| File name: | 1 (1398) |
| Full analysis: | https://app.any.run/tasks/c5a204f7-a1a8-42cb-981c-46e225565f43 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 15:07:25 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | D01BF28855BD5C72A6AFA53DA03B9150 |
| SHA1: | 4C7F9EDD7222D4E33B996FE9830188AFFD317891 |
| SHA256: | 8BB1D514690FE55ABE532EDDC47BB373F581BD6F0D9A2A41C6EF95E5AD0CB7D6 |
| SSDEEP: | 6144:PTKglnIJoDlWA5A36he/RpoxGtBqcvJGB5/6yeOKgk/8SwjwpyAvEh2TDVlnUPRa:PWMIEWA5g6gBBdha5iyeOKQx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- Unicorn-27556.exe (PID: 7256)
- Unicorn-15845.exe (PID: 6372)
- 1 (1398).exe (PID: 6872)
- Unicorn-13524.exe (PID: 7312)
- Unicorn-49918.exe (PID: 7288)
- Unicorn-8885.exe (PID: 7320)
- Unicorn-10923.exe (PID: 7328)
- Unicorn-20378.exe (PID: 7388)
- Unicorn-4596.exe (PID: 7440)
- Unicorn-149.exe (PID: 7520)
- Unicorn-32557.exe (PID: 7580)
- Unicorn-57326.exe (PID: 7572)
- Unicorn-39254.exe (PID: 7248)
- Unicorn-37460.exe (PID: 7564)
- Unicorn-39018.exe (PID: 8052)
- Unicorn-3008.exe (PID: 8064)
- Unicorn-51825.exe (PID: 6712)
- Unicorn-47378.exe (PID: 8112)
- Unicorn-12083.exe (PID: 8124)
- Unicorn-22490.exe (PID: 7180)
- Unicorn-10740.exe (PID: 6632)
- Unicorn-12401.exe (PID: 7532)
- Unicorn-46808.exe (PID: 728)
- Unicorn-44062.exe (PID: 5640)
- Unicorn-27342.exe (PID: 5404)
- Unicorn-4875.exe (PID: 6944)
- Unicorn-43028.exe (PID: 7548)
- Unicorn-39956.exe (PID: 6736)
- Unicorn-44986.exe (PID: 7504)
- Unicorn-61166.exe (PID: 1056)
- Unicorn-64757.exe (PID: 7368)
- Unicorn-45178.exe (PID: 7612)
- Unicorn-62785.exe (PID: 1324)
- Unicorn-10149.exe (PID: 7412)
- Unicorn-14425.exe (PID: 7012)
- Unicorn-16952.exe (PID: 7544)
- Unicorn-23554.exe (PID: 7960)
- Unicorn-54882.exe (PID: 4692)
- Unicorn-54669.exe (PID: 7436)
- Unicorn-22210.exe (PID: 672)
- Unicorn-60398.exe (PID: 7204)
- Unicorn-27638.exe (PID: 7976)
- Unicorn-32716.exe (PID: 7420)
- Unicorn-35612.exe (PID: 7880)
- Unicorn-42608.exe (PID: 7424)
- Unicorn-62474.exe (PID: 7456)
- Unicorn-3443.exe (PID: 7676)
- Unicorn-21674.exe (PID: 6476)
- Unicorn-59350.exe (PID: 7804)
- Unicorn-61374.exe (PID: 6816)
- Unicorn-4477.exe (PID: 8072)
- Unicorn-27062.exe (PID: 7800)
- Unicorn-56330.exe (PID: 6268)
- Unicorn-8732.exe (PID: 7940)
- Unicorn-59525.exe (PID: 7992)
- Unicorn-44462.exe (PID: 5084)
- Unicorn-28680.exe (PID: 5400)
- Unicorn-3429.exe (PID: 1452)
- Unicorn-62349.exe (PID: 7944)
- Unicorn-12199.exe (PID: 4108)
- Unicorn-15259.exe (PID: 7912)
- Unicorn-42416.exe (PID: 1096)
- Unicorn-25578.exe (PID: 7864)
- Unicorn-59469.exe (PID: 5124)
- Unicorn-2179.exe (PID: 7364)
- Unicorn-15363.exe (PID: 1328)
- Unicorn-14343.exe (PID: 5352)
- Unicorn-46501.exe (PID: 5512)
- Unicorn-55470.exe (PID: 8088)
- Unicorn-51426.exe (PID: 8100)
- Unicorn-19447.exe (PID: 6080)
- Unicorn-32018.exe (PID: 4268)
- Unicorn-46937.exe (PID: 8096)
- Unicorn-27860.exe (PID: 8276)
- Unicorn-46486.exe (PID: 8596)
- Unicorn-1628.exe (PID: 5984)
- Unicorn-45910.exe (PID: 8620)
- Unicorn-40636.exe (PID: 5408)
- Unicorn-40304.exe (PID: 8248)
- Unicorn-20948.exe (PID: 8652)
- Unicorn-51597.exe (PID: 6808)
- Unicorn-29535.exe (PID: 8148)
- Unicorn-7461.exe (PID: 8336)
- Unicorn-40657.exe (PID: 5936)
- Unicorn-8769.exe (PID: 8448)
- Unicorn-13408.exe (PID: 8472)
- Unicorn-36434.exe (PID: 8296)
- Unicorn-34249.exe (PID: 7888)
- Unicorn-57793.exe (PID: 8308)
- Unicorn-11322.exe (PID: 7084)
- Unicorn-50378.exe (PID: 8552)
- Unicorn-47254.exe (PID: 8728)
- Unicorn-51618.exe (PID: 8200)
- Unicorn-8583.exe (PID: 8568)
- Unicorn-20918.exe (PID: 7492)
- Unicorn-46693.exe (PID: 7904)
- Unicorn-23030.exe (PID: 8224)
- Unicorn-62417.exe (PID: 8420)
- Unicorn-6584.exe (PID: 8704)
- Unicorn-35208.exe (PID: 2568)
- Unicorn-34684.exe (PID: 968)
- Unicorn-22366.exe (PID: 8712)
- Unicorn-29919.exe (PID: 8368)
- Unicorn-12853.exe (PID: 8488)
- Unicorn-15630.exe (PID: 8344)
- Unicorn-40112.exe (PID: 7396)
- Unicorn-27114.exe (PID: 8208)
- Unicorn-21022.exe (PID: 8496)
- Unicorn-46678.exe (PID: 8768)
- Unicorn-16746.exe (PID: 8436)
- Unicorn-58790.exe (PID: 9868)
- Unicorn-17758.exe (PID: 9900)
- Unicorn-44372.exe (PID: 8536)
- Unicorn-6605.exe (PID: 8980)
- Unicorn-57845.exe (PID: 2064)
- Unicorn-48302.exe (PID: 8360)
- Unicorn-48110.exe (PID: 8024)
- Unicorn-7565.exe (PID: 9000)
- Unicorn-13761.exe (PID: 9296)
- Unicorn-43673.exe (PID: 9064)
- Unicorn-17248.exe (PID: 8588)
- Unicorn-39558.exe (PID: 8264)
- Unicorn-30844.exe (PID: 9304)
- Unicorn-2203.exe (PID: 9100)
- Unicorn-5349.exe (PID: 4740)
- Unicorn-51980.exe (PID: 5020)
- Unicorn-19242.exe (PID: 8888)
- Unicorn-56360.exe (PID: 9988)
- Unicorn-62718.exe (PID: 7848)
- Unicorn-15541.exe (PID: 9280)
- Unicorn-36044.exe (PID: 9352)
- Unicorn-47358.exe (PID: 9416)
- Unicorn-14787.exe (PID: 7528)
- Unicorn-58598.exe (PID: 10024)
- Unicorn-26030.exe (PID: 11244)
- Unicorn-9796.exe (PID: 472)
- Unicorn-10615.exe (PID: 8428)
- Unicorn-51473.exe (PID: 10804)
- Unicorn-37026.exe (PID: 9808)
- Unicorn-52978.exe (PID: 9720)
- Unicorn-61840.exe (PID: 9336)
- Unicorn-55998.exe (PID: 8840)
- Unicorn-46980.exe (PID: 9364)
- Unicorn-11820.exe (PID: 9040)
- Unicorn-13320.exe (PID: 10988)
- Unicorn-42172.exe (PID: 8352)
- Unicorn-51530.exe (PID: 8928)
- Unicorn-49993.exe (PID: 8800)
- Unicorn-16606.exe (PID: 9820)
- Unicorn-461.exe (PID: 9836)
- Unicorn-12137.exe (PID: 9588)
- Unicorn-56745.exe (PID: 8868)
- Unicorn-23030.exe (PID: 8216)
- Unicorn-3777.exe (PID: 9704)
- Unicorn-40896.exe (PID: 9468)
- Unicorn-144.exe (PID: 8400)
- Unicorn-57342.exe (PID: 9164)
- Unicorn-16570.exe (PID: 12392)
- Unicorn-48283.exe (PID: 12436)
- Unicorn-54898.exe (PID: 9952)
- Unicorn-36419.exe (PID: 12356)
- Unicorn-64440.exe (PID: 11080)
- Unicorn-40128.exe (PID: 10872)
- Unicorn-6303.exe (PID: 10848)
- Unicorn-48126.exe (PID: 9544)
- Unicorn-46450.exe (PID: 10956)
- Unicorn-50134.exe (PID: 9184)
- Unicorn-33030.exe (PID: 9144)
- Unicorn-11369.exe (PID: 9444)
- Unicorn-22610.exe (PID: 10136)
- Unicorn-16518.exe (PID: 10812)
- Unicorn-52085.exe (PID: 8912)
- Unicorn-52957.exe (PID: 9452)
- Unicorn-36096.exe (PID: 10788)
- Unicorn-46382.exe (PID: 7712)
- Unicorn-8785.exe (PID: 12296)
- Unicorn-14420.exe (PID: 9968)
- Unicorn-35328.exe (PID: 12456)
- Unicorn-38526.exe (PID: 12552)
- Unicorn-25049.exe (PID: 12336)
- Unicorn-19620.exe (PID: 13064)
- Unicorn-35490.exe (PID: 9516)
- Unicorn-2080.exe (PID: 11212)
- Unicorn-63020.exe (PID: 8920)
- Unicorn-17566.exe (PID: 10104)
- Unicorn-1909.exe (PID: 11092)
- Unicorn-10975.exe (PID: 14668)
- Unicorn-11644.exe (PID: 13092)
- Unicorn-3959.exe (PID: 14744)
- Unicorn-52292.exe (PID: 14684)
- Unicorn-3163.exe (PID: 9212)
- Unicorn-19692.exe (PID: 8256)
- Unicorn-64706.exe (PID: 11364)
- Unicorn-16340.exe (PID: 10416)
- Unicorn-34390.exe (PID: 11196)
- Unicorn-7927.exe (PID: 5452)
- Unicorn-36376.exe (PID: 7836)
- Unicorn-18630.exe (PID: 10728)
- Unicorn-1457.exe (PID: 7664)
- Unicorn-25223.exe (PID: 10296)
- Unicorn-37706.exe (PID: 11012)
- Unicorn-62993.exe (PID: 4932)
- Unicorn-43082.exe (PID: 9388)
- Unicorn-11488.exe (PID: 10328)
- Unicorn-11488.exe (PID: 10356)
- Unicorn-14353.exe (PID: 11132)
Starts itself from another location
- 1 (1398).exe (PID: 6872)
- Unicorn-15845.exe (PID: 6372)
- Unicorn-39254.exe (PID: 7248)
- Unicorn-27556.exe (PID: 7256)
- Unicorn-49918.exe (PID: 7288)
- Unicorn-8885.exe (PID: 7320)
- Unicorn-13524.exe (PID: 7312)
- Unicorn-10923.exe (PID: 7328)
- Unicorn-20378.exe (PID: 7388)
- Unicorn-149.exe (PID: 7520)
- Unicorn-4596.exe (PID: 7440)
- Unicorn-32557.exe (PID: 7580)
- Unicorn-43028.exe (PID: 7548)
- Unicorn-39018.exe (PID: 8052)
- Unicorn-12401.exe (PID: 7532)
- Unicorn-57326.exe (PID: 7572)
- Unicorn-3008.exe (PID: 8064)
- Unicorn-51825.exe (PID: 6712)
- Unicorn-37460.exe (PID: 7564)
- Unicorn-47378.exe (PID: 8112)
- Unicorn-12083.exe (PID: 8124)
- Unicorn-22490.exe (PID: 7180)
- Unicorn-44062.exe (PID: 5640)
- Unicorn-10740.exe (PID: 6632)
- Unicorn-46808.exe (PID: 728)
- Unicorn-39956.exe (PID: 6736)
- Unicorn-4875.exe (PID: 6944)
- Unicorn-27342.exe (PID: 5404)
- Unicorn-21674.exe (PID: 6476)
- Unicorn-45178.exe (PID: 7612)
- Unicorn-44986.exe (PID: 7504)
- Unicorn-61166.exe (PID: 1056)
- Unicorn-62785.exe (PID: 1324)
- Unicorn-59350.exe (PID: 7804)
- Unicorn-10149.exe (PID: 7412)
- Unicorn-14425.exe (PID: 7012)
- Unicorn-23554.exe (PID: 7960)
- Unicorn-54882.exe (PID: 4692)
- Unicorn-54669.exe (PID: 7436)
- Unicorn-16952.exe (PID: 7544)
- Unicorn-60398.exe (PID: 7204)
- Unicorn-35612.exe (PID: 7880)
- Unicorn-27638.exe (PID: 7976)
- Unicorn-64757.exe (PID: 7368)
- Unicorn-22210.exe (PID: 672)
- Unicorn-32716.exe (PID: 7420)
- Unicorn-42608.exe (PID: 7424)
- Unicorn-62474.exe (PID: 7456)
- Unicorn-3443.exe (PID: 7676)
- Unicorn-27062.exe (PID: 7800)
- Unicorn-35208.exe (PID: 2568)
- Unicorn-4477.exe (PID: 8072)
- Unicorn-28680.exe (PID: 5400)
- Unicorn-59525.exe (PID: 7992)
- Unicorn-3429.exe (PID: 1452)
- Unicorn-61374.exe (PID: 6816)
- Unicorn-62349.exe (PID: 7944)
- Unicorn-11322.exe (PID: 7084)
- Unicorn-15259.exe (PID: 7912)
- Unicorn-44462.exe (PID: 5084)
- Unicorn-42416.exe (PID: 1096)
- Unicorn-25578.exe (PID: 7864)
- Unicorn-59469.exe (PID: 5124)
- Unicorn-2179.exe (PID: 7364)
- Unicorn-15363.exe (PID: 1328)
- Unicorn-46501.exe (PID: 5512)
- Unicorn-46937.exe (PID: 8096)
- Unicorn-55470.exe (PID: 8088)
- Unicorn-12199.exe (PID: 4108)
- Unicorn-51426.exe (PID: 8100)
- Unicorn-14343.exe (PID: 5352)
- Unicorn-32018.exe (PID: 4268)
- Unicorn-40304.exe (PID: 8248)
- Unicorn-27860.exe (PID: 8276)
- Unicorn-46486.exe (PID: 8596)
- Unicorn-19447.exe (PID: 6080)
- Unicorn-45910.exe (PID: 8620)
- Unicorn-20948.exe (PID: 8652)
- Unicorn-51597.exe (PID: 6808)
- Unicorn-40657.exe (PID: 5936)
- Unicorn-1628.exe (PID: 5984)
- Unicorn-29535.exe (PID: 8148)
- Unicorn-13408.exe (PID: 8472)
- Unicorn-36434.exe (PID: 8296)
- Unicorn-34249.exe (PID: 7888)
- Unicorn-7461.exe (PID: 8336)
- Unicorn-8769.exe (PID: 8448)
- Unicorn-51618.exe (PID: 8200)
- Unicorn-8583.exe (PID: 8568)
- Unicorn-57793.exe (PID: 8308)
- Unicorn-50378.exe (PID: 8552)
- Unicorn-62417.exe (PID: 8420)
- Unicorn-46693.exe (PID: 7904)
- Unicorn-20918.exe (PID: 7492)
- Unicorn-29919.exe (PID: 8368)
- Unicorn-23030.exe (PID: 8224)
- Unicorn-47254.exe (PID: 8728)
- Unicorn-12853.exe (PID: 8488)
- Unicorn-56330.exe (PID: 6268)
- Unicorn-6584.exe (PID: 8704)
- Unicorn-34684.exe (PID: 968)
- Unicorn-22366.exe (PID: 8712)
- Unicorn-46678.exe (PID: 8768)
- Unicorn-21022.exe (PID: 8496)
- Unicorn-15630.exe (PID: 8344)
- Unicorn-16746.exe (PID: 8436)
- Unicorn-27114.exe (PID: 8208)
- Unicorn-44372.exe (PID: 8536)
- Unicorn-58790.exe (PID: 9868)
- Unicorn-6605.exe (PID: 8980)
- Unicorn-48302.exe (PID: 8360)
- Unicorn-57845.exe (PID: 2064)
- Unicorn-48110.exe (PID: 8024)
- Unicorn-63020.exe (PID: 8920)
- Unicorn-17758.exe (PID: 9900)
- Unicorn-43673.exe (PID: 9064)
- Unicorn-17248.exe (PID: 8588)
- Unicorn-39558.exe (PID: 8264)
- Unicorn-30844.exe (PID: 9304)
- Unicorn-2203.exe (PID: 9100)
- Unicorn-13761.exe (PID: 9296)
- Unicorn-62718.exe (PID: 7848)
- Unicorn-5349.exe (PID: 4740)
- Unicorn-40636.exe (PID: 5408)
- Unicorn-19242.exe (PID: 8888)
- Unicorn-51980.exe (PID: 5020)
- Unicorn-7565.exe (PID: 9000)
- Unicorn-15541.exe (PID: 9280)
- Unicorn-47358.exe (PID: 9416)
- Unicorn-56360.exe (PID: 9988)
- Unicorn-58598.exe (PID: 10024)
- Unicorn-36044.exe (PID: 9352)
- Unicorn-26030.exe (PID: 11244)
- Unicorn-9796.exe (PID: 472)
- Unicorn-51473.exe (PID: 10804)
- Unicorn-36096.exe (PID: 10788)
- Unicorn-14787.exe (PID: 7528)
- Unicorn-10615.exe (PID: 8428)
- Unicorn-52978.exe (PID: 9720)
- Unicorn-11820.exe (PID: 9040)
- Unicorn-61840.exe (PID: 9336)
- Unicorn-55998.exe (PID: 8840)
- Unicorn-37026.exe (PID: 9808)
- Unicorn-42172.exe (PID: 8352)
- Unicorn-13320.exe (PID: 10988)
- Unicorn-51530.exe (PID: 8928)
- Unicorn-46980.exe (PID: 9364)
- Unicorn-16606.exe (PID: 9820)
- Unicorn-49993.exe (PID: 8800)
- Unicorn-461.exe (PID: 9836)
- Unicorn-12137.exe (PID: 9588)
- Unicorn-56745.exe (PID: 8868)
- Unicorn-23030.exe (PID: 8216)
- Unicorn-144.exe (PID: 8400)
- Unicorn-40896.exe (PID: 9468)
- Unicorn-3777.exe (PID: 9704)
- Unicorn-8732.exe (PID: 7940)
- Unicorn-36419.exe (PID: 12356)
- Unicorn-16570.exe (PID: 12392)
- Unicorn-48283.exe (PID: 12436)
- Unicorn-57342.exe (PID: 9164)
- Unicorn-40128.exe (PID: 10872)
- Unicorn-64440.exe (PID: 11080)
- Unicorn-54898.exe (PID: 9952)
- Unicorn-6303.exe (PID: 10848)
- Unicorn-50134.exe (PID: 9184)
- Unicorn-33030.exe (PID: 9144)
- Unicorn-46450.exe (PID: 10956)
- Unicorn-11369.exe (PID: 9444)
- Unicorn-48126.exe (PID: 9544)
- Unicorn-16518.exe (PID: 10812)
- Unicorn-14420.exe (PID: 9968)
- Unicorn-52085.exe (PID: 8912)
- Unicorn-52957.exe (PID: 9452)
- Unicorn-46382.exe (PID: 7712)
- Unicorn-22610.exe (PID: 10136)
- Unicorn-8785.exe (PID: 12296)
- Unicorn-35328.exe (PID: 12456)
- Unicorn-38526.exe (PID: 12552)
- Unicorn-1909.exe (PID: 11092)
- Unicorn-17566.exe (PID: 10104)
- Unicorn-25049.exe (PID: 12336)
Executes application which crashes
- Unicorn-63429.exe (PID: 9908)
- Unicorn-28562.exe (PID: 9172)
INFO
The sample compiled with chinese language support
- 1 (1398).exe (PID: 6872)
- Unicorn-15845.exe (PID: 6372)
- Unicorn-39254.exe (PID: 7248)
- Unicorn-49918.exe (PID: 7288)
- Unicorn-13524.exe (PID: 7312)
- Unicorn-8885.exe (PID: 7320)
- Unicorn-10923.exe (PID: 7328)
- Unicorn-27556.exe (PID: 7256)
- Unicorn-4596.exe (PID: 7440)
- Unicorn-149.exe (PID: 7520)
- Unicorn-32557.exe (PID: 7580)
- Unicorn-20378.exe (PID: 7388)
- Unicorn-39018.exe (PID: 8052)
- Unicorn-57326.exe (PID: 7572)
- Unicorn-37460.exe (PID: 7564)
- Unicorn-3008.exe (PID: 8064)
- Unicorn-51825.exe (PID: 6712)
- Unicorn-47378.exe (PID: 8112)
- Unicorn-12083.exe (PID: 8124)
- Unicorn-22490.exe (PID: 7180)
- Unicorn-44062.exe (PID: 5640)
- Unicorn-10740.exe (PID: 6632)
- Unicorn-12401.exe (PID: 7532)
- Unicorn-46808.exe (PID: 728)
- Unicorn-39956.exe (PID: 6736)
- Unicorn-43028.exe (PID: 7548)
- Unicorn-27342.exe (PID: 5404)
- Unicorn-4875.exe (PID: 6944)
- Unicorn-44986.exe (PID: 7504)
- Unicorn-61166.exe (PID: 1056)
- Unicorn-62785.exe (PID: 1324)
- Unicorn-64757.exe (PID: 7368)
- Unicorn-45178.exe (PID: 7612)
- Unicorn-10149.exe (PID: 7412)
- Unicorn-14425.exe (PID: 7012)
- Unicorn-23554.exe (PID: 7960)
- Unicorn-54882.exe (PID: 4692)
- Unicorn-54669.exe (PID: 7436)
- Unicorn-16952.exe (PID: 7544)
- Unicorn-60398.exe (PID: 7204)
- Unicorn-27638.exe (PID: 7976)
- Unicorn-32716.exe (PID: 7420)
- Unicorn-22210.exe (PID: 672)
- Unicorn-35612.exe (PID: 7880)
- Unicorn-42608.exe (PID: 7424)
- Unicorn-21674.exe (PID: 6476)
- Unicorn-62474.exe (PID: 7456)
- Unicorn-3443.exe (PID: 7676)
- Unicorn-56330.exe (PID: 6268)
- Unicorn-59350.exe (PID: 7804)
- Unicorn-4477.exe (PID: 8072)
- Unicorn-27062.exe (PID: 7800)
- Unicorn-59525.exe (PID: 7992)
- Unicorn-8732.exe (PID: 7940)
- Unicorn-3429.exe (PID: 1452)
- Unicorn-61374.exe (PID: 6816)
- Unicorn-28680.exe (PID: 5400)
- Unicorn-62349.exe (PID: 7944)
- Unicorn-12199.exe (PID: 4108)
- Unicorn-15259.exe (PID: 7912)
- Unicorn-44462.exe (PID: 5084)
- Unicorn-2179.exe (PID: 7364)
- Unicorn-42416.exe (PID: 1096)
- Unicorn-25578.exe (PID: 7864)
- Unicorn-59469.exe (PID: 5124)
- Unicorn-46501.exe (PID: 5512)
- Unicorn-14343.exe (PID: 5352)
- Unicorn-15363.exe (PID: 1328)
- Unicorn-55470.exe (PID: 8088)
- Unicorn-51426.exe (PID: 8100)
- Unicorn-32018.exe (PID: 4268)
- Unicorn-46937.exe (PID: 8096)
- Unicorn-27860.exe (PID: 8276)
- Unicorn-1628.exe (PID: 5984)
- Unicorn-46486.exe (PID: 8596)
- Unicorn-19447.exe (PID: 6080)
- Unicorn-40636.exe (PID: 5408)
- Unicorn-40304.exe (PID: 8248)
- Unicorn-45910.exe (PID: 8620)
- Unicorn-20948.exe (PID: 8652)
- Unicorn-29535.exe (PID: 8148)
- Unicorn-51597.exe (PID: 6808)
- Unicorn-40657.exe (PID: 5936)
- Unicorn-13408.exe (PID: 8472)
- Unicorn-36434.exe (PID: 8296)
- Unicorn-34249.exe (PID: 7888)
- Unicorn-7461.exe (PID: 8336)
- Unicorn-8769.exe (PID: 8448)
- Unicorn-57793.exe (PID: 8308)
- Unicorn-8583.exe (PID: 8568)
- Unicorn-11322.exe (PID: 7084)
- Unicorn-50378.exe (PID: 8552)
- Unicorn-51618.exe (PID: 8200)
- Unicorn-46693.exe (PID: 7904)
- Unicorn-20918.exe (PID: 7492)
- Unicorn-23030.exe (PID: 8224)
- Unicorn-29919.exe (PID: 8368)
- Unicorn-47254.exe (PID: 8728)
- Unicorn-62417.exe (PID: 8420)
- Unicorn-12853.exe (PID: 8488)
- Unicorn-6584.exe (PID: 8704)
- Unicorn-34684.exe (PID: 968)
- Unicorn-22366.exe (PID: 8712)
- Unicorn-46678.exe (PID: 8768)
- Unicorn-15630.exe (PID: 8344)
- Unicorn-27114.exe (PID: 8208)
- Unicorn-40112.exe (PID: 7396)
- Unicorn-35208.exe (PID: 2568)
- Unicorn-21022.exe (PID: 8496)
- Unicorn-16746.exe (PID: 8436)
- Unicorn-58790.exe (PID: 9868)
- Unicorn-17758.exe (PID: 9900)
- Unicorn-44372.exe (PID: 8536)
- Unicorn-6605.exe (PID: 8980)
- Unicorn-57845.exe (PID: 2064)
- Unicorn-48302.exe (PID: 8360)
- Unicorn-48110.exe (PID: 8024)
- Unicorn-7565.exe (PID: 9000)
- Unicorn-17248.exe (PID: 8588)
- Unicorn-39558.exe (PID: 8264)
- Unicorn-30844.exe (PID: 9304)
- Unicorn-2203.exe (PID: 9100)
- Unicorn-13761.exe (PID: 9296)
- Unicorn-43673.exe (PID: 9064)
- Unicorn-62718.exe (PID: 7848)
- Unicorn-5349.exe (PID: 4740)
- Unicorn-51980.exe (PID: 5020)
- Unicorn-19242.exe (PID: 8888)
- Unicorn-56360.exe (PID: 9988)
- Unicorn-58598.exe (PID: 10024)
- Unicorn-15541.exe (PID: 9280)
- Unicorn-36044.exe (PID: 9352)
- Unicorn-47358.exe (PID: 9416)
- Unicorn-9796.exe (PID: 472)
- Unicorn-26030.exe (PID: 11244)
- Unicorn-10615.exe (PID: 8428)
- Unicorn-51473.exe (PID: 10804)
- Unicorn-14787.exe (PID: 7528)
- Unicorn-11820.exe (PID: 9040)
- Unicorn-52978.exe (PID: 9720)
- Unicorn-61840.exe (PID: 9336)
- Unicorn-55998.exe (PID: 8840)
- Unicorn-37026.exe (PID: 9808)
- Unicorn-13320.exe (PID: 10988)
- Unicorn-42172.exe (PID: 8352)
- Unicorn-51530.exe (PID: 8928)
- Unicorn-46980.exe (PID: 9364)
- Unicorn-16606.exe (PID: 9820)
- Unicorn-461.exe (PID: 9836)
- Unicorn-12137.exe (PID: 9588)
- Unicorn-56745.exe (PID: 8868)
- Unicorn-49993.exe (PID: 8800)
- Unicorn-23030.exe (PID: 8216)
- Unicorn-40896.exe (PID: 9468)
- Unicorn-3777.exe (PID: 9704)
- Unicorn-144.exe (PID: 8400)
- Unicorn-16570.exe (PID: 12392)
- Unicorn-48283.exe (PID: 12436)
- Unicorn-57342.exe (PID: 9164)
- Unicorn-36419.exe (PID: 12356)
- Unicorn-6303.exe (PID: 10848)
- Unicorn-40128.exe (PID: 10872)
- Unicorn-48126.exe (PID: 9544)
- Unicorn-54898.exe (PID: 9952)
- Unicorn-64440.exe (PID: 11080)
- Unicorn-50134.exe (PID: 9184)
- Unicorn-33030.exe (PID: 9144)
- Unicorn-46450.exe (PID: 10956)
- Unicorn-11369.exe (PID: 9444)
- Unicorn-16518.exe (PID: 10812)
- Unicorn-52085.exe (PID: 8912)
- Unicorn-14420.exe (PID: 9968)
- Unicorn-8785.exe (PID: 12296)
- Unicorn-36096.exe (PID: 10788)
- Unicorn-52957.exe (PID: 9452)
- Unicorn-46382.exe (PID: 7712)
- Unicorn-22610.exe (PID: 10136)
- Unicorn-38526.exe (PID: 12552)
- Unicorn-25049.exe (PID: 12336)
- Unicorn-35328.exe (PID: 12456)
- Unicorn-1909.exe (PID: 11092)
- Unicorn-17566.exe (PID: 10104)
- Unicorn-35490.exe (PID: 9516)
- Unicorn-19620.exe (PID: 13064)
- Unicorn-2080.exe (PID: 11212)
- Unicorn-63020.exe (PID: 8920)
- Unicorn-16340.exe (PID: 10416)
- Unicorn-34390.exe (PID: 11196)
- Unicorn-10975.exe (PID: 14668)
- Unicorn-52292.exe (PID: 14684)
- Unicorn-64706.exe (PID: 11364)
- Unicorn-19692.exe (PID: 8256)
- Unicorn-3163.exe (PID: 9212)
- Unicorn-3959.exe (PID: 14744)
- Unicorn-11644.exe (PID: 13092)
- Unicorn-62993.exe (PID: 4932)
- Unicorn-36376.exe (PID: 7836)
- Unicorn-7927.exe (PID: 5452)
- Unicorn-43082.exe (PID: 9388)
- Unicorn-1457.exe (PID: 7664)
- Unicorn-18630.exe (PID: 10728)
- Unicorn-25223.exe (PID: 10296)
- Unicorn-37706.exe (PID: 11012)
- Unicorn-11488.exe (PID: 10356)
- Unicorn-14353.exe (PID: 11132)
- Unicorn-11488.exe (PID: 10328)
Reads the computer name
- 1 (1398).exe (PID: 6872)
- Unicorn-15845.exe (PID: 6372)
- Unicorn-27556.exe (PID: 7256)
- Unicorn-39254.exe (PID: 7248)
- Unicorn-10923.exe (PID: 7328)
- Unicorn-20378.exe (PID: 7388)
- Unicorn-49918.exe (PID: 7288)
- Unicorn-12401.exe (PID: 7532)
- Unicorn-43028.exe (PID: 7548)
- Unicorn-37460.exe (PID: 7564)
- Unicorn-3008.exe (PID: 8064)
- Unicorn-22490.exe (PID: 7180)
- Unicorn-27342.exe (PID: 5404)
- Unicorn-39956.exe (PID: 6736)
- Unicorn-10149.exe (PID: 7412)
- Unicorn-54669.exe (PID: 7436)
- Unicorn-16952.exe (PID: 7544)
- Unicorn-35208.exe (PID: 2568)
- Unicorn-3429.exe (PID: 1452)
- Unicorn-51426.exe (PID: 8100)
- Unicorn-29535.exe (PID: 8148)
- Unicorn-13408.exe (PID: 8472)
- Unicorn-16746.exe (PID: 8436)
- Unicorn-62417.exe (PID: 8420)
- Unicorn-29919.exe (PID: 8368)
- Unicorn-63429.exe (PID: 9908)
- Unicorn-30844.exe (PID: 9304)
- Unicorn-63020.exe (PID: 8920)
- Unicorn-144.exe (PID: 8400)
- Unicorn-37706.exe (PID: 11012)
- Unicorn-3163.exe (PID: 9212)
Checks supported languages
- 1 (1398).exe (PID: 6872)
- Unicorn-15845.exe (PID: 6372)
- Unicorn-39254.exe (PID: 7248)
- Unicorn-27556.exe (PID: 7256)
- Unicorn-49918.exe (PID: 7288)
- Unicorn-10923.exe (PID: 7328)
- Unicorn-20378.exe (PID: 7388)
- Unicorn-149.exe (PID: 7520)
- Unicorn-13524.exe (PID: 7312)
- Unicorn-8885.exe (PID: 7320)
- Unicorn-12401.exe (PID: 7532)
- Unicorn-37460.exe (PID: 7564)
- Unicorn-32557.exe (PID: 7580)
- Unicorn-43028.exe (PID: 7548)
- Unicorn-57326.exe (PID: 7572)
- Unicorn-22490.exe (PID: 7180)
- Unicorn-44062.exe (PID: 5640)
- Unicorn-39956.exe (PID: 6736)
- Unicorn-4875.exe (PID: 6944)
- Unicorn-21674.exe (PID: 6476)
- Unicorn-45178.exe (PID: 7612)
- Unicorn-16952.exe (PID: 7544)
- Unicorn-44986.exe (PID: 7504)
- Unicorn-54669.exe (PID: 7436)
- Unicorn-42608.exe (PID: 7424)
- Unicorn-59350.exe (PID: 7804)
- Unicorn-10149.exe (PID: 7412)
- Unicorn-54882.exe (PID: 4692)
- Unicorn-62785.exe (PID: 1324)
- Unicorn-64757.exe (PID: 7368)
- Unicorn-2179.exe (PID: 7364)
- Unicorn-27062.exe (PID: 7800)
- Unicorn-59525.exe (PID: 7992)
- Unicorn-59469.exe (PID: 5124)
- Unicorn-23554.exe (PID: 7960)
- Unicorn-56330.exe (PID: 6268)
- Unicorn-11322.exe (PID: 7084)
- Unicorn-61374.exe (PID: 6816)
- Unicorn-14343.exe (PID: 5352)
- Unicorn-32018.exe (PID: 4268)
- Unicorn-44462.exe (PID: 5084)
- Unicorn-20918.exe (PID: 7492)
- Unicorn-51426.exe (PID: 8100)
- Unicorn-34684.exe (PID: 968)
- Unicorn-46937.exe (PID: 8096)
- Unicorn-51597.exe (PID: 6808)
- Unicorn-46501.exe (PID: 5512)
- Unicorn-2972.exe (PID: 6048)
- Unicorn-36434.exe (PID: 8296)
- Unicorn-27860.exe (PID: 8276)
- Unicorn-13408.exe (PID: 8472)
- Unicorn-16746.exe (PID: 8436)
- Unicorn-144.exe (PID: 8400)
- Unicorn-15630.exe (PID: 8344)
- Unicorn-10615.exe (PID: 8428)
- Unicorn-21022.exe (PID: 8496)
- Unicorn-22366.exe (PID: 8712)
- Unicorn-51980.exe (PID: 5020)
- Unicorn-49537.exe (PID: 9156)
- Unicorn-46980.exe (PID: 9364)
- Unicorn-58790.exe (PID: 9868)
- Unicorn-52957.exe (PID: 9452)
- Unicorn-37026.exe (PID: 9808)
- Unicorn-16414.exe (PID: 9680)
- Unicorn-21139.exe (PID: 10304)
- Unicorn-42624.exe (PID: 10440)
- Unicorn-11488.exe (PID: 10328)
- Unicorn-26915.exe (PID: 10776)
- Unicorn-13481.exe (PID: 10080)
- Unicorn-2080.exe (PID: 11212)
- Unicorn-36419.exe (PID: 12356)
- Unicorn-28504.exe (PID: 11384)
- Unicorn-7892.exe (PID: 11404)
- Unicorn-45417.exe (PID: 11460)
- Unicorn-40128.exe (PID: 10880)
- Unicorn-51944.exe (PID: 11620)
- Unicorn-22086.exe (PID: 11688)
- Unicorn-39775.exe (PID: 11724)
- Unicorn-16932.exe (PID: 12152)
- Unicorn-7965.exe (PID: 13144)
- Unicorn-13063.exe (PID: 12900)
- Unicorn-33355.exe (PID: 13056)
- Unicorn-15728.exe (PID: 13076)
- Unicorn-30882.exe (PID: 10628)
- Unicorn-17058.exe (PID: 13808)
- Unicorn-22190.exe (PID: 12848)
- Unicorn-36444.exe (PID: 14176)
- Unicorn-25030.exe (PID: 10640)
- Unicorn-39590.exe (PID: 14004)
- Unicorn-11644.exe (PID: 13084)
- Unicorn-11364.exe (PID: 14096)
- Unicorn-6114.exe (PID: 7628)
- Unicorn-39952.exe (PID: 14104)
Create files in a temporary directory
- 1 (1398).exe (PID: 6872)
- Unicorn-15845.exe (PID: 6372)
- Unicorn-13524.exe (PID: 7312)
- Unicorn-49918.exe (PID: 7288)
- Unicorn-27556.exe (PID: 7256)
- Unicorn-10923.exe (PID: 7328)
- Unicorn-20378.exe (PID: 7388)
- Unicorn-149.exe (PID: 7520)
- Unicorn-57326.exe (PID: 7572)
- Unicorn-39254.exe (PID: 7248)
- Unicorn-39018.exe (PID: 8052)
- Unicorn-3008.exe (PID: 8064)
- Unicorn-37460.exe (PID: 7564)
- Unicorn-51825.exe (PID: 6712)
- Unicorn-4596.exe (PID: 7440)
- Unicorn-22490.exe (PID: 7180)
- Unicorn-12401.exe (PID: 7532)
- Unicorn-8885.exe (PID: 7320)
- Unicorn-4875.exe (PID: 6944)
- Unicorn-45178.exe (PID: 7612)
- Unicorn-64757.exe (PID: 7368)
- Unicorn-62785.exe (PID: 1324)
- Unicorn-10149.exe (PID: 7412)
- Unicorn-23554.exe (PID: 7960)
- Unicorn-54669.exe (PID: 7436)
- Unicorn-27638.exe (PID: 7976)
- Unicorn-32716.exe (PID: 7420)
- Unicorn-44062.exe (PID: 5640)
- Unicorn-39956.exe (PID: 6736)
- Unicorn-10740.exe (PID: 6632)
- Unicorn-12083.exe (PID: 8124)
- Unicorn-56330.exe (PID: 6268)
- Unicorn-28680.exe (PID: 5400)
- Unicorn-3429.exe (PID: 1452)
- Unicorn-44986.exe (PID: 7504)
- Unicorn-14425.exe (PID: 7012)
- Unicorn-47378.exe (PID: 8112)
- Unicorn-27342.exe (PID: 5404)
- Unicorn-59469.exe (PID: 5124)
- Unicorn-46501.exe (PID: 5512)
- Unicorn-59350.exe (PID: 7804)
- Unicorn-42608.exe (PID: 7424)
- Unicorn-40112.exe (PID: 7396)
- Unicorn-58790.exe (PID: 9868)
- Unicorn-62349.exe (PID: 7944)
- Unicorn-19242.exe (PID: 8888)
- Unicorn-6584.exe (PID: 8704)
- Unicorn-58598.exe (PID: 10024)
- Unicorn-20918.exe (PID: 7492)
- Unicorn-3777.exe (PID: 9704)
- Unicorn-17758.exe (PID: 9900)
- Unicorn-57793.exe (PID: 8308)
- Unicorn-21674.exe (PID: 6476)
- Unicorn-48283.exe (PID: 12436)
- Unicorn-48126.exe (PID: 9544)
- Unicorn-16518.exe (PID: 10812)
- Unicorn-29919.exe (PID: 8368)
- Unicorn-34249.exe (PID: 7888)
- Unicorn-32557.exe (PID: 7580)
- Unicorn-47254.exe (PID: 8728)
- Unicorn-32018.exe (PID: 4268)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 7744)
- BackgroundTransferHost.exe (PID: 2420)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 7744)
- slui.exe (PID: 5328)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 7744)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
607
Monitored processes
469
Malicious processes
72
Suspicious processes
60
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 472 | C:\Users\admin\AppData\Local\Temp\Unicorn-9796.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9796.exe | Unicorn-32557.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 672 | C:\Users\admin\AppData\Local\Temp\Unicorn-22210.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-22210.exe | Unicorn-44062.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 728 | C:\Users\admin\AppData\Local\Temp\Unicorn-46808.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46808.exe | 1 (1398).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 968 | C:\Users\admin\AppData\Local\Temp\Unicorn-34684.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-34684.exe | Unicorn-10740.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1056 | C:\Users\admin\AppData\Local\Temp\Unicorn-61166.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-61166.exe | Unicorn-149.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1096 | C:\Users\admin\AppData\Local\Temp\Unicorn-42416.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-42416.exe | Unicorn-12401.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1324 | C:\Users\admin\AppData\Local\Temp\Unicorn-62785.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-62785.exe | Unicorn-39254.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1328 | C:\Users\admin\AppData\Local\Temp\Unicorn-15363.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-15363.exe | Unicorn-57326.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1452 | C:\Users\admin\AppData\Local\Temp\Unicorn-3429.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3429.exe | Unicorn-61166.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2064 | C:\Users\admin\AppData\Local\Temp\Unicorn-57845.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-57845.exe | Unicorn-20378.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
13 976
Read events
13 961
Write events
15
Delete events
0
Modification events
| (PID) Process: | (7420) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7420) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7420) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7744) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7744) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7744) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (8172) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (8172) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (8172) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7904) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
622
Suspicious files
9
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7744 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8b7ff4c7-5cad-4832-a4d5-2ab9bda4ca51.down_data | — | |
MD5:— | SHA256:— | |||
| 6872 | 1 (1398).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-27556.exe | executable | |
MD5:BA5866F5F17E470AC02769C0E3DBE5D8 | SHA256:C55B6CE97179B8A3E815C7E44E4E43B1FC183F55630A85B00997A6C336C6AC6E | |||
| 6872 | 1 (1398).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-15845.exe | executable | |
MD5:94244A8BE956CF8A6A4AA97B3BA2EDA7 | SHA256:A08AFA81D2A2C096BBC969FC72DD896B2389A4F01C335F49B475E5FE2A5B2466 | |||
| 6372 | Unicorn-15845.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-39254.exe | executable | |
MD5:F5620C7A57557F32C081AA9B97EF611C | SHA256:AA3DBFCDB7B5F83B647354B0E4B7CEABC666AA2B49A5E4F70BAD3B75119D5D9C | |||
| 7744 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8b7ff4c7-5cad-4832-a4d5-2ab9bda4ca51.36ac0809-a223-4266-ae01-23be489c0e86.down_meta | binary | |
MD5:5AFE8E90CFC50FE5AA1CFEE7591849AC | SHA256:A83E86715C14A849CC788532B6D6C16BB9A5815B44E3CFD34F1CF0DF80D65FF5 | |||
| 7320 | Unicorn-8885.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-12401.exe | executable | |
MD5:FBEB6C9F89C756964610547D4F0AFE9D | SHA256:D0D0981353AD63706AECB0B9E9A1BCB6912626DAD236EDE685ED67D22E99A786 | |||
| 6372 | Unicorn-15845.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-43028.exe | executable | |
MD5:2AA76ABCAEEDBBC849E8A661FDF05717 | SHA256:CF1ECEF7FEC5D4EBEED920D9E10C520551D99A6887BCCFB58B2FD7E72BB24554 | |||
| 6872 | 1 (1398).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-32557.exe | executable | |
MD5:102600BA55F5A158D05C7A948A854DFF | SHA256:5DC6D0983270822C848767B7149B8C7058EFD21A6ACE762CFF908C6D00254066 | |||
| 7744 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
| 7744 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:BAD15E2F9F58CA876785EC7C65704912 | SHA256:31622FFB95683788D9CD66F1C5EE9A6EFEC8B3FC41E089F5EF3449179F41FBA2 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
26
DNS requests
19
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5776 | backgroundTaskHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
10488 | backgroundTaskHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
8144 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7744 | BackgroundTransferHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
8144 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.48.23.150:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 23.48.23.150:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6544 | svchost.exe | 40.126.31.129:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 23.54.109.203:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
3216 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5776 | backgroundTaskHost.exe | 20.223.36.55:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5776 | backgroundTaskHost.exe | 23.54.109.203:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
7744 | BackgroundTransferHost.exe | 104.126.37.185:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |