (PID: 7264)
- Unicorn-49040.exe (PID: 7252)
- Unicorn-50960.exe (PID: 8024)
- Unicorn-8339.exe (PID: 7708)
- Unicorn-27245.exe (PID: 8124)
- Unicorn-32917.exe (PID: 2148)
- Unicorn-64193.exe (PID: 8048)
- Unicorn-49803.exe (PID: 8052)
- Unicorn-53529.exe (PID: 8068)
- Unicorn-40893.exe (PID: 6132)
- Unicorn-50535.exe (PID: 6512)
- Unicorn-57613.exe (PID: 6404)
- Unicorn-51920.exe (PID: 7888)
- Unicorn-28898.exe (PID: 7012)
- Unicorn-42045.exe (PID: 6964)
- Unicorn-41085.exe (PID: 7856)
- Unicorn-49643.exe (PID: 6640)
- Unicorn-48397.exe (PID: 7792)
- Unicorn-36491.exe (PID: 7852)
- Unicorn-44405.exe (PID: 5984)
- Unicorn-38921.exe (PID: 7380)
- Unicorn-64695.exe (PID: 8160)
- Unicorn-15340.exe (PID: 1568)
- Unicorn-13155.exe (PID: 8172)
- Unicorn-56217.exe (PID: 8080)
- Unicorn-19962.exe (PID: 7872)
- Unicorn-36351.exe (PID: 8076)
- Unicorn-8603.exe (PID: 8008)
- Unicorn-48787.exe (PID: 8176)
- Unicorn-51853.exe (PID: 8492)
- Unicorn-6440.exe (PID: 4200)
- Unicorn-49808.exe (PID: 2096)
- Unicorn-2963.exe (PID: 8608)
- Unicorn-9569.exe (PID: 1676)
- Unicorn-40037.exe (PID: 7796)
- Unicorn-37913.exe (PID: 632)
- Unicorn-47276.exe (PID: 9012)
- Unicorn-60597.exe (PID: 8592)
- Unicorn-3280.exe (PID: 7780)
- Unicorn-34012.exe (PID: 8984)
- Unicorn-37977.exe (PID: 9048)
- Unicorn-38641.exe (PID: 8340)
- Unicorn-43611.exe (PID: 8204)
- Unicorn-10694.exe (PID: 8952)
- Unicorn-58795.exe (PID: 6676)
- Unicorn-7675.exe (PID: 8712)
- Unicorn-6907.exe (PID: 8512)
- Unicorn-31499.exe (PID: 7400)
- Unicorn-13560.exe (PID: 8376)
- Unicorn-32829.exe (PID: 7924)
- Unicorn-39793.exe (PID: 8688)
- Unicorn-51640.exe (PID: 8348)
- Unicorn-7675.exe (PID: 8720)
- Unicorn-55863.exe (PID: 8220)
- Unicorn-1308.exe (PID: 8436)
- Unicorn-41765.exe (PID: 2644)
- Unicorn-38537.exe (PID: 7844)
- Unicorn-62159.exe (PID: 8648)
- Unicorn-34291.exe (PID: 8908)
- Unicorn-19949.exe (PID: 8788)
- Unicorn-27276.exe (PID: 8696)
- Unicorn-60213.exe (PID: 8656)
- Unicorn-30665.exe (PID: 8500)
- Unicorn-29928.exe (PID: 8976)
- Unicorn-3670.exe (PID: 7944)
- Unicorn-52865.exe (PID: 2552)
- Unicorn-53005.exe (PID: 8836)
- Unicorn-19949.exe (PID: 8780)
- Unicorn-49336.exe (PID: 1040)
- Unicorn-31603.exe (PID: 8532)
- Unicorn-7504.exe (PID: 8628)
- Unicorn-18797.exe (PID: 8468)
- Unicorn-8101.exe (PID: 5436)
- Unicorn-17571.exe (PID: 8444)
- Unicorn-64711.exe (PID: 9076)
- Unicorn-222.exe (PID: 8540)
- Unicorn-58677.exe (PID: 8388)
- Unicorn-61203.exe (PID: 8408)
- Unicorn-7675.exe (PID: 8704)
- Unicorn-48361.exe (PID: 9904)
- Unicorn-12372.exe (PID: 9912)
- Unicorn-28413.exe (PID: 9836)
- Unicorn-54069.exe (PID: 9404)
- Unicorn-18302.exe (PID: 10080)
- Unicorn-36316.exe (PID: 9920)
- Unicorn-48921.exe (PID: 8844)
- Unicorn-54135.exe (PID: 9644)
- Unicorn-25363.exe (PID: 8728)
- Unicorn-24411.exe (PID: 9864)
- Unicorn-7587.exe (PID: 8752)
- Unicorn-14577.exe (PID: 9428)
- Unicorn-4567.exe (PID: 10072)
- Unicorn-14816.exe (PID: 6584)
- Unicorn-7120.exe (PID: 9092)
- Unicorn-55216.exe (PID: 11220)
- Unicorn-32025.exe (PID: 9872)
- Unicorn-16073.exe (PID: 10096)
- Unicorn-24625.exe (PID: 9940)
- Unicorn-27291.exe (PID: 10788)
- Unicorn-30870.exe (PID: 7860)
- Unicorn-37275.exe (PID: 2564)
- Unicorn-53405.exe (PID: 9984)
- Unicorn-28901.exe (PID: 10000)
- Unicorn-60613.exe (PID: 9888)
- Unicorn-50893.exe (PID: 8316)
- Unicorn-53545.exe (PID: 11172)
- Unicorn-64209.exe (PID: 9272)
- Unicorn-17713.exe (PID: 11208)
- Unicorn-50270.exe (PID: 2772)
- Unicorn-11775.exe (PID: 12872)
- Unicorn-18635.exe (PID: 7828)
- Unicorn-41027.exe (PID: 10732)
- Unicorn-55855.exe (PID: 9552)
- Unicorn-48797.exe (PID: 11916)
- Unicorn-11775.exe (PID: 12880)
- Unicorn-11427.exe (PID: 9520)
- Unicorn-24986.exe (PID: 10196)
- Unicorn-41013.exe (PID: 12420)
- Unicorn-623.exe (PID: 10932)
- Unicorn-43929.exe (PID: 9628)
- Unicorn-47925.exe (PID: 10896)
- Unicorn-12808.exe (PID: 12372)
- Unicorn-40385.exe (PID: 9728)
- Unicorn-1531.exe (PID: 9448)
- Unicorn-12054.exe (PID: 10544)
- Unicorn-55849.exe (PID: 684)
- Unicorn-15791.exe (PID: 14288)
- Unicorn-31729.exe (PID: 5360)
- Unicorn-23207.exe (PID: 10708)
- Unicorn-40089.exe (PID: 8816)
- Unicorn-50052.exe (PID: 13380)
- Unicorn-42915.exe (PID: 8680)
- Unicorn-34552.exe (PID: 11384)
- Unicorn-30878.exe (PID: 12864)
- Unicorn-2943.exe (PID: 13108)
- Unicorn-26959.exe (PID: 12820)
- Unicorn-47431.exe (PID: 13168)
- Unicorn-12564.exe (PID: 9992)
- Unicorn-63412.exe (PID: 13196)
- Unicorn-58449.exe (PID: 10208)
- Unicorn-33644.exe (PID: 11052)
- Unicorn-14515.exe (PID: 12756)
- Unicorn-31708.exe (PID: 10852)
- Unicorn-8916.exe (PID: 12528)
- Unicorn-20401.exe (PID: 12412)
- Unicorn-3640.exe (PID: 12000)
- Unicorn-15008.exe (PID: 9248)
- Unicorn-11116.exe (PID: 9576)
- Unicorn-41343.exe (PID: 10888)
- Unicorn-41375.exe (PID: 11976)
- Unicorn-57528.exe (PID: 15296)
- Unicorn-10623.exe (PID: 12812)
- Unicorn-30556.exe (PID: 10772)
- Unicorn-15827.exe (PID: 11160)
- Unicorn-22186.exe (PID: 3396)
- Unicorn-60151.exe (PID: 11112)
- Unicorn-46197.exe (PID: 10200)
- Unicorn-15791.exe (PID: 14296)
- Unicorn-35881.exe (PID: 13096)
- Unicorn-42011.exe (PID: 15304)
- Unicorn-32985.exe (PID: 9976)
- Unicorn-32327.exe (PID: 15272)
- Unicorn-42357.exe (PID: 12476)
- Unicorn-42203.exe (PID: 14888)
- Unicorn-13423.exe (PID: 15356)
- Unicorn-39705.exe (PID: 9260)
- Unicorn-61612.exe (PID: 15264)
- Unicorn-5491.exe (PID: 5324)
- Unicorn-13423.exe (PID: 15348)
- Unicorn-50281.exe (PID: 10220)
- Unicorn-36943.exe (PID: 10824)
- Unicorn-58229.exe (PID: 16808)
- Unicorn-9383.exe (PID: 11988)
- Unicorn-64233.exe (PID: 15144)
- Unicorn-14100.exe (PID: 10552)
- Unicorn-43405.exe (PID: 9168)
- Unicorn-20541.exe (PID: 9948)
- Unicorn-38095.exe (PID: 9412)
- Unicorn-17227.exe (PID: 17732)
- Unicorn-9028.exe (PID: 16832)
- Unicorn-32770.exe (PID: 16756)
- Unicorn-31376.exe (PID: 12908)
- Unicorn-16015.exe (PID: 13088)
- Unicorn-60717.exe (PID: 13644)
- Unicorn-15118.exe (PID: 9748)
- Unicorn-49393.exe (PID: 15312)
- Unicorn-49876.exe (PID: 9928)
- Unicorn-17227.exe (PID: 17740)
- Unicorn-8028.exe (PID: 7232)
- Unicorn-17227.exe (PID: 17748)
- Unicorn-58272.exe (PID: 7896)
- Unicorn-64764.exe (PID: 9224)
Executes application which crashes
- Unicorn-35339.exe (PID: 7704)
- Unicorn-35127.exe (PID: 14312)
INFO
Reads the computer name
- 1 (180).exe (PID: 7548)
- Unicorn-23057.exe (PID: 7728)
- Unicorn-31151.exe (PID: 7152)
- Unicorn-38765.exe (PID: 4756)
- Unicorn-53569.exe (PID: 4880)
- Unicorn-64141.exe (PID: 7540)
- Unicorn-56528.exe (PID: 1348)
- Unicorn-8360.exe (PID: 5956)
- Unicorn-24889.exe (PID: 2384)
- Unicorn-13191.exe (PID: 2140)
- Unicorn-37015.exe (PID: 7460)
- Unicorn-30893.exe (PID: 3900)
- Unicorn-6196.exe (PID: 7292)
- Unicorn-63565.exe (PID: 1272)
- Unicorn-46964.exe (PID: 1616)
- Unicorn-60036.exe (PID: 7316)
- Unicorn-33005.exe (PID: 2152)
- Unicorn-25391.exe (PID: 5156)
- Unicorn-24837.exe (PID: 1660)
- Unicorn-30037.exe (PID: 5416)
- Unicorn-11654.exe (PID: 1052)
- Unicorn-43227.exe (PID: 1056)
- Unicorn-9232.exe (PID: 6240)
- Unicorn-4883.exe (PID: 5204)
- Unicorn-26123.exe (PID: 5800)
- Unicorn-25569.exe (PID: 920)
- Unicorn-36425.exe (PID: 5408)
- Unicorn-44785.exe (PID: 7184)
- Unicorn-59075.exe (PID: 4428)
- Unicorn-65376.exe (PID: 7200)
- Unicorn-24941.exe (PID: 5868)
- Unicorn-3368.exe (PID: 7264)
- Unicorn-8339.exe (PID: 7708)
- Unicorn-50960.exe (PID: 8024)
- Unicorn-35339.exe (PID: 7704)
- Unicorn-64193.exe (PID: 8048)
- Unicorn-49803.exe (PID: 8052)
- Unicorn-30870.exe (PID: 7860)
- Unicorn-51920.exe (PID: 7888)
- Unicorn-28898.exe (PID: 7012)
- Unicorn-49643.exe (PID: 6640)
- Unicorn-41085.exe (PID: 7856)
- Unicorn-38921.exe (PID: 7380)
- Unicorn-48397.exe (PID: 7792)
- Unicorn-58272.exe (PID: 7896)
- Unicorn-64695.exe (PID: 8160)
- Unicorn-37913.exe (PID: 632)
- Unicorn-37275.exe (PID: 2564)
- Unicorn-24255.exe (PID: 5228)
- Unicorn-48787.exe (PID: 8176)
- Unicorn-6440.exe (PID: 4200)
- Unicorn-49808.exe (PID: 2096)
- Unicorn-3280.exe (PID: 7780)
- Unicorn-40037.exe (PID: 7796)
- Unicorn-2963.exe (PID: 8608)
- Unicorn-43611.exe (PID: 8204)
- Unicorn-34012.exe (PID: 8984)
- Unicorn-13560.exe (PID: 8376)
- Unicorn-39793.exe (PID: 8688)
- Unicorn-50270.exe (PID: 2772)
- Unicorn-62159.exe (PID: 8648)
- Unicorn-38537.exe (PID: 7844)
- Unicorn-30665.exe (PID: 8500)
- Unicorn-3670.exe (PID: 7944)
- Unicorn-51640.exe (PID: 8348)
- Unicorn-7675.exe (PID: 8720)
- Unicorn-34291.exe (PID: 8908)
- Unicorn-52865.exe (PID: 2552)
- Unicorn-29928.exe (PID: 8976)
- Unicorn-17571.exe (PID: 8444)
- Unicorn-31603.exe (PID: 8532)
- Unicorn-64711.exe (PID: 9076)
- Unicorn-61203.exe (PID: 8408)
- Unicorn-58677.exe (PID: 8388)
- Unicorn-222.exe (PID: 8540)
- Unicorn-33819.exe (PID: 9896)
- Unicorn-7587.exe (PID: 8752)
- Unicorn-18302.exe (PID: 10080)
- Unicorn-54069.exe (PID: 9404)
- Unicorn-36316.exe (PID: 9920)
- Unicorn-24411.exe (PID: 9864)
- Unicorn-14577.exe (PID: 9428)
- Unicorn-48921.exe (PID: 8844)
- Unicorn-24625.exe (PID: 9940)
- Unicorn-25363.exe (PID: 8728)
- Unicorn-14816.exe (PID: 6584)
- Unicorn-4567.exe (PID: 10072)
- Unicorn-53405.exe (PID: 9984)
- Unicorn-31729.exe (PID: 5360)
- Unicorn-30878.exe (PID: 12864)
- Unicorn-1531.exe (PID: 9448)
- Unicorn-48797.exe (PID: 11916)
- Unicorn-40385.exe (PID: 9728)
- Unicorn-41027.exe (PID: 10732)
- Unicorn-12808.exe (PID: 12372)
- Unicorn-12054.exe (PID: 10544)
- Unicorn-47431.exe (PID: 13168)
- Unicorn-42915.exe (PID: 8680)
- Unicorn-14515.exe (PID: 12756)
- Unicorn-33644.exe (PID: 11052)
- Unicorn-30556.exe (PID: 10772)
- Unicorn-57528.exe (PID: 15296)
- Unicorn-20541.exe (PID: 9948)
- Unicorn-10623.exe (PID: 12812)
- Unicorn-32985.exe (PID: 9976)
- Unicorn-42011.exe (PID: 15304)
- Unicorn-60717.exe (PID: 13644)
Checks supported languages
- 1 (180).exe (PID: 7548)
- Unicorn-13191.exe (PID: 2140)
- Unicorn-38765.exe (PID: 4756)
- Unicorn-31151.exe (PID: 7152)
- Unicorn-23057.exe (PID: 7728)
- Unicorn-8360.exe (PID: 5956)
- Unicorn-64141.exe (PID: 7540)
- Unicorn-56528.exe (PID: 1348)
- Unicorn-6196.exe (PID: 7292)
- Unicorn-60036.exe (PID: 7316)
- Unicorn-24889.exe (PID: 2384)
- Unicorn-53569.exe (PID: 4880)
- Unicorn-63565.exe (PID: 1272)
- Unicorn-37015.exe (PID: 7460)
- Unicorn-46964.exe (PID: 1616)
- Unicorn-30893.exe (PID: 3900)
- Unicorn-24837.exe (PID: 1660)
- Unicorn-6454.exe (PID: 1188)
- Unicorn-30037.exe (PID: 5416)
- Unicorn-5532.exe (PID: 6644)
- Unicorn-25391.exe (PID: 5156)
- Unicorn-11654.exe (PID: 1052)
- Unicorn-4883.exe (PID: 5204)
- Unicorn-9232.exe (PID: 6240)
- Unicorn-4386.exe (PID: 6540)
- Unicorn-36425.exe (PID: 5408)
- Unicorn-59075.exe (PID: 4428)
- Unicorn-24173.exe (PID: 4224)
- Unicorn-12667.exe (PID: 7180)
- Unicorn-44785.exe (PID: 7184)
- Unicorn-3368.exe (PID: 7264)
- Unicorn-49040.exe (PID: 7252)
- Unicorn-56964.exe (PID: 7208)
- Unicorn-46108.exe (PID: 5596)
- Unicorn-8604.exe (PID: 7696)
- Unicorn-8339.exe (PID: 7708)
- Unicorn-40893.exe (PID: 6132)
- Unicorn-35339.exe (PID: 7704)
- Unicorn-41085.exe (PID: 7856)
- Unicorn-49808.exe (PID: 2096)
- Unicorn-32917.exe (PID: 2148)
- Unicorn-30870.exe (PID: 7860)
- Unicorn-64695.exe (PID: 8160)
- Unicorn-42045.exe (PID: 6964)
- Unicorn-49643.exe (PID: 6640)
- Unicorn-27245.exe (PID: 8124)
- Unicorn-19962.exe (PID: 7872)
- Unicorn-38537.exe (PID: 7844)
- Unicorn-38921.exe (PID: 7380)
- Unicorn-51920.exe (PID: 7888)
- Unicorn-36351.exe (PID: 8076)
- Unicorn-36491.exe (PID: 7852)
- Unicorn-28898.exe (PID: 7012)
- Unicorn-6440.exe (PID: 4200)
- Unicorn-50270.exe (PID: 2772)
- Unicorn-58795.exe (PID: 6676)
- Unicorn-52865.exe (PID: 2552)
- Unicorn-13155.exe (PID: 8172)
- Unicorn-37275.exe (PID: 2564)
- Unicorn-48397.exe (PID: 7792)
- Unicorn-40037.exe (PID: 7796)
- Unicorn-3280.exe (PID: 7780)
- Unicorn-31499.exe (PID: 7400)
- Unicorn-3670.exe (PID: 7944)
- Unicorn-50893.exe (PID: 8316)
- Unicorn-38641.exe (PID: 8340)
- Unicorn-6907.exe (PID: 8512)
- Unicorn-51853.exe (PID: 8492)
- Unicorn-31603.exe (PID: 8532)
- Unicorn-2963.exe (PID: 8608)
- Unicorn-60213.exe (PID: 8656)
- Unicorn-34012.exe (PID: 8984)
- Unicorn-27276.exe (PID: 8696)
- Unicorn-51640.exe (PID: 8348)
- Unicorn-34291.exe (PID: 8908)
- Unicorn-37245.exe (PID: 8960)
- Unicorn-7675.exe (PID: 8704)
- Unicorn-19949.exe (PID: 8780)
- Unicorn-7120.exe (PID: 9092)
- Unicorn-7675.exe (PID: 8720)
- Unicorn-7675.exe (PID: 8712)
- Unicorn-37977.exe (PID: 9048)
- Unicorn-29928.exe (PID: 8976)
- Unicorn-48921.exe (PID: 8844)
- Unicorn-1308.exe (PID: 8436)
- Unicorn-39705.exe (PID: 9260)
- Unicorn-64764.exe (PID: 9224)
- Unicorn-8101.exe (PID: 5436)
- Unicorn-46019.exe (PID: 2984)
- Unicorn-7587.exe (PID: 8752)
- Unicorn-40089.exe (PID: 8816)
- Unicorn-18635.exe (PID: 7828)
- Unicorn-33958.exe (PID: 5400)
- Unicorn-15008.exe (PID: 9248)
- Unicorn-11116.exe (PID: 8368)
- Unicorn-33819.exe (PID: 9896)
- Unicorn-45325.exe (PID: 9440)
- Unicorn-11427.exe (PID: 9520)
- Unicorn-55081.exe (PID: 3140)
- Unicorn-38309.exe (PID: 9540)
- Unicorn-57944.exe (PID: 9560)
- Unicorn-64074.exe (PID: 9568)
- Unicorn-43929.exe (PID: 9628)
- Unicorn-51447.exe (PID: 9596)
- Unicorn-47546.exe (PID: 9532)
- Unicorn-54135.exe (PID: 9644)
- Unicorn-48169.exe (PID: 9828)
- Unicorn-27941.exe (PID: 9712)
- Unicorn-24526.exe (PID: 9812)
- Unicorn-28413.exe (PID: 9836)
- Unicorn-36316.exe (PID: 9920)
- Unicorn-504.exe (PID: 10236)
- Unicorn-56337.exe (PID: 9820)
- Unicorn-15118.exe (PID: 9748)
- Unicorn-20541.exe (PID: 9948)
- Unicorn-32985.exe (PID: 9976)
- Unicorn-47555.exe (PID: 9960)
- Unicorn-53405.exe (PID: 9984)
- Unicorn-45429.exe (PID: 10008)
- Unicorn-16471.exe (PID: 9460)
- Unicorn-1531.exe (PID: 9448)
- Unicorn-16073.exe (PID: 10096)
- Unicorn-4183.exe (PID: 9764)
- Unicorn-23784.exe (PID: 9740)
- Unicorn-18302.exe (PID: 10080)
- Unicorn-50281.exe (PID: 10220)
- Unicorn-28901.exe (PID: 10000)
- Unicorn-24625.exe (PID: 9940)
- Unicorn-4567.exe (PID: 10072)
- Unicorn-53175.exe (PID: 9492)
- Unicorn-17203.exe (PID: 9968)
- Unicorn-13140.exe (PID: 10108)
- Unicorn-38095.exe (PID: 9412)
- Unicorn-16715.exe (PID: 9856)
- Unicorn-36878.exe (PID: 10536)
- Unicorn-32874.exe (PID: 10680)
- Unicorn-55444.exe (PID: 10600)
- Unicorn-23207.exe (PID: 10708)
- Unicorn-23207.exe (PID: 10700)
- Unicorn-27291.exe (PID: 10780)
- Unicorn-27291.exe (PID: 10788)
- Unicorn-27291.exe (PID: 10800)
- Unicorn-42808.exe (PID: 10716)
- Unicorn-36943.exe (PID: 10760)
- Unicorn-30556.exe (PID: 10772)
- Unicorn-22221.exe (PID: 10816)
- Unicorn-12107.exe (PID: 10860)
- Unicorn-31708.exe (PID: 10852)
- Unicorn-41343.exe (PID: 10888)
- Unicorn-623.exe (PID: 10932)
- Unicorn-60151.exe (PID: 11112)
- Unicorn-5475.exe (PID: 10520)
- Unicorn-50769.exe (PID: 1116)
- Unicorn-27557.exe (PID: 9796)
- Unicorn-5700.exe (PID: 10528)
- Unicorn-36943.exe (PID: 11068)
- Unicorn-15827.exe (PID: 11160)
- Unicorn-53545.exe (PID: 11172)
- Unicorn-60151.exe (PID: 11116)
- Unicorn-1952.exe (PID: 11284)
- Unicorn-2979.exe (PID: 11880)
- Unicorn-55111.exe (PID: 11960)
- Unicorn-25201.exe (PID: 10436)
- Unicorn-24986.exe (PID: 10196)
- Unicorn-31802.exe (PID: 2416)
- Unicorn-55339.exe (PID: 10264)
- Unicorn-11272.exe (PID: 11464)
- Unicorn-34552.exe (PID: 11384)
- Unicorn-41375.exe (PID: 11968)
- Unicorn-60976.exe (PID: 11948)
- Unicorn-12211.exe (PID: 12132)
- Unicorn-22373.exe (PID: 11372)
- Unicorn-10888.exe (PID: 11560)
- Unicorn-43753.exe (PID: 11592)
- Unicorn-43369.exe (PID: 6572)
- Unicorn-27291.exe (PID: 1600)
- Unicorn-30878.exe (PID: 12864)
- Unicorn-41013.exe (PID: 12420)
- Unicorn-64623.exe (PID: 12452)
- Unicorn-48095.exe (PID: 12608)
- Unicorn-8916.exe (PID: 12528)
- Unicorn-3938.exe (PID: 12600)
- Unicorn-35267.exe (PID: 12352)
- Unicorn-9803.exe (PID: 12624)
- Unicorn-12808.exe (PID: 12372)
- Unicorn-14515.exe (PID: 12756)
- Unicorn-10623.exe (PID: 12804)
- Unicorn-24358.exe (PID: 12784)
- Unicorn-22710.exe (PID: 12920)
- Unicorn-19943.exe (PID: 12964)
- Unicorn-19890.exe (PID: 12684)
- Unicorn-10623.exe (PID: 12812)
- Unicorn-3783.exe (PID: 11992)
- Unicorn-55740.exe (PID: 12588)
- Unicorn-18315.exe (PID: 13768)
- Unicorn-47431.exe (PID: 13168)
- Unicorn-35127.exe (PID: 14312)
- Unicorn-22787.exe (PID: 13360)
- Unicorn-19114.exe (PID: 13672)
- Unicorn-55740.exe (PID: 13160)
- Unicorn-25092.exe (PID: 4844)
- Unicorn-51376.exe (PID: 13352)
- Unicorn-60717.exe (PID: 13644)
- Unicorn-9383.exe (PID: 11988)
- Unicorn-32326.exe (PID: 14248)
- Unicorn-21391.exe (PID: 14264)
- Unicorn-19087.exe (PID: 13528)
- Unicorn-41449.exe (PID: 7668)
- Unicorn-18711.exe (PID: 14860)
- Unicorn-38312.exe (PID: 14840)
- Unicorn-32446.exe (PID: 14824)
- Unicorn-6102.exe (PID: 15088)
- Unicorn-18711.exe (PID: 14868)
- Unicorn-1819.exe (PID: 15040)
- Unicorn-19618.exe (PID: 14564)
- Unicorn-3986.exe (PID: 14580)
- Unicorn-47632.exe (PID: 15128)
- Unicorn-61612.exe (PID: 15264)
- Unicorn-33644.exe (PID: 11052)
- Unicorn-49393.exe (PID: 15312)
- Unicorn-60385.exe (PID: 13060)
- Unicorn-57528.exe (PID: 15288)
- Unicorn-21221.exe (PID: 14344)
- Unicorn-28364.exe (PID: 14988)
- Unicorn-26133.exe (PID: 14396)
- Unicorn-30143.exe (PID: 15492)
- Unicorn-58051.exe (PID: 15616)
- Unicorn-6547.exe (PID: 15636)
- Unicorn-43516.exe (PID: 15788)
- Unicorn-49381.exe (PID: 15796)
- Unicorn-32326.exe (PID: 14272)
- Unicorn-46133.exe (PID: 17364)
- Unicorn-22195.exe (PID: 16588)
- Unicorn-37927.exe (PID: 16312)
- Unicorn-29044.exe (PID: 16248)
- Unicorn-16673.exe (PID: 15900)
- Unicorn-44175.exe (PID: 16076)
- Unicorn-35047.exe (PID: 14452)
- Unicorn-9443.exe (PID: 16188)
The sample compiled with chinese language support
- 1 (180).exe (PID: 7548)
Create files in a temporary directory
- Unicorn-38765.exe (PID: 4756)
- Unicorn-23057.exe (PID: 7728)
- Unicorn-24889.exe (PID: 2384)
- Unicorn-31151.exe (PID: 7152)
- Unicorn-8360.exe (PID: 5956)
- 1 (180).exe (PID: 7548)
- Unicorn-53569.exe (PID: 4880)
- Unicorn-64141.exe (PID: 7540)
- Unicorn-60036.exe (PID: 7316)
- Unicorn-56528.exe (PID: 1348)
- Unicorn-25391.exe (PID: 5156)
- Unicorn-30893.exe (PID: 3900)
- Unicorn-6454.exe (PID: 1188)
- Unicorn-46964.exe (PID: 1616)
- Unicorn-11654.exe (PID: 1052)
- Unicorn-9232.exe (PID: 6240)
- Unicorn-6196.exe (PID: 7292)
- Unicorn-43227.exe (PID: 1056)
- Unicorn-13191.exe (PID: 2140)
- Unicorn-4883.exe (PID: 5204)
- Unicorn-4386.exe (PID: 6540)
- Unicorn-17955.exe (PID: 5720)
- Unicorn-37015.exe (PID: 7460)
- Unicorn-26123.exe (PID: 5800)
- Unicorn-12667.exe (PID: 7180)
- Unicorn-60161.exe (PID: 6036)
- Unicorn-36425.exe (PID: 5408)
- Unicorn-59075.exe (PID: 4428)
- Unicorn-44785.exe (PID: 7184)
- Unicorn-24173.exe (PID: 4224)
- Unicorn-24837.exe (PID: 1660)
- Unicorn-63565.exe (PID: 1272)
- Unicorn-46108.exe (PID: 5596)
- Unicorn-30037.exe (PID: 5416)
- Unicorn-8339.exe (PID: 7708)
- Unicorn-65376.exe (PID: 7200)
- Unicorn-8604.exe (PID: 7696)
- Unicorn-49040.exe (PID: 7252)
- Unicorn-5532.exe (PID: 6644)
- Unicorn-32917.exe (PID: 2148)
- Unicorn-27245.exe (PID: 8124)
- Unicorn-56964.exe (PID: 7208)
- Unicorn-49803.exe (PID: 8052)
- Unicorn-53529.exe (PID: 8068)
- Unicorn-50535.exe (PID: 6512)
- Unicorn-57613.exe (PID: 6404)
- Unicorn-51920.exe (PID: 7888)
- Unicorn-41085.exe (PID: 7856)
- Unicorn-42045.exe (PID: 6964)
- Unicorn-49643.exe (PID: 6640)
- Unicorn-44405.exe (PID: 5984)
- Unicorn-36491.exe (PID: 7852)
- Unicorn-38921.exe (PID: 7380)
- Unicorn-48397.exe (PID: 7792)
- Unicorn-15340.exe (PID: 1568)
- Unicorn-64695.exe (PID: 8160)
- Unicorn-24941.exe (PID: 5868)
- Unicorn-19962.exe (PID: 7872)
- Unicorn-51853.exe (PID: 8492)
- Unicorn-60597.exe (PID: 8592)
- Unicorn-3280.exe (PID: 7780)
- Unicorn-47276.exe (PID: 9012)
- Unicorn-38641.exe (PID: 8340)
- Unicorn-10694.exe (PID: 8952)
- Unicorn-6907.exe (PID: 8512)
- Unicorn-32829.exe (PID: 7924)
- Unicorn-60213.exe (PID: 8656)
- Unicorn-3368.exe (PID: 7264)
- Unicorn-62159.exe (PID: 8648)
- Unicorn-19949.exe (PID: 8788)
- Unicorn-27276.exe (PID: 8696)
- Unicorn-52865.exe (PID: 2552)
- Unicorn-41765.exe (PID: 2644)
- Unicorn-30665.exe (PID: 8500)
- Unicorn-29928.exe (PID: 8976)
- Unicorn-3670.exe (PID: 7944)
- Unicorn-50960.exe (PID: 8024)
- Unicorn-49336.exe (PID: 1040)
- Unicorn-19949.exe (PID: 8780)
- Unicorn-8101.exe (PID: 5436)
- Unicorn-17571.exe (PID: 8444)
- Unicorn-7504.exe (PID: 8628)
- Unicorn-64711.exe (PID: 9076)
- Unicorn-222.exe (PID: 8540)
- Unicorn-58677.exe (PID: 8388)
- Unicorn-33005.exe (PID: 2152)
- Unicorn-25569.exe (PID: 920)
- Unicorn-28413.exe (PID: 9836)
- Unicorn-7675.exe (PID: 8704)
- Unicorn-12372.exe (PID: 9912)
- Unicorn-54069.exe (PID: 9404)
- Unicorn-40893.exe (PID: 6132)
- Unicorn-18302.exe (PID: 10080)
- Unicorn-36316.exe (PID: 9920)
- Unicorn-48787.exe (PID: 8176)
- Unicorn-36351.exe (PID: 8076)
- Unicorn-55863.exe (PID: 8220)
- Unicorn-48921.exe (PID: 8844)
- Unicorn-25363.exe (PID: 8728)
- Unicorn-24411.exe (PID: 9864)
- Unicorn-34291.exe (PID: 8908)
- Unicorn-4567.exe (PID: 10072)
- Unicorn-34012.exe (PID: 8984)
- Unicorn-14816.exe (PID: 6584)
- Unicorn-37977.exe (PID: 9048)
- Unicorn-27291.exe (PID: 10788)
- Unicorn-16073.exe (PID: 10096)
- Unicorn-56217.exe (PID: 8080)
- Unicorn-30870.exe (PID: 7860)
- Unicorn-60613.exe (PID: 9888)
- Unicorn-8603.exe (PID: 8008)
- Unicorn-37275.exe (PID: 2564)
- Unicorn-50893.exe (PID: 8316)
- Unicorn-17713.exe (PID: 11208)
- Unicorn-58795.exe (PID: 6676)
- Unicorn-50270.exe (PID: 2772)
- Unicorn-37913.exe (PID: 632)
- Unicorn-48361.exe (PID: 9904)
- Unicorn-11775.exe (PID: 12880)
- Unicorn-13155.exe (PID: 8172)
- Unicorn-43611.exe (PID: 8204)
- Unicorn-48797.exe (PID: 11916)
- Unicorn-623.exe (PID: 10932)
- Unicorn-43929.exe (PID: 9628)
- Unicorn-61203.exe (PID: 8408)
- Unicorn-39793.exe (PID: 8688)
- Unicorn-24625.exe (PID: 9940)
- Unicorn-54135.exe (PID: 9644)
- Unicorn-15791.exe (PID: 14288)
- Unicorn-7675.exe (PID: 8712)
- Unicorn-2943.exe (PID: 13108)
- Unicorn-8916.exe (PID: 12528)
- Unicorn-3640.exe (PID: 12000)
- Unicorn-41343.exe (PID: 10888)
- Unicorn-64233.exe (PID: 15144)
- Unicorn-57528.exe (PID: 15296)
- Unicorn-60151.exe (PID: 11112)
- Unicorn-22186.exe (PID: 3396)
- Unicorn-49808.exe (PID: 2096)
- Unicorn-64193.exe (PID: 8048)
- Unicorn-9569.exe (PID: 1676)
- Unicorn-7587.exe (PID: 8752)
- Unicorn-46197.exe (PID: 10200)
- Unicorn-28901.exe (PID: 10000)
- Unicorn-31729.exe (PID: 5360)
- Unicorn-13560.exe (PID: 8376)
Creates files or folders in the user directory
- WerFault.exe (PID: 8412)
- WerFault.exe (PID: 14892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
749
Monitored processes
613
Malicious processes
92
Suspicious processes
69
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 496 | C:\Users\admin\AppData\Local\Temp\Unicorn-9382.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9382.exe | — | Unicorn-64193.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 632 | C:\Users\admin\AppData\Local\Temp\Unicorn-37913.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-37913.exe | Unicorn-24837.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 684 | C:\Users\admin\AppData\Local\Temp\Unicorn-55849.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-55849.exe | Unicorn-2963.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 856 | C:\Users\admin\AppData\Local\Temp\Unicorn-46901.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46901.exe | — | Unicorn-22186.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 920 | C:\Users\admin\AppData\Local\Temp\Unicorn-25569.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-25569.exe | Unicorn-30893.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1040 | C:\Users\admin\AppData\Local\Temp\Unicorn-49336.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49336.exe | Unicorn-30037.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1052 | C:\Users\admin\AppData\Local\Temp\Unicorn-11654.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-11654.exe | Unicorn-31151.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1056 | C:\Users\admin\AppData\Local\Temp\Unicorn-43227.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-43227.exe | Unicorn-24889.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1116 | C:\Users\admin\AppData\Local\Temp\Unicorn-50769.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-50769.exe | — | Unicorn-18302.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1188 | C:\Users\admin\AppData\Local\Temp\Unicorn-6454.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-6454.exe | Unicorn-38765.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
14 838
Read events
14 838
Write events
0
Delete events
0
Modification events
Executable files
751
Suspicious files
3
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7548 | 1 (180).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-23057.exe | executable | |
MD5:5E1DCB435A1E8733D2822C385B7BBCC4 | SHA256:F4A7045986052F00E958B207E550D50A1BE5EC38F7F7AB2A43627AB58A30946C | |||
| 7152 | Unicorn-31151.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24889.exe | executable | |
MD5:4A05AA2E5CD8FA86522D756ABDF90271 | SHA256:2368C9B39F000BC0191EAC5C5BEF6CB85C7D66EDA28467F7BA6B309932A4BF86 | |||
| 7728 | Unicorn-23057.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-38765.exe | executable | |
MD5:386EBC5F1338EE0296AD28B8538BBED7 | SHA256:B10D6F7DDAAADDFFFFCDE05C7EFCC5F6D37AE48A150D3EEF4283963E11BB21D4 | |||
| 7548 | 1 (180).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-31151.exe | executable | |
MD5:ED540C0B74021AC87C7BC74C034357D4 | SHA256:E2F21F7DF90495A07E30759FE5961DF9B55B95E990F1384A9CF16934879DBF87 | |||
| 7548 | 1 (180).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53569.exe | executable | |
MD5:020F1C4E3ACF1E1EB6C8EE9556BECC16 | SHA256:A121ADF8B86D001E32A1E4EA605041D72936D7606A3E4D3CFFF4E351A74CC3B7 | |||
| 7728 | Unicorn-23057.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13191.exe | executable | |
MD5:EA4F04FE4C2235069CB6C9FDA2353830 | SHA256:BBF4EE17D375AD5F6E24A670193A7FE7E615A301DB66BBFCCF2EF725FF1DBC55 | |||
| 4756 | Unicorn-38765.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8360.exe | executable | |
MD5:27FA6406E28C06E7CD33849CBACD9425 | SHA256:BFDFFF60C03728F4CA25A90B76980F3DD6FC3FFF891DF43317F8655C5105D5FD | |||
| 4756 | Unicorn-38765.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56528.exe | executable | |
MD5:22AB4EACBE80853F1B2CB807EAB99943 | SHA256:75CFAFD21B15CDAE65791FA4FCCB0DEEF6CA64F843DB95977440C991453FAD32 | |||
| 7540 | Unicorn-64141.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-33005.exe | executable | |
MD5:C4E1A31349E9C9A7864C2BE56A71122B | SHA256:B60C506C19D0882F50FBCF1AAF12CCEE581AFCB4F374E8443F62B4DB5F48FE96 | |||
| 5956 | Unicorn-8360.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-25391.exe | executable | |
MD5:B82F358AB5EC306743474CE35C61956E | SHA256:E5B2B782BD11EC4C29D0B9070B142112BE0E427B287DF816D108D54B936C06E6 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
15
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
2092 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7772 | backgroundTaskHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.48.23.150:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
2092 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.48.23.150:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.159.75:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 23.54.109.203:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
7772 | backgroundTaskHost.exe | 20.199.58.43:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
7772 | backgroundTaskHost.exe | 23.54.109.203:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |