| File name: | 1 (1284) |
| Full analysis: | https://app.any.run/tasks/71013258-0022-4a21-90dc-2191db8f9d37 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 13:28:39 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | B86F2786D79E88493392BDD52A180C40 |
| SHA1: | 8BB1C461EF97A9B5C7DE226067C27CBD9D252991 |
| SHA256: | 09CB6B50CBE5FFCBA3C94226AC910DA0B76B4EF62629A9516BF019DB9C13E378 |
| SSDEEP: | 12288:2KiaMyA5bxUTpfhaCOAeid5sx4DxmDsR:2Kls5UpfhUi |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- Unicorn-32917.exe (PID: 6148)
- 1 (1284).exe (PID: 4880)
- Unicorn-4219.exe (PID: 6404)
- Unicorn-3446.exe (PID: 4976)
- Unicorn-3446.exe (PID: 3888)
- Unicorn-10763.exe (PID: 7084)
- Unicorn-6139.exe (PID: 5332)
- Unicorn-23958.exe (PID: 4000)
- Unicorn-39767.exe (PID: 4436)
- Unicorn-52382.exe (PID: 1616)
- Unicorn-56980.exe (PID: 6872)
- Unicorn-23659.exe (PID: 5640)
- Unicorn-40644.exe (PID: 6240)
- Unicorn-19861.exe (PID: 5756)
- Unicorn-19538.exe (PID: 5436)
- Unicorn-7691.exe (PID: 6800)
- Unicorn-1369.exe (PID: 7228)
- Unicorn-47333.exe (PID: 7212)
- Unicorn-27515.exe (PID: 2340)
- Unicorn-7691.exe (PID: 2108)
- Unicorn-44640.exe (PID: 7192)
- Unicorn-1661.exe (PID: 7220)
- Unicorn-17793.exe (PID: 6080)
- Unicorn-34946.exe (PID: 7320)
- Unicorn-6980.exe (PID: 7776)
- Unicorn-36730.exe (PID: 7796)
- Unicorn-26280.exe (PID: 7312)
- Unicorn-5314.exe (PID: 7744)
- Unicorn-56892.exe (PID: 8124)
- Unicorn-3259.exe (PID: 7820)
- Unicorn-26872.exe (PID: 8092)
- Unicorn-43820.exe (PID: 8180)
- Unicorn-47100.exe (PID: 8188)
- Unicorn-42222.exe (PID: 7360)
- Unicorn-47100.exe (PID: 1020)
- Unicorn-49248.exe (PID: 7500)
- Unicorn-28303.exe (PID: 8172)
- Unicorn-4759.exe (PID: 7516)
- Unicorn-2630.exe (PID: 6824)
- Unicorn-6534.exe (PID: 7472)
- Unicorn-12564.exe (PID: 7352)
- Unicorn-11587.exe (PID: 7396)
- Unicorn-40276.exe (PID: 7380)
- Unicorn-52444.exe (PID: 4268)
- Unicorn-42222.exe (PID: 7368)
- Unicorn-6534.exe (PID: 6808)
- Unicorn-4759.exe (PID: 7572)
- Unicorn-49513.exe (PID: 7508)
- Unicorn-37114.exe (PID: 736)
- Unicorn-15694.exe (PID: 4724)
- Unicorn-24774.exe (PID: 7172)
- Unicorn-888.exe (PID: 7888)
- Unicorn-9148.exe (PID: 7904)
- Unicorn-12491.exe (PID: 8056)
- Unicorn-48506.exe (PID: 8012)
- Unicorn-7499.exe (PID: 7276)
- Unicorn-5527.exe (PID: 7852)
- Unicorn-12756.exe (PID: 8064)
- Unicorn-15615.exe (PID: 8240)
- Unicorn-16732.exe (PID: 7568)
- Unicorn-42506.exe (PID: 8080)
- Unicorn-8838.exe (PID: 8232)
- Unicorn-7499.exe (PID: 7268)
- Unicorn-53161.exe (PID: 8436)
- Unicorn-40909.exe (PID: 8444)
- Unicorn-60540.exe (PID: 8212)
- Unicorn-6975.exe (PID: 8392)
- Unicorn-64899.exe (PID: 8492)
- Unicorn-52263.exe (PID: 8512)
- Unicorn-63198.exe (PID: 8504)
- Unicorn-10867.exe (PID: 8456)
- Unicorn-36524.exe (PID: 8612)
- Unicorn-7058.exe (PID: 8568)
- Unicorn-30585.exe (PID: 8560)
- Unicorn-19036.exe (PID: 8544)
- Unicorn-28849.exe (PID: 8700)
- Unicorn-56944.exe (PID: 8596)
- Unicorn-32056.exe (PID: 8768)
- Unicorn-50837.exe (PID: 8632)
- Unicorn-22718.exe (PID: 8668)
- Unicorn-8428.exe (PID: 8716)
- Unicorn-23888.exe (PID: 8784)
- Unicorn-3010.exe (PID: 8684)
- Unicorn-28849.exe (PID: 8692)
- Unicorn-33177.exe (PID: 7628)
- Unicorn-41293.exe (PID: 8816)
- Unicorn-41293.exe (PID: 8824)
- Unicorn-28849.exe (PID: 8708)
- Unicorn-13498.exe (PID: 8896)
- Unicorn-20819.exe (PID: 8920)
- Unicorn-21112.exe (PID: 8872)
- Unicorn-27233.exe (PID: 8908)
- Unicorn-33364.exe (PID: 8848)
- Unicorn-33364.exe (PID: 8864)
- Unicorn-27046.exe (PID: 6668)
- Unicorn-58615.exe (PID: 8880)
- Unicorn-63389.exe (PID: 7492)
- Unicorn-33364.exe (PID: 8856)
- Unicorn-3282.exe (PID: 9004)
- Unicorn-11417.exe (PID: 9012)
- Unicorn-33534.exe (PID: 9120)
- Unicorn-7084.exe (PID: 8932)
- Unicorn-58615.exe (PID: 8888)
- Unicorn-11417.exe (PID: 9016)
- Unicorn-7084.exe (PID: 8968)
- Unicorn-4759.exe (PID: 7588)
- Unicorn-18494.exe (PID: 7512)
- Unicorn-53171.exe (PID: 7252)
- Unicorn-57592.exe (PID: 9104)
- Unicorn-37941.exe (PID: 9136)
- Unicorn-12367.exe (PID: 9148)
- Unicorn-28001.exe (PID: 9176)
- Unicorn-27033.exe (PID: 8000)
- Unicorn-25964.exe (PID: 9204)
- Unicorn-39839.exe (PID: 9168)
- Unicorn-29591.exe (PID: 7716)
- Unicorn-27033.exe (PID: 7528)
- Unicorn-59513.exe (PID: 7736)
- Unicorn-28408.exe (PID: 8004)
- Unicorn-49015.exe (PID: 8140)
- Unicorn-3113.exe (PID: 7556)
- Unicorn-25580.exe (PID: 8132)
- Unicorn-25580.exe (PID: 7596)
- Unicorn-12438.exe (PID: 8292)
- Unicorn-12565.exe (PID: 8316)
- Unicorn-51791.exe (PID: 9256)
- Unicorn-20518.exe (PID: 8308)
- Unicorn-39538.exe (PID: 9272)
- Unicorn-17831.exe (PID: 9240)
- Unicorn-19249.exe (PID: 9292)
- Unicorn-14650.exe (PID: 9356)
- Unicorn-14287.exe (PID: 9340)
- Unicorn-32055.exe (PID: 9364)
- Unicorn-33730.exe (PID: 9308)
- Unicorn-39861.exe (PID: 9316)
- Unicorn-7965.exe (PID: 9392)
- Unicorn-26156.exe (PID: 9420)
- Unicorn-26156.exe (PID: 9440)
- Unicorn-43571.exe (PID: 9504)
- Unicorn-29537.exe (PID: 9488)
- Unicorn-24521.exe (PID: 9604)
- Unicorn-9117.exe (PID: 9516)
- Unicorn-3275.exe (PID: 8676)
- Unicorn-49072.exe (PID: 9716)
- Unicorn-52964.exe (PID: 9736)
- Unicorn-5854.exe (PID: 9784)
- Unicorn-29804.exe (PID: 9776)
- Unicorn-26950.exe (PID: 8956)
- Unicorn-33561.exe (PID: 8036)
- Unicorn-47380.exe (PID: 9844)
- Unicorn-9362.exe (PID: 9880)
- Unicorn-41458.exe (PID: 9696)
- Unicorn-31449.exe (PID: 9924)
- Unicorn-26296.exe (PID: 9904)
- Unicorn-15615.exe (PID: 8248)
- Unicorn-48370.exe (PID: 9960)
- Unicorn-65045.exe (PID: 9992)
- Unicorn-62760.exe (PID: 9976)
- Unicorn-19159.exe (PID: 10008)
- Unicorn-17936.exe (PID: 9940)
- Unicorn-52279.exe (PID: 10044)
- Unicorn-44049.exe (PID: 10088)
- Unicorn-18476.exe (PID: 10096)
- Unicorn-20182.exe (PID: 10184)
- Unicorn-40602.exe (PID: 10160)
- Unicorn-3846.exe (PID: 10212)
- Unicorn-22451.exe (PID: 2192)
- Unicorn-20239.exe (PID: 3020)
- Unicorn-7567.exe (PID: 10144)
- Unicorn-12144.exe (PID: 10232)
- Unicorn-49731.exe (PID: 10420)
- Unicorn-49176.exe (PID: 10272)
- Unicorn-58968.exe (PID: 10264)
- Unicorn-12912.exe (PID: 10444)
- Unicorn-53368.exe (PID: 10256)
- Unicorn-33717.exe (PID: 10412)
- Unicorn-33333.exe (PID: 10528)
- Unicorn-15928.exe (PID: 10480)
- Unicorn-13467.exe (PID: 10496)
- Unicorn-51807.exe (PID: 10536)
- Unicorn-33333.exe (PID: 10520)
- Unicorn-34677.exe (PID: 10596)
- Unicorn-49679.exe (PID: 10556)
- Unicorn-9554.exe (PID: 9860)
- Unicorn-20972.exe (PID: 10736)
- Unicorn-49752.exe (PID: 10632)
- Unicorn-50629.exe (PID: 10704)
- Unicorn-22041.exe (PID: 10780)
- Unicorn-30763.exe (PID: 10688)
- Unicorn-12041.exe (PID: 10728)
- Unicorn-21526.exe (PID: 10680)
- Unicorn-62004.exe (PID: 10624)
- Unicorn-30763.exe (PID: 10692)
- Unicorn-30292.exe (PID: 10872)
- Unicorn-8013.exe (PID: 10812)
- Unicorn-62772.exe (PID: 10908)
- Unicorn-32137.exe (PID: 10944)
- Unicorn-50328.exe (PID: 11064)
- Unicorn-6067.exe (PID: 10852)
- Unicorn-9082.exe (PID: 10832)
- Unicorn-1630.exe (PID: 8072)
- Unicorn-55481.exe (PID: 11080)
- Unicorn-8610.exe (PID: 10968)
- Unicorn-38268.exe (PID: 10952)
- Unicorn-25824.exe (PID: 11116)
- Unicorn-9030.exe (PID: 11200)
- Unicorn-2388.exe (PID: 10928)
- Unicorn-31854.exe (PID: 11028)
- Unicorn-31854.exe (PID: 11020)
- Unicorn-55289.exe (PID: 11172)
- Unicorn-46052.exe (PID: 11152)
- Unicorn-14256.exe (PID: 11140)
- Unicorn-62563.exe (PID: 11304)
- Unicorn-48465.exe (PID: 11232)
- Unicorn-29333.exe (PID: 11356)
- Unicorn-31422.exe (PID: 856)
- Unicorn-56477.exe (PID: 10980)
- Unicorn-30462.exe (PID: 11056)
- Unicorn-28599.exe (PID: 11224)
- Unicorn-12293.exe (PID: 11420)
- Unicorn-19170.exe (PID: 11280)
- Unicorn-47657.exe (PID: 11464)
- Unicorn-39151.exe (PID: 11396)
- Unicorn-39398.exe (PID: 11348)
- Unicorn-11224.exe (PID: 11380)
- Unicorn-13769.exe (PID: 11296)
- Unicorn-48081.exe (PID: 11404)
- Unicorn-4116.exe (PID: 11520)
- Unicorn-36274.exe (PID: 11552)
- Unicorn-35637.exe (PID: 11500)
- Unicorn-64116.exe (PID: 11608)
- Unicorn-64308.exe (PID: 11544)
- Unicorn-44251.exe (PID: 11600)
- Unicorn-30484.exe (PID: 11472)
- Unicorn-23638.exe (PID: 11692)
- Unicorn-4479.exe (PID: 11676)
- Unicorn-23638.exe (PID: 11700)
- Unicorn-17137.exe (PID: 11756)
- Unicorn-16539.exe (PID: 11728)
- Unicorn-40873.exe (PID: 11584)
- Unicorn-23011.exe (PID: 11660)
- Unicorn-46035.exe (PID: 11388)
Starts itself from another location
- Unicorn-32917.exe (PID: 6148)
- 1 (1284).exe (PID: 4880)
- Unicorn-10763.exe (PID: 7084)
- Unicorn-3446.exe (PID: 4976)
- Unicorn-3446.exe (PID: 3888)
- Unicorn-4219.exe (PID: 6404)
- Unicorn-6139.exe (PID: 5332)
- Unicorn-23958.exe (PID: 4000)
- Unicorn-39767.exe (PID: 4436)
- Unicorn-27515.exe (PID: 2340)
- Unicorn-40644.exe (PID: 6240)
- Unicorn-37114.exe (PID: 736)
- Unicorn-19538.exe (PID: 5436)
- Unicorn-19861.exe (PID: 5756)
- Unicorn-56980.exe (PID: 6872)
- Unicorn-7691.exe (PID: 6800)
- Unicorn-2630.exe (PID: 6824)
- Unicorn-52382.exe (PID: 1616)
- Unicorn-47333.exe (PID: 7212)
- Unicorn-23659.exe (PID: 5640)
- Unicorn-1369.exe (PID: 7228)
- Unicorn-24774.exe (PID: 7172)
- Unicorn-7499.exe (PID: 7276)
- Unicorn-5314.exe (PID: 7744)
- Unicorn-6980.exe (PID: 7776)
- Unicorn-26280.exe (PID: 7312)
- Unicorn-26872.exe (PID: 8092)
- Unicorn-56892.exe (PID: 8124)
- Unicorn-36730.exe (PID: 7796)
- Unicorn-3259.exe (PID: 7820)
- Unicorn-42222.exe (PID: 7360)
- Unicorn-43820.exe (PID: 8180)
- Unicorn-1661.exe (PID: 7220)
- Unicorn-7691.exe (PID: 2108)
- Unicorn-28303.exe (PID: 8172)
- Unicorn-4759.exe (PID: 7516)
- Unicorn-47100.exe (PID: 1020)
- Unicorn-17793.exe (PID: 6080)
- Unicorn-40276.exe (PID: 7380)
- Unicorn-63389.exe (PID: 7492)
- Unicorn-33177.exe (PID: 7628)
- Unicorn-11587.exe (PID: 7396)
- Unicorn-12564.exe (PID: 7352)
- Unicorn-4759.exe (PID: 7572)
- Unicorn-42222.exe (PID: 7368)
- Unicorn-27046.exe (PID: 6668)
- Unicorn-15694.exe (PID: 4724)
- Unicorn-34946.exe (PID: 7320)
- Unicorn-53171.exe (PID: 7252)
- Unicorn-49513.exe (PID: 7508)
- Unicorn-52444.exe (PID: 4268)
- Unicorn-4759.exe (PID: 7588)
- Unicorn-888.exe (PID: 7888)
- Unicorn-5527.exe (PID: 7852)
- Unicorn-33561.exe (PID: 8036)
- Unicorn-12491.exe (PID: 8056)
- Unicorn-48506.exe (PID: 8012)
- Unicorn-9148.exe (PID: 7904)
- Unicorn-44640.exe (PID: 7192)
- Unicorn-28408.exe (PID: 8004)
- Unicorn-15615.exe (PID: 8240)
- Unicorn-8838.exe (PID: 8232)
- Unicorn-42506.exe (PID: 8080)
- Unicorn-12756.exe (PID: 8064)
- Unicorn-7499.exe (PID: 7268)
- Unicorn-12438.exe (PID: 8292)
- Unicorn-53161.exe (PID: 8436)
- Unicorn-15615.exe (PID: 8248)
- Unicorn-6975.exe (PID: 8392)
- Unicorn-47100.exe (PID: 8188)
- Unicorn-64899.exe (PID: 8492)
- Unicorn-40909.exe (PID: 8444)
- Unicorn-10867.exe (PID: 8456)
- Unicorn-36524.exe (PID: 8612)
- Unicorn-19036.exe (PID: 8544)
- Unicorn-7058.exe (PID: 8568)
- Unicorn-30585.exe (PID: 8560)
- Unicorn-63198.exe (PID: 8504)
- Unicorn-50837.exe (PID: 8632)
- Unicorn-56944.exe (PID: 8596)
- Unicorn-28849.exe (PID: 8700)
- Unicorn-49248.exe (PID: 7500)
- Unicorn-22718.exe (PID: 8668)
- Unicorn-8428.exe (PID: 8716)
- Unicorn-3275.exe (PID: 8676)
- Unicorn-3010.exe (PID: 8684)
- Unicorn-28849.exe (PID: 8692)
- Unicorn-32056.exe (PID: 8768)
- Unicorn-28849.exe (PID: 8708)
- Unicorn-41293.exe (PID: 8816)
- Unicorn-41293.exe (PID: 8824)
- Unicorn-13498.exe (PID: 8896)
- Unicorn-33364.exe (PID: 8864)
- Unicorn-20819.exe (PID: 8920)
- Unicorn-6534.exe (PID: 7472)
- Unicorn-6534.exe (PID: 6808)
- Unicorn-27233.exe (PID: 8908)
- Unicorn-33364.exe (PID: 8848)
- Unicorn-58615.exe (PID: 8880)
- Unicorn-26950.exe (PID: 8956)
- Unicorn-33534.exe (PID: 9120)
- Unicorn-33364.exe (PID: 8856)
- Unicorn-11417.exe (PID: 9012)
- Unicorn-7084.exe (PID: 8932)
- Unicorn-58615.exe (PID: 8888)
- Unicorn-11417.exe (PID: 9016)
- Unicorn-7084.exe (PID: 8968)
- Unicorn-3282.exe (PID: 9004)
- Unicorn-57592.exe (PID: 9104)
- Unicorn-18494.exe (PID: 7512)
- Unicorn-37941.exe (PID: 9136)
- Unicorn-12367.exe (PID: 9148)
- Unicorn-39839.exe (PID: 9168)
- Unicorn-27033.exe (PID: 8000)
- Unicorn-28001.exe (PID: 9176)
- Unicorn-27033.exe (PID: 7528)
- Unicorn-25964.exe (PID: 9204)
- Unicorn-29591.exe (PID: 7716)
- Unicorn-59513.exe (PID: 7736)
- Unicorn-49015.exe (PID: 8140)
- Unicorn-3113.exe (PID: 7556)
- Unicorn-1630.exe (PID: 8072)
- Unicorn-25580.exe (PID: 8132)
- Unicorn-25580.exe (PID: 7596)
- Unicorn-60540.exe (PID: 8212)
- Unicorn-12565.exe (PID: 8316)
- Unicorn-51791.exe (PID: 9256)
- Unicorn-17831.exe (PID: 9240)
- Unicorn-19249.exe (PID: 9292)
- Unicorn-39538.exe (PID: 9272)
- Unicorn-14650.exe (PID: 9356)
- Unicorn-14287.exe (PID: 9340)
- Unicorn-33730.exe (PID: 9308)
- Unicorn-7965.exe (PID: 9392)
- Unicorn-39861.exe (PID: 9316)
- Unicorn-16732.exe (PID: 7568)
- Unicorn-26156.exe (PID: 9420)
- Unicorn-52263.exe (PID: 8512)
- Unicorn-43571.exe (PID: 9504)
- Unicorn-9117.exe (PID: 9516)
- Unicorn-21112.exe (PID: 8872)
- Unicorn-49072.exe (PID: 9716)
- Unicorn-24521.exe (PID: 9604)
- Unicorn-5854.exe (PID: 9784)
- Unicorn-52964.exe (PID: 9736)
- Unicorn-29804.exe (PID: 9776)
- Unicorn-9554.exe (PID: 9860)
- Unicorn-47380.exe (PID: 9844)
- Unicorn-20518.exe (PID: 8308)
- Unicorn-41458.exe (PID: 9696)
- Unicorn-23888.exe (PID: 8784)
- Unicorn-26296.exe (PID: 9904)
- Unicorn-31449.exe (PID: 9924)
- Unicorn-26156.exe (PID: 9440)
- Unicorn-9362.exe (PID: 9880)
- Unicorn-17936.exe (PID: 9940)
- Unicorn-48370.exe (PID: 9960)
- Unicorn-62760.exe (PID: 9976)
- Unicorn-65045.exe (PID: 9992)
- Unicorn-32055.exe (PID: 9364)
- Unicorn-29537.exe (PID: 9488)
- Unicorn-52279.exe (PID: 10044)
- Unicorn-44049.exe (PID: 10088)
- Unicorn-18476.exe (PID: 10096)
- Unicorn-20182.exe (PID: 10184)
- Unicorn-19159.exe (PID: 10008)
- Unicorn-40602.exe (PID: 10160)
- Unicorn-7567.exe (PID: 10144)
- Unicorn-3846.exe (PID: 10212)
- Unicorn-22451.exe (PID: 2192)
- Unicorn-20239.exe (PID: 3020)
- Unicorn-12144.exe (PID: 10232)
- Unicorn-49176.exe (PID: 10272)
- Unicorn-53368.exe (PID: 10256)
Executes application which crashes
- Unicorn-29264.exe (PID: 7716)
INFO
The sample compiled with chinese language support
- Unicorn-32917.exe (PID: 6148)
- 1 (1284).exe (PID: 4880)
- Unicorn-4219.exe (PID: 6404)
- Unicorn-3446.exe (PID: 4976)
- Unicorn-3446.exe (PID: 3888)
- Unicorn-10763.exe (PID: 7084)
- Unicorn-6139.exe (PID: 5332)
- Unicorn-23958.exe (PID: 4000)
- Unicorn-39767.exe (PID: 4436)
- Unicorn-52382.exe (PID: 1616)
- Unicorn-56980.exe (PID: 6872)
- Unicorn-23659.exe (PID: 5640)
- Unicorn-40644.exe (PID: 6240)
- Unicorn-19538.exe (PID: 5436)
- Unicorn-7691.exe (PID: 6800)
- Unicorn-27515.exe (PID: 2340)
- Unicorn-7691.exe (PID: 2108)
- Unicorn-1661.exe (PID: 7220)
- Unicorn-34946.exe (PID: 7320)
- Unicorn-17793.exe (PID: 6080)
- Unicorn-44640.exe (PID: 7192)
- Unicorn-1369.exe (PID: 7228)
- Unicorn-47333.exe (PID: 7212)
- Unicorn-6980.exe (PID: 7776)
- Unicorn-26280.exe (PID: 7312)
- Unicorn-5314.exe (PID: 7744)
- Unicorn-36730.exe (PID: 7796)
- Unicorn-26872.exe (PID: 8092)
- Unicorn-56892.exe (PID: 8124)
- Unicorn-3259.exe (PID: 7820)
- Unicorn-47100.exe (PID: 8188)
- Unicorn-42222.exe (PID: 7360)
- Unicorn-43820.exe (PID: 8180)
- Unicorn-49248.exe (PID: 7500)
- Unicorn-4759.exe (PID: 7516)
- Unicorn-47100.exe (PID: 1020)
- Unicorn-2630.exe (PID: 6824)
- Unicorn-28303.exe (PID: 8172)
- Unicorn-6534.exe (PID: 7472)
- Unicorn-40276.exe (PID: 7380)
- Unicorn-12564.exe (PID: 7352)
- Unicorn-11587.exe (PID: 7396)
- Unicorn-19861.exe (PID: 5756)
- Unicorn-42222.exe (PID: 7368)
- Unicorn-6534.exe (PID: 6808)
- Unicorn-4759.exe (PID: 7572)
- Unicorn-52444.exe (PID: 4268)
- Unicorn-24774.exe (PID: 7172)
- Unicorn-37114.exe (PID: 736)
- Unicorn-49513.exe (PID: 7508)
- Unicorn-15694.exe (PID: 4724)
- Unicorn-888.exe (PID: 7888)
- Unicorn-12491.exe (PID: 8056)
- Unicorn-9148.exe (PID: 7904)
- Unicorn-48506.exe (PID: 8012)
- Unicorn-7499.exe (PID: 7276)
- Unicorn-5527.exe (PID: 7852)
- Unicorn-42506.exe (PID: 8080)
- Unicorn-12756.exe (PID: 8064)
- Unicorn-15615.exe (PID: 8240)
- Unicorn-8838.exe (PID: 8232)
- Unicorn-16732.exe (PID: 7568)
- Unicorn-7499.exe (PID: 7268)
- Unicorn-60540.exe (PID: 8212)
- Unicorn-53161.exe (PID: 8436)
- Unicorn-10867.exe (PID: 8456)
- Unicorn-64899.exe (PID: 8492)
- Unicorn-6975.exe (PID: 8392)
- Unicorn-52263.exe (PID: 8512)
- Unicorn-40909.exe (PID: 8444)
- Unicorn-19036.exe (PID: 8544)
- Unicorn-36524.exe (PID: 8612)
- Unicorn-7058.exe (PID: 8568)
- Unicorn-30585.exe (PID: 8560)
- Unicorn-63198.exe (PID: 8504)
- Unicorn-50837.exe (PID: 8632)
- Unicorn-28849.exe (PID: 8700)
- Unicorn-56944.exe (PID: 8596)
- Unicorn-22718.exe (PID: 8668)
- Unicorn-8428.exe (PID: 8716)
- Unicorn-23888.exe (PID: 8784)
- Unicorn-3010.exe (PID: 8684)
- Unicorn-28849.exe (PID: 8692)
- Unicorn-32056.exe (PID: 8768)
- Unicorn-33177.exe (PID: 7628)
- Unicorn-41293.exe (PID: 8816)
- Unicorn-41293.exe (PID: 8824)
- Unicorn-28849.exe (PID: 8708)
- Unicorn-13498.exe (PID: 8896)
- Unicorn-20819.exe (PID: 8920)
- Unicorn-27046.exe (PID: 6668)
- Unicorn-27233.exe (PID: 8908)
- Unicorn-21112.exe (PID: 8872)
- Unicorn-33364.exe (PID: 8848)
- Unicorn-33364.exe (PID: 8864)
- Unicorn-33534.exe (PID: 9120)
- Unicorn-33364.exe (PID: 8856)
- Unicorn-3282.exe (PID: 9004)
- Unicorn-11417.exe (PID: 9012)
- Unicorn-58615.exe (PID: 8880)
- Unicorn-63389.exe (PID: 7492)
- Unicorn-7084.exe (PID: 8932)
- Unicorn-58615.exe (PID: 8888)
- Unicorn-11417.exe (PID: 9016)
- Unicorn-7084.exe (PID: 8968)
- Unicorn-4759.exe (PID: 7588)
- Unicorn-18494.exe (PID: 7512)
- Unicorn-53171.exe (PID: 7252)
- Unicorn-57592.exe (PID: 9104)
- Unicorn-28001.exe (PID: 9176)
- Unicorn-27033.exe (PID: 8000)
- Unicorn-37941.exe (PID: 9136)
- Unicorn-39839.exe (PID: 9168)
- Unicorn-25964.exe (PID: 9204)
- Unicorn-12367.exe (PID: 9148)
- Unicorn-29591.exe (PID: 7716)
- Unicorn-27033.exe (PID: 7528)
- Unicorn-59513.exe (PID: 7736)
- Unicorn-28408.exe (PID: 8004)
- Unicorn-49015.exe (PID: 8140)
- Unicorn-3113.exe (PID: 7556)
- Unicorn-12565.exe (PID: 8316)
- Unicorn-25580.exe (PID: 8132)
- Unicorn-25580.exe (PID: 7596)
- Unicorn-12438.exe (PID: 8292)
- Unicorn-20518.exe (PID: 8308)
- Unicorn-51791.exe (PID: 9256)
- Unicorn-17831.exe (PID: 9240)
- Unicorn-39538.exe (PID: 9272)
- Unicorn-19249.exe (PID: 9292)
- Unicorn-14650.exe (PID: 9356)
- Unicorn-32055.exe (PID: 9364)
- Unicorn-33730.exe (PID: 9308)
- Unicorn-39861.exe (PID: 9316)
- Unicorn-7965.exe (PID: 9392)
- Unicorn-26156.exe (PID: 9420)
- Unicorn-14287.exe (PID: 9340)
- Unicorn-26156.exe (PID: 9440)
- Unicorn-43571.exe (PID: 9504)
- Unicorn-29537.exe (PID: 9488)
- Unicorn-9117.exe (PID: 9516)
- Unicorn-24521.exe (PID: 9604)
- Unicorn-3275.exe (PID: 8676)
- Unicorn-49072.exe (PID: 9716)
- Unicorn-52964.exe (PID: 9736)
- Unicorn-29804.exe (PID: 9776)
- Unicorn-26950.exe (PID: 8956)
- Unicorn-5854.exe (PID: 9784)
- Unicorn-33561.exe (PID: 8036)
- Unicorn-47380.exe (PID: 9844)
- Unicorn-9362.exe (PID: 9880)
- Unicorn-41458.exe (PID: 9696)
- Unicorn-15615.exe (PID: 8248)
- Unicorn-26296.exe (PID: 9904)
- Unicorn-31449.exe (PID: 9924)
- Unicorn-48370.exe (PID: 9960)
- Unicorn-65045.exe (PID: 9992)
- Unicorn-62760.exe (PID: 9976)
- Unicorn-19159.exe (PID: 10008)
- Unicorn-17936.exe (PID: 9940)
- Unicorn-52279.exe (PID: 10044)
- Unicorn-44049.exe (PID: 10088)
- Unicorn-18476.exe (PID: 10096)
- Unicorn-20182.exe (PID: 10184)
- Unicorn-40602.exe (PID: 10160)
- Unicorn-7567.exe (PID: 10144)
- Unicorn-3846.exe (PID: 10212)
- Unicorn-22451.exe (PID: 2192)
- Unicorn-20239.exe (PID: 3020)
- Unicorn-12144.exe (PID: 10232)
- Unicorn-49176.exe (PID: 10272)
- Unicorn-58968.exe (PID: 10264)
- Unicorn-49731.exe (PID: 10420)
- Unicorn-53368.exe (PID: 10256)
- Unicorn-9554.exe (PID: 9860)
- Unicorn-15928.exe (PID: 10480)
- Unicorn-33333.exe (PID: 10528)
- Unicorn-51807.exe (PID: 10536)
- Unicorn-13467.exe (PID: 10496)
- Unicorn-33333.exe (PID: 10520)
- Unicorn-49679.exe (PID: 10556)
- Unicorn-12912.exe (PID: 10444)
- Unicorn-33717.exe (PID: 10412)
- Unicorn-49752.exe (PID: 10632)
- Unicorn-30763.exe (PID: 10688)
- Unicorn-50629.exe (PID: 10704)
- Unicorn-22041.exe (PID: 10780)
- Unicorn-12041.exe (PID: 10728)
- Unicorn-21526.exe (PID: 10680)
- Unicorn-34677.exe (PID: 10596)
- Unicorn-62004.exe (PID: 10624)
- Unicorn-20972.exe (PID: 10736)
- Unicorn-30292.exe (PID: 10872)
- Unicorn-8013.exe (PID: 10812)
- Unicorn-62772.exe (PID: 10908)
- Unicorn-32137.exe (PID: 10944)
- Unicorn-50328.exe (PID: 11064)
- Unicorn-6067.exe (PID: 10852)
- Unicorn-30763.exe (PID: 10692)
- Unicorn-9082.exe (PID: 10832)
- Unicorn-31854.exe (PID: 11020)
- Unicorn-1630.exe (PID: 8072)
- Unicorn-8610.exe (PID: 10968)
- Unicorn-55481.exe (PID: 11080)
- Unicorn-38268.exe (PID: 10952)
- Unicorn-25824.exe (PID: 11116)
- Unicorn-2388.exe (PID: 10928)
- Unicorn-31854.exe (PID: 11028)
- Unicorn-46052.exe (PID: 11152)
- Unicorn-30462.exe (PID: 11056)
- Unicorn-14256.exe (PID: 11140)
- Unicorn-48465.exe (PID: 11232)
- Unicorn-31422.exe (PID: 856)
- Unicorn-62563.exe (PID: 11304)
- Unicorn-29333.exe (PID: 11356)
- Unicorn-9030.exe (PID: 11200)
- Unicorn-56477.exe (PID: 10980)
- Unicorn-55289.exe (PID: 11172)
- Unicorn-13769.exe (PID: 11296)
- Unicorn-12293.exe (PID: 11420)
- Unicorn-47657.exe (PID: 11464)
- Unicorn-39151.exe (PID: 11396)
- Unicorn-39398.exe (PID: 11348)
- Unicorn-46035.exe (PID: 11388)
- Unicorn-28599.exe (PID: 11224)
- Unicorn-19170.exe (PID: 11280)
- Unicorn-48081.exe (PID: 11404)
- Unicorn-4116.exe (PID: 11520)
- Unicorn-35637.exe (PID: 11500)
- Unicorn-64116.exe (PID: 11608)
- Unicorn-64308.exe (PID: 11544)
- Unicorn-44251.exe (PID: 11600)
- Unicorn-36274.exe (PID: 11552)
- Unicorn-11224.exe (PID: 11380)
- Unicorn-30484.exe (PID: 11472)
- Unicorn-23011.exe (PID: 11660)
- Unicorn-23638.exe (PID: 11692)
- Unicorn-4479.exe (PID: 11676)
- Unicorn-23638.exe (PID: 11700)
- Unicorn-17137.exe (PID: 11756)
- Unicorn-16539.exe (PID: 11728)
- Unicorn-40873.exe (PID: 11584)
Reads the computer name
- 1 (1284).exe (PID: 4880)
- Unicorn-32917.exe (PID: 6148)
- Unicorn-10763.exe (PID: 7084)
- Unicorn-4219.exe (PID: 6404)
- Unicorn-3446.exe (PID: 3888)
- Unicorn-6139.exe (PID: 5332)
- Unicorn-23958.exe (PID: 4000)
- Unicorn-3446.exe (PID: 4976)
- Unicorn-39767.exe (PID: 4436)
- Unicorn-52382.exe (PID: 1616)
- Unicorn-40644.exe (PID: 6240)
- Unicorn-17793.exe (PID: 6080)
- Unicorn-19861.exe (PID: 5756)
- Unicorn-56980.exe (PID: 6872)
- Unicorn-37114.exe (PID: 736)
- Unicorn-24774.exe (PID: 7172)
- Unicorn-7499.exe (PID: 7268)
- Unicorn-7499.exe (PID: 7276)
- Unicorn-53171.exe (PID: 7252)
- Unicorn-34946.exe (PID: 7320)
- Unicorn-7691.exe (PID: 2108)
- Unicorn-44640.exe (PID: 7192)
- Unicorn-4759.exe (PID: 7572)
- Unicorn-7058.exe (PID: 8568)
- Unicorn-3275.exe (PID: 8676)
- Unicorn-57592.exe (PID: 9104)
- Unicorn-27233.exe (PID: 8908)
- Unicorn-33364.exe (PID: 8848)
- Unicorn-27033.exe (PID: 7528)
- Unicorn-41458.exe (PID: 9696)
- Unicorn-53368.exe (PID: 10256)
- Unicorn-7567.exe (PID: 10144)
Checks supported languages
- 1 (1284).exe (PID: 4880)
- Unicorn-10763.exe (PID: 7084)
- Unicorn-32917.exe (PID: 6148)
- Unicorn-3446.exe (PID: 4976)
- Unicorn-4219.exe (PID: 6404)
- Unicorn-3446.exe (PID: 3888)
- Unicorn-6139.exe (PID: 5332)
- Unicorn-39767.exe (PID: 4436)
- Unicorn-27515.exe (PID: 2340)
- Unicorn-52382.exe (PID: 1616)
- Unicorn-23958.exe (PID: 4000)
- Unicorn-56980.exe (PID: 6872)
- Unicorn-40644.exe (PID: 6240)
- Unicorn-37114.exe (PID: 736)
- Unicorn-17793.exe (PID: 6080)
- Unicorn-23659.exe (PID: 5640)
- Unicorn-19538.exe (PID: 5436)
- Unicorn-19861.exe (PID: 5756)
- Unicorn-7691.exe (PID: 6800)
- Unicorn-44640.exe (PID: 7192)
- Unicorn-24774.exe (PID: 7172)
- Unicorn-1369.exe (PID: 7228)
- Unicorn-47333.exe (PID: 7212)
- Unicorn-1661.exe (PID: 7220)
- Unicorn-7499.exe (PID: 7268)
- Unicorn-7691.exe (PID: 2108)
- Unicorn-26280.exe (PID: 7312)
- Unicorn-5314.exe (PID: 7744)
- Unicorn-63389.exe (PID: 7492)
- Unicorn-4759.exe (PID: 7572)
- Unicorn-28408.exe (PID: 8004)
- Unicorn-16732.exe (PID: 7568)
- Unicorn-15615.exe (PID: 8248)
- Unicorn-12438.exe (PID: 8292)
- Unicorn-64899.exe (PID: 8492)
- Unicorn-3275.exe (PID: 8676)
- Unicorn-28849.exe (PID: 8692)
- Unicorn-50837.exe (PID: 8632)
- Unicorn-23888.exe (PID: 8784)
- Unicorn-58615.exe (PID: 8888)
- Unicorn-41293.exe (PID: 8824)
- Unicorn-37941.exe (PID: 9136)
- Unicorn-39538.exe (PID: 9272)
- Unicorn-7965.exe (PID: 9392)
- Unicorn-29537.exe (PID: 9488)
- Unicorn-32055.exe (PID: 9364)
- Unicorn-9554.exe (PID: 9860)
- Unicorn-44049.exe (PID: 10088)
- Unicorn-62760.exe (PID: 9976)
- Unicorn-53368.exe (PID: 10256)
- Unicorn-58968.exe (PID: 10264)
- Unicorn-49752.exe (PID: 10632)
- Unicorn-20972.exe (PID: 10736)
- Unicorn-8610.exe (PID: 10968)
- Unicorn-14256.exe (PID: 11140)
- Unicorn-30462.exe (PID: 11056)
- Unicorn-19170.exe (PID: 11280)
- Unicorn-39398.exe (PID: 11348)
- Unicorn-47657.exe (PID: 11464)
- Unicorn-48081.exe (PID: 11404)
- Unicorn-23638.exe (PID: 11692)
- Unicorn-19190.exe (PID: 11928)
- Unicorn-32212.exe (PID: 12032)
- Unicorn-57544.exe (PID: 3968)
- Unicorn-25292.exe (PID: 5624)
- Unicorn-37544.exe (PID: 1600)
- Unicorn-60149.exe (PID: 12464)
- Unicorn-6864.exe (PID: 12448)
- Unicorn-11970.exe (PID: 12912)
- Unicorn-26281.exe (PID: 12812)
- Unicorn-21730.exe (PID: 12624)
- Unicorn-58047.exe (PID: 12984)
- Unicorn-11882.exe (PID: 13908)
- Unicorn-40662.exe (PID: 13740)
- Unicorn-7441.exe (PID: 14052)
- Unicorn-52343.exe (PID: 14144)
- Unicorn-22109.exe (PID: 14420)
- Unicorn-28622.exe (PID: 14492)
- Unicorn-38607.exe (PID: 14136)
- Unicorn-17807.exe (PID: 15000)
- Unicorn-48997.exe (PID: 15140)
- Unicorn-16761.exe (PID: 15252)
- Unicorn-15831.exe (PID: 15408)
- Unicorn-11009.exe (PID: 14468)
- Unicorn-43600.exe (PID: 15592)
- Unicorn-37927.exe (PID: 15504)
- Unicorn-13121.exe (PID: 15664)
- Unicorn-44887.exe (PID: 15912)
- Unicorn-1026.exe (PID: 16144)
- Unicorn-50663.exe (PID: 16260)
- Unicorn-41295.exe (PID: 15756)
- Unicorn-62042.exe (PID: 16536)
- Unicorn-19548.exe (PID: 16952)
- Unicorn-65351.exe (PID: 17020)
- Unicorn-64071.exe (PID: 16748)
- Unicorn-24903.exe (PID: 17492)
- Unicorn-37155.exe (PID: 17444)
- Unicorn-51187.exe (PID: 17708)
- Unicorn-9883.exe (PID: 17640)
- Unicorn-54855.exe (PID: 18092)
- Unicorn-20921.exe (PID: 18184)
- Unicorn-2163.exe (PID: 18216)
- Unicorn-53786.exe (PID: 18024)
Create files in a temporary directory
- 1 (1284).exe (PID: 4880)
- Unicorn-32917.exe (PID: 6148)
- Unicorn-3446.exe (PID: 3888)
- Unicorn-4219.exe (PID: 6404)
- Unicorn-6139.exe (PID: 5332)
- Unicorn-23958.exe (PID: 4000)
- Unicorn-39767.exe (PID: 4436)
- Unicorn-3446.exe (PID: 4976)
- Unicorn-23659.exe (PID: 5640)
- Unicorn-19861.exe (PID: 5756)
- Unicorn-19538.exe (PID: 5436)
- Unicorn-40644.exe (PID: 6240)
- Unicorn-1369.exe (PID: 7228)
- Unicorn-52382.exe (PID: 1616)
- Unicorn-26280.exe (PID: 7312)
- Unicorn-6980.exe (PID: 7776)
- Unicorn-36730.exe (PID: 7796)
- Unicorn-56980.exe (PID: 6872)
- Unicorn-26872.exe (PID: 8092)
- Unicorn-42222.exe (PID: 7360)
- Unicorn-47100.exe (PID: 8188)
- Unicorn-7691.exe (PID: 2108)
- Unicorn-10763.exe (PID: 7084)
- Unicorn-4759.exe (PID: 7572)
- Unicorn-6534.exe (PID: 6808)
- Unicorn-52444.exe (PID: 4268)
- Unicorn-42222.exe (PID: 7368)
- Unicorn-3259.exe (PID: 7820)
- Unicorn-7691.exe (PID: 6800)
- Unicorn-40909.exe (PID: 8444)
- Unicorn-56892.exe (PID: 8124)
- Unicorn-47100.exe (PID: 1020)
- Unicorn-49248.exe (PID: 7500)
- Unicorn-8428.exe (PID: 8716)
- Unicorn-41293.exe (PID: 8816)
- Unicorn-3282.exe (PID: 9004)
- Unicorn-58615.exe (PID: 8888)
- Unicorn-7084.exe (PID: 8968)
- Unicorn-47333.exe (PID: 7212)
- Unicorn-18494.exe (PID: 7512)
- Unicorn-12367.exe (PID: 9148)
- Unicorn-44640.exe (PID: 7192)
- Unicorn-27515.exe (PID: 2340)
- Unicorn-19249.exe (PID: 9292)
- Unicorn-14287.exe (PID: 9340)
- Unicorn-26156.exe (PID: 9440)
- Unicorn-28303.exe (PID: 8172)
- Unicorn-50837.exe (PID: 8632)
- Unicorn-33364.exe (PID: 8848)
- Unicorn-34946.exe (PID: 7320)
- Unicorn-63198.exe (PID: 8504)
- Unicorn-10867.exe (PID: 8456)
- Unicorn-52964.exe (PID: 9736)
- Unicorn-48506.exe (PID: 8012)
- Unicorn-53161.exe (PID: 8436)
- Unicorn-22718.exe (PID: 8668)
- Unicorn-3010.exe (PID: 8684)
- Unicorn-12144.exe (PID: 10232)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 6652)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 6652)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 2092)
- BackgroundTransferHost.exe (PID: 6652)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 6652)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:20 00:32:00+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
686
Monitored processes
554
Malicious processes
80
Suspicious processes
65
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 496 | C:\Users\admin\AppData\Local\Temp\Unicorn-56236.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56236.exe | — | Unicorn-6980.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 736 | C:\Users\admin\AppData\Local\Temp\Unicorn-37114.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-37114.exe | Unicorn-10763.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 856 | C:\Users\admin\AppData\Local\Temp\Unicorn-31422.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-31422.exe | Unicorn-52444.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 864 | C:\Users\admin\AppData\Local\Temp\Unicorn-58613.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-58613.exe | — | Unicorn-51791.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1020 | C:\Users\admin\AppData\Local\Temp\Unicorn-47100.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-47100.exe | Unicorn-7691.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1188 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1600 | C:\Users\admin\AppData\Local\Temp\Unicorn-37544.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-37544.exe | — | Unicorn-7691.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1616 | C:\Users\admin\AppData\Local\Temp\Unicorn-52382.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-52382.exe | Unicorn-4219.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1812 | C:\Users\admin\AppData\Local\Temp\Unicorn-31186.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-31186.exe | — | Unicorn-56944.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2092 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
14 995
Read events
14 980
Write events
15
Delete events
0
Modification events
| (PID) Process: | (1188) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (1188) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (1188) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6652) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6652) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6652) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6816) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6816) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6816) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2092) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
1 142
Suspicious files
7
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6652 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\4407dc23-17d1-416b-9673-ee6b260f37d2.down_data | — | |
MD5:— | SHA256:— | |||
| 4880 | 1 (1284).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-32917.exe | executable | |
MD5:09EC3F5A8A35B638EC3B433747C8E4FB | SHA256:9BC33F50FEFC50F77AB328EB7567B2959F2FFE753974ADC2A356B18352D4EC74 | |||
| 6404 | Unicorn-4219.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3446.exe | executable | |
MD5:A2F8B9DB01797CF15A3208B1B16041E5 | SHA256:BA503566813D8EC895A89F5D84B9909F70242863BD3ED139203A8B2F30C9F0A7 | |||
| 4880 | 1 (1284).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-23958.exe | executable | |
MD5:2190713AAE928C4E88CB4E596200C5FC | SHA256:53CA84AC82801D2F4851B023E4651419D4AB39DBC005E98A116977089C3B9B65 | |||
| 6148 | Unicorn-32917.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-10763.exe | executable | |
MD5:E0774379D6DE52A27201EE0CDD773E93 | SHA256:EADAAA6DBD308D01B74738E6137346EAA2A5FFAFE77A55B143C486E697121332 | |||
| 6148 | Unicorn-32917.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-17793.exe | executable | |
MD5:898E9CE2F9559CE63316D347E9E45967 | SHA256:51D97A06BE5E5F4F50FE60ED0189783D4EDF104C3DC67F69806FA842B5624050 | |||
| 4880 | 1 (1284).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-23659.exe | executable | |
MD5:825F610A46CD3C1D2D048462FB97F7E0 | SHA256:6E6066D26E44FC3A9A7A421138E93C67EE047A4185BE780E3649A91EE78CB1A7 | |||
| 6652 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
| 7084 | Unicorn-10763.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-37114.exe | executable | |
MD5:58DCFF99FCEA8B2626AD022BE5D99FFB | SHA256:A49114B193621731E5B365EF2788942C772F48F4D256C503B634266FA50C0388 | |||
| 6652 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\340479fe-5dd5-4328-9e8f-67f14c6fe5b4.2d2fd71b-1c59-49a1-9c5b-5f29df9c5f6d.down_meta | binary | |
MD5:DBA6F046DC5783827780657A4773EF88 | SHA256:BD1C1B6FB3177168C7D99304C6FB650588F2D9A70493D40FFEBB72AEB4EE9215 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
17
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
3132 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.16.168.114:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6652 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
7552 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7552 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.16.168.114:80 | crl.microsoft.com | Akamai International B.V. | RU | whitelisted |
3216 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.159.64:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
2104 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3132 | backgroundTaskHost.exe | 20.31.169.57:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3132 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
6652 | BackgroundTransferHost.exe | 2.19.96.120:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |