| File name: | 1 (1422) |
| Full analysis: | https://app.any.run/tasks/3f44dbf2-b467-43a0-b027-ead7fcee0d2e |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 14:40:47 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | DB1D722B5D41FD6B2F70D9C341C12300 |
| SHA1: | C4FEC0299B4E41D4A4606D61C8BE2D3F54FCFABE |
| SHA256: | FE06888785B679EFD3FB21A4C3EE9FB422C315D85B21D847DDA0104C953642E8 |
| SSDEEP: | 6144:07wJlrIfQD82A5RaMUeQRSfx5D3/lB8GBC/7yemaTk/8SwjwpyAvEhTf1tFBsOUa:0sPcZ2A5IMXr3tWaCjyema8x4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- 1 (1422).exe (PID: 6876)
- Unicorn-9919.exe (PID: 7244)
- Unicorn-778.exe (PID: 7936)
- Unicorn-59538.exe (PID: 7928)
- Unicorn-48796.exe (PID: 8024)
- Unicorn-3679.exe (PID: 8052)
- Unicorn-63086.exe (PID: 8044)
- Unicorn-29807.exe (PID: 8076)
- Unicorn-5407.exe (PID: 8112)
- Unicorn-58884.exe (PID: 8148)
- Unicorn-50716.exe (PID: 8164)
- Unicorn-1878.exe (PID: 8132)
- Unicorn-45510.exe (PID: 664)
- Unicorn-61385.exe (PID: 6264)
- Unicorn-51640.exe (PID: 6040)
- Unicorn-21670.exe (PID: 8184)
- Unicorn-44816.exe (PID: 4300)
- Unicorn-49455.exe (PID: 5640)
- Unicorn-8827.exe (PID: 2088)
- Unicorn-20120.exe (PID: 4228)
- Unicorn-5821.exe (PID: 3268)
- Unicorn-50052.exe (PID: 5892)
- Unicorn-22018.exe (PID: 3132)
- Unicorn-275.exe (PID: 1452)
- Unicorn-37778.exe (PID: 3784)
- Unicorn-62797.exe (PID: 5392)
- Unicorn-9382.exe (PID: 5936)
- Unicorn-59682.exe (PID: 5968)
- Unicorn-57379.exe (PID: 4244)
- Unicorn-275.exe (PID: 6972)
- Unicorn-49783.exe (PID: 6388)
- Unicorn-64971.exe (PID: 7580)
- Unicorn-53041.exe (PID: 7660)
- Unicorn-2178.exe (PID: 5072)
- Unicorn-64416.exe (PID: 7296)
- Unicorn-44188.exe (PID: 1760)
- Unicorn-64608.exe (PID: 4212)
- Unicorn-34436.exe (PID: 7556)
- Unicorn-11058.exe (PID: 7600)
- Unicorn-58713.exe (PID: 6300)
- Unicorn-15023.exe (PID: 7532)
- Unicorn-33066.exe (PID: 7528)
- Unicorn-62169.exe (PID: 7520)
- Unicorn-40580.exe (PID: 7880)
- Unicorn-2946.exe (PID: 1764)
- Unicorn-26844.exe (PID: 7872)
- Unicorn-4608.exe (PID: 7712)
- Unicorn-4608.exe (PID: 7904)
- Unicorn-20068.exe (PID: 7468)
- Unicorn-36020.exe (PID: 7844)
- Unicorn-4608.exe (PID: 7756)
- Unicorn-44307.exe (PID: 7828)
- Unicorn-4608.exe (PID: 7908)
- Unicorn-17829.exe (PID: 7812)
- Unicorn-15029.exe (PID: 7972)
- Unicorn-57379.exe (PID: 3768)
- Unicorn-51779.exe (PID: 8000)
- Unicorn-4094.exe (PID: 7888)
- Unicorn-45127.exe (PID: 7676)
- Unicorn-45257.exe (PID: 7740)
- Unicorn-4094.exe (PID: 7996)
- Unicorn-36020.exe (PID: 7744)
- Unicorn-37712.exe (PID: 5400)
- Unicorn-54603.exe (PID: 1012)
- Unicorn-41988.exe (PID: 1040)
- Unicorn-38864.exe (PID: 6576)
- Unicorn-55755.exe (PID: 6344)
- Unicorn-14167.exe (PID: 6228)
- Unicorn-44026.exe (PID: 3008)
- Unicorn-43118.exe (PID: 7216)
- Unicorn-22890.exe (PID: 7876)
- Unicorn-26036.exe (PID: 7724)
- Unicorn-46959.exe (PID: 744)
- Unicorn-46648.exe (PID: 3140)
- Unicorn-22890.exe (PID: 7856)
- Unicorn-9699.exe (PID: 7444)
- Unicorn-26036.exe (PID: 7232)
- Unicorn-41670.exe (PID: 7728)
- Unicorn-35356.exe (PID: 2852)
- Unicorn-10659.exe (PID: 8204)
- Unicorn-26617.exe (PID: 7736)
- Unicorn-37062.exe (PID: 8392)
- Unicorn-54690.exe (PID: 8284)
- Unicorn-7535.exe (PID: 8328)
- Unicorn-36316.exe (PID: 8272)
- Unicorn-28702.exe (PID: 8240)
- Unicorn-62169.exe (PID: 7852)
- Unicorn-24064.exe (PID: 8408)
- Unicorn-6886.exe (PID: 8476)
- Unicorn-60436.exe (PID: 8448)
- Unicorn-4006.exe (PID: 8360)
- Unicorn-2802.exe (PID: 8484)
- Unicorn-48376.exe (PID: 8516)
- Unicorn-16664.exe (PID: 8580)
- Unicorn-16834.exe (PID: 8616)
- Unicorn-44100.exe (PID: 8432)
- Unicorn-42246.exe (PID: 8508)
- Unicorn-57312.exe (PID: 8728)
- Unicorn-57312.exe (PID: 8704)
- Unicorn-44868.exe (PID: 8596)
- Unicorn-12195.exe (PID: 8720)
- Unicorn-57312.exe (PID: 8696)
- Unicorn-46020.exe (PID: 8780)
- Unicorn-50104.exe (PID: 8796)
- Unicorn-306.exe (PID: 8664)
- Unicorn-49144.exe (PID: 8672)
- Unicorn-5542.exe (PID: 8864)
- Unicorn-50104.exe (PID: 8772)
- Unicorn-57312.exe (PID: 8712)
- Unicorn-48931.exe (PID: 8540)
- Unicorn-33938.exe (PID: 9056)
- Unicorn-50064.exe (PID: 8916)
- Unicorn-25408.exe (PID: 8856)
- Unicorn-63103.exe (PID: 8956)
- Unicorn-50104.exe (PID: 8788)
- Unicorn-4914.exe (PID: 8964)
- Unicorn-25408.exe (PID: 8848)
- Unicorn-52334.exe (PID: 8940)
- Unicorn-25408.exe (PID: 8872)
- Unicorn-33938.exe (PID: 9064)
- Unicorn-52334.exe (PID: 8924)
- Unicorn-8302.exe (PID: 8980)
- Unicorn-5371.exe (PID: 9120)
- Unicorn-38236.exe (PID: 9112)
- Unicorn-46596.exe (PID: 9148)
- Unicorn-32297.exe (PID: 9156)
- Unicorn-27654.exe (PID: 9212)
- Unicorn-19486.exe (PID: 9184)
- Unicorn-31376.exe (PID: 4040)
- Unicorn-34884.exe (PID: 8228)
- Unicorn-30800.exe (PID: 5776)
- Unicorn-34884.exe (PID: 8420)
- Unicorn-47328.exe (PID: 9236)
- Unicorn-20777.exe (PID: 1132)
- Unicorn-7042.exe (PID: 9220)
- Unicorn-10769.exe (PID: 9372)
- Unicorn-27462.exe (PID: 9228)
- Unicorn-47904.exe (PID: 9400)
- Unicorn-47904.exe (PID: 9408)
- Unicorn-65392.exe (PID: 9516)
- Unicorn-64415.exe (PID: 9508)
- Unicorn-47904.exe (PID: 9392)
- Unicorn-36996.exe (PID: 9540)
- Unicorn-18421.exe (PID: 9632)
- Unicorn-16384.exe (PID: 9640)
- Unicorn-49419.exe (PID: 9696)
- Unicorn-33466.exe (PID: 9556)
- Unicorn-24552.exe (PID: 9624)
- Unicorn-7638.exe (PID: 9776)
- Unicorn-53908.exe (PID: 9744)
- Unicorn-18037.exe (PID: 9716)
- Unicorn-49419.exe (PID: 9688)
Executable content was dropped or overwritten
- 1 (1422).exe (PID: 6876)
- Unicorn-9919.exe (PID: 7244)
- Unicorn-778.exe (PID: 7936)
- Unicorn-59538.exe (PID: 7928)
- Unicorn-3679.exe (PID: 8052)
- Unicorn-63086.exe (PID: 8044)
- Unicorn-48796.exe (PID: 8024)
- Unicorn-29807.exe (PID: 8076)
- Unicorn-5407.exe (PID: 8112)
- Unicorn-1878.exe (PID: 8132)
- Unicorn-50716.exe (PID: 8164)
- Unicorn-58884.exe (PID: 8148)
- Unicorn-45510.exe (PID: 664)
- Unicorn-61385.exe (PID: 6264)
- Unicorn-21670.exe (PID: 8184)
- Unicorn-44816.exe (PID: 4300)
- Unicorn-49455.exe (PID: 5640)
- Unicorn-5821.exe (PID: 3268)
- Unicorn-20120.exe (PID: 4228)
- Unicorn-8827.exe (PID: 2088)
- Unicorn-50052.exe (PID: 5892)
- Unicorn-59682.exe (PID: 5968)
- Unicorn-58713.exe (PID: 6300)
- Unicorn-275.exe (PID: 6972)
- Unicorn-9382.exe (PID: 5936)
- Unicorn-51640.exe (PID: 6040)
- Unicorn-64416.exe (PID: 7296)
- Unicorn-64971.exe (PID: 7580)
- Unicorn-53041.exe (PID: 7660)
- Unicorn-2178.exe (PID: 5072)
- Unicorn-64608.exe (PID: 4212)
- Unicorn-34436.exe (PID: 7556)
- Unicorn-44188.exe (PID: 1760)
- Unicorn-15023.exe (PID: 7532)
- Unicorn-33066.exe (PID: 7528)
- Unicorn-62169.exe (PID: 7520)
- Unicorn-62169.exe (PID: 7852)
- Unicorn-2946.exe (PID: 1764)
- Unicorn-26844.exe (PID: 7872)
- Unicorn-22018.exe (PID: 3132)
- Unicorn-40580.exe (PID: 7880)
- Unicorn-4608.exe (PID: 7712)
- Unicorn-4608.exe (PID: 7904)
- Unicorn-20068.exe (PID: 7468)
- Unicorn-49783.exe (PID: 6388)
- Unicorn-36020.exe (PID: 7844)
- Unicorn-51779.exe (PID: 8000)
- Unicorn-62797.exe (PID: 5392)
- Unicorn-15029.exe (PID: 7972)
- Unicorn-4608.exe (PID: 7756)
- Unicorn-17829.exe (PID: 7812)
- Unicorn-45257.exe (PID: 7740)
- Unicorn-57379.exe (PID: 4244)
- Unicorn-275.exe (PID: 1452)
- Unicorn-54603.exe (PID: 1012)
- Unicorn-37712.exe (PID: 5400)
- Unicorn-41988.exe (PID: 1040)
- Unicorn-38864.exe (PID: 6576)
- Unicorn-55755.exe (PID: 6344)
- Unicorn-46959.exe (PID: 744)
- Unicorn-44026.exe (PID: 3008)
- Unicorn-43118.exe (PID: 7216)
- Unicorn-26036.exe (PID: 7724)
- Unicorn-26036.exe (PID: 7232)
- Unicorn-9699.exe (PID: 7444)
- Unicorn-26617.exe (PID: 7736)
- Unicorn-22890.exe (PID: 7856)
- Unicorn-35356.exe (PID: 2852)
- Unicorn-36316.exe (PID: 8272)
- Unicorn-41670.exe (PID: 7728)
- Unicorn-10659.exe (PID: 8204)
- Unicorn-54690.exe (PID: 8284)
- Unicorn-37062.exe (PID: 8392)
- Unicorn-7535.exe (PID: 8328)
- Unicorn-4006.exe (PID: 8360)
- Unicorn-28702.exe (PID: 8240)
- Unicorn-6886.exe (PID: 8476)
- Unicorn-60436.exe (PID: 8448)
- Unicorn-44100.exe (PID: 8432)
- Unicorn-24064.exe (PID: 8408)
- Unicorn-42246.exe (PID: 8508)
- Unicorn-2802.exe (PID: 8484)
- Unicorn-48931.exe (PID: 8540)
- Unicorn-16664.exe (PID: 8580)
- Unicorn-16834.exe (PID: 8616)
- Unicorn-12195.exe (PID: 8720)
- Unicorn-57312.exe (PID: 8704)
- Unicorn-306.exe (PID: 8664)
- Unicorn-44868.exe (PID: 8596)
- Unicorn-57312.exe (PID: 8728)
- Unicorn-46020.exe (PID: 8780)
- Unicorn-50104.exe (PID: 8796)
- Unicorn-57312.exe (PID: 8696)
- Unicorn-44307.exe (PID: 7828)
- Unicorn-5542.exe (PID: 8864)
- Unicorn-4094.exe (PID: 7888)
- Unicorn-50104.exe (PID: 8772)
- Unicorn-57312.exe (PID: 8712)
- Unicorn-57379.exe (PID: 3768)
- Unicorn-333.exe (PID: 8948)
- Unicorn-45127.exe (PID: 7676)
- Unicorn-50064.exe (PID: 8916)
- Unicorn-25408.exe (PID: 8856)
- Unicorn-33938.exe (PID: 9056)
- Unicorn-50104.exe (PID: 8788)
- Unicorn-36020.exe (PID: 7744)
- Unicorn-4914.exe (PID: 8964)
- Unicorn-25408.exe (PID: 8848)
- Unicorn-4094.exe (PID: 7996)
- Unicorn-37778.exe (PID: 3784)
- Unicorn-33938.exe (PID: 9064)
- Unicorn-52334.exe (PID: 8924)
- Unicorn-52334.exe (PID: 8940)
- Unicorn-5371.exe (PID: 9120)
- Unicorn-38236.exe (PID: 9112)
- Unicorn-8302.exe (PID: 8980)
- Unicorn-50851.exe (PID: 8972)
- Unicorn-46596.exe (PID: 9148)
- Unicorn-14167.exe (PID: 6228)
- Unicorn-27654.exe (PID: 9212)
- Unicorn-19486.exe (PID: 9184)
- Unicorn-34884.exe (PID: 8420)
- Unicorn-30800.exe (PID: 5776)
- Unicorn-47328.exe (PID: 9236)
- Unicorn-27462.exe (PID: 9228)
- Unicorn-31376.exe (PID: 4040)
- Unicorn-34884.exe (PID: 8228)
- Unicorn-46648.exe (PID: 3140)
- Unicorn-20777.exe (PID: 1132)
- Unicorn-7042.exe (PID: 9220)
- Unicorn-10769.exe (PID: 9372)
- Unicorn-47904.exe (PID: 9392)
- Unicorn-33466.exe (PID: 9556)
- Unicorn-65392.exe (PID: 9516)
- Unicorn-64415.exe (PID: 9508)
- Unicorn-47904.exe (PID: 9400)
- Unicorn-47904.exe (PID: 9408)
- Unicorn-36996.exe (PID: 9540)
- Unicorn-24552.exe (PID: 9624)
- Unicorn-18421.exe (PID: 9632)
- Unicorn-49419.exe (PID: 9696)
- Unicorn-18037.exe (PID: 9716)
- Unicorn-16384.exe (PID: 9640)
- Unicorn-49419.exe (PID: 9688)
- Unicorn-53908.exe (PID: 9744)
- Unicorn-7638.exe (PID: 9776)
- Unicorn-16768.exe (PID: 9828)
- Unicorn-48376.exe (PID: 8516)
- Unicorn-46508.exe (PID: 9856)
- Unicorn-63103.exe (PID: 8956)
- Unicorn-19050.exe (PID: 10012)
- Unicorn-10519.exe (PID: 9972)
- Unicorn-25408.exe (PID: 8872)
- Unicorn-31708.exe (PID: 10048)
- Unicorn-62771.exe (PID: 9888)
- Unicorn-22174.exe (PID: 9912)
- Unicorn-4608.exe (PID: 7908)
- Unicorn-32297.exe (PID: 9156)
- Unicorn-56383.exe (PID: 10144)
- Unicorn-60104.exe (PID: 10196)
- Unicorn-43576.exe (PID: 10116)
- Unicorn-2543.exe (PID: 10172)
- Unicorn-48812.exe (PID: 9476)
- Unicorn-23156.exe (PID: 5056)
- Unicorn-22069.exe (PID: 9296)
- Unicorn-56404.exe (PID: 10088)
- Unicorn-45806.exe (PID: 10216)
- Unicorn-49736.exe (PID: 10368)
- Unicorn-16310.exe (PID: 7684)
- Unicorn-40452.exe (PID: 7396)
- Unicorn-343.exe (PID: 10284)
- Unicorn-29316.exe (PID: 10348)
- Unicorn-48782.exe (PID: 10292)
- Unicorn-41390.exe (PID: 9572)
- Unicorn-59210.exe (PID: 9608)
- Unicorn-32284.exe (PID: 7616)
- Unicorn-535.exe (PID: 10412)
- Unicorn-3778.exe (PID: 10488)
- Unicorn-3281.exe (PID: 10480)
- Unicorn-28932.exe (PID: 10504)
- Unicorn-42807.exe (PID: 10528)
- Unicorn-14302.exe (PID: 10580)
- Unicorn-19869.exe (PID: 10592)
- Unicorn-58459.exe (PID: 10448)
- Unicorn-50099.exe (PID: 10336)
- Unicorn-22801.exe (PID: 10496)
- Unicorn-29508.exe (PID: 10624)
- Unicorn-42506.exe (PID: 10660)
- Unicorn-52334.exe (PID: 8932)
- Unicorn-30660.exe (PID: 10680)
- Unicorn-39020.exe (PID: 10792)
- Unicorn-31337.exe (PID: 9004)
- Unicorn-63332.exe (PID: 10716)
- Unicorn-39897.exe (PID: 10688)
- Unicorn-22684.exe (PID: 10764)
- Unicorn-50696.exe (PID: 10824)
- Unicorn-22890.exe (PID: 7876)
- Unicorn-54780.exe (PID: 10860)
- Unicorn-18770.exe (PID: 10968)
- Unicorn-59419.exe (PID: 10868)
- Unicorn-50888.exe (PID: 10936)
- Unicorn-22684.exe (PID: 10760)
- Unicorn-30852.exe (PID: 10744)
- Unicorn-36066.exe (PID: 11020)
- Unicorn-2647.exe (PID: 11004)
- Unicorn-20764.exe (PID: 10516)
- Unicorn-15838.exe (PID: 11060)
- Unicorn-44235.exe (PID: 11012)
- Unicorn-62054.exe (PID: 10996)
- Unicorn-2839.exe (PID: 11100)
- Unicorn-2839.exe (PID: 11108)
- Unicorn-23452.exe (PID: 11084)
- Unicorn-14686.exe (PID: 10896)
- Unicorn-19346.exe (PID: 6620)
- Unicorn-11007.exe (PID: 11184)
- Unicorn-64847.exe (PID: 11152)
- Unicorn-11007.exe (PID: 11196)
- Unicorn-40342.exe (PID: 11132)
- Unicorn-35128.exe (PID: 11208)
- Unicorn-56679.exe (PID: 11160)
- Unicorn-11007.exe (PID: 11176)
- Unicorn-19346.exe (PID: 11256)
- Unicorn-3202.exe (PID: 872)
- Unicorn-16937.exe (PID: 3032)
- Unicorn-23763.exe (PID: 11428)
- Unicorn-55740.exe (PID: 11320)
- Unicorn-3202.exe (PID: 8232)
- Unicorn-54397.exe (PID: 11332)
- Unicorn-51656.exe (PID: 3024)
- Unicorn-18806.exe (PID: 680)
- Unicorn-10814.exe (PID: 11396)
- Unicorn-30149.exe (PID: 11372)
- Unicorn-44043.exe (PID: 11300)
- Unicorn-27349.exe (PID: 11388)
- Unicorn-50570.exe (PID: 11544)
- Unicorn-44448.exe (PID: 11504)
- Unicorn-44448.exe (PID: 11496)
- Unicorn-44183.exe (PID: 11484)
- Unicorn-30149.exe (PID: 11380)
- Unicorn-27847.exe (PID: 11460)
- Unicorn-63014.exe (PID: 11600)
- Unicorn-49144.exe (PID: 8672)
- Unicorn-7115.exe (PID: 11680)
- Unicorn-32388.exe (PID: 11572)
- Unicorn-60400.exe (PID: 11664)
- Unicorn-23644.exe (PID: 11636)
- Unicorn-27847.exe (PID: 11420)
- Unicorn-18792.exe (PID: 11348)
- Unicorn-58023.exe (PID: 11816)
- Unicorn-9206.exe (PID: 11836)
- Unicorn-21458.exe (PID: 11884)
- Unicorn-27880.exe (PID: 11404)
- Unicorn-41059.exe (PID: 11892)
Executes application which crashes
- Unicorn-11058.exe (PID: 7600)
- Unicorn-10498.exe (PID: 616)
- Unicorn-26036.exe (PID: 7724)
- Unicorn-26036.exe (PID: 7232)
INFO
The sample compiled with chinese language support
- 1 (1422).exe (PID: 6876)
- Unicorn-9919.exe (PID: 7244)
- Unicorn-59538.exe (PID: 7928)
- Unicorn-778.exe (PID: 7936)
- Unicorn-48796.exe (PID: 8024)
- Unicorn-63086.exe (PID: 8044)
- Unicorn-29807.exe (PID: 8076)
- Unicorn-5407.exe (PID: 8112)
- Unicorn-1878.exe (PID: 8132)
- Unicorn-3679.exe (PID: 8052)
- Unicorn-58884.exe (PID: 8148)
- Unicorn-50716.exe (PID: 8164)
- Unicorn-21670.exe (PID: 8184)
- Unicorn-61385.exe (PID: 6264)
- Unicorn-45510.exe (PID: 664)
- Unicorn-44816.exe (PID: 4300)
- Unicorn-49455.exe (PID: 5640)
- Unicorn-20120.exe (PID: 4228)
- Unicorn-8827.exe (PID: 2088)
- Unicorn-50052.exe (PID: 5892)
- Unicorn-5821.exe (PID: 3268)
- Unicorn-58713.exe (PID: 6300)
- Unicorn-275.exe (PID: 6972)
- Unicorn-59682.exe (PID: 5968)
- Unicorn-9382.exe (PID: 5936)
- Unicorn-51640.exe (PID: 6040)
- Unicorn-64416.exe (PID: 7296)
- Unicorn-64971.exe (PID: 7580)
- Unicorn-53041.exe (PID: 7660)
- Unicorn-2178.exe (PID: 5072)
- Unicorn-44188.exe (PID: 1760)
- Unicorn-64608.exe (PID: 4212)
- Unicorn-34436.exe (PID: 7556)
- Unicorn-15023.exe (PID: 7532)
- Unicorn-33066.exe (PID: 7528)
- Unicorn-62169.exe (PID: 7520)
- Unicorn-62169.exe (PID: 7852)
- Unicorn-40580.exe (PID: 7880)
- Unicorn-2946.exe (PID: 1764)
- Unicorn-26844.exe (PID: 7872)
- Unicorn-22018.exe (PID: 3132)
- Unicorn-4608.exe (PID: 7712)
- Unicorn-4608.exe (PID: 7904)
- Unicorn-20068.exe (PID: 7468)
- Unicorn-49783.exe (PID: 6388)
- Unicorn-36020.exe (PID: 7844)
- Unicorn-51779.exe (PID: 8000)
- Unicorn-62797.exe (PID: 5392)
- Unicorn-17829.exe (PID: 7812)
- Unicorn-15029.exe (PID: 7972)
- Unicorn-4608.exe (PID: 7756)
- Unicorn-275.exe (PID: 1452)
- Unicorn-45257.exe (PID: 7740)
- Unicorn-57379.exe (PID: 4244)
- Unicorn-37712.exe (PID: 5400)
- Unicorn-41988.exe (PID: 1040)
- Unicorn-54603.exe (PID: 1012)
- Unicorn-38864.exe (PID: 6576)
- Unicorn-55755.exe (PID: 6344)
- Unicorn-46959.exe (PID: 744)
- Unicorn-44026.exe (PID: 3008)
- Unicorn-26036.exe (PID: 7724)
- Unicorn-43118.exe (PID: 7216)
- Unicorn-22890.exe (PID: 7856)
- Unicorn-9699.exe (PID: 7444)
- Unicorn-26617.exe (PID: 7736)
- Unicorn-26036.exe (PID: 7232)
- Unicorn-10659.exe (PID: 8204)
- Unicorn-36316.exe (PID: 8272)
- Unicorn-41670.exe (PID: 7728)
- Unicorn-35356.exe (PID: 2852)
- Unicorn-54690.exe (PID: 8284)
- Unicorn-37062.exe (PID: 8392)
- Unicorn-7535.exe (PID: 8328)
- Unicorn-28702.exe (PID: 8240)
- Unicorn-24064.exe (PID: 8408)
- Unicorn-6886.exe (PID: 8476)
- Unicorn-60436.exe (PID: 8448)
- Unicorn-44100.exe (PID: 8432)
- Unicorn-4006.exe (PID: 8360)
- Unicorn-2802.exe (PID: 8484)
- Unicorn-48931.exe (PID: 8540)
- Unicorn-16664.exe (PID: 8580)
- Unicorn-16834.exe (PID: 8616)
- Unicorn-42246.exe (PID: 8508)
- Unicorn-57312.exe (PID: 8704)
- Unicorn-12195.exe (PID: 8720)
- Unicorn-57312.exe (PID: 8728)
- Unicorn-44868.exe (PID: 8596)
- Unicorn-46020.exe (PID: 8780)
- Unicorn-50104.exe (PID: 8796)
- Unicorn-306.exe (PID: 8664)
- Unicorn-57312.exe (PID: 8696)
- Unicorn-4094.exe (PID: 7888)
- Unicorn-5542.exe (PID: 8864)
- Unicorn-50104.exe (PID: 8772)
- Unicorn-57312.exe (PID: 8712)
- Unicorn-44307.exe (PID: 7828)
- Unicorn-50064.exe (PID: 8916)
- Unicorn-57379.exe (PID: 3768)
- Unicorn-45127.exe (PID: 7676)
- Unicorn-333.exe (PID: 8948)
- Unicorn-25408.exe (PID: 8856)
- Unicorn-33938.exe (PID: 9056)
- Unicorn-36020.exe (PID: 7744)
- Unicorn-50104.exe (PID: 8788)
- Unicorn-4914.exe (PID: 8964)
- Unicorn-25408.exe (PID: 8848)
- Unicorn-4094.exe (PID: 7996)
- Unicorn-52334.exe (PID: 8940)
- Unicorn-33938.exe (PID: 9064)
- Unicorn-37778.exe (PID: 3784)
- Unicorn-52334.exe (PID: 8924)
- Unicorn-8302.exe (PID: 8980)
- Unicorn-38236.exe (PID: 9112)
- Unicorn-50851.exe (PID: 8972)
- Unicorn-5371.exe (PID: 9120)
- Unicorn-19486.exe (PID: 9184)
- Unicorn-46596.exe (PID: 9148)
- Unicorn-14167.exe (PID: 6228)
- Unicorn-27654.exe (PID: 9212)
- Unicorn-30800.exe (PID: 5776)
- Unicorn-34884.exe (PID: 8420)
- Unicorn-46648.exe (PID: 3140)
- Unicorn-47328.exe (PID: 9236)
- Unicorn-31376.exe (PID: 4040)
- Unicorn-34884.exe (PID: 8228)
- Unicorn-10769.exe (PID: 9372)
- Unicorn-20777.exe (PID: 1132)
- Unicorn-7042.exe (PID: 9220)
- Unicorn-47904.exe (PID: 9392)
- Unicorn-27462.exe (PID: 9228)
- Unicorn-47904.exe (PID: 9408)
- Unicorn-65392.exe (PID: 9516)
- Unicorn-64415.exe (PID: 9508)
- Unicorn-33466.exe (PID: 9556)
- Unicorn-47904.exe (PID: 9400)
- Unicorn-36996.exe (PID: 9540)
- Unicorn-18421.exe (PID: 9632)
- Unicorn-16384.exe (PID: 9640)
- Unicorn-49419.exe (PID: 9696)
- Unicorn-24552.exe (PID: 9624)
- Unicorn-49419.exe (PID: 9688)
- Unicorn-53908.exe (PID: 9744)
- Unicorn-7638.exe (PID: 9776)
- Unicorn-16768.exe (PID: 9828)
- Unicorn-46508.exe (PID: 9856)
- Unicorn-48376.exe (PID: 8516)
- Unicorn-18037.exe (PID: 9716)
- Unicorn-22174.exe (PID: 9912)
- Unicorn-25408.exe (PID: 8872)
- Unicorn-63103.exe (PID: 8956)
- Unicorn-4608.exe (PID: 7908)
- Unicorn-10519.exe (PID: 9972)
- Unicorn-31708.exe (PID: 10048)
- Unicorn-19050.exe (PID: 10012)
- Unicorn-32297.exe (PID: 9156)
- Unicorn-62771.exe (PID: 9888)
- Unicorn-43576.exe (PID: 10116)
- Unicorn-2543.exe (PID: 10172)
- Unicorn-45806.exe (PID: 10216)
- Unicorn-48812.exe (PID: 9476)
- Unicorn-60104.exe (PID: 10196)
- Unicorn-23156.exe (PID: 5056)
- Unicorn-56404.exe (PID: 10088)
- Unicorn-56383.exe (PID: 10144)
- Unicorn-59210.exe (PID: 9608)
- Unicorn-16310.exe (PID: 7684)
- Unicorn-32284.exe (PID: 7616)
- Unicorn-40452.exe (PID: 7396)
- Unicorn-29316.exe (PID: 10348)
- Unicorn-22069.exe (PID: 9296)
- Unicorn-41390.exe (PID: 9572)
- Unicorn-49736.exe (PID: 10368)
- Unicorn-343.exe (PID: 10284)
- Unicorn-58459.exe (PID: 10448)
- Unicorn-50099.exe (PID: 10336)
- Unicorn-535.exe (PID: 10412)
- Unicorn-22801.exe (PID: 10496)
- Unicorn-3778.exe (PID: 10488)
- Unicorn-42807.exe (PID: 10528)
- Unicorn-28932.exe (PID: 10504)
- Unicorn-14302.exe (PID: 10580)
- Unicorn-48782.exe (PID: 10292)
- Unicorn-3281.exe (PID: 10480)
- Unicorn-29508.exe (PID: 10624)
- Unicorn-42506.exe (PID: 10660)
- Unicorn-39897.exe (PID: 10688)
- Unicorn-30660.exe (PID: 10680)
- Unicorn-52334.exe (PID: 8932)
- Unicorn-31337.exe (PID: 9004)
- Unicorn-39020.exe (PID: 10792)
- Unicorn-63332.exe (PID: 10716)
- Unicorn-19869.exe (PID: 10592)
- Unicorn-30852.exe (PID: 10744)
- Unicorn-22684.exe (PID: 10764)
- Unicorn-50696.exe (PID: 10824)
- Unicorn-59419.exe (PID: 10868)
- Unicorn-22890.exe (PID: 7876)
- Unicorn-54780.exe (PID: 10860)
- Unicorn-18770.exe (PID: 10968)
- Unicorn-50888.exe (PID: 10936)
- Unicorn-22684.exe (PID: 10760)
- Unicorn-14686.exe (PID: 10896)
- Unicorn-15838.exe (PID: 11060)
- Unicorn-44235.exe (PID: 11012)
- Unicorn-62054.exe (PID: 10996)
- Unicorn-20764.exe (PID: 10516)
- Unicorn-36066.exe (PID: 11020)
- Unicorn-23452.exe (PID: 11084)
- Unicorn-2647.exe (PID: 11004)
- Unicorn-19346.exe (PID: 6620)
- Unicorn-40342.exe (PID: 11132)
- Unicorn-35128.exe (PID: 11208)
- Unicorn-11007.exe (PID: 11196)
- Unicorn-56679.exe (PID: 11160)
- Unicorn-11007.exe (PID: 11176)
- Unicorn-2839.exe (PID: 11100)
- Unicorn-2839.exe (PID: 11108)
- Unicorn-11007.exe (PID: 11184)
- Unicorn-64847.exe (PID: 11152)
- Unicorn-3202.exe (PID: 872)
- Unicorn-18806.exe (PID: 680)
- Unicorn-51656.exe (PID: 3024)
- Unicorn-16937.exe (PID: 3032)
- Unicorn-3202.exe (PID: 8232)
- Unicorn-23763.exe (PID: 11428)
- Unicorn-55740.exe (PID: 11320)
- Unicorn-10814.exe (PID: 11396)
- Unicorn-19346.exe (PID: 11256)
- Unicorn-30149.exe (PID: 11380)
- Unicorn-27349.exe (PID: 11388)
- Unicorn-44043.exe (PID: 11300)
- Unicorn-44448.exe (PID: 11504)
- Unicorn-44448.exe (PID: 11496)
- Unicorn-50570.exe (PID: 11544)
- Unicorn-54397.exe (PID: 11332)
- Unicorn-44183.exe (PID: 11484)
- Unicorn-30149.exe (PID: 11372)
- Unicorn-18792.exe (PID: 11348)
- Unicorn-49144.exe (PID: 8672)
- Unicorn-63014.exe (PID: 11600)
- Unicorn-7115.exe (PID: 11680)
- Unicorn-32388.exe (PID: 11572)
- Unicorn-60400.exe (PID: 11664)
- Unicorn-27847.exe (PID: 11420)
- Unicorn-27847.exe (PID: 11460)
- Unicorn-58023.exe (PID: 11816)
- Unicorn-9206.exe (PID: 11836)
- Unicorn-41059.exe (PID: 11892)
- Unicorn-21458.exe (PID: 11884)
- Unicorn-23644.exe (PID: 11636)
- Unicorn-27880.exe (PID: 11404)
Reads the computer name
- 1 (1422).exe (PID: 6876)
- Unicorn-9919.exe (PID: 7244)
- Unicorn-778.exe (PID: 7936)
- Unicorn-59538.exe (PID: 7928)
- Unicorn-5407.exe (PID: 8112)
- Unicorn-1878.exe (PID: 8132)
- Unicorn-29807.exe (PID: 8076)
- Unicorn-63086.exe (PID: 8044)
- Unicorn-45510.exe (PID: 664)
- Unicorn-51640.exe (PID: 6040)
- Unicorn-21670.exe (PID: 8184)
- Unicorn-50716.exe (PID: 8164)
- Unicorn-44816.exe (PID: 4300)
- Unicorn-20120.exe (PID: 4228)
- Unicorn-5821.exe (PID: 3268)
- Unicorn-22018.exe (PID: 3132)
- Unicorn-50052.exe (PID: 5892)
- Unicorn-59682.exe (PID: 5968)
- Unicorn-8827.exe (PID: 2088)
- Unicorn-275.exe (PID: 1452)
- Unicorn-58713.exe (PID: 6300)
- Unicorn-57379.exe (PID: 4244)
- Unicorn-275.exe (PID: 6972)
- Unicorn-49783.exe (PID: 6388)
- Unicorn-64416.exe (PID: 7296)
- Unicorn-2178.exe (PID: 5072)
- Unicorn-64608.exe (PID: 4212)
- Unicorn-11058.exe (PID: 7600)
- Unicorn-15023.exe (PID: 7532)
- Unicorn-26844.exe (PID: 7872)
- Unicorn-51779.exe (PID: 8000)
- Unicorn-4608.exe (PID: 7756)
- Unicorn-4608.exe (PID: 7908)
- Unicorn-17829.exe (PID: 7812)
- Unicorn-37712.exe (PID: 5400)
- Unicorn-14167.exe (PID: 6228)
- Unicorn-55755.exe (PID: 6344)
- Unicorn-9699.exe (PID: 7444)
- Unicorn-22890.exe (PID: 7856)
- Unicorn-48376.exe (PID: 8516)
- Unicorn-57312.exe (PID: 8728)
- Unicorn-57312.exe (PID: 8704)
- Unicorn-57312.exe (PID: 8696)
- Unicorn-52334.exe (PID: 8924)
- Unicorn-5371.exe (PID: 9120)
- Unicorn-27462.exe (PID: 9228)
- Unicorn-34884.exe (PID: 8420)
- Unicorn-24552.exe (PID: 9624)
Checks supported languages
- 1 (1422).exe (PID: 6876)
- Unicorn-9919.exe (PID: 7244)
- Unicorn-63086.exe (PID: 8044)
- Unicorn-59538.exe (PID: 7928)
- Unicorn-778.exe (PID: 7936)
- Unicorn-1878.exe (PID: 8132)
- Unicorn-58884.exe (PID: 8148)
- Unicorn-50716.exe (PID: 8164)
- Unicorn-3679.exe (PID: 8052)
- Unicorn-29807.exe (PID: 8076)
- Unicorn-45510.exe (PID: 664)
- Unicorn-51640.exe (PID: 6040)
- Unicorn-44816.exe (PID: 4300)
- Unicorn-49455.exe (PID: 5640)
- Unicorn-61385.exe (PID: 6264)
- Unicorn-20120.exe (PID: 4228)
- Unicorn-50052.exe (PID: 5892)
- Unicorn-9382.exe (PID: 5936)
- Unicorn-5821.exe (PID: 3268)
- Unicorn-62797.exe (PID: 5392)
- Unicorn-58713.exe (PID: 6300)
- Unicorn-59682.exe (PID: 5968)
- Unicorn-275.exe (PID: 1452)
- Unicorn-49783.exe (PID: 6388)
- Unicorn-57379.exe (PID: 4244)
- Unicorn-37778.exe (PID: 3784)
- Unicorn-64971.exe (PID: 7580)
- Unicorn-64416.exe (PID: 7296)
- Unicorn-53041.exe (PID: 7660)
- Unicorn-44188.exe (PID: 1760)
- Unicorn-11058.exe (PID: 7600)
- Unicorn-62169.exe (PID: 7852)
- Unicorn-26844.exe (PID: 7872)
- Unicorn-2946.exe (PID: 1764)
- Unicorn-4608.exe (PID: 7712)
- Unicorn-4094.exe (PID: 7888)
- Unicorn-36020.exe (PID: 7744)
- Unicorn-45257.exe (PID: 7740)
- Unicorn-4608.exe (PID: 7756)
- Unicorn-44307.exe (PID: 7828)
- Unicorn-15029.exe (PID: 7972)
- Unicorn-57379.exe (PID: 3768)
- Unicorn-37712.exe (PID: 5400)
- Unicorn-54603.exe (PID: 1012)
- Unicorn-44026.exe (PID: 3008)
- Unicorn-14167.exe (PID: 6228)
- Unicorn-46959.exe (PID: 744)
- Unicorn-38864.exe (PID: 6576)
- Unicorn-46648.exe (PID: 3140)
- Unicorn-43118.exe (PID: 7216)
- Unicorn-9699.exe (PID: 7444)
- Unicorn-22890.exe (PID: 7876)
- Unicorn-41670.exe (PID: 7728)
- Unicorn-26617.exe (PID: 7736)
- Unicorn-6886.exe (PID: 8476)
- Unicorn-60436.exe (PID: 8448)
- Unicorn-48931.exe (PID: 8540)
- Unicorn-16664.exe (PID: 8580)
- Unicorn-2802.exe (PID: 8484)
- Unicorn-44868.exe (PID: 8596)
- Unicorn-25408.exe (PID: 8856)
- Unicorn-5542.exe (PID: 8864)
- Unicorn-63103.exe (PID: 8956)
- Unicorn-4914.exe (PID: 8964)
- Unicorn-57312.exe (PID: 8712)
- Unicorn-50104.exe (PID: 8788)
- Unicorn-46020.exe (PID: 8780)
- Unicorn-33938.exe (PID: 9056)
- Unicorn-19486.exe (PID: 9184)
- Unicorn-52334.exe (PID: 8940)
- Unicorn-33938.exe (PID: 9064)
- Unicorn-34884.exe (PID: 8228)
- Unicorn-31376.exe (PID: 4040)
- Unicorn-47328.exe (PID: 9236)
- Unicorn-64415.exe (PID: 9508)
- Unicorn-27462.exe (PID: 9228)
- Unicorn-24552.exe (PID: 9624)
- Unicorn-18421.exe (PID: 9632)
- Unicorn-49419.exe (PID: 9688)
- Unicorn-33466.exe (PID: 9556)
- Unicorn-19050.exe (PID: 10012)
- Unicorn-7638.exe (PID: 9776)
- Unicorn-60104.exe (PID: 10196)
- Unicorn-41390.exe (PID: 9572)
- Unicorn-32284.exe (PID: 7616)
- Unicorn-42506.exe (PID: 10660)
- Unicorn-30660.exe (PID: 10680)
- Unicorn-22684.exe (PID: 10760)
- Unicorn-50696.exe (PID: 10824)
- Unicorn-54780.exe (PID: 10860)
- Unicorn-36066.exe (PID: 11020)
- Unicorn-15838.exe (PID: 11060)
- Unicorn-54397.exe (PID: 11332)
- Unicorn-3202.exe (PID: 872)
- Unicorn-55740.exe (PID: 11320)
- Unicorn-44448.exe (PID: 11504)
- Unicorn-27847.exe (PID: 11420)
- Unicorn-50570.exe (PID: 11544)
- Unicorn-30149.exe (PID: 11380)
- Unicorn-29072.exe (PID: 11844)
- Unicorn-9921.exe (PID: 11996)
- Unicorn-42786.exe (PID: 11976)
- Unicorn-65444.exe (PID: 12048)
- Unicorn-33924.exe (PID: 12180)
- Unicorn-60466.exe (PID: 12228)
- Unicorn-21074.exe (PID: 12024)
- Unicorn-25948.exe (PID: 12384)
- Unicorn-61966.exe (PID: 12568)
- Unicorn-27234.exe (PID: 12656)
- Unicorn-7987.exe (PID: 12960)
Create files in a temporary directory
- 1 (1422).exe (PID: 6876)
- Unicorn-778.exe (PID: 7936)
- Unicorn-63086.exe (PID: 8044)
- Unicorn-48796.exe (PID: 8024)
- Unicorn-1878.exe (PID: 8132)
- Unicorn-58884.exe (PID: 8148)
- Unicorn-21670.exe (PID: 8184)
- Unicorn-3679.exe (PID: 8052)
- Unicorn-59538.exe (PID: 7928)
- Unicorn-61385.exe (PID: 6264)
- Unicorn-49455.exe (PID: 5640)
- Unicorn-20120.exe (PID: 4228)
- Unicorn-5821.exe (PID: 3268)
- Unicorn-8827.exe (PID: 2088)
- Unicorn-59682.exe (PID: 5968)
- Unicorn-58713.exe (PID: 6300)
- Unicorn-50716.exe (PID: 8164)
- Unicorn-45510.exe (PID: 664)
- Unicorn-29807.exe (PID: 8076)
- Unicorn-64971.exe (PID: 7580)
- Unicorn-44816.exe (PID: 4300)
- Unicorn-53041.exe (PID: 7660)
- Unicorn-34436.exe (PID: 7556)
- Unicorn-33066.exe (PID: 7528)
- Unicorn-62169.exe (PID: 7852)
- Unicorn-2946.exe (PID: 1764)
- Unicorn-26844.exe (PID: 7872)
- Unicorn-50052.exe (PID: 5892)
- Unicorn-9382.exe (PID: 5936)
- Unicorn-4608.exe (PID: 7712)
- Unicorn-36020.exe (PID: 7844)
- Unicorn-62797.exe (PID: 5392)
- Unicorn-49783.exe (PID: 6388)
- Unicorn-4608.exe (PID: 7756)
- Unicorn-275.exe (PID: 6972)
- Unicorn-9919.exe (PID: 7244)
- Unicorn-57379.exe (PID: 4244)
- Unicorn-41988.exe (PID: 1040)
- Unicorn-2178.exe (PID: 5072)
- Unicorn-46959.exe (PID: 744)
- Unicorn-5407.exe (PID: 8112)
- Unicorn-38864.exe (PID: 6576)
- Unicorn-43118.exe (PID: 7216)
- Unicorn-22890.exe (PID: 7856)
- Unicorn-44188.exe (PID: 1760)
- Unicorn-36316.exe (PID: 8272)
- Unicorn-37062.exe (PID: 8392)
- Unicorn-7535.exe (PID: 8328)
- Unicorn-54690.exe (PID: 8284)
- Unicorn-50104.exe (PID: 8796)
- Unicorn-44307.exe (PID: 7828)
- Unicorn-15029.exe (PID: 7972)
- Unicorn-50104.exe (PID: 8788)
- Unicorn-38236.exe (PID: 9112)
- Unicorn-8302.exe (PID: 8980)
- Unicorn-50851.exe (PID: 8972)
- Unicorn-31376.exe (PID: 4040)
- Unicorn-46596.exe (PID: 9148)
- Unicorn-46648.exe (PID: 3140)
- Unicorn-47904.exe (PID: 9392)
- Unicorn-26617.exe (PID: 7736)
- Unicorn-47904.exe (PID: 9408)
- Unicorn-41670.exe (PID: 7728)
Creates files or folders in the user directory
- WerFault.exe (PID: 9288)
- WerFault.exe (PID: 9604)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:20 00:32:00+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
470
Monitored processes
328
Malicious processes
48
Suspicious processes
71
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 616 | C:\Users\admin\AppData\Local\Temp\Unicorn-10498.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-10498.exe | Unicorn-5407.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Exit code: 0 Version: 1.00 Modules
| |||||||||||||||
| 664 | C:\Users\admin\AppData\Local\Temp\Unicorn-45510.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-45510.exe | Unicorn-9919.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 680 | C:\Users\admin\AppData\Local\Temp\Unicorn-18806.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-18806.exe | Unicorn-58884.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 744 | C:\Users\admin\AppData\Local\Temp\Unicorn-46959.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46959.exe | Unicorn-48796.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 872 | C:\Users\admin\AppData\Local\Temp\Unicorn-3202.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3202.exe | Unicorn-45257.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 924 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 616 -s 528 | C:\Windows\SysWOW64\WerFault.exe | — | Unicorn-10498.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1012 | C:\Users\admin\AppData\Local\Temp\Unicorn-54603.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-54603.exe | Unicorn-44816.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1040 | C:\Users\admin\AppData\Local\Temp\Unicorn-41988.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-41988.exe | Unicorn-64971.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1132 | C:\Users\admin\AppData\Local\Temp\Unicorn-20777.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20777.exe | Unicorn-49455.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1452 | C:\Users\admin\AppData\Local\Temp\Unicorn-275.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-275.exe | Unicorn-45510.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
18 416
Read events
18 416
Write events
0
Delete events
0
Modification events
Executable files
1 162
Suspicious files
6
Text files
6
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6876 | 1 (1422).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9919.exe | executable | |
MD5:0B7A0425B7175CF643C7A8D949446AC1 | SHA256:F692D8F5D596727E9490A541C502436E8541F0EC7B55B38EA5441F479C402469 | |||
| 7936 | Unicorn-778.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-1878.exe | executable | |
MD5:D5620600734317084B03223484DB3BEA | SHA256:EE03DDA08DF8E240B16151B6C3E04BAB36D4EF488234B7DF912F65455E811EDC | |||
| 6876 | 1 (1422).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-778.exe | executable | |
MD5:DC28DE6A9154C391FB434F9869DEDABF | SHA256:99622F4101541097ABE2FD16B1FDFC5F3043FF041F7641DEA8DBEC94621A97EB | |||
| 6876 | 1 (1422).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63086.exe | executable | |
MD5:CE48F6F4A584B4B34EEDF41311575B91 | SHA256:02D84DF9315AC954A482FEEB21E96150781CBD70BE6ED61E011B17EF7ACCBD10 | |||
| 6876 | 1 (1422).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-21670.exe | executable | |
MD5:AA618DE4BA69E510FBE3C8E74ACC7CBA | SHA256:BA5AA83B49F409271747E093608A4C2A6F1AE4F4469EE60BC34B569DB357FE18 | |||
| 7244 | Unicorn-9919.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-29807.exe | executable | |
MD5:EF5AC8FC9D6AAAE7E83128597A114AB9 | SHA256:2133E1292807CD794B4A453A8233D8BB6E74F2095DF878C2E78F5F931A89A4DE | |||
| 8024 | Unicorn-48796.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5407.exe | executable | |
MD5:DB4B61C4463CC04949404BDD9CE8AF39 | SHA256:FE01E990E3B2BD522B571E11F500FCABFB30336A96E69913F0AB3D2C49E89BF9 | |||
| 7928 | Unicorn-59538.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-61385.exe | executable | |
MD5:0AFA2F8FFF1A6181A0FCB760284AFEF6 | SHA256:3A5F3422A38DD1CEB905BE5D9A91CFC260774C324C8AAA9A1958D22A2708ED9B | |||
| 8052 | Unicorn-3679.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-58884.exe | executable | |
MD5:0EC494F0B55327DDEEBB8D65BBA166B0 | SHA256:FE9CE5C806B8450D32B8E7D9B332CDA5568AC2A43C211C90B30726BB41D18CF1 | |||
| 7244 | Unicorn-9919.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-45510.exe | executable | |
MD5:29EFB7AE927129743D90F433F38A10B9 | SHA256:8679F9DAA8E2B28E7860D57E1969A12024C5D5BEEB8FD00D658BC7F8BFB239E2 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
23
DNS requests
15
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.19.11.105:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
7204 | backgroundTaskHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | unknown |
2244 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | unknown |
2244 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
4 | System | 192.168.100.255:137 | — | — | — | unknown |
— | — | 2.19.11.105:80 | crl.microsoft.com | Elisa Oyj | NL | unknown |
4 | System | 192.168.100.255:138 | — | — | — | unknown |
3216 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
6544 | svchost.exe | 40.126.31.2:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | unknown |
7204 | backgroundTaskHost.exe | 20.199.58.43:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | unknown |
7204 | backgroundTaskHost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | unknown |
2244 | SIHClient.exe | 4.175.87.197:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| unknown |
client.wns.windows.com |
| unknown |
login.live.com |
| unknown |
ocsp.digicert.com |
| unknown |
arc.msn.com |
| unknown |
slscr.update.microsoft.com |
| unknown |
www.microsoft.com |
| unknown |
fe3cr.delivery.mp.microsoft.com |
| unknown |
settings-win.data.microsoft.com |
| unknown |
activation-v2.sls.microsoft.com |
| unknown |