| File name: | 1 (1295) |
| Full analysis: | https://app.any.run/tasks/00457f33-c27d-4e1a-a10e-c2b4f90873ac |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 13:17:36 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | B3407E7EBAFF8937490FB9DD441D8B70 |
| SHA1: | 862B47C25A610664B6317841968CA693E9444C15 |
| SHA256: | E33B84BF4DFE3FF8DDE8AB54C7C4FF95BEA510CEA6528986A3BDD9B149667293 |
| SSDEEP: | 6144:77wgV7+ZQDAHA5ZTZ7sXUJfx5pBEovJHB3/WpSaCZk/8SwjwpyAOEh8sWzuGLJIt:7UsyJHA5BZQWBbhh3OpSaCUx4DxDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- Unicorn-539.exe (PID: 4408)
- Unicorn-24414.exe (PID: 6512)
- 1 (1295).exe (PID: 660)
- Unicorn-40750.exe (PID: 4920)
- Unicorn-14199.exe (PID: 4068)
- Unicorn-35632.exe (PID: 1660)
- Unicorn-63474.exe (PID: 1388)
- Unicorn-13951.exe (PID: 1228)
- Unicorn-2213.exe (PID: 1276)
- Unicorn-38321.exe (PID: 1568)
- Unicorn-42670.exe (PID: 2088)
- Unicorn-42670.exe (PID: 5588)
- Unicorn-49406.exe (PID: 1096)
- Unicorn-13.exe (PID: 5720)
- Unicorn-54258.exe (PID: 6392)
- Unicorn-50174.exe (PID: 6112)
- Unicorn-62021.exe (PID: 3768)
- Unicorn-46090.exe (PID: 3884)
- Unicorn-17118.exe (PID: 4688)
- Unicorn-19.exe (PID: 7192)
- Unicorn-33131.exe (PID: 7228)
- Unicorn-23894.exe (PID: 7212)
- Unicorn-10485.exe (PID: 7312)
- Unicorn-39820.exe (PID: 7332)
- Unicorn-61030.exe (PID: 7348)
- Unicorn-50816.exe (PID: 7368)
- Unicorn-48778.exe (PID: 7380)
- Unicorn-27709.exe (PID: 7408)
- Unicorn-24466.exe (PID: 7484)
- Unicorn-41548.exe (PID: 7504)
- Unicorn-40610.exe (PID: 7520)
- Unicorn-61777.exe (PID: 7540)
- Unicorn-51252.exe (PID: 3888)
- Unicorn-5752.exe (PID: 7584)
- Unicorn-46230.exe (PID: 7640)
- Unicorn-37538.exe (PID: 2092)
- Unicorn-46230.exe (PID: 7648)
- Unicorn-48970.exe (PID: 7560)
- Unicorn-46230.exe (PID: 7608)
- Unicorn-17672.exe (PID: 6228)
- Unicorn-23239.exe (PID: 2908)
- Unicorn-41762.exe (PID: 7660)
- Unicorn-46230.exe (PID: 7616)
- Unicorn-50314.exe (PID: 7624)
- Unicorn-50314.exe (PID: 7632)
- Unicorn-46593.exe (PID: 7812)
- Unicorn-46593.exe (PID: 7748)
- Unicorn-8824.exe (PID: 7756)
- Unicorn-13173.exe (PID: 7696)
- Unicorn-21342.exe (PID: 7716)
- Unicorn-54761.exe (PID: 7788)
- Unicorn-60328.exe (PID: 7740)
- Unicorn-29370.exe (PID: 3300)
- Unicorn-2959.exe (PID: 7724)
- Unicorn-49160.exe (PID: 7764)
- Unicorn-60328.exe (PID: 7824)
- Unicorn-22302.exe (PID: 7908)
- Unicorn-55166.exe (PID: 7940)
- Unicorn-32315.exe (PID: 7956)
- Unicorn-51637.exe (PID: 7924)
- Unicorn-33978.exe (PID: 7988)
- Unicorn-54590.exe (PID: 8084)
- Unicorn-46422.exe (PID: 8108)
- Unicorn-46422.exe (PID: 8100)
- Unicorn-46422.exe (PID: 8112)
- Unicorn-63304.exe (PID: 3140)
- Unicorn-30937.exe (PID: 8140)
- Unicorn-50506.exe (PID: 8124)
- Unicorn-3168.exe (PID: 8172)
- Unicorn-48778.exe (PID: 7388)
- Unicorn-31970.exe (PID: 8228)
- Unicorn-39178.exe (PID: 6972)
- Unicorn-8108.exe (PID: 7416)
- Unicorn-10760.exe (PID: 6656)
- Unicorn-36940.exe (PID: 8208)
- Unicorn-46452.exe (PID: 8272)
- Unicorn-38092.exe (PID: 8328)
- Unicorn-63490.exe (PID: 2980)
- Unicorn-16188.exe (PID: 8344)
- Unicorn-7465.exe (PID: 8248)
- Unicorn-11357.exe (PID: 8296)
- Unicorn-7273.exe (PID: 8304)
- Unicorn-3936.exe (PID: 8240)
- Unicorn-12125.exe (PID: 8388)
- Unicorn-29208.exe (PID: 8408)
- Unicorn-58202.exe (PID: 8528)
- Unicorn-46313.exe (PID: 8556)
- Unicorn-24954.exe (PID: 8572)
- Unicorn-34274.exe (PID: 8676)
- Unicorn-47273.exe (PID: 8708)
- Unicorn-1964.exe (PID: 8728)
- Unicorn-38358.exe (PID: 8764)
- Unicorn-17532.exe (PID: 8592)
- Unicorn-62670.exe (PID: 8800)
- Unicorn-9385.exe (PID: 8788)
- Unicorn-58778.exe (PID: 8748)
- Unicorn-5301.exe (PID: 8780)
- Unicorn-1025.exe (PID: 8872)
- Unicorn-58949.exe (PID: 8844)
- Unicorn-50226.exe (PID: 8880)
- Unicorn-49524.exe (PID: 8956)
- Unicorn-25530.exe (PID: 8836)
- Unicorn-35042.exe (PID: 8908)
- Unicorn-33698.exe (PID: 8828)
- Unicorn-22192.exe (PID: 8932)
- Unicorn-17751.exe (PID: 9044)
- Unicorn-4407.exe (PID: 8924)
- Unicorn-30501.exe (PID: 9004)
- Unicorn-34201.exe (PID: 9188)
- Unicorn-4023.exe (PID: 9116)
- Unicorn-63993.exe (PID: 9092)
- Unicorn-46870.exe (PID: 9140)
- Unicorn-9888.exe (PID: 9132)
- Unicorn-39126.exe (PID: 9068)
- Unicorn-31726.exe (PID: 9212)
- Unicorn-20220.exe (PID: 1852)
- Unicorn-19282.exe (PID: 7996)
- Unicorn-55825.exe (PID: 9124)
- Unicorn-27450.exe (PID: 8016)
- Unicorn-22717.exe (PID: 9264)
- Unicorn-52509.exe (PID: 9248)
- Unicorn-43978.exe (PID: 9232)
- Unicorn-36194.exe (PID: 9316)
- Unicorn-7413.exe (PID: 9356)
- Unicorn-4599.exe (PID: 9288)
- Unicorn-15581.exe (PID: 9340)
- Unicorn-24866.exe (PID: 9496)
- Unicorn-8529.exe (PID: 9528)
- Unicorn-8529.exe (PID: 9532)
- Unicorn-65337.exe (PID: 9348)
- Unicorn-24674.exe (PID: 9636)
- Unicorn-54009.exe (PID: 9668)
- Unicorn-16698.exe (PID: 9508)
- Unicorn-28950.exe (PID: 9704)
- Unicorn-56577.exe (PID: 9656)
- Unicorn-26572.exe (PID: 9836)
- Unicorn-33396.exe (PID: 9748)
- Unicorn-1876.exe (PID: 9796)
- Unicorn-61430.exe (PID: 9740)
- Unicorn-57081.exe (PID: 9772)
- Unicorn-47132.exe (PID: 9756)
- Unicorn-11335.exe (PID: 9888)
- Unicorn-257.exe (PID: 8652)
- Unicorn-44332.exe (PID: 9764)
- Unicorn-55109.exe (PID: 10052)
- Unicorn-39732.exe (PID: 9964)
- Unicorn-58306.exe (PID: 9928)
- Unicorn-4829.exe (PID: 9944)
- Unicorn-47206.exe (PID: 10064)
- Unicorn-18234.exe (PID: 10100)
- Unicorn-6173.exe (PID: 10012)
- Unicorn-27148.exe (PID: 10152)
- Unicorn-5789.exe (PID: 8696)
- Unicorn-13692.exe (PID: 10228)
- Unicorn-2089.exe (PID: 10044)
- Unicorn-56836.exe (PID: 9452)
- Unicorn-34113.exe (PID: 10040)
- Unicorn-52369.exe (PID: 2616)
- Unicorn-36276.exe (PID: 8040)
- Unicorn-13957.exe (PID: 10236)
- Unicorn-2068.exe (PID: 8700)
- Unicorn-50714.exe (PID: 5200)
- Unicorn-44445.exe (PID: 9620)
- Unicorn-20847.exe (PID: 10308)
- Unicorn-6099.exe (PID: 9724)
- Unicorn-8529.exe (PID: 9544)
- Unicorn-56142.exe (PID: 2096)
- Unicorn-64673.exe (PID: 10268)
- Unicorn-35338.exe (PID: 10328)
- Unicorn-23854.exe (PID: 10352)
- Unicorn-8072.exe (PID: 10360)
- Unicorn-42058.exe (PID: 8900)
- Unicorn-58372.exe (PID: 10408)
- Unicorn-47014.exe (PID: 10160)
Starts itself from another location
- Unicorn-539.exe (PID: 4408)
- Unicorn-24414.exe (PID: 6512)
- 1 (1295).exe (PID: 660)
- Unicorn-40750.exe (PID: 4920)
- Unicorn-35632.exe (PID: 1660)
- Unicorn-63474.exe (PID: 1388)
- Unicorn-13951.exe (PID: 1228)
- Unicorn-14199.exe (PID: 4068)
- Unicorn-2213.exe (PID: 1276)
- Unicorn-42670.exe (PID: 2088)
- Unicorn-42670.exe (PID: 5588)
- Unicorn-49406.exe (PID: 1096)
- Unicorn-38321.exe (PID: 1568)
- Unicorn-62021.exe (PID: 3768)
- Unicorn-51252.exe (PID: 3888)
- Unicorn-13.exe (PID: 5720)
- Unicorn-54258.exe (PID: 6392)
- Unicorn-46090.exe (PID: 3884)
- Unicorn-23239.exe (PID: 2908)
- Unicorn-17672.exe (PID: 6228)
- Unicorn-17118.exe (PID: 4688)
- Unicorn-29370.exe (PID: 3300)
- Unicorn-37538.exe (PID: 2092)
- Unicorn-50174.exe (PID: 6112)
- Unicorn-19.exe (PID: 7192)
- Unicorn-33131.exe (PID: 7228)
- Unicorn-23894.exe (PID: 7212)
- Unicorn-10485.exe (PID: 7312)
- Unicorn-39820.exe (PID: 7332)
- Unicorn-61030.exe (PID: 7348)
- Unicorn-48778.exe (PID: 7388)
- Unicorn-48778.exe (PID: 7380)
- Unicorn-8108.exe (PID: 7416)
- Unicorn-27709.exe (PID: 7408)
- Unicorn-50816.exe (PID: 7368)
- Unicorn-24466.exe (PID: 7484)
- Unicorn-41548.exe (PID: 7504)
- Unicorn-40610.exe (PID: 7520)
- Unicorn-48970.exe (PID: 7560)
- Unicorn-46230.exe (PID: 7640)
- Unicorn-46230.exe (PID: 7608)
- Unicorn-41762.exe (PID: 7660)
- Unicorn-46230.exe (PID: 7616)
- Unicorn-46230.exe (PID: 7648)
- Unicorn-50314.exe (PID: 7624)
- Unicorn-50314.exe (PID: 7632)
- Unicorn-46593.exe (PID: 7812)
- Unicorn-46593.exe (PID: 7748)
- Unicorn-8824.exe (PID: 7756)
- Unicorn-21342.exe (PID: 7716)
- Unicorn-13173.exe (PID: 7696)
- Unicorn-60328.exe (PID: 7740)
- Unicorn-49160.exe (PID: 7764)
- Unicorn-60328.exe (PID: 7824)
- Unicorn-54761.exe (PID: 7788)
- Unicorn-22302.exe (PID: 7908)
- Unicorn-55166.exe (PID: 7940)
- Unicorn-32315.exe (PID: 7956)
- Unicorn-2959.exe (PID: 7724)
- Unicorn-51637.exe (PID: 7924)
- Unicorn-33978.exe (PID: 7988)
- Unicorn-46422.exe (PID: 8108)
- Unicorn-4651.exe (PID: 8188)
- Unicorn-30937.exe (PID: 8140)
- Unicorn-46422.exe (PID: 8100)
- Unicorn-54590.exe (PID: 8084)
- Unicorn-52369.exe (PID: 2616)
- Unicorn-46422.exe (PID: 8112)
- Unicorn-50506.exe (PID: 8124)
- Unicorn-3168.exe (PID: 8172)
- Unicorn-10760.exe (PID: 6656)
- Unicorn-36940.exe (PID: 8208)
- Unicorn-31970.exe (PID: 8228)
- Unicorn-38092.exe (PID: 8328)
- Unicorn-63490.exe (PID: 2980)
- Unicorn-16188.exe (PID: 8344)
- Unicorn-39178.exe (PID: 6972)
- Unicorn-7273.exe (PID: 8304)
- Unicorn-11357.exe (PID: 8296)
- Unicorn-46452.exe (PID: 8272)
- Unicorn-5752.exe (PID: 7584)
- Unicorn-12125.exe (PID: 8388)
- Unicorn-29208.exe (PID: 8408)
- Unicorn-61777.exe (PID: 7540)
- Unicorn-3936.exe (PID: 8240)
- Unicorn-24954.exe (PID: 8572)
- Unicorn-34274.exe (PID: 8676)
- Unicorn-257.exe (PID: 8652)
- Unicorn-58202.exe (PID: 8528)
- Unicorn-46313.exe (PID: 8556)
- Unicorn-47273.exe (PID: 8708)
- Unicorn-1964.exe (PID: 8728)
- Unicorn-38358.exe (PID: 8764)
- Unicorn-17532.exe (PID: 8592)
- Unicorn-58778.exe (PID: 8748)
- Unicorn-62670.exe (PID: 8800)
- Unicorn-9385.exe (PID: 8788)
- Unicorn-5301.exe (PID: 8780)
- Unicorn-1025.exe (PID: 8872)
- Unicorn-50226.exe (PID: 8880)
- Unicorn-25530.exe (PID: 8836)
- Unicorn-58949.exe (PID: 8844)
- Unicorn-35042.exe (PID: 8908)
- Unicorn-42058.exe (PID: 8900)
- Unicorn-33698.exe (PID: 8828)
- Unicorn-22192.exe (PID: 8932)
- Unicorn-49524.exe (PID: 8956)
- Unicorn-4407.exe (PID: 8924)
- Unicorn-30501.exe (PID: 9004)
- Unicorn-4023.exe (PID: 9116)
- Unicorn-34201.exe (PID: 9188)
- Unicorn-17751.exe (PID: 9044)
- Unicorn-30958.exe (PID: 8892)
- Unicorn-39126.exe (PID: 9068)
- Unicorn-9888.exe (PID: 9132)
- Unicorn-63993.exe (PID: 9092)
- Unicorn-46870.exe (PID: 9140)
- Unicorn-55825.exe (PID: 9124)
- Unicorn-20220.exe (PID: 1852)
- Unicorn-19282.exe (PID: 7996)
- Unicorn-31726.exe (PID: 9212)
- Unicorn-22717.exe (PID: 9264)
- Unicorn-52509.exe (PID: 9248)
- Unicorn-43978.exe (PID: 9232)
- Unicorn-27450.exe (PID: 8016)
- Unicorn-4599.exe (PID: 9288)
- Unicorn-63304.exe (PID: 3140)
- Unicorn-15581.exe (PID: 9340)
- Unicorn-36194.exe (PID: 9316)
- Unicorn-7413.exe (PID: 9356)
- Unicorn-65337.exe (PID: 9348)
- Unicorn-7465.exe (PID: 8248)
- Unicorn-24866.exe (PID: 9496)
- Unicorn-8529.exe (PID: 9528)
- Unicorn-8529.exe (PID: 9544)
- Unicorn-54009.exe (PID: 9668)
- Unicorn-16698.exe (PID: 9508)
- Unicorn-56577.exe (PID: 9656)
- Unicorn-8529.exe (PID: 9532)
- Unicorn-6099.exe (PID: 9724)
- Unicorn-26572.exe (PID: 9836)
- Unicorn-33396.exe (PID: 9748)
- Unicorn-57901.exe (PID: 9732)
- Unicorn-1876.exe (PID: 9796)
- Unicorn-28950.exe (PID: 9704)
- Unicorn-61430.exe (PID: 9740)
- Unicorn-57081.exe (PID: 9772)
- Unicorn-24674.exe (PID: 9636)
- Unicorn-11335.exe (PID: 9888)
- Unicorn-44332.exe (PID: 9764)
- Unicorn-47132.exe (PID: 9756)
- Unicorn-39732.exe (PID: 9964)
- Unicorn-58306.exe (PID: 9928)
- Unicorn-4829.exe (PID: 9944)
- Unicorn-55109.exe (PID: 10052)
- Unicorn-18234.exe (PID: 10100)
- Unicorn-47206.exe (PID: 10064)
- Unicorn-6173.exe (PID: 10012)
- Unicorn-2089.exe (PID: 10044)
- Unicorn-27148.exe (PID: 10152)
- Unicorn-18980.exe (PID: 10172)
- Unicorn-47014.exe (PID: 10160)
- Unicorn-34762.exe (PID: 10208)
- Unicorn-56836.exe (PID: 9452)
- Unicorn-13692.exe (PID: 10228)
- Unicorn-13957.exe (PID: 10236)
- Unicorn-34113.exe (PID: 10040)
- Unicorn-36276.exe (PID: 8040)
- Unicorn-50714.exe (PID: 5200)
- Unicorn-2068.exe (PID: 8700)
- Unicorn-44445.exe (PID: 9620)
- Unicorn-56142.exe (PID: 2096)
- Unicorn-64673.exe (PID: 10268)
- Unicorn-20847.exe (PID: 10308)
- Unicorn-35338.exe (PID: 10328)
- Unicorn-23854.exe (PID: 10352)
- Unicorn-8072.exe (PID: 10360)
- Unicorn-58372.exe (PID: 10408)
- Unicorn-5789.exe (PID: 8696)
Executes application which crashes
- Unicorn-63313.exe (PID: 8036)
- Unicorn-39836.exe (PID: 14424)
INFO
The sample compiled with chinese language support
- 1 (1295).exe (PID: 660)
- Unicorn-539.exe (PID: 4408)
- Unicorn-40750.exe (PID: 4920)
- Unicorn-24414.exe (PID: 6512)
- Unicorn-14199.exe (PID: 4068)
- Unicorn-2213.exe (PID: 1276)
- Unicorn-35632.exe (PID: 1660)
- Unicorn-63474.exe (PID: 1388)
- Unicorn-13951.exe (PID: 1228)
- Unicorn-38321.exe (PID: 1568)
- Unicorn-42670.exe (PID: 2088)
- Unicorn-42670.exe (PID: 5588)
- Unicorn-49406.exe (PID: 1096)
- Unicorn-13.exe (PID: 5720)
- Unicorn-54258.exe (PID: 6392)
- Unicorn-50174.exe (PID: 6112)
- Unicorn-62021.exe (PID: 3768)
- Unicorn-46090.exe (PID: 3884)
- Unicorn-19.exe (PID: 7192)
- Unicorn-17118.exe (PID: 4688)
- Unicorn-33131.exe (PID: 7228)
- Unicorn-23894.exe (PID: 7212)
- Unicorn-10485.exe (PID: 7312)
- Unicorn-39820.exe (PID: 7332)
- Unicorn-61030.exe (PID: 7348)
- Unicorn-48778.exe (PID: 7380)
- Unicorn-27709.exe (PID: 7408)
- Unicorn-50816.exe (PID: 7368)
- Unicorn-24466.exe (PID: 7484)
- Unicorn-40610.exe (PID: 7520)
- Unicorn-41548.exe (PID: 7504)
- Unicorn-61777.exe (PID: 7540)
- Unicorn-51252.exe (PID: 3888)
- Unicorn-46230.exe (PID: 7648)
- Unicorn-5752.exe (PID: 7584)
- Unicorn-46230.exe (PID: 7640)
- Unicorn-37538.exe (PID: 2092)
- Unicorn-48970.exe (PID: 7560)
- Unicorn-17672.exe (PID: 6228)
- Unicorn-46230.exe (PID: 7608)
- Unicorn-23239.exe (PID: 2908)
- Unicorn-41762.exe (PID: 7660)
- Unicorn-46230.exe (PID: 7616)
- Unicorn-50314.exe (PID: 7624)
- Unicorn-46593.exe (PID: 7748)
- Unicorn-50314.exe (PID: 7632)
- Unicorn-46593.exe (PID: 7812)
- Unicorn-8824.exe (PID: 7756)
- Unicorn-21342.exe (PID: 7716)
- Unicorn-13173.exe (PID: 7696)
- Unicorn-60328.exe (PID: 7740)
- Unicorn-49160.exe (PID: 7764)
- Unicorn-54761.exe (PID: 7788)
- Unicorn-60328.exe (PID: 7824)
- Unicorn-29370.exe (PID: 3300)
- Unicorn-2959.exe (PID: 7724)
- Unicorn-55166.exe (PID: 7940)
- Unicorn-32315.exe (PID: 7956)
- Unicorn-22302.exe (PID: 7908)
- Unicorn-51637.exe (PID: 7924)
- Unicorn-33978.exe (PID: 7988)
- Unicorn-54590.exe (PID: 8084)
- Unicorn-46422.exe (PID: 8100)
- Unicorn-30937.exe (PID: 8140)
- Unicorn-63304.exe (PID: 3140)
- Unicorn-46422.exe (PID: 8108)
- Unicorn-50506.exe (PID: 8124)
- Unicorn-3168.exe (PID: 8172)
- Unicorn-48778.exe (PID: 7388)
- Unicorn-46422.exe (PID: 8112)
- Unicorn-36940.exe (PID: 8208)
- Unicorn-31970.exe (PID: 8228)
- Unicorn-39178.exe (PID: 6972)
- Unicorn-8108.exe (PID: 7416)
- Unicorn-10760.exe (PID: 6656)
- Unicorn-38092.exe (PID: 8328)
- Unicorn-63490.exe (PID: 2980)
- Unicorn-16188.exe (PID: 8344)
- Unicorn-11357.exe (PID: 8296)
- Unicorn-3936.exe (PID: 8240)
- Unicorn-46452.exe (PID: 8272)
- Unicorn-7273.exe (PID: 8304)
- Unicorn-7465.exe (PID: 8248)
- Unicorn-12125.exe (PID: 8388)
- Unicorn-29208.exe (PID: 8408)
- Unicorn-46313.exe (PID: 8556)
- Unicorn-34274.exe (PID: 8676)
- Unicorn-58202.exe (PID: 8528)
- Unicorn-24954.exe (PID: 8572)
- Unicorn-47273.exe (PID: 8708)
- Unicorn-1964.exe (PID: 8728)
- Unicorn-38358.exe (PID: 8764)
- Unicorn-17532.exe (PID: 8592)
- Unicorn-9385.exe (PID: 8788)
- Unicorn-5301.exe (PID: 8780)
- Unicorn-58778.exe (PID: 8748)
- Unicorn-58949.exe (PID: 8844)
- Unicorn-50226.exe (PID: 8880)
- Unicorn-25530.exe (PID: 8836)
- Unicorn-1025.exe (PID: 8872)
- Unicorn-35042.exe (PID: 8908)
- Unicorn-33698.exe (PID: 8828)
- Unicorn-22192.exe (PID: 8932)
- Unicorn-49524.exe (PID: 8956)
- Unicorn-4407.exe (PID: 8924)
- Unicorn-30501.exe (PID: 9004)
- Unicorn-34201.exe (PID: 9188)
- Unicorn-4023.exe (PID: 9116)
- Unicorn-17751.exe (PID: 9044)
- Unicorn-63993.exe (PID: 9092)
- Unicorn-46870.exe (PID: 9140)
- Unicorn-9888.exe (PID: 9132)
- Unicorn-39126.exe (PID: 9068)
- Unicorn-31726.exe (PID: 9212)
- Unicorn-20220.exe (PID: 1852)
- Unicorn-19282.exe (PID: 7996)
- Unicorn-55825.exe (PID: 9124)
- Unicorn-27450.exe (PID: 8016)
- Unicorn-22717.exe (PID: 9264)
- Unicorn-52509.exe (PID: 9248)
- Unicorn-43978.exe (PID: 9232)
- Unicorn-36194.exe (PID: 9316)
- Unicorn-15581.exe (PID: 9340)
- Unicorn-7413.exe (PID: 9356)
- Unicorn-4599.exe (PID: 9288)
- Unicorn-24674.exe (PID: 9636)
- Unicorn-24866.exe (PID: 9496)
- Unicorn-8529.exe (PID: 9528)
- Unicorn-65337.exe (PID: 9348)
- Unicorn-54009.exe (PID: 9668)
- Unicorn-16698.exe (PID: 9508)
- Unicorn-28950.exe (PID: 9704)
- Unicorn-56577.exe (PID: 9656)
- Unicorn-8529.exe (PID: 9532)
- Unicorn-26572.exe (PID: 9836)
- Unicorn-33396.exe (PID: 9748)
- Unicorn-1876.exe (PID: 9796)
- Unicorn-61430.exe (PID: 9740)
- Unicorn-57081.exe (PID: 9772)
- Unicorn-47132.exe (PID: 9756)
- Unicorn-11335.exe (PID: 9888)
- Unicorn-44332.exe (PID: 9764)
- Unicorn-58306.exe (PID: 9928)
- Unicorn-4829.exe (PID: 9944)
- Unicorn-39732.exe (PID: 9964)
- Unicorn-55109.exe (PID: 10052)
- Unicorn-257.exe (PID: 8652)
- Unicorn-18234.exe (PID: 10100)
- Unicorn-47206.exe (PID: 10064)
- Unicorn-6173.exe (PID: 10012)
- Unicorn-2089.exe (PID: 10044)
- Unicorn-27148.exe (PID: 10152)
- Unicorn-5789.exe (PID: 8696)
- Unicorn-13692.exe (PID: 10228)
- Unicorn-13957.exe (PID: 10236)
- Unicorn-56836.exe (PID: 9452)
- Unicorn-34113.exe (PID: 10040)
- Unicorn-52369.exe (PID: 2616)
- Unicorn-50714.exe (PID: 5200)
- Unicorn-44445.exe (PID: 9620)
- Unicorn-36276.exe (PID: 8040)
- Unicorn-2068.exe (PID: 8700)
- Unicorn-56142.exe (PID: 2096)
- Unicorn-64673.exe (PID: 10268)
- Unicorn-8529.exe (PID: 9544)
- Unicorn-20847.exe (PID: 10308)
- Unicorn-35338.exe (PID: 10328)
- Unicorn-23854.exe (PID: 10352)
- Unicorn-8072.exe (PID: 10360)
- Unicorn-6099.exe (PID: 9724)
- Unicorn-42058.exe (PID: 8900)
- Unicorn-58372.exe (PID: 10408)
- Unicorn-47014.exe (PID: 10160)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 6872)
- BackgroundTransferHost.exe (PID: 1040)
- BackgroundTransferHost.exe (PID: 5588)
Checks supported languages
- Unicorn-24414.exe (PID: 6512)
- Unicorn-539.exe (PID: 4408)
- Unicorn-2213.exe (PID: 1276)
- Unicorn-35632.exe (PID: 1660)
- Unicorn-62021.exe (PID: 3768)
- Unicorn-13951.exe (PID: 1228)
- Unicorn-10485.exe (PID: 7312)
- Unicorn-50314.exe (PID: 7632)
- Unicorn-41762.exe (PID: 7660)
- Unicorn-13173.exe (PID: 7696)
- Unicorn-51637.exe (PID: 7924)
- Unicorn-55166.exe (PID: 7940)
- Unicorn-30937.exe (PID: 8140)
- Unicorn-46422.exe (PID: 8100)
- Unicorn-17532.exe (PID: 8592)
- Unicorn-47273.exe (PID: 8708)
- Unicorn-9385.exe (PID: 8788)
- Unicorn-5301.exe (PID: 8780)
- Unicorn-50226.exe (PID: 8880)
- Unicorn-22192.exe (PID: 8932)
- Unicorn-42058.exe (PID: 8900)
- Unicorn-20220.exe (PID: 1852)
- Unicorn-19282.exe (PID: 7996)
- Unicorn-63993.exe (PID: 9092)
- Unicorn-9888.exe (PID: 9132)
- Unicorn-52509.exe (PID: 9248)
- Unicorn-43978.exe (PID: 9232)
- Unicorn-22717.exe (PID: 9264)
- Unicorn-4599.exe (PID: 9288)
- Unicorn-24866.exe (PID: 9496)
- Unicorn-7413.exe (PID: 9356)
- Unicorn-56577.exe (PID: 9656)
- Unicorn-1876.exe (PID: 9796)
- Unicorn-55109.exe (PID: 10052)
- Unicorn-18234.exe (PID: 10100)
- Unicorn-18980.exe (PID: 10172)
- Unicorn-13692.exe (PID: 10228)
- Unicorn-56836.exe (PID: 9452)
- Unicorn-50714.exe (PID: 5200)
- Unicorn-64673.exe (PID: 10268)
- Unicorn-20847.exe (PID: 10308)
- Unicorn-58372.exe (PID: 10408)
- Unicorn-56142.exe (PID: 2096)
- Unicorn-36276.exe (PID: 8040)
- Unicorn-42664.exe (PID: 10528)
- Unicorn-13692.exe (PID: 10612)
- Unicorn-22266.exe (PID: 10664)
- Unicorn-26904.exe (PID: 10764)
- Unicorn-18338.exe (PID: 11064)
- Unicorn-55841.exe (PID: 11072)
- Unicorn-24320.exe (PID: 11192)
- Unicorn-3900.exe (PID: 11212)
- Unicorn-56246.exe (PID: 11228)
- Unicorn-27658.exe (PID: 11248)
- Unicorn-43802.exe (PID: 3024)
- Unicorn-12089.exe (PID: 11292)
- Unicorn-21004.exe (PID: 11348)
- Unicorn-36594.exe (PID: 11480)
- Unicorn-36329.exe (PID: 11504)
- Unicorn-23188.exe (PID: 11628)
- Unicorn-33397.exe (PID: 11772)
- Unicorn-57974.exe (PID: 11848)
- Unicorn-40552.exe (PID: 12068)
- Unicorn-34238.exe (PID: 12120)
- Unicorn-41808.exe (PID: 11952)
- Unicorn-9031.exe (PID: 12476)
- Unicorn-148.exe (PID: 12772)
- Unicorn-56941.exe (PID: 12364)
- Unicorn-18699.exe (PID: 13168)
- Unicorn-19251.exe (PID: 12848)
- Unicorn-38234.exe (PID: 1280)
- Unicorn-5540.exe (PID: 13464)
- Unicorn-49142.exe (PID: 13252)
- Unicorn-62857.exe (PID: 13564)
- Unicorn-2629.exe (PID: 13776)
- Unicorn-42384.exe (PID: 14036)
- Unicorn-31091.exe (PID: 14244)
- Unicorn-7931.exe (PID: 14572)
- Unicorn-39660.exe (PID: 15248)
- Unicorn-61564.exe (PID: 15204)
- Unicorn-61564.exe (PID: 15212)
- Unicorn-39993.exe (PID: 15448)
- Unicorn-15561.exe (PID: 15620)
- Unicorn-2364.exe (PID: 14768)
- Unicorn-6988.exe (PID: 15324)
- Unicorn-14792.exe (PID: 15440)
- Unicorn-58056.exe (PID: 15700)
- Unicorn-55316.exe (PID: 15840)
- Unicorn-39872.exe (PID: 15936)
- Unicorn-36920.exe (PID: 16112)
- Unicorn-47532.exe (PID: 16364)
- Unicorn-43256.exe (PID: 14700)
- Unicorn-41219.exe (PID: 16412)
- Unicorn-60870.exe (PID: 16100)
- Unicorn-25079.exe (PID: 16692)
- Unicorn-45176.exe (PID: 16876)
- Unicorn-16779.exe (PID: 16828)
- Unicorn-52960.exe (PID: 17140)
- Unicorn-63564.exe (PID: 17276)
- Unicorn-20532.exe (PID: 17572)
- Unicorn-64902.exe (PID: 17544)
- Unicorn-59665.exe (PID: 17260)
- Unicorn-23848.exe (PID: 17404)
- Unicorn-8803.exe (PID: 17472)
- Unicorn-21264.exe (PID: 17712)
- Unicorn-34668.exe (PID: 17800)
- Unicorn-20391.exe (PID: 18192)
- Unicorn-60464.exe (PID: 17920)
- Unicorn-7179.exe (PID: 18024)
- Unicorn-46293.exe (PID: 18336)
- Unicorn-5717.exe (PID: 18404)
- Unicorn-9999.exe (PID: 6324)
- Unicorn-22119.exe (PID: 18528)
- Unicorn-13375.exe (PID: 18748)
- Unicorn-4876.exe (PID: 18872)
- Unicorn-49436.exe (PID: 19304)
Reads the computer name
- Unicorn-539.exe (PID: 4408)
- Unicorn-40750.exe (PID: 4920)
- Unicorn-42670.exe (PID: 5588)
- Unicorn-62021.exe (PID: 3768)
- Unicorn-33131.exe (PID: 7228)
- Unicorn-50174.exe (PID: 6112)
- Unicorn-27709.exe (PID: 7408)
- Unicorn-48778.exe (PID: 7380)
- Unicorn-10485.exe (PID: 7312)
- Unicorn-46230.exe (PID: 7616)
- Unicorn-60328.exe (PID: 7824)
- Unicorn-50314.exe (PID: 7624)
- Unicorn-54761.exe (PID: 7788)
- Unicorn-63313.exe (PID: 8036)
- Unicorn-46422.exe (PID: 8100)
- Unicorn-31970.exe (PID: 8228)
- Unicorn-16188.exe (PID: 8344)
- Unicorn-46452.exe (PID: 8272)
- Unicorn-12125.exe (PID: 8388)
- Unicorn-257.exe (PID: 8652)
- Unicorn-17532.exe (PID: 8592)
- Unicorn-1964.exe (PID: 8728)
- Unicorn-42058.exe (PID: 8900)
- Unicorn-30501.exe (PID: 9004)
- Unicorn-31726.exe (PID: 9212)
- Unicorn-55825.exe (PID: 9124)
- Unicorn-52509.exe (PID: 9248)
- Unicorn-4829.exe (PID: 9944)
- Unicorn-50714.exe (PID: 5200)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 5588)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 5588)
Create files in a temporary directory
- Unicorn-539.exe (PID: 4408)
- Unicorn-14199.exe (PID: 4068)
- 1 (1295).exe (PID: 660)
- Unicorn-24414.exe (PID: 6512)
- Unicorn-38321.exe (PID: 1568)
- Unicorn-40750.exe (PID: 4920)
- Unicorn-42670.exe (PID: 2088)
- Unicorn-42670.exe (PID: 5588)
- Unicorn-49406.exe (PID: 1096)
- Unicorn-13.exe (PID: 5720)
- Unicorn-54258.exe (PID: 6392)
- Unicorn-13951.exe (PID: 1228)
- Unicorn-2213.exe (PID: 1276)
- Unicorn-17118.exe (PID: 4688)
- Unicorn-33131.exe (PID: 7228)
- Unicorn-23894.exe (PID: 7212)
- Unicorn-50816.exe (PID: 7368)
- Unicorn-27709.exe (PID: 7408)
- Unicorn-35632.exe (PID: 1660)
- Unicorn-24466.exe (PID: 7484)
- Unicorn-40610.exe (PID: 7520)
- Unicorn-50174.exe (PID: 6112)
- Unicorn-63474.exe (PID: 1388)
- Unicorn-5752.exe (PID: 7584)
- Unicorn-46090.exe (PID: 3884)
- Unicorn-46230.exe (PID: 7648)
- Unicorn-48970.exe (PID: 7560)
- Unicorn-23239.exe (PID: 2908)
- Unicorn-46230.exe (PID: 7616)
- Unicorn-19.exe (PID: 7192)
- Unicorn-17672.exe (PID: 6228)
- Unicorn-46230.exe (PID: 7608)
- Unicorn-50314.exe (PID: 7632)
- Unicorn-46593.exe (PID: 7748)
- Unicorn-60328.exe (PID: 7740)
- Unicorn-8824.exe (PID: 7756)
- Unicorn-21342.exe (PID: 7716)
- Unicorn-13173.exe (PID: 7696)
- Unicorn-49160.exe (PID: 7764)
- Unicorn-60328.exe (PID: 7824)
- Unicorn-54761.exe (PID: 7788)
- Unicorn-29370.exe (PID: 3300)
- Unicorn-22302.exe (PID: 7908)
- Unicorn-55166.exe (PID: 7940)
- Unicorn-32315.exe (PID: 7956)
- Unicorn-51637.exe (PID: 7924)
- Unicorn-33978.exe (PID: 7988)
- Unicorn-54590.exe (PID: 8084)
- Unicorn-46422.exe (PID: 8108)
- Unicorn-63304.exe (PID: 3140)
- Unicorn-50506.exe (PID: 8124)
- Unicorn-48778.exe (PID: 7380)
- Unicorn-62021.exe (PID: 3768)
- Unicorn-31970.exe (PID: 8228)
- Unicorn-39178.exe (PID: 6972)
- Unicorn-10760.exe (PID: 6656)
- Unicorn-46452.exe (PID: 8272)
- Unicorn-38092.exe (PID: 8328)
- Unicorn-11357.exe (PID: 8296)
- Unicorn-37538.exe (PID: 2092)
- Unicorn-24954.exe (PID: 8572)
- Unicorn-34274.exe (PID: 8676)
- Unicorn-47273.exe (PID: 8708)
- Unicorn-1964.exe (PID: 8728)
- Unicorn-41762.exe (PID: 7660)
- Unicorn-62670.exe (PID: 8800)
- Unicorn-50314.exe (PID: 7624)
- Unicorn-9385.exe (PID: 8788)
- Unicorn-46593.exe (PID: 7812)
- Unicorn-35042.exe (PID: 8908)
- Unicorn-22192.exe (PID: 8932)
- Unicorn-4407.exe (PID: 8924)
- Unicorn-17751.exe (PID: 9044)
- Unicorn-39126.exe (PID: 9068)
- Unicorn-63993.exe (PID: 9092)
- Unicorn-2959.exe (PID: 7724)
- Unicorn-31726.exe (PID: 9212)
- Unicorn-19282.exe (PID: 7996)
- Unicorn-27450.exe (PID: 8016)
- Unicorn-52509.exe (PID: 9248)
- Unicorn-4599.exe (PID: 9288)
- Unicorn-30937.exe (PID: 8140)
- Unicorn-24866.exe (PID: 9496)
- Unicorn-65337.exe (PID: 9348)
- Unicorn-46230.exe (PID: 7640)
- Unicorn-33396.exe (PID: 9748)
- Unicorn-46313.exe (PID: 8556)
- Unicorn-47132.exe (PID: 9756)
- Unicorn-25530.exe (PID: 8836)
- Unicorn-49524.exe (PID: 8956)
- Unicorn-47206.exe (PID: 10064)
- Unicorn-46422.exe (PID: 8100)
- Unicorn-8529.exe (PID: 9532)
- Unicorn-8529.exe (PID: 9528)
- Unicorn-257.exe (PID: 8652)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 5588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProdctVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
770
Monitored processes
622
Malicious processes
82
Suspicious processes
75
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\Users\admin\AppData\Local\Temp\Unicorn-23500.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-23500.exe | — | Unicorn-33978.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 456 | C:\Users\admin\AppData\Local\Temp\Unicorn-49645.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49645.exe | — | Unicorn-1964.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 660 | "C:\Users\admin\AppData\Local\Temp\1 (1295).exe" | C:\Users\admin\AppData\Local\Temp\1 (1295).exe | explorer.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 | |||||||||||||||
| 872 | C:\Users\admin\AppData\Local\Temp\Unicorn-20450.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20450.exe | — | Unicorn-33698.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1040 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1096 | C:\Users\admin\AppData\Local\Temp\Unicorn-49406.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49406.exe | Unicorn-2213.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1188 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1228 | C:\Users\admin\AppData\Local\Temp\Unicorn-13951.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13951.exe | Unicorn-539.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1276 | C:\Users\admin\AppData\Local\Temp\Unicorn-2213.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-2213.exe | Unicorn-40750.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1280 | C:\Users\admin\AppData\Local\Temp\Unicorn-38234.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-38234.exe | — | Unicorn-16698.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
16 912
Read events
16 897
Write events
15
Delete events
0
Modification events
| (PID) Process: | (6872) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6872) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6872) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (5588) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (5588) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (5588) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (1188) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (1188) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (1188) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (1040) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
609
Suspicious files
7
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5588 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\04c5f736-fb25-4771-aaf9-5dba2cb0ac86.down_data | — | |
MD5:— | SHA256:— | |||
| 660 | 1 (1295).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63025.exe | executable | |
MD5:CCE404830724D086E0E5351CDEB416A2 | SHA256:EEC5B15B20880988C5AE564008213B48EB9C66C6C1C6598A1617B4E94873125D | |||
| 660 | 1 (1295).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-14199.exe | executable | |
MD5:D0B7E88D753593DE43C6191B5EE1D446 | SHA256:7A70A696D30464558844AA46CA051B340055368A1AD349DE6A34852BE074224F | |||
| 4408 | Unicorn-539.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24414.exe | executable | |
MD5:2143DC352AA9B274234B0A5BEAA4359D | SHA256:2F9D9A92D7C4C85CE00D601699D48C219AE5A0FB48EA53128E15FA741B535796 | |||
| 5588 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\dbb1f7e6-a290-4048-8a17-927bd9e466ae.up_meta_secure | binary | |
MD5:6A6D201B87EF53BDFE992E2D386D64C2 | SHA256:A7776788B38878B5519BB2D6262F0F066546628E289EB774F98D415C95C73397 | |||
| 660 | 1 (1295).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-38321.exe | executable | |
MD5:5A997EE8CB1D9DC0356C850C8CCC7428 | SHA256:0EF9C3AB72A92E2B71B84312DEF3ACA6E7AF320626D565DBF8FE5BB1B72B207C | |||
| 6512 | Unicorn-24414.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63474.exe | executable | |
MD5:3DFCE681FDB1BA76AF479DBE2DEF3C28 | SHA256:AC024C8820D76AC26B301BDE992F333F228472D3D8DE2094A4D973502FF903B1 | |||
| 4068 | Unicorn-14199.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-42670.exe | executable | |
MD5:826BEDE15063A10E579CCD452A505D5E | SHA256:E40AA00A03C44D238259DBEAC1D9C55FA9D681490B729A6E3ADCE4404B80E679 | |||
| 4408 | Unicorn-539.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13951.exe | executable | |
MD5:DE861B8CCCEB241CFCF6AB89429BD667 | SHA256:0C79F5AC8B4CB1D01BDF4313C1EC0B707A92F1C9B2D563D5B991F490BF3A9E74 | |||
| 5588 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\04c5f736-fb25-4771-aaf9-5dba2cb0ac86.0f28668e-13c1-457c-9be4-a66925a1af19.down_meta | binary | |
MD5:716980EA586483E20DAB80B553121F00 | SHA256:46956B5FC4AC621CC996622D21117757668A307E576070350CC2922E2CBEAF08 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
28
DNS requests
19
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6572 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | unknown |
— | — | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
5588 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | unknown |
8376 | SIHClient.exe | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | unknown |
3284 | svchost.exe | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
8376 | SIHClient.exe | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | unknown |
3284 | svchost.exe | GET | 200 | 23.48.23.147:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | unknown |
— | — | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
— | — | 40.126.32.140:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
— | — | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | unknown |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
2112 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
6544 | svchost.exe | 40.126.32.140:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
6572 | backgroundTaskHost.exe | 20.223.36.55:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
6572 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
client.wns.windows.com |
| unknown |
login.live.com |
| unknown |
ocsp.digicert.com |
| unknown |
settings-win.data.microsoft.com |
| unknown |
arc.msn.com |
| unknown |
www.bing.com |
| unknown |
slscr.update.microsoft.com |
| unknown |
www.microsoft.com |
| unknown |
fe3cr.delivery.mp.microsoft.com |
| unknown |
watson.events.data.microsoft.com |
| unknown |