| File name: | 1 (1234) |
| Full analysis: | https://app.any.run/tasks/75f9592f-9923-4e30-b4ac-f72acfd635d7 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 10:37:51 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | AB47615C7075CB460CCADCE456540670 |
| SHA1: | 71DF63B7331443AA876CC5BEE7BCAE4F95FCDA51 |
| SHA256: | CE50ADE6481BA46A5F6BCD284268D8F4EFF3CF076AD384E54D7A61246992B160 |
| SSDEEP: | 6144:O7tTl09tbDULA5L63GeL1VMx5t3Xlp8GBV/yUVOH+k/8SwjwpyAvEhMxfLf68OBa:OZh6mLA5O3Z63V+aV6UVOHAx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- Unicorn-25273.exe (PID: 1052)
- 1 (1234).exe (PID: 1812)
- Unicorn-31469.exe (PID: 5408)
- Unicorn-63861.exe (PID: 3784)
- Unicorn-45812.exe (PID: 6132)
- Unicorn-27467.exe (PID: 1168)
- Unicorn-8338.exe (PID: 4112)
- Unicorn-57805.exe (PID: 4920)
- Unicorn-26913.exe (PID: 2616)
- Unicorn-21411.exe (PID: 1672)
- Unicorn-56544.exe (PID: 5892)
- Unicorn-63735.exe (PID: 5968)
- Unicorn-19330.exe (PID: 4224)
- Unicorn-53529.exe (PID: 5576)
- Unicorn-65267.exe (PID: 5384)
- Unicorn-19596.exe (PID: 2420)
- Unicorn-46596.exe (PID: 5260)
- Unicorn-64364.exe (PID: 4188)
- Unicorn-48781.exe (PID: 5360)
- Unicorn-8717.exe (PID: 6824)
- Unicorn-48397.exe (PID: 7240)
- Unicorn-32615.exe (PID: 7256)
- Unicorn-27785.exe (PID: 7276)
- Unicorn-2211.exe (PID: 7308)
- Unicorn-1946.exe (PID: 7300)
- Unicorn-2211.exe (PID: 7316)
- Unicorn-2211.exe (PID: 7324)
- Unicorn-42075.exe (PID: 7400)
- Unicorn-28339.exe (PID: 7380)
- Unicorn-28339.exe (PID: 7388)
- Unicorn-60457.exe (PID: 7336)
- Unicorn-53825.exe (PID: 7600)
- Unicorn-1095.exe (PID: 7620)
- Unicorn-47878.exe (PID: 7640)
- Unicorn-12090.exe (PID: 7692)
- Unicorn-63700.exe (PID: 7748)
- Unicorn-30281.exe (PID: 7740)
- Unicorn-26809.exe (PID: 7784)
- Unicorn-63913.exe (PID: 7836)
- Unicorn-6030.exe (PID: 7856)
- Unicorn-2268.exe (PID: 7876)
- Unicorn-53507.exe (PID: 7892)
- Unicorn-63779.exe (PID: 7344)
- Unicorn-39579.exe (PID: 7936)
- Unicorn-11396.exe (PID: 8004)
- Unicorn-10244.exe (PID: 7924)
- Unicorn-48345.exe (PID: 8016)
- Unicorn-15480.exe (PID: 8072)
- Unicorn-18411.exe (PID: 8144)
- Unicorn-14718.exe (PID: 8064)
- Unicorn-15480.exe (PID: 8048)
- Unicorn-23649.exe (PID: 8136)
- Unicorn-37747.exe (PID: 8168)
- Unicorn-3783.exe (PID: 8056)
- Unicorn-35901.exe (PID: 8036)
- Unicorn-37747.exe (PID: 8176)
- Unicorn-15480.exe (PID: 8080)
- Unicorn-24011.exe (PID: 8120)
- Unicorn-40539.exe (PID: 8096)
- Unicorn-43612.exe (PID: 8128)
- Unicorn-43637.exe (PID: 4268)
- Unicorn-38515.exe (PID: 7508)
- Unicorn-24417.exe (PID: 6584)
- Unicorn-8272.exe (PID: 7484)
- Unicorn-19927.exe (PID: 8184)
- Unicorn-872.exe (PID: 1240)
- Unicorn-64006.exe (PID: 1020)
- Unicorn-32201.exe (PID: 7204)
- Unicorn-8251.exe (PID: 7212)
- Unicorn-27323.exe (PID: 1228)
- Unicorn-27323.exe (PID: 5720)
- Unicorn-19054.exe (PID: 7920)
- Unicorn-25185.exe (PID: 7812)
- Unicorn-6710.exe (PID: 2284)
- Unicorn-30452.exe (PID: 7728)
- Unicorn-13756.exe (PID: 8208)
- Unicorn-17571.exe (PID: 5548)
- Unicorn-41006.exe (PID: 7684)
- Unicorn-18256.exe (PID: 6300)
- Unicorn-22387.exe (PID: 8256)
- Unicorn-12548.exe (PID: 7656)
- Unicorn-34277.exe (PID: 7528)
- Unicorn-50229.exe (PID: 8296)
- Unicorn-4427.exe (PID: 8232)
- Unicorn-50229.exe (PID: 8292)
- Unicorn-3721.exe (PID: 8276)
- Unicorn-47224.exe (PID: 8356)
- Unicorn-41167.exe (PID: 8400)
- Unicorn-51936.exe (PID: 8432)
- Unicorn-48620.exe (PID: 8564)
- Unicorn-46093.exe (PID: 8920)
- Unicorn-64593.exe (PID: 8536)
- Unicorn-34478.exe (PID: 8972)
- Unicorn-2128.exe (PID: 8996)
- Unicorn-43161.exe (PID: 9016)
- Unicorn-18465.exe (PID: 9072)
- Unicorn-15480.exe (PID: 8088)
- Unicorn-14743.exe (PID: 9148)
- Unicorn-38501.exe (PID: 5352)
- Unicorn-50945.exe (PID: 8204)
- Unicorn-9872.exe (PID: 9184)
- Unicorn-53960.exe (PID: 9176)
- Unicorn-31271.exe (PID: 9120)
- Unicorn-22357.exe (PID: 9160)
- Unicorn-59476.exe (PID: 8516)
- Unicorn-41815.exe (PID: 9192)
- Unicorn-26057.exe (PID: 8368)
- Unicorn-38309.exe (PID: 8524)
- Unicorn-44484.exe (PID: 8692)
- Unicorn-50753.exe (PID: 8340)
- Unicorn-47224.exe (PID: 8528)
- Unicorn-34417.exe (PID: 720)
- Unicorn-54135.exe (PID: 8720)
- Unicorn-22113.exe (PID: 7776)
- Unicorn-38501.exe (PID: 5776)
- Unicorn-58027.exe (PID: 3140)
- Unicorn-3451.exe (PID: 8856)
- Unicorn-9720.exe (PID: 8676)
- Unicorn-62740.exe (PID: 8492)
- Unicorn-46669.exe (PID: 8588)
- Unicorn-54135.exe (PID: 8744)
- Unicorn-16994.exe (PID: 9236)
- Unicorn-41691.exe (PID: 5116)
- Unicorn-51713.exe (PID: 9304)
- Unicorn-26752.exe (PID: 9320)
- Unicorn-23125.exe (PID: 9248)
- Unicorn-64157.exe (PID: 9036)
- Unicorn-10872.exe (PID: 9224)
- Unicorn-56352.exe (PID: 9360)
- Unicorn-22741.exe (PID: 9440)
- Unicorn-19887.exe (PID: 8224)
- Unicorn-27571.exe (PID: 9396)
- Unicorn-60997.exe (PID: 9472)
- Unicorn-22002.exe (PID: 9496)
- Unicorn-24049.exe (PID: 9504)
- Unicorn-45216.exe (PID: 9512)
- Unicorn-64328.exe (PID: 9448)
- Unicorn-43353.exe (PID: 9408)
- Unicorn-23286.exe (PID: 9556)
- Unicorn-23857.exe (PID: 9628)
- Unicorn-27941.exe (PID: 9616)
- Unicorn-3436.exe (PID: 9640)
- Unicorn-32217.exe (PID: 9572)
- Unicorn-40747.exe (PID: 9700)
- Unicorn-28495.exe (PID: 9684)
- Unicorn-48361.exe (PID: 9692)
- Unicorn-17534.exe (PID: 9780)
- Unicorn-6367.exe (PID: 9872)
- Unicorn-27749.exe (PID: 9772)
- Unicorn-32217.exe (PID: 9564)
- Unicorn-17534.exe (PID: 9788)
- Unicorn-27484.exe (PID: 9764)
- Unicorn-7883.exe (PID: 9756)
- Unicorn-42039.exe (PID: 9836)
- Unicorn-48169.exe (PID: 9844)
- Unicorn-7136.exe (PID: 9996)
- Unicorn-31833.exe (PID: 9880)
- Unicorn-64240.exe (PID: 9964)
Executable content was dropped or overwritten
- 1 (1234).exe (PID: 1812)
- Unicorn-25273.exe (PID: 1052)
- Unicorn-31469.exe (PID: 5408)
- Unicorn-45812.exe (PID: 6132)
- Unicorn-63861.exe (PID: 3784)
- Unicorn-27467.exe (PID: 1168)
- Unicorn-8338.exe (PID: 4112)
- Unicorn-57805.exe (PID: 4920)
- Unicorn-26913.exe (PID: 2616)
- Unicorn-21411.exe (PID: 1672)
- Unicorn-56544.exe (PID: 5892)
- Unicorn-63735.exe (PID: 5968)
- Unicorn-53529.exe (PID: 5576)
- Unicorn-19596.exe (PID: 2420)
- Unicorn-46596.exe (PID: 5260)
- Unicorn-64364.exe (PID: 4188)
- Unicorn-48781.exe (PID: 5360)
- Unicorn-8717.exe (PID: 6824)
- Unicorn-32615.exe (PID: 7256)
- Unicorn-48397.exe (PID: 7240)
- Unicorn-2211.exe (PID: 7308)
- Unicorn-1946.exe (PID: 7300)
- Unicorn-2211.exe (PID: 7316)
- Unicorn-2211.exe (PID: 7324)
- Unicorn-27785.exe (PID: 7276)
- Unicorn-65267.exe (PID: 5384)
- Unicorn-60457.exe (PID: 7336)
- Unicorn-19330.exe (PID: 4224)
- Unicorn-1095.exe (PID: 7620)
- Unicorn-47878.exe (PID: 7640)
- Unicorn-12090.exe (PID: 7692)
- Unicorn-53825.exe (PID: 7600)
- Unicorn-63700.exe (PID: 7748)
- Unicorn-22113.exe (PID: 7776)
- Unicorn-26809.exe (PID: 7784)
- Unicorn-63913.exe (PID: 7836)
- Unicorn-6030.exe (PID: 7856)
- Unicorn-53507.exe (PID: 7892)
- Unicorn-2268.exe (PID: 7876)
- Unicorn-63779.exe (PID: 7344)
- Unicorn-11396.exe (PID: 8004)
- Unicorn-10244.exe (PID: 7924)
- Unicorn-48345.exe (PID: 8016)
- Unicorn-15480.exe (PID: 8072)
- Unicorn-18411.exe (PID: 8144)
- Unicorn-14718.exe (PID: 8064)
- Unicorn-42075.exe (PID: 7400)
- Unicorn-15480.exe (PID: 8048)
- Unicorn-15480.exe (PID: 8088)
- Unicorn-23649.exe (PID: 8136)
- Unicorn-37747.exe (PID: 8168)
- Unicorn-35901.exe (PID: 8036)
- Unicorn-43612.exe (PID: 8128)
- Unicorn-15480.exe (PID: 8080)
- Unicorn-37747.exe (PID: 8176)
- Unicorn-24011.exe (PID: 8120)
- Unicorn-40539.exe (PID: 8096)
- Unicorn-28339.exe (PID: 7380)
- Unicorn-43637.exe (PID: 4268)
- Unicorn-8272.exe (PID: 7484)
- Unicorn-38515.exe (PID: 7508)
- Unicorn-19927.exe (PID: 8184)
- Unicorn-24417.exe (PID: 6584)
- Unicorn-32201.exe (PID: 7204)
- Unicorn-8251.exe (PID: 7212)
- Unicorn-872.exe (PID: 1240)
- Unicorn-64006.exe (PID: 1020)
- Unicorn-19054.exe (PID: 7920)
- Unicorn-41006.exe (PID: 7684)
- Unicorn-17571.exe (PID: 5548)
- Unicorn-6710.exe (PID: 2284)
- Unicorn-27323.exe (PID: 5720)
- Unicorn-18256.exe (PID: 6300)
- Unicorn-30452.exe (PID: 7728)
- Unicorn-13756.exe (PID: 8208)
- Unicorn-34277.exe (PID: 7528)
- Unicorn-4427.exe (PID: 8232)
- Unicorn-50229.exe (PID: 8296)
- Unicorn-12548.exe (PID: 7656)
- Unicorn-50229.exe (PID: 8292)
- Unicorn-3721.exe (PID: 8276)
- Unicorn-19887.exe (PID: 8224)
- Unicorn-51936.exe (PID: 8432)
- Unicorn-41167.exe (PID: 8400)
- Unicorn-47224.exe (PID: 8356)
- Unicorn-39579.exe (PID: 7936)
- Unicorn-48620.exe (PID: 8564)
- Unicorn-46093.exe (PID: 8920)
- Unicorn-64593.exe (PID: 8536)
- Unicorn-34478.exe (PID: 8972)
- Unicorn-2128.exe (PID: 8996)
- Unicorn-43161.exe (PID: 9016)
- Unicorn-18465.exe (PID: 9072)
- Unicorn-34801.exe (PID: 9052)
- Unicorn-28339.exe (PID: 7388)
- Unicorn-14743.exe (PID: 9148)
- Unicorn-38501.exe (PID: 5352)
- Unicorn-50945.exe (PID: 8204)
- Unicorn-9872.exe (PID: 9184)
- Unicorn-22357.exe (PID: 9160)
- Unicorn-31271.exe (PID: 9120)
- Unicorn-53960.exe (PID: 9176)
- Unicorn-59476.exe (PID: 8516)
- Unicorn-41815.exe (PID: 9192)
- Unicorn-25185.exe (PID: 7812)
- Unicorn-26057.exe (PID: 8368)
- Unicorn-38309.exe (PID: 8524)
- Unicorn-47224.exe (PID: 8528)
- Unicorn-38501.exe (PID: 5776)
- Unicorn-34417.exe (PID: 720)
- Unicorn-50753.exe (PID: 8340)
- Unicorn-54135.exe (PID: 8720)
- Unicorn-58027.exe (PID: 3140)
- Unicorn-44484.exe (PID: 8692)
- Unicorn-3451.exe (PID: 8856)
- Unicorn-54135.exe (PID: 8744)
- Unicorn-46669.exe (PID: 8588)
- Unicorn-62740.exe (PID: 8492)
- Unicorn-16994.exe (PID: 9236)
- Unicorn-41691.exe (PID: 5116)
- Unicorn-23125.exe (PID: 9248)
- Unicorn-64157.exe (PID: 9036)
- Unicorn-26752.exe (PID: 9320)
- Unicorn-10872.exe (PID: 9224)
- Unicorn-56352.exe (PID: 9360)
- Unicorn-22741.exe (PID: 9440)
- Unicorn-27571.exe (PID: 9396)
- Unicorn-60997.exe (PID: 9472)
- Unicorn-64328.exe (PID: 9448)
- Unicorn-43353.exe (PID: 9408)
- Unicorn-22002.exe (PID: 9496)
- Unicorn-24049.exe (PID: 9504)
- Unicorn-45216.exe (PID: 9512)
- Unicorn-23286.exe (PID: 9556)
- Unicorn-23857.exe (PID: 9628)
- Unicorn-23857.exe (PID: 9624)
- Unicorn-27941.exe (PID: 9616)
- Unicorn-36301.exe (PID: 9544)
- Unicorn-32217.exe (PID: 9572)
- Unicorn-40747.exe (PID: 9700)
- Unicorn-28495.exe (PID: 9684)
- Unicorn-48361.exe (PID: 9692)
- Unicorn-17534.exe (PID: 9788)
- Unicorn-27484.exe (PID: 9764)
- Unicorn-17534.exe (PID: 9780)
- Unicorn-27749.exe (PID: 9772)
- Unicorn-6367.exe (PID: 9872)
- Unicorn-32217.exe (PID: 9564)
- Unicorn-64240.exe (PID: 9964)
- Unicorn-7136.exe (PID: 9996)
- Unicorn-31833.exe (PID: 9880)
- Unicorn-3052.exe (PID: 9948)
- Unicorn-31833.exe (PID: 9888)
- Unicorn-45429.exe (PID: 10060)
- Unicorn-25563.exe (PID: 10052)
- Unicorn-42039.exe (PID: 9836)
- Unicorn-48169.exe (PID: 9844)
- Unicorn-17395.exe (PID: 10040)
- Unicorn-26854.exe (PID: 10160)
- Unicorn-32985.exe (PID: 10168)
- Unicorn-50068.exe (PID: 10128)
- Unicorn-4204.exe (PID: 9420)
- Unicorn-30554.exe (PID: 10268)
- Unicorn-15502.exe (PID: 9936)
- Unicorn-30281.exe (PID: 7740)
- Unicorn-9720.exe (PID: 8676)
- Unicorn-36420.exe (PID: 10260)
- Unicorn-51713.exe (PID: 9304)
- Unicorn-20157.exe (PID: 10292)
- Unicorn-6218.exe (PID: 4120)
- Unicorn-29669.exe (PID: 10320)
- Unicorn-7883.exe (PID: 9756)
- Unicorn-13695.exe (PID: 10364)
- Unicorn-20733.exe (PID: 10096)
- Unicorn-21287.exe (PID: 10192)
- Unicorn-9035.exe (PID: 10116)
- Unicorn-55635.exe (PID: 10020)
- Unicorn-41899.exe (PID: 10028)
- Unicorn-10902.exe (PID: 10380)
- Unicorn-27323.exe (PID: 1228)
- Unicorn-63892.exe (PID: 7544)
- Unicorn-23473.exe (PID: 9940)
- Unicorn-41153.exe (PID: 10224)
- Unicorn-40747.exe (PID: 9708)
- Unicorn-22387.exe (PID: 8256)
- Unicorn-3436.exe (PID: 9640)
- Unicorn-40001.exe (PID: 9896)
- Unicorn-3783.exe (PID: 8056)
INFO
Checks supported languages
- 1 (1234).exe (PID: 1812)
- Unicorn-25273.exe (PID: 1052)
- Unicorn-31469.exe (PID: 5408)
- Unicorn-45812.exe (PID: 6132)
- Unicorn-63861.exe (PID: 3784)
- Unicorn-27467.exe (PID: 1168)
- Unicorn-26913.exe (PID: 2616)
- Unicorn-57805.exe (PID: 4920)
- Unicorn-56544.exe (PID: 5892)
- Unicorn-19330.exe (PID: 4224)
- Unicorn-19596.exe (PID: 2420)
- Unicorn-46596.exe (PID: 5260)
- Unicorn-53529.exe (PID: 5576)
- Unicorn-65267.exe (PID: 5384)
- Unicorn-48781.exe (PID: 5360)
- Unicorn-8717.exe (PID: 6824)
- Unicorn-27785.exe (PID: 7276)
- Unicorn-64364.exe (PID: 4188)
- Unicorn-2211.exe (PID: 7316)
- Unicorn-2211.exe (PID: 7308)
- Unicorn-28339.exe (PID: 7380)
- Unicorn-60457.exe (PID: 7336)
- Unicorn-63779.exe (PID: 7344)
- Unicorn-2211.exe (PID: 7324)
- Unicorn-42075.exe (PID: 7400)
- Unicorn-28339.exe (PID: 7388)
- Unicorn-1946.exe (PID: 7300)
- Unicorn-1095.exe (PID: 7620)
- Unicorn-53825.exe (PID: 7600)
- Unicorn-12090.exe (PID: 7692)
- Unicorn-47878.exe (PID: 7640)
- Unicorn-30281.exe (PID: 7740)
- Unicorn-26809.exe (PID: 7784)
- Unicorn-63700.exe (PID: 7748)
- Unicorn-63913.exe (PID: 7836)
- Unicorn-2268.exe (PID: 7876)
- Unicorn-53507.exe (PID: 7892)
- Unicorn-39579.exe (PID: 7936)
- Unicorn-10244.exe (PID: 7924)
- Unicorn-48345.exe (PID: 8016)
- Unicorn-15480.exe (PID: 8048)
- Unicorn-15480.exe (PID: 8072)
- Unicorn-35901.exe (PID: 8036)
- Unicorn-43612.exe (PID: 8128)
- Unicorn-40539.exe (PID: 8096)
- Unicorn-23649.exe (PID: 8136)
- Unicorn-19927.exe (PID: 8184)
- Unicorn-15480.exe (PID: 8088)
- Unicorn-8272.exe (PID: 7484)
- Unicorn-43637.exe (PID: 4268)
- Unicorn-24417.exe (PID: 6584)
- Unicorn-8251.exe (PID: 7212)
- Unicorn-37747.exe (PID: 8176)
- Unicorn-64006.exe (PID: 1020)
- Unicorn-17571.exe (PID: 5548)
- Unicorn-25185.exe (PID: 7812)
- Unicorn-19054.exe (PID: 7920)
- Unicorn-30452.exe (PID: 7728)
- Unicorn-27323.exe (PID: 1228)
- Unicorn-18256.exe (PID: 6300)
- Unicorn-13756.exe (PID: 8208)
- Unicorn-4427.exe (PID: 8232)
- Unicorn-19887.exe (PID: 8224)
- Unicorn-22387.exe (PID: 8256)
- Unicorn-3721.exe (PID: 8276)
- Unicorn-12548.exe (PID: 7656)
- Unicorn-50229.exe (PID: 8296)
- Unicorn-51936.exe (PID: 8432)
- Unicorn-41167.exe (PID: 8400)
- Unicorn-46093.exe (PID: 8920)
- Unicorn-34478.exe (PID: 8972)
- Unicorn-2128.exe (PID: 8996)
- Unicorn-34801.exe (PID: 9052)
- Unicorn-43161.exe (PID: 9016)
- Unicorn-22357.exe (PID: 9160)
- Unicorn-9872.exe (PID: 9184)
- Unicorn-53960.exe (PID: 9176)
- Unicorn-31271.exe (PID: 9120)
- Unicorn-14743.exe (PID: 9148)
- Unicorn-41815.exe (PID: 9192)
- Unicorn-38501.exe (PID: 5352)
- Unicorn-50945.exe (PID: 8204)
- Unicorn-38501.exe (PID: 5776)
- Unicorn-46669.exe (PID: 8588)
- Unicorn-26057.exe (PID: 8368)
- Unicorn-59476.exe (PID: 8516)
- Unicorn-62740.exe (PID: 8492)
- Unicorn-44484.exe (PID: 8692)
- Unicorn-38309.exe (PID: 8524)
- Unicorn-54135.exe (PID: 8744)
- Unicorn-10872.exe (PID: 9224)
- Unicorn-64157.exe (PID: 9036)
- Unicorn-23125.exe (PID: 9248)
- Unicorn-51713.exe (PID: 9304)
- Unicorn-26752.exe (PID: 9320)
- Unicorn-63892.exe (PID: 7544)
- Unicorn-3451.exe (PID: 8856)
- Unicorn-58027.exe (PID: 3140)
- Unicorn-56352.exe (PID: 9360)
- Unicorn-43353.exe (PID: 9408)
- Unicorn-27571.exe (PID: 9396)
- Unicorn-22741.exe (PID: 9440)
- Unicorn-64328.exe (PID: 9448)
- Unicorn-60997.exe (PID: 9472)
- Unicorn-36301.exe (PID: 9544)
- Unicorn-32217.exe (PID: 9564)
- Unicorn-23286.exe (PID: 9556)
- Unicorn-22002.exe (PID: 9496)
- Unicorn-23857.exe (PID: 9628)
- Unicorn-3436.exe (PID: 9640)
- Unicorn-28495.exe (PID: 9684)
- Unicorn-40747.exe (PID: 9708)
- Unicorn-40747.exe (PID: 9700)
- Unicorn-27749.exe (PID: 9772)
- Unicorn-23857.exe (PID: 9624)
- Unicorn-42039.exe (PID: 9836)
- Unicorn-6367.exe (PID: 9872)
- Unicorn-48169.exe (PID: 9844)
- Unicorn-17395.exe (PID: 10040)
- Unicorn-41899.exe (PID: 10028)
- Unicorn-45429.exe (PID: 10060)
- Unicorn-25563.exe (PID: 10052)
- Unicorn-9035.exe (PID: 10116)
- Unicorn-20733.exe (PID: 10096)
- Unicorn-50068.exe (PID: 10128)
- Unicorn-23473.exe (PID: 9940)
- Unicorn-7136.exe (PID: 9996)
- Unicorn-26854.exe (PID: 10160)
- Unicorn-21287.exe (PID: 10192)
- Unicorn-41153.exe (PID: 10224)
- Unicorn-4204.exe (PID: 9420)
- Unicorn-15502.exe (PID: 9936)
- Unicorn-32985.exe (PID: 10168)
- Unicorn-13695.exe (PID: 10364)
- Unicorn-37941.exe (PID: 10652)
- Unicorn-55792.exe (PID: 10752)
- Unicorn-36420.exe (PID: 10260)
- Unicorn-20157.exe (PID: 10292)
- Unicorn-23141.exe (PID: 10912)
- Unicorn-28569.exe (PID: 11024)
- Unicorn-24847.exe (PID: 11060)
- Unicorn-52305.exe (PID: 10816)
- Unicorn-28547.exe (PID: 11180)
- Unicorn-32631.exe (PID: 11224)
- Unicorn-44329.exe (PID: 11212)
- Unicorn-13502.exe (PID: 11256)
- Unicorn-60665.exe (PID: 10316)
- Unicorn-43627.exe (PID: 4944)
- Unicorn-4043.exe (PID: 11136)
- Unicorn-11658.exe (PID: 8396)
- Unicorn-33189.exe (PID: 5072)
- Unicorn-54396.exe (PID: 10520)
- Unicorn-35267.exe (PID: 9100)
- Unicorn-20214.exe (PID: 2968)
- Unicorn-21723.exe (PID: 10508)
- Unicorn-54396.exe (PID: 10536)
- Unicorn-5003.exe (PID: 9068)
- Unicorn-54204.exe (PID: 11276)
- Unicorn-35075.exe (PID: 11372)
- Unicorn-43243.exe (PID: 11312)
- Unicorn-4448.exe (PID: 11292)
- Unicorn-36856.exe (PID: 11404)
- Unicorn-50120.exe (PID: 11284)
- Unicorn-46036.exe (PID: 10796)
- Unicorn-44335.exe (PID: 11476)
- Unicorn-2226.exe (PID: 11456)
- Unicorn-23608.exe (PID: 11492)
- Unicorn-38827.exe (PID: 11560)
- Unicorn-53000.exe (PID: 11484)
- Unicorn-34743.exe (PID: 11580)
- Unicorn-25423.exe (PID: 11420)
- Unicorn-41205.exe (PID: 11396)
- Unicorn-47135.exe (PID: 11504)
- Unicorn-21745.exe (PID: 11624)
- Unicorn-52371.exe (PID: 11656)
- Unicorn-38081.exe (PID: 11704)
- Unicorn-31950.exe (PID: 11696)
- Unicorn-1879.exe (PID: 11616)
- Unicorn-42719.exe (PID: 11712)
- Unicorn-18023.exe (PID: 11776)
- Unicorn-34359.exe (PID: 11736)
- Unicorn-5408.exe (PID: 11648)
- Unicorn-50696.exe (PID: 11832)
- Unicorn-4759.exe (PID: 11840)
- Unicorn-57048.exe (PID: 11908)
- Unicorn-40819.exe (PID: 11900)
- Unicorn-4832.exe (PID: 11928)
- Unicorn-58672.exe (PID: 11888)
- Unicorn-55377.exe (PID: 11972)
- Unicorn-22513.exe (PID: 12096)
- Unicorn-59269.exe (PID: 12160)
- Unicorn-20466.exe (PID: 12080)
- Unicorn-57415.exe (PID: 12128)
- Unicorn-63280.exe (PID: 12120)
- Unicorn-46420.exe (PID: 11916)
- Unicorn-59824.exe (PID: 12236)
- Unicorn-59824.exe (PID: 12252)
- Unicorn-30489.exe (PID: 7048)
- Unicorn-51101.exe (PID: 12340)
- Unicorn-20466.exe (PID: 12204)
- Unicorn-10815.exe (PID: 12196)
- Unicorn-20082.exe (PID: 12320)
- Unicorn-63280.exe (PID: 12212)
- Unicorn-9836.exe (PID: 12224)
- Unicorn-50504.exe (PID: 11964)
- Unicorn-30489.exe (PID: 1568)
- Unicorn-55740.exe (PID: 12276)
- Unicorn-51656.exe (PID: 12260)
- Unicorn-4531.exe (PID: 12572)
- Unicorn-5792.exe (PID: 12392)
- Unicorn-65199.exe (PID: 12368)
- Unicorn-30416.exe (PID: 12188)
- Unicorn-31641.exe (PID: 12712)
- Unicorn-39809.exe (PID: 12812)
- Unicorn-15112.exe (PID: 12736)
- Unicorn-4531.exe (PID: 12672)
- Unicorn-47015.exe (PID: 12796)
- Unicorn-4266.exe (PID: 12764)
- Unicorn-39809.exe (PID: 12720)
- Unicorn-50203.exe (PID: 12684)
- Unicorn-55761.exe (PID: 12936)
- Unicorn-39787.exe (PID: 13048)
- Unicorn-30934.exe (PID: 12888)
- Unicorn-11760.exe (PID: 13084)
- Unicorn-5438.exe (PID: 13164)
- Unicorn-18739.exe (PID: 12856)
- Unicorn-36611.exe (PID: 12648)
- Unicorn-27365.exe (PID: 12772)
- Unicorn-1599.exe (PID: 12848)
- Unicorn-15460.exe (PID: 13264)
- Unicorn-18842.exe (PID: 5452)
- Unicorn-4945.exe (PID: 6028)
- Unicorn-25357.exe (PID: 13336)
- Unicorn-49669.exe (PID: 13360)
- Unicorn-52336.exe (PID: 13180)
- Unicorn-45860.exe (PID: 13388)
- Unicorn-22041.exe (PID: 13468)
- Unicorn-27085.exe (PID: 13604)
The sample compiled with chinese language support
- 1 (1234).exe (PID: 1812)
Reads the computer name
- 1 (1234).exe (PID: 1812)
- Unicorn-25273.exe (PID: 1052)
- Unicorn-31469.exe (PID: 5408)
- Unicorn-45812.exe (PID: 6132)
- Unicorn-27467.exe (PID: 1168)
- Unicorn-63861.exe (PID: 3784)
- Unicorn-8338.exe (PID: 4112)
- Unicorn-57805.exe (PID: 4920)
- Unicorn-56544.exe (PID: 5892)
- Unicorn-21411.exe (PID: 1672)
- Unicorn-63735.exe (PID: 5968)
- Unicorn-53529.exe (PID: 5576)
- Unicorn-65267.exe (PID: 5384)
- Unicorn-19596.exe (PID: 2420)
- Unicorn-19330.exe (PID: 4224)
- Unicorn-64364.exe (PID: 4188)
- Unicorn-48781.exe (PID: 5360)
- Unicorn-27785.exe (PID: 7276)
- Unicorn-48397.exe (PID: 7240)
- Unicorn-32615.exe (PID: 7256)
- Unicorn-28339.exe (PID: 7380)
- Unicorn-1946.exe (PID: 7300)
- Unicorn-42075.exe (PID: 7400)
- Unicorn-63779.exe (PID: 7344)
- Unicorn-2211.exe (PID: 7324)
- Unicorn-60457.exe (PID: 7336)
- Unicorn-53825.exe (PID: 7600)
- Unicorn-1095.exe (PID: 7620)
- Unicorn-47878.exe (PID: 7640)
- Unicorn-30281.exe (PID: 7740)
- Unicorn-22113.exe (PID: 7776)
- Unicorn-63700.exe (PID: 7748)
- Unicorn-26809.exe (PID: 7784)
- Unicorn-63913.exe (PID: 7836)
- Unicorn-6030.exe (PID: 7856)
- Unicorn-2211.exe (PID: 7308)
- Unicorn-39579.exe (PID: 7936)
- Unicorn-10244.exe (PID: 7924)
- Unicorn-48345.exe (PID: 8016)
- Unicorn-14718.exe (PID: 8064)
- Unicorn-18411.exe (PID: 8144)
- Unicorn-35901.exe (PID: 8036)
- Unicorn-37747.exe (PID: 8168)
- Unicorn-38515.exe (PID: 7508)
- Unicorn-15480.exe (PID: 8080)
- Unicorn-24011.exe (PID: 8120)
- Unicorn-3783.exe (PID: 8056)
- Unicorn-32201.exe (PID: 7204)
- Unicorn-872.exe (PID: 1240)
- Unicorn-6710.exe (PID: 2284)
- Unicorn-27323.exe (PID: 1228)
- Unicorn-41006.exe (PID: 7684)
- Unicorn-19054.exe (PID: 7920)
- Unicorn-30452.exe (PID: 7728)
- Unicorn-22387.exe (PID: 8256)
- Unicorn-34277.exe (PID: 7528)
- Unicorn-4427.exe (PID: 8232)
- Unicorn-24417.exe (PID: 6584)
- Unicorn-25185.exe (PID: 7812)
- Unicorn-13756.exe (PID: 8208)
- Unicorn-19887.exe (PID: 8224)
- Unicorn-3721.exe (PID: 8276)
- Unicorn-64593.exe (PID: 8536)
- Unicorn-48620.exe (PID: 8564)
- Unicorn-34478.exe (PID: 8972)
- Unicorn-43161.exe (PID: 9016)
- Unicorn-18465.exe (PID: 9072)
- Unicorn-50945.exe (PID: 8204)
- Unicorn-14743.exe (PID: 9148)
- Unicorn-38501.exe (PID: 5352)
- Unicorn-2128.exe (PID: 8996)
- Unicorn-22357.exe (PID: 9160)
- Unicorn-54135.exe (PID: 8744)
- Unicorn-59476.exe (PID: 8516)
- Unicorn-41815.exe (PID: 9192)
- Unicorn-38309.exe (PID: 8524)
- Unicorn-47224.exe (PID: 8528)
- Unicorn-3451.exe (PID: 8856)
- Unicorn-62740.exe (PID: 8492)
- Unicorn-63892.exe (PID: 7544)
- Unicorn-34417.exe (PID: 720)
- Unicorn-54135.exe (PID: 8720)
- Unicorn-58027.exe (PID: 3140)
- Unicorn-26752.exe (PID: 9320)
- Unicorn-10872.exe (PID: 9224)
- Unicorn-23125.exe (PID: 9248)
- Unicorn-56352.exe (PID: 9360)
- Unicorn-64328.exe (PID: 9448)
- Unicorn-60997.exe (PID: 9472)
- Unicorn-43353.exe (PID: 9408)
- Unicorn-22002.exe (PID: 9496)
- Unicorn-23857.exe (PID: 9628)
- Unicorn-27941.exe (PID: 9616)
- Unicorn-3436.exe (PID: 9640)
- Unicorn-27484.exe (PID: 9764)
- Unicorn-17534.exe (PID: 9788)
- Unicorn-48361.exe (PID: 9692)
- Unicorn-6367.exe (PID: 9872)
Create files in a temporary directory
- Unicorn-25273.exe (PID: 1052)
- 1 (1234).exe (PID: 1812)
- Unicorn-31469.exe (PID: 5408)
- Unicorn-27467.exe (PID: 1168)
- Unicorn-26913.exe (PID: 2616)
- Unicorn-45812.exe (PID: 6132)
- Unicorn-63861.exe (PID: 3784)
- Unicorn-53529.exe (PID: 5576)
- Unicorn-19596.exe (PID: 2420)
- Unicorn-46596.exe (PID: 5260)
- Unicorn-57805.exe (PID: 4920)
- Unicorn-21411.exe (PID: 1672)
- Unicorn-8717.exe (PID: 6824)
- Unicorn-56544.exe (PID: 5892)
- Unicorn-48397.exe (PID: 7240)
- Unicorn-2211.exe (PID: 7324)
- Unicorn-1946.exe (PID: 7300)
- Unicorn-60457.exe (PID: 7336)
- Unicorn-27785.exe (PID: 7276)
- Unicorn-65267.exe (PID: 5384)
- Unicorn-1095.exe (PID: 7620)
- Unicorn-47878.exe (PID: 7640)
- Unicorn-64364.exe (PID: 4188)
- Unicorn-12090.exe (PID: 7692)
- Unicorn-63700.exe (PID: 7748)
- Unicorn-48781.exe (PID: 5360)
- Unicorn-22113.exe (PID: 7776)
- Unicorn-26809.exe (PID: 7784)
- Unicorn-2268.exe (PID: 7876)
- Unicorn-6030.exe (PID: 7856)
- Unicorn-53507.exe (PID: 7892)
- Unicorn-10244.exe (PID: 7924)
- Unicorn-63735.exe (PID: 5968)
- Unicorn-11396.exe (PID: 8004)
- Unicorn-2211.exe (PID: 7308)
- Unicorn-48345.exe (PID: 8016)
- Unicorn-15480.exe (PID: 8048)
- Unicorn-23649.exe (PID: 8136)
- Unicorn-42075.exe (PID: 7400)
- Unicorn-37747.exe (PID: 8168)
- Unicorn-43612.exe (PID: 8128)
- Unicorn-40539.exe (PID: 8096)
- Unicorn-19927.exe (PID: 8184)
- Unicorn-2211.exe (PID: 7316)
- Unicorn-38515.exe (PID: 7508)
- Unicorn-8272.exe (PID: 7484)
- Unicorn-8338.exe (PID: 4112)
- Unicorn-872.exe (PID: 1240)
- Unicorn-64006.exe (PID: 1020)
- Unicorn-19054.exe (PID: 7920)
- Unicorn-17571.exe (PID: 5548)
- Unicorn-41006.exe (PID: 7684)
- Unicorn-27323.exe (PID: 5720)
- Unicorn-30452.exe (PID: 7728)
- Unicorn-13756.exe (PID: 8208)
- Unicorn-34277.exe (PID: 7528)
- Unicorn-4427.exe (PID: 8232)
- Unicorn-50229.exe (PID: 8296)
- Unicorn-12548.exe (PID: 7656)
- Unicorn-63913.exe (PID: 7836)
- Unicorn-50229.exe (PID: 8292)
- Unicorn-3721.exe (PID: 8276)
- Unicorn-19887.exe (PID: 8224)
- Unicorn-63779.exe (PID: 7344)
- Unicorn-32615.exe (PID: 7256)
- Unicorn-47224.exe (PID: 8356)
- Unicorn-41167.exe (PID: 8400)
- Unicorn-51936.exe (PID: 8432)
- Unicorn-48620.exe (PID: 8564)
- Unicorn-34478.exe (PID: 8972)
- Unicorn-14718.exe (PID: 8064)
- Unicorn-18465.exe (PID: 9072)
- Unicorn-34801.exe (PID: 9052)
- Unicorn-15480.exe (PID: 8072)
- Unicorn-35901.exe (PID: 8036)
- Unicorn-28339.exe (PID: 7388)
- Unicorn-24011.exe (PID: 8120)
- Unicorn-37747.exe (PID: 8176)
- Unicorn-15480.exe (PID: 8088)
- Unicorn-43637.exe (PID: 4268)
- Unicorn-14743.exe (PID: 9148)
- Unicorn-38501.exe (PID: 5352)
- Unicorn-9872.exe (PID: 9184)
- Unicorn-22357.exe (PID: 9160)
- Unicorn-19330.exe (PID: 4224)
- Unicorn-24417.exe (PID: 6584)
- Unicorn-28339.exe (PID: 7380)
- Unicorn-53825.exe (PID: 7600)
- Unicorn-31271.exe (PID: 9120)
- Unicorn-6710.exe (PID: 2284)
- Unicorn-32201.exe (PID: 7204)
- Unicorn-8251.exe (PID: 7212)
- Unicorn-53960.exe (PID: 9176)
- Unicorn-26057.exe (PID: 8368)
- Unicorn-18256.exe (PID: 6300)
- Unicorn-34417.exe (PID: 720)
- Unicorn-54135.exe (PID: 8720)
- Unicorn-62740.exe (PID: 8492)
- Unicorn-54135.exe (PID: 8744)
- Unicorn-41691.exe (PID: 5116)
- Unicorn-39579.exe (PID: 7936)
- Unicorn-56352.exe (PID: 9360)
- Unicorn-10872.exe (PID: 9224)
- Unicorn-22741.exe (PID: 9440)
- Unicorn-64593.exe (PID: 8536)
- Unicorn-60997.exe (PID: 9472)
- Unicorn-64328.exe (PID: 9448)
- Unicorn-24049.exe (PID: 9504)
- Unicorn-23286.exe (PID: 9556)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 7664)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 7664)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 7664)
- BackgroundTransferHost.exe (PID: 7556)
- BackgroundTransferHost.exe (PID: 11796)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 7664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
492
Monitored processes
362
Malicious processes
48
Suspicious processes
48
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\Users\admin\AppData\Local\Temp\Unicorn-54396.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-54396.exe | — | Unicorn-23649.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 536 | C:\Users\admin\AppData\Local\Temp\Unicorn-34308.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-34308.exe | — | Unicorn-63779.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 720 | C:\Users\admin\AppData\Local\Temp\Unicorn-34417.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-34417.exe | Unicorn-40539.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1020 | C:\Users\admin\AppData\Local\Temp\Unicorn-64006.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-64006.exe | Unicorn-63861.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1052 | C:\Users\admin\AppData\Local\Temp\Unicorn-25273.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-25273.exe | 1 (1234).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1168 | C:\Users\admin\AppData\Local\Temp\Unicorn-27467.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-27467.exe | Unicorn-25273.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1228 | C:\Users\admin\AppData\Local\Temp\Unicorn-27323.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-27323.exe | Unicorn-30281.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1240 | C:\Users\admin\AppData\Local\Temp\Unicorn-872.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-872.exe | Unicorn-12090.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1568 | C:\Users\admin\AppData\Local\Temp\Unicorn-30489.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-30489.exe | — | Unicorn-62740.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1660 | C:\Users\admin\AppData\Local\Temp\Unicorn-52108.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-52108.exe | — | Unicorn-43353.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
8 826
Read events
8 811
Write events
15
Delete events
0
Modification events
| (PID) Process: | (6960) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6960) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6960) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7664) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7664) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7664) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7556) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7556) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7556) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (9064) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
988
Suspicious files
5
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1812 | 1 (1234).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8338.exe | executable | |
MD5:F6B55CF82C4404E84EE4BBDC711AFF97 | SHA256:4942A6CA22F47EC940DD25EBC4249450FCFE1DD37C587F3D4156FE1E02FA862D | |||
| 3784 | Unicorn-63861.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-57805.exe | executable | |
MD5:34D7C3B974ECA8382271F68D32E7FFA0 | SHA256:8AFE6E60109E71374C2BA689B5A6603DCE3D9E9CBA097261953445B3B366BECA | |||
| 5408 | Unicorn-31469.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-21411.exe | executable | |
MD5:BDA70F6D6FF9FA0ACA71317E84EE9E1E | SHA256:6AA3A1D5FFA01A187FDFF14BC98960D2DA8420BF0AD3AC29121EC26834DCCBAF | |||
| 1812 | 1 (1234).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-19330.exe | executable | |
MD5:C0A8937CF4ACA03DD796ADC3C836EAFA | SHA256:8BBFB965DD30CB8918C495EC3B58D8167DF23D01017AE97CCFED32CFB5F9A71A | |||
| 2616 | Unicorn-26913.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53529.exe | executable | |
MD5:755E842ECE30B0E1DABAB13D69C723F6 | SHA256:B8E6C54C628FFB64BFF3B44E79E64D700FB4AB98D66FF3F11FD076BF2706EF0A | |||
| 5408 | Unicorn-31469.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8717.exe | executable | |
MD5:A613747865557F56084583BB170BEFC8 | SHA256:11071812E9724861FD38E61ECDB2D09D5D21EB2A7E717AFAAF16F3AA6A8509AA | |||
| 1672 | Unicorn-21411.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-48781.exe | executable | |
MD5:7CFD3FC54939109597F701A276187A96 | SHA256:F4D458EF22E6FF640EE7F0B033765405BFC19BDA928F84963FB96DC83A400479 | |||
| 4112 | Unicorn-8338.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-19596.exe | executable | |
MD5:EC9408B4FDF54688FA012179F72E79EC | SHA256:1D57ADFDC62206EA73AF0AA87B6F3F45109F12D0155821CD4211BF5FE84C678D | |||
| 4920 | Unicorn-57805.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46596.exe | executable | |
MD5:3D1751499EE962E511925F8911280BDA | SHA256:EB82588077691FF37C688A48F8E65DA90D3EFBD9F66EBF61C2BBC6E201A7FFB6 | |||
| 5892 | Unicorn-56544.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-48397.exe | executable | |
MD5:EC4F354D33A4815AB1695F510BA51AB9 | SHA256:9BAD04C2E5758BFA1F5FCB1DFDE57A13CC338E821C25038F351A85DE4A6B9028 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
17
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.48.23.143:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5864 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
7664 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
8328 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
8328 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 23.48.23.143:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
2104 | svchost.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6544 | svchost.exe | 40.126.32.140:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
2112 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5864 | backgroundTaskHost.exe | 20.199.58.43:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |