| File name: | 1 (1196) |
| Full analysis: | https://app.any.run/tasks/c900f69e-e759-4faa-9da0-3f2ea6570ba7 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 11:33:26 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | A15FED82B2AEEFAE4F23D4852FD8C2E0 |
| SHA1: | 5D8090780A189EBEFE0DE2C496B864C9AF2BB79A |
| SHA256: | FBA858E10987175211607A34FFD703840FBD8CF1BD8FC0ADDA4AF01F5D40A6A4 |
| SSDEEP: | 6144:5DIElUIYQD08A5cEKWeURT6x5t3qlp8GBV/2yeZIKk/8SwjwpyAvEhfe75r6vQ+a:5cMDw8A5DKp53M+aVuyeZIqx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- 1 (1196).exe (PID: 7320)
- Unicorn-14992.exe (PID: 7440)
- Unicorn-37385.exe (PID: 7408)
- Unicorn-20961.exe (PID: 8100)
- Unicorn-53825.exe (PID: 2564)
- Unicorn-23523.exe (PID: 7464)
- Unicorn-17431.exe (PID: 8128)
- Unicorn-47695.exe (PID: 8184)
- Unicorn-22471.exe (PID: 7212)
- Unicorn-4956.exe (PID: 7208)
- Unicorn-53560.exe (PID: 6044)
- Unicorn-59995.exe (PID: 5176)
- Unicorn-59995.exe (PID: 6372)
- Unicorn-6445.exe (PID: 4628)
- Unicorn-52382.exe (PID: 4024)
- Unicorn-53865.exe (PID: 5772)
- Unicorn-3057.exe (PID: 4892)
- Unicorn-28714.exe (PID: 5728)
- Unicorn-22583.exe (PID: 1324)
- Unicorn-11884.exe (PID: 5720)
- Unicorn-24691.exe (PID: 3180)
- Unicorn-6435.exe (PID: 5124)
- Unicorn-55522.exe (PID: 3784)
- Unicorn-5444.exe (PID: 1568)
- Unicorn-50561.exe (PID: 7504)
- Unicorn-33384.exe (PID: 7744)
- Unicorn-49607.exe (PID: 2040)
- Unicorn-9891.exe (PID: 4188)
- Unicorn-55230.exe (PID: 7496)
- Unicorn-5252.exe (PID: 7644)
- Unicorn-7836.exe (PID: 7848)
- Unicorn-29757.exe (PID: 6752)
- Unicorn-16418.exe (PID: 5112)
- Unicorn-57146.exe (PID: 6592)
- Unicorn-37816.exe (PID: 8032)
- Unicorn-22339.exe (PID: 5380)
- Unicorn-16820.exe (PID: 6456)
- Unicorn-1635.exe (PID: 6632)
- Unicorn-33622.exe (PID: 780)
- Unicorn-15637.exe (PID: 7156)
- Unicorn-32527.exe (PID: 2136)
- Unicorn-1853.exe (PID: 7772)
- Unicorn-41677.exe (PID: 4108)
- Unicorn-56867.exe (PID: 2772)
- Unicorn-50857.exe (PID: 3956)
- Unicorn-9736.exe (PID: 1096)
- Unicorn-57784.exe (PID: 7460)
- Unicorn-4344.exe (PID: 5048)
- Unicorn-25881.exe (PID: 4776)
- Unicorn-30650.exe (PID: 6712)
- Unicorn-30650.exe (PID: 672)
- Unicorn-29965.exe (PID: 1276)
- Unicorn-63000.exe (PID: 8152)
- Unicorn-51537.exe (PID: 8216)
- Unicorn-49679.exe (PID: 2192)
- Unicorn-7489.exe (PID: 8236)
- Unicorn-51345.exe (PID: 8416)
- Unicorn-5443.exe (PID: 1452)
- Unicorn-40966.exe (PID: 4268)
- Unicorn-30852.exe (PID: 4488)
- Unicorn-1822.exe (PID: 8352)
- Unicorn-27702.exe (PID: 7688)
- Unicorn-7489.exe (PID: 8232)
- Unicorn-22549.exe (PID: 5024)
- Unicorn-20536.exe (PID: 1132)
- Unicorn-38636.exe (PID: 8468)
- Unicorn-6783.exe (PID: 8432)
- Unicorn-6591.exe (PID: 8504)
- Unicorn-35886.exe (PID: 8336)
- Unicorn-42415.exe (PID: 8388)
- Unicorn-43773.exe (PID: 7884)
- Unicorn-16426.exe (PID: 8524)
- Unicorn-11473.exe (PID: 8344)
- Unicorn-13227.exe (PID: 8424)
- Unicorn-63275.exe (PID: 8360)
- Unicorn-35101.exe (PID: 3768)
- Unicorn-17394.exe (PID: 8548)
- Unicorn-12019.exe (PID: 8556)
- Unicorn-28024.exe (PID: 8060)
- Unicorn-55237.exe (PID: 8476)
- Unicorn-57266.exe (PID: 8628)
- Unicorn-2912.exe (PID: 8592)
- Unicorn-47929.exe (PID: 8600)
- Unicorn-11536.exe (PID: 6048)
- Unicorn-16426.exe (PID: 8532)
- Unicorn-51537.exe (PID: 8208)
- Unicorn-8158.exe (PID: 8064)
- Unicorn-674.exe (PID: 8736)
- Unicorn-61241.exe (PID: 8836)
- Unicorn-19057.exe (PID: 8772)
- Unicorn-36139.exe (PID: 8816)
- Unicorn-39669.exe (PID: 8776)
- Unicorn-12403.exe (PID: 8852)
- Unicorn-4007.exe (PID: 7928)
- Unicorn-748.exe (PID: 9008)
- Unicorn-482.exe (PID: 8812)
- Unicorn-32881.exe (PID: 8828)
- Unicorn-20783.exe (PID: 8956)
- Unicorn-30982.exe (PID: 8860)
- Unicorn-51848.exe (PID: 9036)
- Unicorn-1900.exe (PID: 9076)
- Unicorn-34551.exe (PID: 8976)
- Unicorn-52815.exe (PID: 9096)
- Unicorn-31989.exe (PID: 9188)
- Unicorn-24172.exe (PID: 7856)
- Unicorn-60385.exe (PID: 9204)
- Unicorn-4723.exe (PID: 7932)
- Unicorn-4360.exe (PID: 8652)
- Unicorn-51537.exe (PID: 8224)
- Unicorn-49285.exe (PID: 8712)
Executable content was dropped or overwritten
- Unicorn-37385.exe (PID: 7408)
- 1 (1196).exe (PID: 7320)
- Unicorn-14992.exe (PID: 7440)
- Unicorn-23523.exe (PID: 7464)
- Unicorn-20961.exe (PID: 8100)
- Unicorn-17431.exe (PID: 8128)
- Unicorn-22471.exe (PID: 7212)
- Unicorn-53825.exe (PID: 2564)
- Unicorn-53560.exe (PID: 6044)
- Unicorn-4956.exe (PID: 7208)
- Unicorn-59995.exe (PID: 5176)
- Unicorn-59995.exe (PID: 6372)
- Unicorn-6445.exe (PID: 4628)
- Unicorn-52382.exe (PID: 4024)
- Unicorn-47695.exe (PID: 8184)
- Unicorn-53865.exe (PID: 5772)
- Unicorn-3057.exe (PID: 4892)
- Unicorn-6435.exe (PID: 5124)
- Unicorn-22583.exe (PID: 1324)
- Unicorn-11884.exe (PID: 5720)
- Unicorn-24691.exe (PID: 3180)
- Unicorn-50561.exe (PID: 7504)
- Unicorn-55522.exe (PID: 3784)
- Unicorn-5444.exe (PID: 1568)
- Unicorn-33384.exe (PID: 7744)
- Unicorn-49607.exe (PID: 2040)
- Unicorn-9891.exe (PID: 4188)
- Unicorn-29757.exe (PID: 6752)
- Unicorn-57146.exe (PID: 6592)
- Unicorn-5252.exe (PID: 7644)
- Unicorn-55230.exe (PID: 7496)
- Unicorn-1853.exe (PID: 7772)
- Unicorn-27702.exe (PID: 7688)
- Unicorn-24172.exe (PID: 7856)
- Unicorn-37816.exe (PID: 8032)
- Unicorn-28714.exe (PID: 5728)
- Unicorn-22339.exe (PID: 5380)
- Unicorn-16820.exe (PID: 6456)
- Unicorn-50857.exe (PID: 3956)
- Unicorn-28024.exe (PID: 8060)
- Unicorn-1635.exe (PID: 6632)
- Unicorn-15637.exe (PID: 7156)
- Unicorn-32527.exe (PID: 2136)
- Unicorn-4344.exe (PID: 5048)
- Unicorn-41677.exe (PID: 4108)
- Unicorn-56867.exe (PID: 2772)
- Unicorn-9736.exe (PID: 1096)
- Unicorn-57784.exe (PID: 7460)
- Unicorn-25881.exe (PID: 4776)
- Unicorn-29965.exe (PID: 1276)
- Unicorn-30650.exe (PID: 672)
- Unicorn-30650.exe (PID: 6712)
- Unicorn-7836.exe (PID: 7848)
- Unicorn-49679.exe (PID: 2192)
- Unicorn-63000.exe (PID: 8152)
- Unicorn-51537.exe (PID: 8208)
- Unicorn-51345.exe (PID: 8416)
- Unicorn-51537.exe (PID: 8216)
- Unicorn-7489.exe (PID: 8232)
- Unicorn-5443.exe (PID: 1452)
- Unicorn-1822.exe (PID: 8352)
- Unicorn-20536.exe (PID: 1132)
- Unicorn-6591.exe (PID: 8504)
- Unicorn-38636.exe (PID: 8468)
- Unicorn-42415.exe (PID: 8388)
- Unicorn-43773.exe (PID: 7884)
- Unicorn-11251.exe (PID: 7228)
- Unicorn-11473.exe (PID: 8344)
- Unicorn-16418.exe (PID: 5112)
- Unicorn-13227.exe (PID: 8424)
- Unicorn-51537.exe (PID: 8224)
- Unicorn-17394.exe (PID: 8548)
- Unicorn-35101.exe (PID: 3768)
- Unicorn-22549.exe (PID: 5024)
- Unicorn-55237.exe (PID: 8476)
- Unicorn-57266.exe (PID: 8628)
- Unicorn-2912.exe (PID: 8592)
- Unicorn-47929.exe (PID: 8600)
- Unicorn-11536.exe (PID: 6048)
- Unicorn-33622.exe (PID: 780)
- Unicorn-63275.exe (PID: 8360)
- Unicorn-16426.exe (PID: 8532)
- Unicorn-8158.exe (PID: 8064)
- Unicorn-48392.exe (PID: 8740)
- Unicorn-674.exe (PID: 8736)
- Unicorn-8703.exe (PID: 8844)
- Unicorn-16810.exe (PID: 8884)
- Unicorn-19057.exe (PID: 8772)
- Unicorn-62564.exe (PID: 8804)
- Unicorn-61241.exe (PID: 8836)
- Unicorn-36139.exe (PID: 8816)
- Unicorn-12403.exe (PID: 8852)
- Unicorn-482.exe (PID: 8812)
- Unicorn-748.exe (PID: 9008)
- Unicorn-20783.exe (PID: 8956)
- Unicorn-32881.exe (PID: 8828)
- Unicorn-30982.exe (PID: 8860)
- Unicorn-35886.exe (PID: 8336)
- Unicorn-6783.exe (PID: 8432)
- Unicorn-12019.exe (PID: 8556)
- Unicorn-51848.exe (PID: 9036)
- Unicorn-1900.exe (PID: 9076)
- Unicorn-34551.exe (PID: 8976)
- Unicorn-52815.exe (PID: 9096)
- Unicorn-31989.exe (PID: 9188)
- Unicorn-7489.exe (PID: 8236)
- Unicorn-30852.exe (PID: 4488)
- Unicorn-4360.exe (PID: 8652)
- Unicorn-60385.exe (PID: 9204)
- Unicorn-4723.exe (PID: 7932)
- Unicorn-21251.exe (PID: 8688)
- Unicorn-45585.exe (PID: 2088)
- Unicorn-30593.exe (PID: 9268)
- Unicorn-30593.exe (PID: 9260)
- Unicorn-34188.exe (PID: 7988)
- Unicorn-61106.exe (PID: 9056)
- Unicorn-45585.exe (PID: 8112)
- Unicorn-48007.exe (PID: 1748)
- Unicorn-8060.exe (PID: 7268)
- Unicorn-49285.exe (PID: 8712)
- Unicorn-16426.exe (PID: 8524)
- Unicorn-63073.exe (PID: 9324)
- Unicorn-43447.exe (PID: 7864)
- Unicorn-54905.exe (PID: 9308)
- Unicorn-58989.exe (PID: 9316)
- Unicorn-34847.exe (PID: 9468)
- Unicorn-10748.exe (PID: 9704)
- Unicorn-24462.exe (PID: 9276)
- Unicorn-56559.exe (PID: 9556)
- Unicorn-1729.exe (PID: 9132)
- Unicorn-35170.exe (PID: 9504)
- Unicorn-2580.exe (PID: 9664)
- Unicorn-9980.exe (PID: 4724)
- Unicorn-36130.exe (PID: 9852)
- Unicorn-14811.exe (PID: 9392)
- Unicorn-40966.exe (PID: 4268)
- Unicorn-63628.exe (PID: 9348)
- Unicorn-4007.exe (PID: 7928)
- Unicorn-63628.exe (PID: 9340)
- Unicorn-55865.exe (PID: 9648)
- Unicorn-42823.exe (PID: 9548)
- Unicorn-27639.exe (PID: 9904)
- Unicorn-9404.exe (PID: 9608)
- Unicorn-45346.exe (PID: 9460)
- Unicorn-35170.exe (PID: 9500)
- Unicorn-50821.exe (PID: 9436)
- Unicorn-9404.exe (PID: 9680)
- Unicorn-63841.exe (PID: 9836)
- Unicorn-43229.exe (PID: 9984)
- Unicorn-22238.exe (PID: 9884)
- Unicorn-4618.exe (PID: 9696)
- Unicorn-26239.exe (PID: 9452)
- Unicorn-47048.exe (PID: 10020)
- Unicorn-3327.exe (PID: 9720)
- Unicorn-45591.exe (PID: 9524)
- Unicorn-59565.exe (PID: 9924)
- Unicorn-3566.exe (PID: 9484)
- Unicorn-35999.exe (PID: 9640)
- Unicorn-39669.exe (PID: 8776)
- Unicorn-23577.exe (PID: 3968)
- Unicorn-29314.exe (PID: 9752)
- Unicorn-36130.exe (PID: 9860)
- Unicorn-46351.exe (PID: 9948)
- Unicorn-62755.exe (PID: 10140)
- Unicorn-50940.exe (PID: 10120)
- Unicorn-62371.exe (PID: 10220)
- Unicorn-52720.exe (PID: 10236)
- Unicorn-30977.exe (PID: 9976)
- Unicorn-46353.exe (PID: 9616)
- Unicorn-54521.exe (PID: 9532)
- Unicorn-63457.exe (PID: 10036)
- Unicorn-61603.exe (PID: 9940)
- Unicorn-34905.exe (PID: 9476)
- Unicorn-53872.exe (PID: 6564)
- Unicorn-59876.exe (PID: 5624)
- Unicorn-43924.exe (PID: 10200)
- Unicorn-23312.exe (PID: 9972)
- Unicorn-35170.exe (PID: 9516)
- Unicorn-61848.exe (PID: 10268)
- Unicorn-3711.exe (PID: 2416)
- Unicorn-16347.exe (PID: 10164)
- Unicorn-33368.exe (PID: 10160)
INFO
Reads the computer name
- 1 (1196).exe (PID: 7320)
- Unicorn-37385.exe (PID: 7408)
- Unicorn-14992.exe (PID: 7440)
- Unicorn-23523.exe (PID: 7464)
- Unicorn-20961.exe (PID: 8100)
- Unicorn-53825.exe (PID: 2564)
- Unicorn-47695.exe (PID: 8184)
- Unicorn-17431.exe (PID: 8128)
- Unicorn-22471.exe (PID: 7212)
- Unicorn-53560.exe (PID: 6044)
- Unicorn-4956.exe (PID: 7208)
- Unicorn-59995.exe (PID: 5176)
- Unicorn-59995.exe (PID: 6372)
- Unicorn-6445.exe (PID: 4628)
- Unicorn-3057.exe (PID: 4892)
- Unicorn-6435.exe (PID: 5124)
- Unicorn-53865.exe (PID: 5772)
- Unicorn-52382.exe (PID: 4024)
- Unicorn-22583.exe (PID: 1324)
- Unicorn-28714.exe (PID: 5728)
- Unicorn-11884.exe (PID: 5720)
- Unicorn-24691.exe (PID: 3180)
- Unicorn-55522.exe (PID: 3784)
- Unicorn-50561.exe (PID: 7504)
- Unicorn-5444.exe (PID: 1568)
- Unicorn-49607.exe (PID: 2040)
- Unicorn-11536.exe (PID: 6048)
- Unicorn-16418.exe (PID: 5112)
- Unicorn-9891.exe (PID: 4188)
- Unicorn-57146.exe (PID: 6592)
- Unicorn-5252.exe (PID: 7644)
- Unicorn-55230.exe (PID: 7496)
- Unicorn-1853.exe (PID: 7772)
- Unicorn-43773.exe (PID: 7884)
- Unicorn-24172.exe (PID: 7856)
- Unicorn-16820.exe (PID: 6456)
- Unicorn-22339.exe (PID: 5380)
- Unicorn-33384.exe (PID: 7744)
- Unicorn-28024.exe (PID: 8060)
- Unicorn-50857.exe (PID: 3956)
- Unicorn-33622.exe (PID: 780)
- Unicorn-15637.exe (PID: 7156)
- Unicorn-32527.exe (PID: 2136)
- Unicorn-41677.exe (PID: 4108)
- Unicorn-8158.exe (PID: 8064)
- Unicorn-4344.exe (PID: 5048)
- Unicorn-9736.exe (PID: 1096)
- Unicorn-56867.exe (PID: 2772)
- Unicorn-57784.exe (PID: 7460)
- Unicorn-29965.exe (PID: 1276)
- Unicorn-30650.exe (PID: 6712)
- Unicorn-30650.exe (PID: 672)
- Unicorn-63000.exe (PID: 8152)
- Unicorn-51537.exe (PID: 8208)
- Unicorn-51537.exe (PID: 8216)
- Unicorn-4007.exe (PID: 7928)
- Unicorn-40966.exe (PID: 4268)
- Unicorn-1822.exe (PID: 8352)
- Unicorn-30852.exe (PID: 4488)
- Unicorn-7489.exe (PID: 8232)
- Unicorn-20536.exe (PID: 1132)
- Unicorn-6591.exe (PID: 8504)
- Unicorn-6783.exe (PID: 8432)
- Unicorn-35886.exe (PID: 8336)
- Unicorn-49679.exe (PID: 2192)
- Unicorn-51345.exe (PID: 8416)
- Unicorn-38636.exe (PID: 8468)
- Unicorn-13227.exe (PID: 8424)
- Unicorn-51537.exe (PID: 8224)
- Unicorn-63275.exe (PID: 8360)
- Unicorn-16426.exe (PID: 8524)
- Unicorn-35101.exe (PID: 3768)
- Unicorn-2912.exe (PID: 8592)
- Unicorn-12019.exe (PID: 8556)
- Unicorn-17394.exe (PID: 8548)
- Unicorn-16426.exe (PID: 8532)
- Unicorn-48392.exe (PID: 8740)
- Unicorn-674.exe (PID: 8736)
- Unicorn-16810.exe (PID: 8884)
- Unicorn-8703.exe (PID: 8844)
- Unicorn-61241.exe (PID: 8836)
- Unicorn-36139.exe (PID: 8816)
- Unicorn-12403.exe (PID: 8852)
- Unicorn-30982.exe (PID: 8860)
- Unicorn-1900.exe (PID: 9076)
- Unicorn-51848.exe (PID: 9036)
- Unicorn-34551.exe (PID: 8976)
- Unicorn-31989.exe (PID: 9188)
- Unicorn-49285.exe (PID: 8712)
- Unicorn-45585.exe (PID: 2088)
- Unicorn-61106.exe (PID: 9056)
- Unicorn-30593.exe (PID: 9268)
Create files in a temporary directory
- 1 (1196).exe (PID: 7320)
- Unicorn-37385.exe (PID: 7408)
- Unicorn-17431.exe (PID: 8128)
- Unicorn-53560.exe (PID: 6044)
- Unicorn-59995.exe (PID: 6372)
- Unicorn-6445.exe (PID: 4628)
- Unicorn-52382.exe (PID: 4024)
- Unicorn-53825.exe (PID: 2564)
- Unicorn-22471.exe (PID: 7212)
- Unicorn-23523.exe (PID: 7464)
- Unicorn-4956.exe (PID: 7208)
- Unicorn-11884.exe (PID: 5720)
- Unicorn-14992.exe (PID: 7440)
- Unicorn-24691.exe (PID: 3180)
- Unicorn-6435.exe (PID: 5124)
- Unicorn-55522.exe (PID: 3784)
- Unicorn-59995.exe (PID: 5176)
- Unicorn-50561.exe (PID: 7504)
- Unicorn-5444.exe (PID: 1568)
- Unicorn-33384.exe (PID: 7744)
- Unicorn-29757.exe (PID: 6752)
- Unicorn-1853.exe (PID: 7772)
- Unicorn-47695.exe (PID: 8184)
- Unicorn-5252.exe (PID: 7644)
- Unicorn-20961.exe (PID: 8100)
- Unicorn-37816.exe (PID: 8032)
- Unicorn-3057.exe (PID: 4892)
- Unicorn-28714.exe (PID: 5728)
- Unicorn-22583.exe (PID: 1324)
- Unicorn-1635.exe (PID: 6632)
- Unicorn-50857.exe (PID: 3956)
- Unicorn-15637.exe (PID: 7156)
- Unicorn-41677.exe (PID: 4108)
- Unicorn-4344.exe (PID: 5048)
- Unicorn-49607.exe (PID: 2040)
- Unicorn-56867.exe (PID: 2772)
- Unicorn-9736.exe (PID: 1096)
- Unicorn-57784.exe (PID: 7460)
- Unicorn-25881.exe (PID: 4776)
- Unicorn-30650.exe (PID: 672)
- Unicorn-29965.exe (PID: 1276)
- Unicorn-55230.exe (PID: 7496)
- Unicorn-49679.exe (PID: 2192)
- Unicorn-51537.exe (PID: 8208)
- Unicorn-51345.exe (PID: 8416)
- Unicorn-5443.exe (PID: 1452)
- Unicorn-53865.exe (PID: 5772)
- Unicorn-7489.exe (PID: 8232)
- Unicorn-24172.exe (PID: 7856)
- Unicorn-22339.exe (PID: 5380)
- Unicorn-38636.exe (PID: 8468)
- Unicorn-42415.exe (PID: 8388)
- Unicorn-11251.exe (PID: 7228)
- Unicorn-11473.exe (PID: 8344)
- Unicorn-51537.exe (PID: 8224)
- Unicorn-63275.exe (PID: 8360)
- Unicorn-35101.exe (PID: 3768)
- Unicorn-28024.exe (PID: 8060)
- Unicorn-47929.exe (PID: 8600)
- Unicorn-11536.exe (PID: 6048)
- Unicorn-16426.exe (PID: 8532)
- Unicorn-33622.exe (PID: 780)
- Unicorn-32527.exe (PID: 2136)
- Unicorn-9891.exe (PID: 4188)
- Unicorn-674.exe (PID: 8736)
- Unicorn-8703.exe (PID: 8844)
- Unicorn-16810.exe (PID: 8884)
- Unicorn-30650.exe (PID: 6712)
- Unicorn-7836.exe (PID: 7848)
- Unicorn-63000.exe (PID: 8152)
- Unicorn-61241.exe (PID: 8836)
- Unicorn-19057.exe (PID: 8772)
- Unicorn-62564.exe (PID: 8804)
- Unicorn-51537.exe (PID: 8216)
- Unicorn-36139.exe (PID: 8816)
- Unicorn-57146.exe (PID: 6592)
- Unicorn-1822.exe (PID: 8352)
- Unicorn-27702.exe (PID: 7688)
- Unicorn-482.exe (PID: 8812)
- Unicorn-20783.exe (PID: 8956)
- Unicorn-748.exe (PID: 9008)
- Unicorn-43773.exe (PID: 7884)
- Unicorn-6783.exe (PID: 8432)
- Unicorn-6591.exe (PID: 8504)
- Unicorn-35886.exe (PID: 8336)
- Unicorn-32881.exe (PID: 8828)
- Unicorn-17394.exe (PID: 8548)
- Unicorn-12019.exe (PID: 8556)
- Unicorn-55237.exe (PID: 8476)
- Unicorn-51848.exe (PID: 9036)
- Unicorn-57266.exe (PID: 8628)
- Unicorn-1900.exe (PID: 9076)
- Unicorn-34551.exe (PID: 8976)
- Unicorn-16820.exe (PID: 6456)
- Unicorn-52815.exe (PID: 9096)
- Unicorn-8158.exe (PID: 8064)
- Unicorn-7489.exe (PID: 8236)
- Unicorn-20536.exe (PID: 1132)
- Unicorn-4360.exe (PID: 8652)
- Unicorn-4723.exe (PID: 7932)
- Unicorn-8060.exe (PID: 7268)
- Unicorn-60385.exe (PID: 9204)
- Unicorn-16418.exe (PID: 5112)
- Unicorn-13227.exe (PID: 8424)
- Unicorn-49285.exe (PID: 8712)
- Unicorn-2912.exe (PID: 8592)
Checks supported languages
- 1 (1196).exe (PID: 7320)
- Unicorn-37385.exe (PID: 7408)
- Unicorn-23523.exe (PID: 7464)
- Unicorn-14992.exe (PID: 7440)
- Unicorn-20961.exe (PID: 8100)
- Unicorn-17431.exe (PID: 8128)
- Unicorn-53825.exe (PID: 2564)
- Unicorn-47695.exe (PID: 8184)
- Unicorn-53560.exe (PID: 6044)
- Unicorn-22471.exe (PID: 7212)
- Unicorn-4956.exe (PID: 7208)
- Unicorn-53865.exe (PID: 5772)
- Unicorn-3057.exe (PID: 4892)
- Unicorn-6435.exe (PID: 5124)
- Unicorn-59995.exe (PID: 5176)
- Unicorn-52382.exe (PID: 4024)
- Unicorn-22583.exe (PID: 1324)
- Unicorn-6445.exe (PID: 4628)
- Unicorn-59995.exe (PID: 6372)
- Unicorn-28714.exe (PID: 5728)
- Unicorn-24691.exe (PID: 3180)
- Unicorn-50561.exe (PID: 7504)
- Unicorn-55522.exe (PID: 3784)
- Unicorn-5444.exe (PID: 1568)
- Unicorn-11884.exe (PID: 5720)
- Unicorn-29757.exe (PID: 6752)
- Unicorn-9891.exe (PID: 4188)
- Unicorn-57146.exe (PID: 6592)
- Unicorn-49607.exe (PID: 2040)
- Unicorn-55230.exe (PID: 7496)
- Unicorn-5252.exe (PID: 7644)
- Unicorn-33384.exe (PID: 7744)
- Unicorn-11536.exe (PID: 6048)
- Unicorn-24172.exe (PID: 7856)
- Unicorn-27702.exe (PID: 7688)
- Unicorn-16418.exe (PID: 5112)
- Unicorn-1853.exe (PID: 7772)
- Unicorn-22549.exe (PID: 5024)
- Unicorn-37816.exe (PID: 8032)
- Unicorn-22339.exe (PID: 5380)
- Unicorn-16820.exe (PID: 6456)
- Unicorn-28024.exe (PID: 8060)
- Unicorn-8158.exe (PID: 8064)
- Unicorn-15637.exe (PID: 7156)
- Unicorn-32527.exe (PID: 2136)
- Unicorn-33622.exe (PID: 780)
- Unicorn-41677.exe (PID: 4108)
- Unicorn-4344.exe (PID: 5048)
- Unicorn-56867.exe (PID: 2772)
- Unicorn-9736.exe (PID: 1096)
- Unicorn-57784.exe (PID: 7460)
- Unicorn-14789.exe (PID: 864)
- Unicorn-29965.exe (PID: 1276)
- Unicorn-25881.exe (PID: 4776)
- Unicorn-63000.exe (PID: 8152)
- Unicorn-30650.exe (PID: 6712)
- Unicorn-30650.exe (PID: 672)
- Unicorn-49679.exe (PID: 2192)
- Unicorn-5443.exe (PID: 1452)
- Unicorn-40966.exe (PID: 4268)
- Unicorn-35101.exe (PID: 3768)
- Unicorn-11251.exe (PID: 7228)
- Unicorn-51537.exe (PID: 8224)
- Unicorn-51537.exe (PID: 8216)
- Unicorn-7489.exe (PID: 8232)
- Unicorn-20536.exe (PID: 1132)
- Unicorn-7489.exe (PID: 8236)
- Unicorn-4007.exe (PID: 7928)
- Unicorn-30852.exe (PID: 4488)
- Unicorn-11473.exe (PID: 8344)
- Unicorn-35886.exe (PID: 8336)
- Unicorn-1822.exe (PID: 8352)
- Unicorn-63275.exe (PID: 8360)
- Unicorn-42415.exe (PID: 8388)
- Unicorn-6783.exe (PID: 8432)
- Unicorn-51345.exe (PID: 8416)
- Unicorn-13227.exe (PID: 8424)
- Unicorn-6591.exe (PID: 8504)
- Unicorn-16426.exe (PID: 8524)
- Unicorn-17394.exe (PID: 8548)
- Unicorn-12019.exe (PID: 8556)
- Unicorn-47929.exe (PID: 8600)
- Unicorn-16426.exe (PID: 8532)
- Unicorn-57266.exe (PID: 8628)
- Unicorn-38636.exe (PID: 8468)
- Unicorn-55237.exe (PID: 8476)
- Unicorn-674.exe (PID: 8736)
- Unicorn-39669.exe (PID: 8776)
- Unicorn-19057.exe (PID: 8772)
- Unicorn-12403.exe (PID: 8852)
- Unicorn-30982.exe (PID: 8860)
- Unicorn-61241.exe (PID: 8836)
- Unicorn-482.exe (PID: 8812)
- Unicorn-16810.exe (PID: 8884)
- Unicorn-51848.exe (PID: 9036)
- Unicorn-34551.exe (PID: 8976)
- Unicorn-36139.exe (PID: 8816)
- Unicorn-8703.exe (PID: 8844)
- Unicorn-20783.exe (PID: 8956)
- Unicorn-1900.exe (PID: 9076)
- Unicorn-60385.exe (PID: 9204)
- Unicorn-4360.exe (PID: 8652)
- Unicorn-49285.exe (PID: 8712)
- Unicorn-4723.exe (PID: 7932)
- Unicorn-48007.exe (PID: 1748)
- Unicorn-61106.exe (PID: 9056)
- Unicorn-21251.exe (PID: 8688)
- Unicorn-8060.exe (PID: 7268)
- Unicorn-45585.exe (PID: 8112)
- Unicorn-1729.exe (PID: 9132)
- Unicorn-43447.exe (PID: 7864)
- Unicorn-30593.exe (PID: 9268)
- Unicorn-45585.exe (PID: 2088)
- Unicorn-9980.exe (PID: 4724)
- Unicorn-30593.exe (PID: 9260)
- Unicorn-63628.exe (PID: 9348)
- Unicorn-63073.exe (PID: 9324)
- Unicorn-63628.exe (PID: 9340)
- Unicorn-54905.exe (PID: 9308)
- Unicorn-14811.exe (PID: 9392)
- Unicorn-50821.exe (PID: 9436)
- Unicorn-45346.exe (PID: 9460)
- Unicorn-26239.exe (PID: 9452)
- Unicorn-35170.exe (PID: 9516)
- Unicorn-35170.exe (PID: 9500)
- Unicorn-56559.exe (PID: 9556)
- Unicorn-34847.exe (PID: 9468)
- Unicorn-45591.exe (PID: 9524)
- Unicorn-3566.exe (PID: 9484)
- Unicorn-54521.exe (PID: 9532)
- Unicorn-46353.exe (PID: 9616)
- Unicorn-9404.exe (PID: 9608)
- Unicorn-34905.exe (PID: 9476)
- Unicorn-55865.exe (PID: 9648)
- Unicorn-2580.exe (PID: 9664)
- Unicorn-35999.exe (PID: 9640)
- Unicorn-9404.exe (PID: 9680)
- Unicorn-35170.exe (PID: 9504)
- Unicorn-63841.exe (PID: 9836)
- Unicorn-36130.exe (PID: 9852)
- Unicorn-10748.exe (PID: 9704)
- Unicorn-4618.exe (PID: 9696)
- Unicorn-29314.exe (PID: 9752)
- Unicorn-22238.exe (PID: 9884)
- Unicorn-36130.exe (PID: 9860)
- Unicorn-59565.exe (PID: 9924)
- Unicorn-27639.exe (PID: 9904)
- Unicorn-61603.exe (PID: 9940)
- Unicorn-46351.exe (PID: 9948)
- Unicorn-30977.exe (PID: 9976)
- Unicorn-47048.exe (PID: 10020)
- Unicorn-50940.exe (PID: 10120)
- Unicorn-63457.exe (PID: 10036)
- Unicorn-62755.exe (PID: 10140)
- Unicorn-62371.exe (PID: 10220)
- Unicorn-52720.exe (PID: 10236)
- Unicorn-23577.exe (PID: 3968)
- Unicorn-23312.exe (PID: 9972)
- Unicorn-43924.exe (PID: 10200)
- Unicorn-64160.exe (PID: 10524)
- Unicorn-61848.exe (PID: 10268)
- Unicorn-6079.exe (PID: 10516)
- Unicorn-15587.exe (PID: 10548)
- Unicorn-32115.exe (PID: 10564)
- Unicorn-33368.exe (PID: 10160)
- Unicorn-59876.exe (PID: 5624)
- Unicorn-53872.exe (PID: 6564)
- Unicorn-5887.exe (PID: 10596)
- Unicorn-35567.exe (PID: 10616)
- Unicorn-18659.exe (PID: 10648)
- Unicorn-45851.exe (PID: 10580)
- Unicorn-45851.exe (PID: 10572)
- Unicorn-64596.exe (PID: 10640)
- Unicorn-32289.exe (PID: 10716)
- Unicorn-24632.exe (PID: 10632)
- Unicorn-58871.exe (PID: 10788)
- Unicorn-45851.exe (PID: 10588)
- Unicorn-56450.exe (PID: 10840)
- Unicorn-39795.exe (PID: 10928)
- Unicorn-47077.exe (PID: 11040)
- Unicorn-55992.exe (PID: 11060)
- Unicorn-63776.exe (PID: 11096)
- Unicorn-40859.exe (PID: 10808)
- Unicorn-47440.exe (PID: 11160)
- Unicorn-30165.exe (PID: 11184)
- Unicorn-1576.exe (PID: 11204)
- Unicorn-3283.exe (PID: 7312)
- Unicorn-2920.exe (PID: 11260)
- Unicorn-45415.exe (PID: 7780)
- Unicorn-45799.exe (PID: 5036)
- Unicorn-61943.exe (PID: 7812)
- Unicorn-41715.exe (PID: 11224)
- Unicorn-48592.exe (PID: 11252)
- Unicorn-65105.exe (PID: 11132)
- Unicorn-6163.exe (PID: 1300)
- Unicorn-19989.exe (PID: 10804)
- Unicorn-3823.exe (PID: 7964)
- Unicorn-44856.exe (PID: 7972)
- Unicorn-23497.exe (PID: 7828)
- Unicorn-64913.exe (PID: 7664)
- Unicorn-35749.exe (PID: 10100)
- Unicorn-15883.exe (PID: 7352)
- Unicorn-15883.exe (PID: 7356)
- Unicorn-35484.exe (PID: 7364)
- Unicorn-49537.exe (PID: 11308)
- Unicorn-13937.exe (PID: 7000)
- Unicorn-36116.exe (PID: 11300)
- Unicorn-13937.exe (PID: 11272)
- Unicorn-13937.exe (PID: 6392)
- Unicorn-35749.exe (PID: 10116)
- Unicorn-30962.exe (PID: 11292)
- Unicorn-22602.exe (PID: 11368)
- Unicorn-4320.exe (PID: 11384)
- Unicorn-32817.exe (PID: 11376)
- Unicorn-16158.exe (PID: 11416)
- Unicorn-41177.exe (PID: 11392)
- Unicorn-56122.exe (PID: 11400)
- Unicorn-43407.exe (PID: 11328)
- Unicorn-19395.exe (PID: 11440)
- Unicorn-12951.exe (PID: 11360)
- Unicorn-28733.exe (PID: 11484)
- Unicorn-35759.exe (PID: 11408)
- Unicorn-43023.exe (PID: 11548)
- Unicorn-38524.exe (PID: 11492)
- Unicorn-3267.exe (PID: 11472)
- Unicorn-9827.exe (PID: 11652)
- Unicorn-57512.exe (PID: 11624)
- Unicorn-29287.exe (PID: 11540)
- Unicorn-59329.exe (PID: 11340)
- Unicorn-48888.exe (PID: 11516)
- Unicorn-15394.exe (PID: 11632)
- Unicorn-62837.exe (PID: 11608)
- Unicorn-4591.exe (PID: 11588)
- Unicorn-4591.exe (PID: 11600)
- Unicorn-29287.exe (PID: 11660)
- Unicorn-50040.exe (PID: 11728)
- Unicorn-7663.exe (PID: 11556)
- Unicorn-31831.exe (PID: 11760)
- Unicorn-38524.exe (PID: 11496)
- Unicorn-50585.exe (PID: 11580)
- Unicorn-11965.exe (PID: 11772)
- Unicorn-25526.exe (PID: 11448)
- Unicorn-41905.exe (PID: 11720)
- Unicorn-62837.exe (PID: 11612)
- Unicorn-29287.exe (PID: 11524)
- Unicorn-37212.exe (PID: 11980)
- Unicorn-10734.exe (PID: 12088)
- Unicorn-43129.exe (PID: 11788)
- Unicorn-60.exe (PID: 11432)
- Unicorn-32193.exe (PID: 11796)
- Unicorn-43023.exe (PID: 11692)
- Unicorn-12210.exe (PID: 12024)
- Unicorn-57195.exe (PID: 12192)
- Unicorn-59604.exe (PID: 12244)
- Unicorn-58479.exe (PID: 12200)
- Unicorn-7802.exe (PID: 12228)
- Unicorn-33782.exe (PID: 12280)
- Unicorn-63133.exe (PID: 5608)
- Unicorn-29698.exe (PID: 12148)
- Unicorn-7802.exe (PID: 12236)
- Unicorn-52535.exe (PID: 12424)
- Unicorn-36391.exe (PID: 12320)
- Unicorn-48643.exe (PID: 12360)
- Unicorn-8998.exe (PID: 12868)
- Unicorn-13936.exe (PID: 12888)
- Unicorn-36391.exe (PID: 12324)
- Unicorn-17663.exe (PID: 12860)
- Unicorn-13936.exe (PID: 12928)
- Unicorn-1135.exe (PID: 12896)
- Unicorn-1135.exe (PID: 12912)
- Unicorn-1135.exe (PID: 12904)
- Unicorn-52639.exe (PID: 13012)
- Unicorn-21555.exe (PID: 12936)
- Unicorn-25135.exe (PID: 12988)
- Unicorn-51104.exe (PID: 13148)
- Unicorn-7157.exe (PID: 13044)
- Unicorn-33178.exe (PID: 13104)
- Unicorn-64914.exe (PID: 13020)
- Unicorn-26481.exe (PID: 13168)
- Unicorn-53215.exe (PID: 13188)
- Unicorn-15188.exe (PID: 13240)
- Unicorn-23887.exe (PID: 13212)
- Unicorn-7788.exe (PID: 5172)
- Unicorn-27944.exe (PID: 7636)
- Unicorn-28401.exe (PID: 5640)
The sample compiled with chinese language support
- 1 (1196).exe (PID: 7320)
- Unicorn-51537.exe (PID: 8216)
- Unicorn-16426.exe (PID: 8532)
- Unicorn-51537.exe (PID: 8208)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 3300)
- BackgroundTransferHost.exe (PID: 6676)
- BackgroundTransferHost.exe (PID: 8180)
- BackgroundTransferHost.exe (PID: 4724)
- BackgroundTransferHost.exe (PID: 10072)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 6676)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 6676)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 6676)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:20 00:32:00+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
458
Monitored processes
325
Malicious processes
52
Suspicious processes
38
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 672 | C:\Users\admin\AppData\Local\Temp\Unicorn-30650.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-30650.exe | Unicorn-7836.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 780 | C:\Users\admin\AppData\Local\Temp\Unicorn-33622.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-33622.exe | Unicorn-59995.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 864 | C:\Users\admin\AppData\Local\Temp\Unicorn-14789.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-14789.exe | — | Unicorn-53825.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1096 | C:\Users\admin\AppData\Local\Temp\Unicorn-9736.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9736.exe | Unicorn-9891.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1132 | C:\Users\admin\AppData\Local\Temp\Unicorn-20536.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20536.exe | Unicorn-16418.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1276 | C:\Users\admin\AppData\Local\Temp\Unicorn-29965.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-29965.exe | Unicorn-5252.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1300 | C:\Users\admin\AppData\Local\Temp\Unicorn-6163.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-6163.exe | — | Unicorn-52382.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1324 | C:\Users\admin\AppData\Local\Temp\Unicorn-22583.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-22583.exe | Unicorn-14992.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1452 | C:\Users\admin\AppData\Local\Temp\Unicorn-5443.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5443.exe | Unicorn-22471.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1568 | C:\Users\admin\AppData\Local\Temp\Unicorn-5444.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5444.exe | Unicorn-6445.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
8 347
Read events
8 332
Write events
15
Delete events
0
Modification events
| (PID) Process: | (3300) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (3300) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (3300) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6676) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6676) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6676) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (8180) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (8180) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (8180) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4724) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
864
Suspicious files
5
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7440 | Unicorn-14992.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20961.exe | executable | |
MD5:13351251AC32E4E54D28B4ECA561A60A | SHA256:5DA6A1FBDA3F8B5C76CEDC1D9844F14658E937923E16728A19BD5EBC9D8BD24C | |||
| 7320 | 1 (1196).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-47695.exe | executable | |
MD5:9C98A83837E12D720C8600DCCD486F2E | SHA256:73D18F171C43AE2FAB15FC1D75D24276E6D88FA77C6285885D364A240A9E4896 | |||
| 7408 | Unicorn-37385.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-17431.exe | executable | |
MD5:C81AD7A30F4E221438DEC213A3A672A6 | SHA256:59E7C16E33A23D81181DC301F16EBC9FD161793B4CCC491ADCC0FCCEA578D0AF | |||
| 2564 | Unicorn-53825.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-59995.exe | executable | |
MD5:681AF5F661919995333B94E23D7D08E0 | SHA256:CAC8F462A54421D73D1546750C1925132CF3870F4C0613C956843043528ACFF4 | |||
| 7320 | 1 (1196).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-37385.exe | executable | |
MD5:DE75F76B6D0C2807BB14B4A2CED9FC88 | SHA256:49B748540DF53C8B7AB3DEB1B6691340AF3FC97DDBC63980F14ECF9B5EFB0C25 | |||
| 7464 | Unicorn-23523.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-52382.exe | executable | |
MD5:38653B531D4C3C16A0CD479F660A7AC8 | SHA256:B982F3FFBA933E605547D5195FE898E2DF2A30445D4BA03BAB4F1B77636EF717 | |||
| 7320 | 1 (1196).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-23523.exe | executable | |
MD5:BB0D857F4231107F28EC66628A73E34B | SHA256:0932BE45EFC3100F6AD9EDD5929A98826CFB85B855DE57A07E98369E6E6F8E37 | |||
| 7408 | Unicorn-37385.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53865.exe | executable | |
MD5:09424155AC2543E4B7D14F1765D20C4A | SHA256:C9B82E9ABDB92D9BB867239955FABB79E4D1A36CC2D4824E1F5F0CB2C8DCDE48 | |||
| 8100 | Unicorn-20961.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-6435.exe | executable | |
MD5:5465372CFD9E6501C8D7DA69148C67A3 | SHA256:928FA2992A17C5306D9563AD24D4E1515FBEE73DF4C06F6BB08B0C24C29587A6 | |||
| 7408 | Unicorn-37385.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-14992.exe | executable | |
MD5:329BC10609D890335609FBD80CF1C1CF | SHA256:43089737F133308C6FC5BB1BB15AAB37A4D493215E1DE1619999472534B23690 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
27
DNS requests
16
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
7364 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.53.40.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6676 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
7996 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7996 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2104 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.53.40.176:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.159.68:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
4208 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2112 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
7364 | backgroundTaskHost.exe | 20.103.156.88:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |