| File name: | 1 (1233) |
| Full analysis: | https://app.any.run/tasks/ae533bee-8e71-4884-bd68-5f868f50b57c |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 10:38:50 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | AB572EF61D67EFE01464750770B25760 |
| SHA1: | E1BA1C238602FD331B386BA1D6C3BB1A234E0603 |
| SHA256: | FF9637AABDF91A14F5C0C597C04E45B92E13DBD60074BF6C0C6A46390312A1A2 |
| SSDEEP: | 6144:p7YP2kIJlD1HA5l2EZevr4fx/tBqlvJGBV/xyeO92k/8SwjwpyAvEhFSh+t2VmHa:pE+zBHA5sEYQBMhaVJyeO98x4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- 1 (1233).exe (PID: 5048)
- Unicorn-3548.exe (PID: 6372)
- Unicorn-5338.exe (PID: 664)
- Unicorn-48961.exe (PID: 6652)
- Unicorn-60699.exe (PID: 672)
- Unicorn-27036.exe (PID: 2108)
- Unicorn-56179.exe (PID: 4180)
- Unicorn-8897.exe (PID: 2516)
- Unicorn-24797.exe (PID: 2088)
- Unicorn-51348.exe (PID: 6388)
- Unicorn-19745.exe (PID: 4988)
- Unicorn-61976.exe (PID: 2552)
- Unicorn-46003.exe (PID: 736)
- Unicorn-8499.exe (PID: 1040)
- Unicorn-22789.exe (PID: 856)
- Unicorn-12946.exe (PID: 2040)
- Unicorn-5292.exe (PID: 1240)
- Unicorn-8115.exe (PID: 7200)
- Unicorn-57051.exe (PID: 7220)
- Unicorn-38831.exe (PID: 6268)
- Unicorn-9184.exe (PID: 7236)
- Unicorn-22458.exe (PID: 7252)
- Unicorn-7466.exe (PID: 7972)
- Unicorn-47560.exe (PID: 8028)
- Unicorn-27332.exe (PID: 7964)
- Unicorn-12841.exe (PID: 8044)
- Unicorn-60175.exe (PID: 8136)
- Unicorn-18780.exe (PID: 8108)
- Unicorn-15848.exe (PID: 7208)
- Unicorn-58504.exe (PID: 1096)
- Unicorn-45697.exe (PID: 7176)
- Unicorn-26683.exe (PID: 8120)
- Unicorn-30838.exe (PID: 5552)
- Unicorn-25861.exe (PID: 4488)
- Unicorn-53076.exe (PID: 8148)
- Unicorn-44244.exe (PID: 2268)
- Unicorn-7596.exe (PID: 8080)
- Unicorn-45121.exe (PID: 1628)
- Unicorn-47374.exe (PID: 6028)
- Unicorn-20425.exe (PID: 5156)
- Unicorn-8042.exe (PID: 680)
- Unicorn-24378.exe (PID: 1764)
- Unicorn-50174.exe (PID: 4920)
- Unicorn-2562.exe (PID: 7272)
- Unicorn-48520.exe (PID: 5756)
- Unicorn-63962.exe (PID: 7460)
- Unicorn-55079.exe (PID: 7576)
- Unicorn-54825.exe (PID: 7288)
- Unicorn-63631.exe (PID: 7532)
- Unicorn-48386.exe (PID: 7228)
- Unicorn-14871.exe (PID: 7524)
- Unicorn-11052.exe (PID: 7512)
- Unicorn-56408.exe (PID: 7748)
- Unicorn-65131.exe (PID: 7792)
- Unicorn-19460.exe (PID: 7800)
- Unicorn-59340.exe (PID: 7496)
- Unicorn-43772.exe (PID: 7872)
- Unicorn-20537.exe (PID: 7648)
- Unicorn-11955.exe (PID: 7492)
- Unicorn-35604.exe (PID: 7728)
- Unicorn-3808.exe (PID: 7876)
- Unicorn-48712.exe (PID: 7652)
- Unicorn-55448.exe (PID: 7640)
- Unicorn-52132.exe (PID: 7856)
- Unicorn-3123.exe (PID: 7680)
- Unicorn-23801.exe (PID: 8396)
- Unicorn-4254.exe (PID: 8172)
- Unicorn-6697.exe (PID: 7444)
- Unicorn-16528.exe (PID: 7888)
- Unicorn-45993.exe (PID: 7988)
- Unicorn-6247.exe (PID: 7628)
- Unicorn-58219.exe (PID: 8948)
- Unicorn-52516.exe (PID: 7480)
- Unicorn-26232.exe (PID: 8280)
- Unicorn-28204.exe (PID: 8160)
- Unicorn-62530.exe (PID: 7464)
- Unicorn-43202.exe (PID: 7864)
- Unicorn-27626.exe (PID: 8072)
- Unicorn-42650.exe (PID: 9024)
- Unicorn-10938.exe (PID: 9096)
- Unicorn-2862.exe (PID: 8784)
- Unicorn-5536.exe (PID: 516)
- Unicorn-57566.exe (PID: 8444)
- Unicorn-15738.exe (PID: 7732)
- Unicorn-8727.exe (PID: 8792)
- Unicorn-53128.exe (PID: 8484)
- Unicorn-58904.exe (PID: 8296)
- Unicorn-32790.exe (PID: 8860)
- Unicorn-24347.exe (PID: 8500)
- Unicorn-36756.exe (PID: 8024)
- Unicorn-29617.exe (PID: 7944)
- Unicorn-20228.exe (PID: 8096)
- Unicorn-7456.exe (PID: 8476)
- Unicorn-45728.exe (PID: 8012)
- Unicorn-62914.exe (PID: 7940)
- Unicorn-3507.exe (PID: 7928)
- Unicorn-18919.exe (PID: 7892)
- Unicorn-26616.exe (PID: 8528)
- Unicorn-29932.exe (PID: 8388)
- Unicorn-51675.exe (PID: 8548)
- Unicorn-59864.exe (PID: 8744)
- Unicorn-51208.exe (PID: 920)
- Unicorn-24800.exe (PID: 8932)
- Unicorn-42568.exe (PID: 8252)
- Unicorn-8323.exe (PID: 10048)
- Unicorn-43034.exe (PID: 10056)
- Unicorn-62163.exe (PID: 10040)
- Unicorn-39657.exe (PID: 9196)
- Unicorn-19520.exe (PID: 9132)
- Unicorn-8463.exe (PID: 8940)
- Unicorn-54415.exe (PID: 9692)
- Unicorn-41202.exe (PID: 8104)
- Unicorn-4586.exe (PID: 8768)
- Unicorn-17395.exe (PID: 9900)
- Unicorn-55012.exe (PID: 8572)
- Unicorn-52390.exe (PID: 8416)
- Unicorn-4778.exe (PID: 8460)
- Unicorn-12739.exe (PID: 8908)
- Unicorn-62028.exe (PID: 644)
- Unicorn-15240.exe (PID: 8536)
- Unicorn-25092.exe (PID: 9504)
- Unicorn-37711.exe (PID: 9168)
- Unicorn-31642.exe (PID: 8760)
- Unicorn-46631.exe (PID: 8436)
- Unicorn-7425.exe (PID: 9716)
- Unicorn-31292.exe (PID: 9780)
- Unicorn-44482.exe (PID: 11428)
- Unicorn-41682.exe (PID: 11436)
- Unicorn-47332.exe (PID: 11444)
- Unicorn-51416.exe (PID: 8404)
- Unicorn-26785.exe (PID: 9344)
- Unicorn-56527.exe (PID: 7932)
- Unicorn-45750.exe (PID: 9708)
- Unicorn-47213.exe (PID: 3396)
- Unicorn-50683.exe (PID: 10616)
- Unicorn-27274.exe (PID: 9140)
- Unicorn-27960.exe (PID: 8880)
- Unicorn-8520.exe (PID: 1272)
- Unicorn-31585.exe (PID: 7908)
- Unicorn-26092.exe (PID: 9664)
- Unicorn-65270.exe (PID: 9616)
- Unicorn-46932.exe (PID: 7276)
- Unicorn-44592.exe (PID: 7768)
- Unicorn-21956.exe (PID: 8328)
- Unicorn-19054.exe (PID: 8356)
- Unicorn-54125.exe (PID: 10128)
- Unicorn-25322.exe (PID: 9648)
- Unicorn-49143.exe (PID: 9928)
- Unicorn-9947.exe (PID: 9636)
- Unicorn-37825.exe (PID: 8052)
- Unicorn-51951.exe (PID: 12580)
- Unicorn-37642.exe (PID: 7700)
- Unicorn-52080.exe (PID: 8676)
- Unicorn-49445.exe (PID: 9676)
- Unicorn-48744.exe (PID: 12608)
- Unicorn-50212.exe (PID: 9464)
- Unicorn-44658.exe (PID: 9656)
- Unicorn-11093.exe (PID: 12700)
- Unicorn-310.exe (PID: 8800)
- Unicorn-18011.exe (PID: 9380)
- Unicorn-37005.exe (PID: 8600)
- Unicorn-52065.exe (PID: 11388)
- Unicorn-16969.exe (PID: 8816)
- Unicorn-34814.exe (PID: 9700)
- Unicorn-7643.exe (PID: 7764)
- Unicorn-7258.exe (PID: 11228)
- Unicorn-50715.exe (PID: 8452)
- Unicorn-63174.exe (PID: 14332)
- Unicorn-63174.exe (PID: 14324)
- Unicorn-49439.exe (PID: 1280)
- Unicorn-18338.exe (PID: 10384)
- Unicorn-18366.exe (PID: 15264)
- Unicorn-27726.exe (PID: 12388)
- Unicorn-50322.exe (PID: 10428)
- Unicorn-41100.exe (PID: 11140)
- Unicorn-31297.exe (PID: 9956)
- Unicorn-60374.exe (PID: 15168)
- Unicorn-12473.exe (PID: 10368)
- Unicorn-17260.exe (PID: 10216)
- Unicorn-54792.exe (PID: 13936)
- Unicorn-60980.exe (PID: 10740)
- Unicorn-6027.exe (PID: 13728)
- Unicorn-27463.exe (PID: 12052)
- Unicorn-19762.exe (PID: 13712)
- Unicorn-6403.exe (PID: 9844)
- Unicorn-18302.exe (PID: 3968)
- Unicorn-52589.exe (PID: 9816)
- Unicorn-50404.exe (PID: 9732)
- Unicorn-41660.exe (PID: 9516)
- Unicorn-46232.exe (PID: 10340)
- Unicorn-63969.exe (PID: 8780)
- Unicorn-31566.exe (PID: 13436)
- Unicorn-19948.exe (PID: 10784)
- Unicorn-2490.exe (PID: 12156)
- Unicorn-10874.exe (PID: 6940)
- Unicorn-65043.exe (PID: 10168)
- Unicorn-19762.exe (PID: 13720)
- Unicorn-54679.exe (PID: 11716)
- Unicorn-34643.exe (PID: 2084)
- Unicorn-20922.exe (PID: 8752)
- Unicorn-46624.exe (PID: 14692)
- Unicorn-22171.exe (PID: 14296)
- Unicorn-45042.exe (PID: 12736)
- Unicorn-58991.exe (PID: 7456)
- Unicorn-46868.exe (PID: 14128)
- Unicorn-34644.exe (PID: 9576)
- Unicorn-50721.exe (PID: 11540)
- Unicorn-6551.exe (PID: 14824)
- Unicorn-38234.exe (PID: 10224)
- Unicorn-63174.exe (PID: 13540)
- Unicorn-19651.exe (PID: 9804)
- Unicorn-58026.exe (PID: 9748)
- Unicorn-52952.exe (PID: 12008)
- Unicorn-29578.exe (PID: 9324)
- Unicorn-46445.exe (PID: 11120)
- Unicorn-35907.exe (PID: 14368)
- Unicorn-1639.exe (PID: 9208)
- Unicorn-16056.exe (PID: 10680)
- Unicorn-40996.exe (PID: 10100)
- Unicorn-42511.exe (PID: 7556)
- Unicorn-54792.exe (PID: 14684)
- Unicorn-45360.exe (PID: 9316)
- Unicorn-3358.exe (PID: 12468)
- Unicorn-41550.exe (PID: 11668)
- Unicorn-24232.exe (PID: 14600)
- Unicorn-54187.exe (PID: 3032)
- Unicorn-14727.exe (PID: 12372)
- Unicorn-52184.exe (PID: 11920)
- Unicorn-21396.exe (PID: 12264)
- Unicorn-48370.exe (PID: 13524)
- Unicorn-18718.exe (PID: 10420)
- Unicorn-54902.exe (PID: 10176)
- Unicorn-35213.exe (PID: 14228)
- Unicorn-8441.exe (PID: 9836)
- Unicorn-23399.exe (PID: 12444)
- Unicorn-65041.exe (PID: 14788)
- Unicorn-6551.exe (PID: 14812)
- Unicorn-13523.exe (PID: 12972)
- Unicorn-5967.exe (PID: 10452)
- Unicorn-45739.exe (PID: 11236)
- Unicorn-12111.exe (PID: 9428)
- Unicorn-8022.exe (PID: 12524)
- Unicorn-63004.exe (PID: 12184)
- Unicorn-41767.exe (PID: 14892)
- Unicorn-709.exe (PID: 11660)
Starts itself from another location
- Unicorn-5338.exe (PID: 664)
- 1 (1233).exe (PID: 5048)
- Unicorn-3548.exe (PID: 6372)
- Unicorn-48961.exe (PID: 6652)
- Unicorn-60699.exe (PID: 672)
- Unicorn-8897.exe (PID: 2516)
- Unicorn-27036.exe (PID: 2108)
- Unicorn-56179.exe (PID: 4180)
- Unicorn-38831.exe (PID: 6268)
- Unicorn-51348.exe (PID: 6388)
- Unicorn-19745.exe (PID: 4988)
- Unicorn-46003.exe (PID: 736)
- Unicorn-61976.exe (PID: 2552)
- Unicorn-8499.exe (PID: 1040)
- Unicorn-22789.exe (PID: 856)
- Unicorn-12946.exe (PID: 2040)
- Unicorn-5292.exe (PID: 1240)
- Unicorn-24797.exe (PID: 2088)
- Unicorn-8115.exe (PID: 7200)
- Unicorn-48386.exe (PID: 7228)
- Unicorn-22458.exe (PID: 7252)
- Unicorn-9184.exe (PID: 7236)
- Unicorn-7466.exe (PID: 7972)
- Unicorn-27332.exe (PID: 7964)
- Unicorn-47560.exe (PID: 8028)
- Unicorn-12841.exe (PID: 8044)
- Unicorn-15848.exe (PID: 7208)
- Unicorn-57051.exe (PID: 7220)
- Unicorn-18780.exe (PID: 8108)
- Unicorn-58504.exe (PID: 1096)
- Unicorn-45697.exe (PID: 7176)
- Unicorn-26683.exe (PID: 8120)
- Unicorn-44244.exe (PID: 2268)
- Unicorn-30838.exe (PID: 5552)
- Unicorn-7596.exe (PID: 8080)
- Unicorn-53076.exe (PID: 8148)
- Unicorn-47374.exe (PID: 6028)
- Unicorn-8042.exe (PID: 680)
- Unicorn-45121.exe (PID: 1628)
- Unicorn-25861.exe (PID: 4488)
- Unicorn-20425.exe (PID: 5156)
- Unicorn-24378.exe (PID: 1764)
- Unicorn-48520.exe (PID: 5756)
- Unicorn-50174.exe (PID: 4920)
- Unicorn-46932.exe (PID: 7276)
- Unicorn-54825.exe (PID: 7288)
- Unicorn-55079.exe (PID: 7576)
- Unicorn-2562.exe (PID: 7272)
- Unicorn-11052.exe (PID: 7512)
- Unicorn-14871.exe (PID: 7524)
- Unicorn-65131.exe (PID: 7792)
- Unicorn-19460.exe (PID: 7800)
- Unicorn-11955.exe (PID: 7492)
- Unicorn-43772.exe (PID: 7872)
- Unicorn-20537.exe (PID: 7648)
- Unicorn-59340.exe (PID: 7496)
- Unicorn-35604.exe (PID: 7728)
- Unicorn-63962.exe (PID: 7460)
- Unicorn-3808.exe (PID: 7876)
- Unicorn-48712.exe (PID: 7652)
- Unicorn-55448.exe (PID: 7640)
- Unicorn-52132.exe (PID: 7856)
- Unicorn-3123.exe (PID: 7680)
- Unicorn-16528.exe (PID: 7888)
- Unicorn-23801.exe (PID: 8396)
- Unicorn-4254.exe (PID: 8172)
- Unicorn-45993.exe (PID: 7988)
- Unicorn-6697.exe (PID: 7444)
- Unicorn-52516.exe (PID: 7480)
- Unicorn-60175.exe (PID: 8136)
- Unicorn-58219.exe (PID: 8948)
- Unicorn-26232.exe (PID: 8280)
- Unicorn-62530.exe (PID: 7464)
- Unicorn-6247.exe (PID: 7628)
- Unicorn-42650.exe (PID: 9024)
- Unicorn-43202.exe (PID: 7864)
- Unicorn-10938.exe (PID: 9096)
- Unicorn-27626.exe (PID: 8072)
- Unicorn-15738.exe (PID: 7732)
- Unicorn-8727.exe (PID: 8792)
- Unicorn-46631.exe (PID: 8436)
- Unicorn-5536.exe (PID: 516)
- Unicorn-57566.exe (PID: 8444)
- Unicorn-58904.exe (PID: 8296)
- Unicorn-32790.exe (PID: 8860)
- Unicorn-29617.exe (PID: 7944)
- Unicorn-53128.exe (PID: 8484)
- Unicorn-56408.exe (PID: 7748)
- Unicorn-7456.exe (PID: 8476)
- Unicorn-45728.exe (PID: 8012)
- Unicorn-62914.exe (PID: 7940)
- Unicorn-15240.exe (PID: 8536)
- Unicorn-3507.exe (PID: 7928)
- Unicorn-2862.exe (PID: 8784)
- Unicorn-18919.exe (PID: 7892)
- Unicorn-51675.exe (PID: 8548)
- Unicorn-37642.exe (PID: 7700)
- Unicorn-26616.exe (PID: 8528)
- Unicorn-36756.exe (PID: 8024)
- Unicorn-59864.exe (PID: 8744)
- Unicorn-51208.exe (PID: 920)
- Unicorn-37825.exe (PID: 8052)
- Unicorn-8323.exe (PID: 10048)
- Unicorn-62163.exe (PID: 10040)
- Unicorn-24800.exe (PID: 8932)
- Unicorn-52080.exe (PID: 8676)
- Unicorn-19520.exe (PID: 9132)
- Unicorn-8463.exe (PID: 8940)
- Unicorn-54415.exe (PID: 9692)
- Unicorn-43034.exe (PID: 10056)
- Unicorn-41202.exe (PID: 8104)
- Unicorn-52390.exe (PID: 8416)
- Unicorn-4586.exe (PID: 8768)
- Unicorn-55012.exe (PID: 8572)
- Unicorn-12739.exe (PID: 8908)
- Unicorn-25322.exe (PID: 9648)
- Unicorn-39657.exe (PID: 9196)
- Unicorn-44592.exe (PID: 7768)
- Unicorn-62028.exe (PID: 644)
- Unicorn-25092.exe (PID: 9504)
- Unicorn-28204.exe (PID: 8160)
- Unicorn-31642.exe (PID: 8760)
- Unicorn-37711.exe (PID: 9168)
- Unicorn-7425.exe (PID: 9716)
- Unicorn-29932.exe (PID: 8388)
- Unicorn-47332.exe (PID: 11444)
- Unicorn-44482.exe (PID: 11428)
- Unicorn-41682.exe (PID: 11436)
- Unicorn-51416.exe (PID: 8404)
- Unicorn-20228.exe (PID: 8096)
- Unicorn-26785.exe (PID: 9344)
- Unicorn-56527.exe (PID: 7932)
- Unicorn-31292.exe (PID: 9780)
- Unicorn-45750.exe (PID: 9708)
- Unicorn-34814.exe (PID: 9700)
- Unicorn-50683.exe (PID: 10616)
- Unicorn-8520.exe (PID: 1272)
- Unicorn-27960.exe (PID: 8880)
- Unicorn-31585.exe (PID: 7908)
- Unicorn-27274.exe (PID: 9140)
- Unicorn-42568.exe (PID: 8252)
- Unicorn-18302.exe (PID: 3968)
- Unicorn-26092.exe (PID: 9664)
- Unicorn-21956.exe (PID: 8328)
- Unicorn-19054.exe (PID: 8356)
- Unicorn-54125.exe (PID: 10128)
- Unicorn-17395.exe (PID: 9900)
- Unicorn-9947.exe (PID: 9636)
- Unicorn-65270.exe (PID: 9616)
- Unicorn-49143.exe (PID: 9928)
- Unicorn-49445.exe (PID: 9676)
- Unicorn-48744.exe (PID: 12608)
- Unicorn-11093.exe (PID: 12700)
- Unicorn-51951.exe (PID: 12580)
- Unicorn-4778.exe (PID: 8460)
- Unicorn-50212.exe (PID: 9464)
- Unicorn-44658.exe (PID: 9656)
- Unicorn-37005.exe (PID: 8600)
- Unicorn-310.exe (PID: 8800)
- Unicorn-63174.exe (PID: 14332)
- Unicorn-49439.exe (PID: 1280)
- Unicorn-52065.exe (PID: 11388)
- Unicorn-63174.exe (PID: 14324)
- Unicorn-16969.exe (PID: 8816)
- Unicorn-24347.exe (PID: 8500)
- Unicorn-7643.exe (PID: 7764)
- Unicorn-3502.exe (PID: 15100)
- Unicorn-60374.exe (PID: 15168)
- Unicorn-18366.exe (PID: 15264)
- Unicorn-50715.exe (PID: 8452)
Executes application which crashes
- Unicorn-29288.exe (PID: 5116)
- Unicorn-29252.exe (PID: 7308)
- Unicorn-63631.exe (PID: 7532)
- Unicorn-5536.exe (PID: 516)
INFO
The sample compiled with chinese language support
- 1 (1233).exe (PID: 5048)
Reads the computer name
- Unicorn-48961.exe (PID: 6652)
- Unicorn-29288.exe (PID: 5116)
- 1 (1233).exe (PID: 5048)
- Unicorn-5338.exe (PID: 664)
- Unicorn-3548.exe (PID: 6372)
- Unicorn-60699.exe (PID: 672)
- Unicorn-8897.exe (PID: 2516)
- Unicorn-27036.exe (PID: 2108)
- Unicorn-51348.exe (PID: 6388)
- Unicorn-61976.exe (PID: 2552)
- Unicorn-46003.exe (PID: 736)
- Unicorn-8499.exe (PID: 1040)
- Unicorn-38831.exe (PID: 6268)
- Unicorn-24797.exe (PID: 2088)
- Unicorn-56179.exe (PID: 4180)
- Unicorn-22789.exe (PID: 856)
- Unicorn-8115.exe (PID: 7200)
- Unicorn-12946.exe (PID: 2040)
- Unicorn-9184.exe (PID: 7236)
- Unicorn-27332.exe (PID: 7964)
- Unicorn-48386.exe (PID: 7228)
- Unicorn-57051.exe (PID: 7220)
- Unicorn-12841.exe (PID: 8044)
- Unicorn-60175.exe (PID: 8136)
- Unicorn-30838.exe (PID: 5552)
- Unicorn-58504.exe (PID: 1096)
- Unicorn-7596.exe (PID: 8080)
- Unicorn-53076.exe (PID: 8148)
- Unicorn-20425.exe (PID: 5156)
- Unicorn-45121.exe (PID: 1628)
- Unicorn-47374.exe (PID: 6028)
- Unicorn-48520.exe (PID: 5756)
- Unicorn-24378.exe (PID: 1764)
- Unicorn-2562.exe (PID: 7272)
- Unicorn-63631.exe (PID: 7532)
- Unicorn-55079.exe (PID: 7576)
- Unicorn-14871.exe (PID: 7524)
- Unicorn-11052.exe (PID: 7512)
- Unicorn-19460.exe (PID: 7800)
- Unicorn-20537.exe (PID: 7648)
- Unicorn-59340.exe (PID: 7496)
- Unicorn-65131.exe (PID: 7792)
- Unicorn-3808.exe (PID: 7876)
- Unicorn-52132.exe (PID: 7856)
- Unicorn-3123.exe (PID: 7680)
- Unicorn-16528.exe (PID: 7888)
- Unicorn-6247.exe (PID: 7628)
- Unicorn-28204.exe (PID: 8160)
- Unicorn-26232.exe (PID: 8280)
- Unicorn-10938.exe (PID: 9096)
- Unicorn-27626.exe (PID: 8072)
- Unicorn-32790.exe (PID: 8860)
- Unicorn-15240.exe (PID: 8536)
- Unicorn-62914.exe (PID: 7940)
- Unicorn-3507.exe (PID: 7928)
- Unicorn-51675.exe (PID: 8548)
- Unicorn-59864.exe (PID: 8744)
- Unicorn-24800.exe (PID: 8932)
- Unicorn-37825.exe (PID: 8052)
- Unicorn-52390.exe (PID: 8416)
- Unicorn-8463.exe (PID: 8940)
- Unicorn-44592.exe (PID: 7768)
- Unicorn-39657.exe (PID: 9196)
- Unicorn-62028.exe (PID: 644)
- Unicorn-27960.exe (PID: 8880)
- Unicorn-31292.exe (PID: 9780)
- Unicorn-27274.exe (PID: 9140)
- Unicorn-26785.exe (PID: 9344)
- Unicorn-56527.exe (PID: 7932)
- Unicorn-51416.exe (PID: 8404)
- Unicorn-31585.exe (PID: 7908)
- Unicorn-37005.exe (PID: 8600)
- Unicorn-19054.exe (PID: 8356)
- Unicorn-50683.exe (PID: 10616)
- Unicorn-18302.exe (PID: 3968)
- Unicorn-310.exe (PID: 8800)
- Unicorn-11093.exe (PID: 12700)
- Unicorn-50715.exe (PID: 8452)
- Unicorn-51951.exe (PID: 12580)
- Unicorn-52065.exe (PID: 11388)
- Unicorn-29578.exe (PID: 9324)
- Unicorn-46232.exe (PID: 10340)
Create files in a temporary directory
- 1 (1233).exe (PID: 5048)
- Unicorn-3548.exe (PID: 6372)
- Unicorn-5338.exe (PID: 664)
- Unicorn-8897.exe (PID: 2516)
- Unicorn-48961.exe (PID: 6652)
- Unicorn-60699.exe (PID: 672)
- Unicorn-22789.exe (PID: 856)
- Unicorn-24797.exe (PID: 2088)
- Unicorn-8499.exe (PID: 1040)
- Unicorn-9184.exe (PID: 7236)
- Unicorn-51348.exe (PID: 6388)
- Unicorn-22458.exe (PID: 7252)
- Unicorn-7466.exe (PID: 7972)
- Unicorn-12841.exe (PID: 8044)
- Unicorn-61976.exe (PID: 2552)
- Unicorn-15848.exe (PID: 7208)
- Unicorn-56179.exe (PID: 4180)
- Unicorn-18780.exe (PID: 8108)
- Unicorn-5292.exe (PID: 1240)
- Unicorn-19745.exe (PID: 4988)
- Unicorn-12946.exe (PID: 2040)
- Unicorn-45697.exe (PID: 7176)
- Unicorn-30838.exe (PID: 5552)
- Unicorn-25861.exe (PID: 4488)
- Unicorn-44244.exe (PID: 2268)
- Unicorn-45121.exe (PID: 1628)
- Unicorn-20425.exe (PID: 5156)
- Unicorn-8042.exe (PID: 680)
- Unicorn-58504.exe (PID: 1096)
- Unicorn-50174.exe (PID: 4920)
- Unicorn-38831.exe (PID: 6268)
- Unicorn-8115.exe (PID: 7200)
- Unicorn-63962.exe (PID: 7460)
- Unicorn-55079.exe (PID: 7576)
- Unicorn-46003.exe (PID: 736)
- Unicorn-14871.exe (PID: 7524)
- Unicorn-65131.exe (PID: 7792)
- Unicorn-11052.exe (PID: 7512)
- Unicorn-27332.exe (PID: 7964)
- Unicorn-19460.exe (PID: 7800)
- Unicorn-43772.exe (PID: 7872)
- Unicorn-3808.exe (PID: 7876)
- Unicorn-48712.exe (PID: 7652)
- Unicorn-59340.exe (PID: 7496)
- Unicorn-35604.exe (PID: 7728)
- Unicorn-52132.exe (PID: 7856)
- Unicorn-53076.exe (PID: 8148)
- Unicorn-16528.exe (PID: 7888)
- Unicorn-23801.exe (PID: 8396)
- Unicorn-4254.exe (PID: 8172)
- Unicorn-6697.exe (PID: 7444)
- Unicorn-45993.exe (PID: 7988)
- Unicorn-57051.exe (PID: 7220)
- Unicorn-52516.exe (PID: 7480)
- Unicorn-26232.exe (PID: 8280)
- Unicorn-6247.exe (PID: 7628)
- Unicorn-24378.exe (PID: 1764)
- Unicorn-42650.exe (PID: 9024)
- Unicorn-15738.exe (PID: 7732)
- Unicorn-2862.exe (PID: 8784)
- Unicorn-5536.exe (PID: 516)
- Unicorn-57566.exe (PID: 8444)
- Unicorn-54825.exe (PID: 7288)
- Unicorn-20228.exe (PID: 8096)
- Unicorn-53128.exe (PID: 8484)
- Unicorn-24347.exe (PID: 8500)
- Unicorn-36756.exe (PID: 8024)
- Unicorn-29617.exe (PID: 7944)
- Unicorn-7456.exe (PID: 8476)
- Unicorn-56408.exe (PID: 7748)
- Unicorn-62914.exe (PID: 7940)
- Unicorn-29932.exe (PID: 8388)
- Unicorn-51675.exe (PID: 8548)
- Unicorn-48520.exe (PID: 5756)
- Unicorn-18919.exe (PID: 7892)
- Unicorn-26616.exe (PID: 8528)
- Unicorn-48386.exe (PID: 7228)
- Unicorn-59864.exe (PID: 8744)
- Unicorn-51208.exe (PID: 920)
- Unicorn-27036.exe (PID: 2108)
- Unicorn-2562.exe (PID: 7272)
- Unicorn-47560.exe (PID: 8028)
- Unicorn-8323.exe (PID: 10048)
- Unicorn-43034.exe (PID: 10056)
- Unicorn-8463.exe (PID: 8940)
- Unicorn-41202.exe (PID: 8104)
- Unicorn-17395.exe (PID: 9900)
- Unicorn-20537.exe (PID: 7648)
- Unicorn-7596.exe (PID: 8080)
- Unicorn-39657.exe (PID: 9196)
- Unicorn-60175.exe (PID: 8136)
- Unicorn-3123.exe (PID: 7680)
- Unicorn-26683.exe (PID: 8120)
- Unicorn-7425.exe (PID: 9716)
- Unicorn-15240.exe (PID: 8536)
- Unicorn-31292.exe (PID: 9780)
- Unicorn-47332.exe (PID: 11444)
- Unicorn-41682.exe (PID: 11436)
- Unicorn-51416.exe (PID: 8404)
- Unicorn-50683.exe (PID: 10616)
- Unicorn-27274.exe (PID: 9140)
- Unicorn-42568.exe (PID: 8252)
- Unicorn-58904.exe (PID: 8296)
- Unicorn-10938.exe (PID: 9096)
- Unicorn-21956.exe (PID: 8328)
- Unicorn-3507.exe (PID: 7928)
- Unicorn-52080.exe (PID: 8676)
- Unicorn-51951.exe (PID: 12580)
- Unicorn-25092.exe (PID: 9504)
- Unicorn-44658.exe (PID: 9656)
- Unicorn-49439.exe (PID: 1280)
- Unicorn-24800.exe (PID: 8932)
- Unicorn-7643.exe (PID: 7764)
Checks supported languages
- Unicorn-8897.exe (PID: 2516)
- Unicorn-5338.exe (PID: 664)
- Unicorn-60699.exe (PID: 672)
- Unicorn-48961.exe (PID: 6652)
- 1 (1233).exe (PID: 5048)
- Unicorn-3548.exe (PID: 6372)
- Unicorn-29288.exe (PID: 5116)
- Unicorn-56179.exe (PID: 4180)
- Unicorn-19745.exe (PID: 4988)
- Unicorn-51348.exe (PID: 6388)
- Unicorn-61976.exe (PID: 2552)
- Unicorn-46003.exe (PID: 736)
- Unicorn-8499.exe (PID: 1040)
- Unicorn-22789.exe (PID: 856)
- Unicorn-38831.exe (PID: 6268)
- Unicorn-8115.exe (PID: 7200)
- Unicorn-5292.exe (PID: 1240)
- Unicorn-12946.exe (PID: 2040)
- Unicorn-57051.exe (PID: 7220)
- Unicorn-48386.exe (PID: 7228)
- Unicorn-22458.exe (PID: 7252)
- Unicorn-7466.exe (PID: 7972)
- Unicorn-27332.exe (PID: 7964)
- Unicorn-47560.exe (PID: 8028)
- Unicorn-18780.exe (PID: 8108)
- Unicorn-15848.exe (PID: 7208)
- Unicorn-60175.exe (PID: 8136)
- Unicorn-53076.exe (PID: 8148)
- Unicorn-45121.exe (PID: 1628)
- Unicorn-47374.exe (PID: 6028)
- Unicorn-24378.exe (PID: 1764)
- Unicorn-48520.exe (PID: 5756)
- Unicorn-26683.exe (PID: 8120)
- Unicorn-54825.exe (PID: 7288)
- Unicorn-46932.exe (PID: 7276)
- Unicorn-2562.exe (PID: 7272)
- Unicorn-14871.exe (PID: 7524)
- Unicorn-63962.exe (PID: 7460)
- Unicorn-63631.exe (PID: 7532)
- Unicorn-11955.exe (PID: 7492)
- Unicorn-59340.exe (PID: 7496)
- Unicorn-6247.exe (PID: 7628)
- Unicorn-56408.exe (PID: 7748)
- Unicorn-65131.exe (PID: 7792)
- Unicorn-19460.exe (PID: 7800)
- Unicorn-43202.exe (PID: 7864)
- Unicorn-35604.exe (PID: 7728)
- Unicorn-43772.exe (PID: 7872)
- Unicorn-15738.exe (PID: 7732)
- Unicorn-48712.exe (PID: 7652)
- Unicorn-20228.exe (PID: 8096)
- Unicorn-28204.exe (PID: 8160)
- Unicorn-4254.exe (PID: 8172)
- Unicorn-29617.exe (PID: 7944)
- Unicorn-45993.exe (PID: 7988)
- Unicorn-36756.exe (PID: 8024)
- Unicorn-56527.exe (PID: 7932)
- Unicorn-18919.exe (PID: 7892)
- Unicorn-6697.exe (PID: 7444)
- Unicorn-51208.exe (PID: 920)
- Unicorn-3507.exe (PID: 7928)
- Unicorn-62914.exe (PID: 7940)
- Unicorn-26232.exe (PID: 8280)
- Unicorn-58904.exe (PID: 8296)
- Unicorn-62028.exe (PID: 644)
- Unicorn-57566.exe (PID: 8444)
- Unicorn-5536.exe (PID: 516)
- Unicorn-26616.exe (PID: 8528)
- Unicorn-15240.exe (PID: 8536)
- Unicorn-27768.exe (PID: 8608)
- Unicorn-37005.exe (PID: 8600)
- Unicorn-52080.exe (PID: 8676)
- Unicorn-2862.exe (PID: 8784)
- Unicorn-8727.exe (PID: 8792)
- Unicorn-32790.exe (PID: 8860)
- Unicorn-10938.exe (PID: 9096)
- Unicorn-51675.exe (PID: 8548)
- Unicorn-55012.exe (PID: 8572)
- Unicorn-42650.exe (PID: 9024)
- Unicorn-12739.exe (PID: 8908)
- Unicorn-39657.exe (PID: 9196)
- Unicorn-27213.exe (PID: 8340)
- Unicorn-1513.exe (PID: 3020)
- Unicorn-6994.exe (PID: 9256)
- Unicorn-24940.exe (PID: 9288)
- Unicorn-26785.exe (PID: 9344)
- Unicorn-26476.exe (PID: 9568)
- Unicorn-9947.exe (PID: 9636)
- Unicorn-25322.exe (PID: 9648)
- Unicorn-26092.exe (PID: 9664)
- Unicorn-54415.exe (PID: 9692)
- Unicorn-58026.exe (PID: 9748)
- Unicorn-65270.exe (PID: 9616)
- Unicorn-19651.exe (PID: 9804)
- Unicorn-31297.exe (PID: 9956)
- Unicorn-44312.exe (PID: 9972)
- Unicorn-40036.exe (PID: 10008)
- Unicorn-40996.exe (PID: 10100)
- Unicorn-31292.exe (PID: 9780)
- Unicorn-27981.exe (PID: 10088)
- Unicorn-62931.exe (PID: 10232)
- Unicorn-34259.exe (PID: 10136)
- Unicorn-45443.exe (PID: 10148)
- Unicorn-65043.exe (PID: 10168)
- Unicorn-17260.exe (PID: 10216)
- Unicorn-41956.exe (PID: 10348)
- Unicorn-27710.exe (PID: 10624)
- Unicorn-12473.exe (PID: 10368)
- Unicorn-46232.exe (PID: 10340)
- Unicorn-37767.exe (PID: 9988)
- Unicorn-50322.exe (PID: 10428)
- Unicorn-34643.exe (PID: 2084)
- Unicorn-23818.exe (PID: 10592)
- Unicorn-24764.exe (PID: 11148)
- Unicorn-9673.exe (PID: 10376)
- Unicorn-7258.exe (PID: 11228)
- Unicorn-65339.exe (PID: 11256)
- Unicorn-45739.exe (PID: 11236)
- Unicorn-41031.exe (PID: 10632)
- Unicorn-63440.exe (PID: 11364)
- Unicorn-29210.exe (PID: 2800)
- Unicorn-41682.exe (PID: 11436)
- Unicorn-58479.exe (PID: 11284)
- Unicorn-63419.exe (PID: 5800)
- Unicorn-41467.exe (PID: 11452)
- Unicorn-54679.exe (PID: 11716)
- Unicorn-50721.exe (PID: 11108)
- Unicorn-56595.exe (PID: 11632)
- Unicorn-42444.exe (PID: 11420)
- Unicorn-709.exe (PID: 11660)
- Unicorn-63446.exe (PID: 11652)
- Unicorn-52952.exe (PID: 12008)
- Unicorn-51951.exe (PID: 12580)
- Unicorn-48744.exe (PID: 12608)
- Unicorn-45879.exe (PID: 12112)
- Unicorn-21396.exe (PID: 12264)
- Unicorn-46184.exe (PID: 10696)
- Unicorn-11093.exe (PID: 12700)
- Unicorn-2407.exe (PID: 10760)
- Unicorn-50347.exe (PID: 12192)
- Unicorn-37540.exe (PID: 10808)
- Unicorn-42511.exe (PID: 7556)
- Unicorn-14727.exe (PID: 12372)
- Unicorn-57175.exe (PID: 10748)
- Unicorn-16661.exe (PID: 11780)
- Unicorn-52360.exe (PID: 12476)
- Unicorn-47519.exe (PID: 12492)
- Unicorn-39578.exe (PID: 10764)
- Unicorn-16958.exe (PID: 12764)
- Unicorn-3358.exe (PID: 12468)
- Unicorn-32600.exe (PID: 12572)
- Unicorn-21993.exe (PID: 12812)
- Unicorn-8022.exe (PID: 12524)
- Unicorn-22007.exe (PID: 10724)
- Unicorn-762.exe (PID: 12072)
- Unicorn-27918.exe (PID: 12500)
- Unicorn-23399.exe (PID: 12444)
- Unicorn-51432.exe (PID: 13744)
- Unicorn-24659.exe (PID: 13680)
- Unicorn-39232.exe (PID: 13012)
- Unicorn-13824.exe (PID: 12832)
- Unicorn-61254.exe (PID: 13404)
- Unicorn-63174.exe (PID: 14332)
- Unicorn-49439.exe (PID: 1280)
- Unicorn-13523.exe (PID: 12972)
- Unicorn-36484.exe (PID: 14088)
- Unicorn-2998.exe (PID: 13556)
- Unicorn-24759.exe (PID: 14048)
- Unicorn-49228.exe (PID: 14056)
- Unicorn-6897.exe (PID: 13696)
- Unicorn-54622.exe (PID: 13704)
- Unicorn-57305.exe (PID: 14172)
- Unicorn-6027.exe (PID: 13728)
- Unicorn-35907.exe (PID: 14152)
- Unicorn-21425.exe (PID: 14188)
- Unicorn-38395.exe (PID: 13500)
- Unicorn-25628.exe (PID: 14204)
- Unicorn-7533.exe (PID: 13944)
- Unicorn-6027.exe (PID: 14464)
- Unicorn-18366.exe (PID: 14512)
- Unicorn-24422.exe (PID: 14712)
- Unicorn-24232.exe (PID: 14552)
- Unicorn-54792.exe (PID: 14684)
- Unicorn-10874.exe (PID: 6940)
- Unicorn-49439.exe (PID: 4056)
- Unicorn-43838.exe (PID: 14288)
- Unicorn-49055.exe (PID: 6980)
- Unicorn-63174.exe (PID: 13540)
- Unicorn-16962.exe (PID: 1184)
- Unicorn-24232.exe (PID: 14568)
- Unicorn-65041.exe (PID: 14788)
- Unicorn-41767.exe (PID: 14892)
- Unicorn-26116.exe (PID: 14936)
- Unicorn-54844.exe (PID: 15000)
- Unicorn-24858.exe (PID: 15752)
- Unicorn-14895.exe (PID: 15024)
- Unicorn-19762.exe (PID: 14236)
- Unicorn-1195.exe (PID: 14408)
- Unicorn-9918.exe (PID: 15348)
- Unicorn-15566.exe (PID: 14612)
- Unicorn-4844.exe (PID: 15544)
- Unicorn-9224.exe (PID: 15400)
- Unicorn-25836.exe (PID: 15728)
Creates files or folders in the user directory
- WerFault.exe (PID: 2564)
- BackgroundTransferHost.exe (PID: 7284)
- WerFault.exe (PID: 8344)
- WerFault.exe (PID: 4008)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 4068)
- BackgroundTransferHost.exe (PID: 7284)
- BackgroundTransferHost.exe (PID: 7908)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 7284)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 7284)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
662
Monitored processes
523
Malicious processes
74
Suspicious processes
69
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 516 | C:\Users\admin\AppData\Local\Temp\Unicorn-5536.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5536.exe | Unicorn-63631.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Exit code: 0 Version: 1.00 Modules
| |||||||||||||||
| 644 | C:\Users\admin\AppData\Local\Temp\Unicorn-62028.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-62028.exe | Unicorn-2562.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 664 | C:\Users\admin\AppData\Local\Temp\Unicorn-5338.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5338.exe | 1 (1233).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 672 | C:\Users\admin\AppData\Local\Temp\Unicorn-60699.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-60699.exe | Unicorn-3548.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 680 | C:\Users\admin\AppData\Local\Temp\Unicorn-8042.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8042.exe | Unicorn-51348.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 736 | C:\Users\admin\AppData\Local\Temp\Unicorn-46003.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46003.exe | Unicorn-48961.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 856 | C:\Users\admin\AppData\Local\Temp\Unicorn-22789.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-22789.exe | Unicorn-5338.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 920 | C:\Users\admin\AppData\Local\Temp\Unicorn-51208.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-51208.exe | Unicorn-48386.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 960 | C:\Users\admin\AppData\Local\Temp\Unicorn-60163.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-60163.exe | — | Unicorn-42650.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 | |||||||||||||||
| 1040 | C:\Users\admin\AppData\Local\Temp\Unicorn-8499.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8499.exe | Unicorn-56179.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
18 379
Read events
18 364
Write events
15
Delete events
0
Modification events
| (PID) Process: | (4068) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4068) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4068) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7284) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7284) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7284) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7480) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7480) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7480) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7700) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
710
Suspicious files
14
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2564 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Unicorn-29288.ex_177f95ff516a3ec8cee23b47631d9ae6a66c68_b40444e3_b903e859-3810-4456-a5ea-fd9647aa4cf9\Report.wer | — | |
MD5:— | SHA256:— | |||
| 5048 | 1 (1233).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8897.exe | executable | |
MD5:EFA7AA1C6D0F64CDA29AF26D90C1E3D2 | SHA256:A07A80C1783D77137EAAD31E27FCFD56C10A37D03F44E257F0B39D077E22DB45 | |||
| 2564 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC97.tmp.WERInternalMetadata.xml | binary | |
MD5:0B28662C5E64B7F5903C67FDC9768152 | SHA256:A49B096E163C510E077F987077D8466A111BCD585A9EDE00B1E44150D7F28C3E | |||
| 6372 | Unicorn-3548.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-29288.exe | executable | |
MD5:57D69C7AE5B5674DA4DD5FAA41BC8A5D | SHA256:052CAFC378073D30EB3D637FEC0E269A0EE93301B100DB07B1857CBED77DCA55 | |||
| 2564 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WERDCC7.tmp.xml | xml | |
MD5:2361D76171FDE410F35F91142A0659C5 | SHA256:24A1F825F67B06DFA4BF1DA218FD5EBCFA442F7DDC3D7311855EC0C3D62C1722 | |||
| 6372 | Unicorn-3548.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-60699.exe | executable | |
MD5:CC88A8B4489AF41B3EC05123F0FAD642 | SHA256:EC0169645102BF233724F79AFF32E23ABAF13CDC350F78B353DB47E2AB2646B9 | |||
| 5048 | 1 (1233).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5338.exe | executable | |
MD5:77908B21E7BC16DA62500B272D261F65 | SHA256:D7C88E8C7CE9B28DD813184A01D086AA2D57D16AB5FBB613F5E70192B473BEBF | |||
| 664 | Unicorn-5338.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-48961.exe | executable | |
MD5:C5C5A4FB830F5721F368E80B8554283D | SHA256:AB4ABABCE1A9877B62BC585D195355F94812E6D5B94890F4EB02A80958F082D2 | |||
| 5048 | 1 (1233).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3548.exe | executable | |
MD5:5B52A8C0264CDE7123AC2EE3881B06B5 | SHA256:B9227A526124A9595CFAAA0A8A527772A8E488018280D459937016ED6CA401C3 | |||
| 6652 | Unicorn-48961.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-27036.exe | executable | |
MD5:5D6C034283F15CCAA4AC5D593DD04F8C | SHA256:E34C3EB2585003012439088B39DCADE77AEADCCD57E082B8E24C215997AF7FBD | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
18
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.16.164.130:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
7284 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4224 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
7436 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7436 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 2.16.164.130:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 40.126.31.71:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
2104 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4224 | backgroundTaskHost.exe | 20.223.35.26:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4224 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |