| File name: | 002945eb40f7c7bc8739a7b1cf9932ead0c867b9dd2f24da7ad3b1f649d04cad |
| Full analysis: | https://app.any.run/tasks/76bbf513-4ec2-40f4-bba7-b5dea8892af0 |
| Verdict: | Malicious activity |
| Analysis date: | October 15, 2024, 13:32:43 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 4C5E49085FE494C129C95242ADDC51E0 |
| SHA1: | 957127540D93651578E21CFA73780853D1C1CA6E |
| SHA256: | 002945EB40F7C7BC8739A7B1CF9932EAD0C867B9DD2F24DA7AD3B1F649D04CAD |
| SSDEEP: | 3072:KCc51qc/pDjCV0KjikWN+y4A6ao8D7Cxfpfu4hQoLcBuIX:KCc51qcRDh2ZW2AjfWfpfu4hQoLcBuI |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- 002945eb40f7c7bc8739a7b1cf9932ead0c867b9dd2f24da7ad3b1f649d04cad.exe (PID: 6316)
- Unicorn-14530.exe (PID: 6400)
- Unicorn-49035.exe (PID: 4144)
- Unicorn-5890.exe (PID: 6180)
- Unicorn-56118.exe (PID: 2652)
- Unicorn-61619.exe (PID: 6776)
- Unicorn-43393.exe (PID: 7140)
- Unicorn-14058.exe (PID: 7088)
- Unicorn-57129.exe (PID: 7136)
- Unicorn-20181.exe (PID: 1952)
- Unicorn-14316.exe (PID: 1884)
- Unicorn-63918.exe (PID: 5172)
- Unicorn-58385.exe (PID: 1784)
- Unicorn-36783.exe (PID: 6396)
- Unicorn-36783.exe (PID: 2236)
- Unicorn-37337.exe (PID: 7120)
- Unicorn-10660.exe (PID: 2588)
- Unicorn-27759.exe (PID: 6680)
- Unicorn-21628.exe (PID: 1372)
- Unicorn-7893.exe (PID: 6696)
- Unicorn-31843.exe (PID: 3676)
- Unicorn-6113.exe (PID: 6336)
- Unicorn-40011.exe (PID: 5616)
- Unicorn-40011.exe (PID: 3764)
- Unicorn-11488.exe (PID: 6136)
- Unicorn-46378.exe (PID: 5652)
- Unicorn-22663.exe (PID: 6900)
- Unicorn-18387.exe (PID: 4792)
- Unicorn-14302.exe (PID: 6196)
- Unicorn-33571.exe (PID: 6028)
- Unicorn-14494.exe (PID: 6344)
- Unicorn-1453.exe (PID: 3108)
- Unicorn-33955.exe (PID: 6904)
- Unicorn-46021.exe (PID: 6260)
- Unicorn-26555.exe (PID: 6736)
- Unicorn-34723.exe (PID: 7176)
- Unicorn-26008.exe (PID: 7340)
- Unicorn-56989.exe (PID: 6132)
- Unicorn-19325.exe (PID: 1788)
- Unicorn-16969.exe (PID: 1172)
- Unicorn-57181.exe (PID: 7024)
- Unicorn-3358.exe (PID: 7392)
- Unicorn-44562.exe (PID: 7400)
- Unicorn-35574.exe (PID: 7440)
- Unicorn-57603.exe (PID: 7460)
- Unicorn-52175.exe (PID: 7424)
- Unicorn-36223.exe (PID: 7328)
- Unicorn-22575.exe (PID: 7640)
- Unicorn-60675.exe (PID: 7712)
- Unicorn-44339.exe (PID: 7768)
- Unicorn-52507.exe (PID: 7744)
- Unicorn-25401.exe (PID: 5984)
- Unicorn-33571.exe (PID: 5956)
- Unicorn-50602.exe (PID: 6992)
- Unicorn-60675.exe (PID: 7696)
- Unicorn-60675.exe (PID: 7704)
- Unicorn-56591.exe (PID: 7720)
- Unicorn-40255.exe (PID: 7792)
- Unicorn-39169.exe (PID: 7204)
- Unicorn-23919.exe (PID: 7848)
- Unicorn-53254.exe (PID: 7916)
- Unicorn-55506.exe (PID: 4676)
- Unicorn-23919.exe (PID: 7856)
- Unicorn-15751.exe (PID: 7892)
- Unicorn-43445.exe (PID: 6812)
- Unicorn-23919.exe (PID: 7872)
- Unicorn-15751.exe (PID: 7888)
- Unicorn-56591.exe (PID: 7728)
- Unicorn-7582.exe (PID: 7924)
- Unicorn-18387.exe (PID: 6420)
- Unicorn-31132.exe (PID: 8032)
- Unicorn-57146.exe (PID: 8140)
- Unicorn-20197.exe (PID: 8040)
- Unicorn-15293.exe (PID: 8132)
- Unicorn-61230.exe (PID: 8156)
- Unicorn-12029.exe (PID: 8056)
- Unicorn-61230.exe (PID: 8164)
- Unicorn-11209.exe (PID: 8148)
- Unicorn-53275.exe (PID: 8264)
- Unicorn-9428.exe (PID: 8124)
- Unicorn-31132.exe (PID: 8100)
- Unicorn-13512.exe (PID: 7096)
- Unicorn-9834.exe (PID: 6428)
- Unicorn-39798.exe (PID: 8024)
- Unicorn-60431.exe (PID: 6480)
- Unicorn-49191.exe (PID: 8272)
- Unicorn-16917.exe (PID: 4040)
- Unicorn-20197.exe (PID: 8064)
- Unicorn-8350.exe (PID: 8340)
- Unicorn-57167.exe (PID: 8388)
- Unicorn-29133.exe (PID: 8416)
- Unicorn-61251.exe (PID: 8380)
- Unicorn-36747.exe (PID: 8460)
- Unicorn-38785.exe (PID: 8436)
- Unicorn-23732.exe (PID: 8468)
- Unicorn-12797.exe (PID: 8476)
- Unicorn-32590.exe (PID: 8300)
- Unicorn-4821.exe (PID: 8320)
- Unicorn-42693.exe (PID: 8772)
- Unicorn-64878.exe (PID: 8564)
- Unicorn-12242.exe (PID: 8528)
- Unicorn-63533.exe (PID: 7496)
- Unicorn-21719.exe (PID: 8708)
- Unicorn-3306.exe (PID: 7660)
- Unicorn-23919.exe (PID: 7864)
- Unicorn-10374.exe (PID: 4032)
- Unicorn-64567.exe (PID: 7936)
- Unicorn-545.exe (PID: 8508)
- Unicorn-1630.exe (PID: 2132)
- Unicorn-27479.exe (PID: 1112)
- Unicorn-43986.exe (PID: 9228)
- Unicorn-31371.exe (PID: 9116)
- Unicorn-15397.exe (PID: 9276)
- Unicorn-46747.exe (PID: 8544)
- Unicorn-44370.exe (PID: 3524)
- Unicorn-64598.exe (PID: 9292)
- Unicorn-32849.exe (PID: 9364)
- Unicorn-2782.exe (PID: 9220)
- Unicorn-64406.exe (PID: 9336)
- Unicorn-23373.exe (PID: 9312)
- Unicorn-44355.exe (PID: 9464)
- Unicorn-65522.exe (PID: 9492)
- Unicorn-23395.exe (PID: 6148)
- Unicorn-43431.exe (PID: 9256)
- Unicorn-56799.exe (PID: 9524)
- Unicorn-61246.exe (PID: 9576)
- Unicorn-36741.exe (PID: 9624)
- Unicorn-23743.exe (PID: 9560)
- Unicorn-7214.exe (PID: 9660)
- Unicorn-56970.exe (PID: 9644)
- Unicorn-17281.exe (PID: 9708)
- Unicorn-21173.exe (PID: 9728)
- Unicorn-4282.exe (PID: 9792)
- Unicorn-4282.exe (PID: 9784)
- Unicorn-7982.exe (PID: 9920)
- Unicorn-6.exe (PID: 9824)
- Unicorn-16151.exe (PID: 9868)
- Unicorn-61267.exe (PID: 9984)
- Unicorn-18188.exe (PID: 9848)
- Unicorn-4453.exe (PID: 9840)
- Unicorn-12066.exe (PID: 9908)
- Unicorn-3898.exe (PID: 9944)
- Unicorn-54251.exe (PID: 10036)
- Unicorn-24319.exe (PID: 9856)
- Unicorn-34193.exe (PID: 10148)
- Unicorn-13410.exe (PID: 10132)
- Unicorn-56289.exe (PID: 10212)
- Unicorn-41999.exe (PID: 10100)
- Unicorn-39569.exe (PID: 9620)
- Unicorn-37266.exe (PID: 9168)
- Unicorn-29098.exe (PID: 9080)
- Unicorn-23232.exe (PID: 9208)
- Unicorn-63830.exe (PID: 860)
- Unicorn-49213.exe (PID: 10252)
- Unicorn-60373.exe (PID: 10188)
- Unicorn-54019.exe (PID: 10204)
- Unicorn-60181.exe (PID: 9096)
- Unicorn-43653.exe (PID: 10236)
- Unicorn-12761.exe (PID: 7740)
- Unicorn-4096.exe (PID: 9640)
- Unicorn-6896.exe (PID: 9816)
- Unicorn-774.exe (PID: 9132)
- Unicorn-25087.exe (PID: 10328)
- Unicorn-53098.exe (PID: 9556)
- Unicorn-62035.exe (PID: 10416)
- Unicorn-23232.exe (PID: 9440)
- Unicorn-62227.exe (PID: 10156)
- Unicorn-21195.exe (PID: 6124)
- Unicorn-46851.exe (PID: 10484)
- Unicorn-44356.exe (PID: 10368)
- Unicorn-50935.exe (PID: 10456)
- Unicorn-57951.exe (PID: 10440)
- Unicorn-8750.exe (PID: 10376)
- Unicorn-6010.exe (PID: 10548)
- Unicorn-26431.exe (PID: 10524)
- Unicorn-63379.exe (PID: 10564)
- Unicorn-6373.exe (PID: 10656)
- Unicorn-36445.exe (PID: 10628)
- Unicorn-15574.exe (PID: 9584)
- Unicorn-20197.exe (PID: 8044)
- Unicorn-50365.exe (PID: 10588)
- Unicorn-33950.exe (PID: 10772)
- Unicorn-52973.exe (PID: 10696)
- Unicorn-36768.exe (PID: 9684)
- Unicorn-34961.exe (PID: 10596)
- Unicorn-28084.exe (PID: 10780)
- Unicorn-30685.exe (PID: 10704)
- Unicorn-38060.exe (PID: 8808)
- Unicorn-8749.exe (PID: 10788)
- Unicorn-30685.exe (PID: 10712)
- Unicorn-25449.exe (PID: 9688)
- Unicorn-8948.exe (PID: 10812)
- Unicorn-63550.exe (PID: 10824)
- Unicorn-39237.exe (PID: 10688)
- Unicorn-50167.exe (PID: 10052)
- Unicorn-12066.exe (PID: 9900)
- Unicorn-54251.exe (PID: 10044)
- Unicorn-49205.exe (PID: 10168)
- Unicorn-4924.exe (PID: 11056)
- Unicorn-6482.exe (PID: 9344)
- Unicorn-15138.exe (PID: 11048)
- Unicorn-10094.exe (PID: 10540)
- Unicorn-19916.exe (PID: 10796)
- Unicorn-51127.exe (PID: 10900)
- Unicorn-54251.exe (PID: 10020)
- Unicorn-46083.exe (PID: 10064)
- Unicorn-64915.exe (PID: 10988)
- Unicorn-63742.exe (PID: 10664)
- Unicorn-64146.exe (PID: 11084)
- Unicorn-32413.exe (PID: 11016)
Executable content was dropped or overwritten
- 002945eb40f7c7bc8739a7b1cf9932ead0c867b9dd2f24da7ad3b1f649d04cad.exe (PID: 6316)
- Unicorn-61619.exe (PID: 6776)
- Unicorn-56118.exe (PID: 2652)
- Unicorn-14058.exe (PID: 7088)
- Unicorn-14530.exe (PID: 6400)
- Unicorn-57129.exe (PID: 7136)
- Unicorn-5890.exe (PID: 6180)
- Unicorn-49035.exe (PID: 4144)
- Unicorn-37337.exe (PID: 7120)
- Unicorn-16917.exe (PID: 4040)
- Unicorn-36783.exe (PID: 2236)
- Unicorn-14316.exe (PID: 1884)
- Unicorn-43393.exe (PID: 7140)
- Unicorn-63918.exe (PID: 5172)
- Unicorn-60431.exe (PID: 6480)
- Unicorn-10660.exe (PID: 2588)
- Unicorn-6113.exe (PID: 6336)
- Unicorn-19325.exe (PID: 1788)
- Unicorn-31843.exe (PID: 3676)
- Unicorn-20181.exe (PID: 1952)
- Unicorn-40011.exe (PID: 5616)
- Unicorn-40011.exe (PID: 3764)
- Unicorn-27759.exe (PID: 6680)
- Unicorn-36783.exe (PID: 6396)
- Unicorn-7893.exe (PID: 6696)
- Unicorn-11488.exe (PID: 6136)
- Unicorn-46378.exe (PID: 5652)
- Unicorn-33571.exe (PID: 6028)
- Unicorn-22663.exe (PID: 6900)
- Unicorn-33571.exe (PID: 5956)
- Unicorn-50602.exe (PID: 6992)
- Unicorn-33955.exe (PID: 6904)
- Unicorn-18387.exe (PID: 4792)
- Unicorn-43445.exe (PID: 6812)
- Unicorn-57181.exe (PID: 7024)
- Unicorn-55506.exe (PID: 4676)
- Unicorn-9834.exe (PID: 6428)
- Unicorn-56989.exe (PID: 6132)
- Unicorn-36223.exe (PID: 7328)
- Unicorn-58385.exe (PID: 1784)
- Unicorn-26008.exe (PID: 7340)
- Unicorn-16969.exe (PID: 1172)
- Unicorn-46021.exe (PID: 6260)
- Unicorn-44562.exe (PID: 7400)
- Unicorn-35574.exe (PID: 7440)
- Unicorn-57603.exe (PID: 7460)
- Unicorn-63533.exe (PID: 7496)
- Unicorn-3358.exe (PID: 7392)
- Unicorn-52175.exe (PID: 7424)
- Unicorn-22575.exe (PID: 7640)
- Unicorn-60675.exe (PID: 7712)
- Unicorn-1453.exe (PID: 3108)
- Unicorn-44339.exe (PID: 7768)
- Unicorn-3306.exe (PID: 7660)
- Unicorn-25401.exe (PID: 5984)
- Unicorn-23919.exe (PID: 7864)
- Unicorn-15751.exe (PID: 7888)
- Unicorn-60675.exe (PID: 7704)
- Unicorn-60675.exe (PID: 7696)
- Unicorn-56591.exe (PID: 7720)
- Unicorn-40255.exe (PID: 7792)
- Unicorn-52507.exe (PID: 7744)
- Unicorn-23919.exe (PID: 7848)
- Unicorn-64567.exe (PID: 7936)
- Unicorn-23919.exe (PID: 7856)
- Unicorn-15751.exe (PID: 7892)
- Unicorn-14494.exe (PID: 6344)
- Unicorn-23919.exe (PID: 7872)
- Unicorn-34723.exe (PID: 7176)
- Unicorn-26555.exe (PID: 6736)
- Unicorn-56591.exe (PID: 7728)
- Unicorn-39169.exe (PID: 7204)
- Unicorn-7582.exe (PID: 7924)
- Unicorn-18387.exe (PID: 6420)
- Unicorn-31132.exe (PID: 8032)
- Unicorn-57146.exe (PID: 8140)
- Unicorn-20197.exe (PID: 8044)
- Unicorn-20197.exe (PID: 8080)
- Unicorn-20197.exe (PID: 8072)
- Unicorn-20197.exe (PID: 8040)
- Unicorn-12029.exe (PID: 8056)
- Unicorn-61230.exe (PID: 8156)
- Unicorn-9428.exe (PID: 8124)
- Unicorn-31132.exe (PID: 8100)
- Unicorn-13512.exe (PID: 7096)
- Unicorn-39798.exe (PID: 8024)
- Unicorn-21628.exe (PID: 1372)
- Unicorn-49191.exe (PID: 8272)
- Unicorn-53275.exe (PID: 8264)
- Unicorn-32590.exe (PID: 8300)
- Unicorn-4821.exe (PID: 8320)
- Unicorn-36747.exe (PID: 8460)
- Unicorn-8350.exe (PID: 8340)
- Unicorn-57167.exe (PID: 8388)
- Unicorn-29133.exe (PID: 8416)
- Unicorn-61251.exe (PID: 8380)
- Unicorn-23732.exe (PID: 8468)
- Unicorn-12797.exe (PID: 8476)
- Unicorn-38785.exe (PID: 8436)
- Unicorn-545.exe (PID: 8508)
- Unicorn-64878.exe (PID: 8564)
- Unicorn-21719.exe (PID: 8708)
- Unicorn-42693.exe (PID: 8772)
- Unicorn-38060.exe (PID: 8808)
- Unicorn-10374.exe (PID: 4032)
- Unicorn-12242.exe (PID: 8528)
- Unicorn-46747.exe (PID: 8544)
- Unicorn-1630.exe (PID: 2132)
- Unicorn-11209.exe (PID: 8148)
- Unicorn-43986.exe (PID: 9228)
- Unicorn-27479.exe (PID: 1112)
- Unicorn-31371.exe (PID: 9116)
- Unicorn-15397.exe (PID: 9276)
- Unicorn-23395.exe (PID: 6148)
- Unicorn-63830.exe (PID: 860)
- Unicorn-53254.exe (PID: 7916)
- Unicorn-44370.exe (PID: 3524)
- Unicorn-2782.exe (PID: 9220)
- Unicorn-64598.exe (PID: 9292)
- Unicorn-6482.exe (PID: 9344)
- Unicorn-64406.exe (PID: 9336)
- Unicorn-23373.exe (PID: 9312)
- Unicorn-65159.exe (PID: 9412)
- Unicorn-32849.exe (PID: 9364)
- Unicorn-65522.exe (PID: 9492)
- Unicorn-44355.exe (PID: 9464)
- Unicorn-56799.exe (PID: 9524)
- Unicorn-43431.exe (PID: 9256)
- Unicorn-23743.exe (PID: 9560)
- Unicorn-15574.exe (PID: 9584)
- Unicorn-36741.exe (PID: 9624)
- Unicorn-7214.exe (PID: 9660)
- Unicorn-4282.exe (PID: 9784)
- Unicorn-56970.exe (PID: 9644)
- Unicorn-25449.exe (PID: 9688)
- Unicorn-17281.exe (PID: 9708)
- Unicorn-21173.exe (PID: 9728)
- Unicorn-4282.exe (PID: 9792)
- Unicorn-7982.exe (PID: 9920)
- Unicorn-18188.exe (PID: 9848)
- Unicorn-61267.exe (PID: 9984)
- Unicorn-4453.exe (PID: 9840)
- Unicorn-3898.exe (PID: 9944)
- Unicorn-54251.exe (PID: 10020)
- Unicorn-12066.exe (PID: 9908)
- Unicorn-54251.exe (PID: 10036)
- Unicorn-6.exe (PID: 9824)
- Unicorn-16151.exe (PID: 9868)
- Unicorn-54251.exe (PID: 10028)
- Unicorn-34193.exe (PID: 10148)
- Unicorn-24319.exe (PID: 9856)
- Unicorn-13410.exe (PID: 10132)
- Unicorn-46083.exe (PID: 10064)
- Unicorn-54251.exe (PID: 10044)
- Unicorn-49205.exe (PID: 10168)
- Unicorn-36768.exe (PID: 9684)
- Unicorn-41999.exe (PID: 10100)
- Unicorn-60181.exe (PID: 9096)
- Unicorn-39569.exe (PID: 9620)
- Unicorn-23232.exe (PID: 9208)
- Unicorn-37266.exe (PID: 9168)
- Unicorn-17665.exe (PID: 9064)
- Unicorn-49213.exe (PID: 10252)
- Unicorn-60373.exe (PID: 10188)
- Unicorn-54019.exe (PID: 10204)
- Unicorn-29098.exe (PID: 9080)
- Unicorn-62227.exe (PID: 10156)
- Unicorn-43653.exe (PID: 10236)
- Unicorn-12761.exe (PID: 7740)
- Unicorn-4096.exe (PID: 9640)
- Unicorn-62035.exe (PID: 10416)
- Unicorn-774.exe (PID: 9132)
- Unicorn-25087.exe (PID: 10328)
- Unicorn-53098.exe (PID: 9556)
- Unicorn-23232.exe (PID: 9440)
- Unicorn-6896.exe (PID: 9816)
- Unicorn-44356.exe (PID: 10368)
- Unicorn-50935.exe (PID: 10456)
- Unicorn-8750.exe (PID: 10376)
- Unicorn-6010.exe (PID: 10548)
- Unicorn-46851.exe (PID: 10484)
- Unicorn-26431.exe (PID: 10524)
- Unicorn-34961.exe (PID: 10596)
- Unicorn-10094.exe (PID: 10540)
- Unicorn-21195.exe (PID: 6124)
- Unicorn-57951.exe (PID: 10440)
- Unicorn-61246.exe (PID: 9576)
- Unicorn-6373.exe (PID: 10656)
- Unicorn-36445.exe (PID: 10628)
- Unicorn-50365.exe (PID: 10588)
- Unicorn-33950.exe (PID: 10772)
- Unicorn-63742.exe (PID: 10664)
- Unicorn-63379.exe (PID: 10564)
- Unicorn-52973.exe (PID: 10696)
- Unicorn-8749.exe (PID: 10788)
- Unicorn-8948.exe (PID: 10812)
- Unicorn-63550.exe (PID: 10824)
- Unicorn-19916.exe (PID: 10796)
- Unicorn-28084.exe (PID: 10780)
- Unicorn-30685.exe (PID: 10704)
- Unicorn-30685.exe (PID: 10712)
- Unicorn-50167.exe (PID: 10052)
- Unicorn-64915.exe (PID: 10988)
- Unicorn-56289.exe (PID: 10212)
- Unicorn-32413.exe (PID: 11016)
- Unicorn-4924.exe (PID: 11056)
- Unicorn-15138.exe (PID: 11048)
- Unicorn-51127.exe (PID: 10900)
- Unicorn-12066.exe (PID: 9900)
- Unicorn-64146.exe (PID: 11084)
- Unicorn-39237.exe (PID: 10688)
Executes application which crashes
- Unicorn-65371.exe (PID: 7148)
- Unicorn-7146.exe (PID: 6216)
- Unicorn-6164.exe (PID: 7480)
- Unicorn-64759.exe (PID: 7668)
- Unicorn-64759.exe (PID: 7676)
- Unicorn-31663.exe (PID: 8016)
- Unicorn-3882.exe (PID: 8360)
- Unicorn-9312.exe (PID: 13252)
- Unicorn-65351.exe (PID: 9972)
- Unicorn-65351.exe (PID: 9964)
- Unicorn-1789.exe (PID: 19184)
INFO
Reads the computer name
- 002945eb40f7c7bc8739a7b1cf9932ead0c867b9dd2f24da7ad3b1f649d04cad.exe (PID: 6316)
Checks supported languages
- 002945eb40f7c7bc8739a7b1cf9932ead0c867b9dd2f24da7ad3b1f649d04cad.exe (PID: 6316)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:04:26 10:28:09+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 8192 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13b0 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
1 371
Monitored processes
1 231
Malicious processes
172
Suspicious processes
33
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 204 | C:\Users\admin\Desktop\Unicorn-9209.exe | C:\Users\admin\Desktop\Unicorn-9209.exe | — | Unicorn-50935.exe | |||||||||||
User: admin Integrity Level: MEDIUM | |||||||||||||||
| 300 | C:\Users\admin\Desktop\Unicorn-52770.exe | C:\Users\admin\Desktop\Unicorn-52770.exe | — | Unicorn-23232.exe | |||||||||||
User: admin Integrity Level: MEDIUM | |||||||||||||||
| 860 | C:\Users\admin\Desktop\Unicorn-63830.exe | C:\Users\admin\Desktop\Unicorn-63830.exe | Unicorn-18387.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 916 | C:\Users\admin\Desktop\Unicorn-53935.exe | C:\Users\admin\Desktop\Unicorn-53935.exe | — | Unicorn-43986.exe | |||||||||||
User: admin Integrity Level: MEDIUM | |||||||||||||||
| 944 | C:\Users\admin\Desktop\Unicorn-13361.exe | C:\Users\admin\Desktop\Unicorn-13361.exe | — | Unicorn-54251.exe | |||||||||||
User: admin Integrity Level: MEDIUM | |||||||||||||||
| 1112 | C:\Users\admin\Desktop\Unicorn-27479.exe | C:\Users\admin\Desktop\Unicorn-27479.exe | Unicorn-60675.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1172 | C:\Users\admin\Desktop\Unicorn-16969.exe | C:\Users\admin\Desktop\Unicorn-16969.exe | Unicorn-14530.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1176 | C:\Users\admin\Desktop\Unicorn-65521.exe | C:\Users\admin\Desktop\Unicorn-65521.exe | — | Unicorn-18387.exe | |||||||||||
User: admin Integrity Level: MEDIUM | |||||||||||||||
| 1332 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6216 -s 672 | C:\Windows\SysWOW64\WerFault.exe | Unicorn-7146.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1372 | C:\Users\admin\Desktop\Unicorn-21628.exe | C:\Users\admin\Desktop\Unicorn-21628.exe | Unicorn-56118.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
Total events
52 966
Read events
52 966
Write events
0
Delete events
0
Modification events
Executable files
1 128
Suspicious files
0
Text files
20
Unknown types
18
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6316 | 002945eb40f7c7bc8739a7b1cf9932ead0c867b9dd2f24da7ad3b1f649d04cad.exe | C:\Users\admin\Desktop\Unicorn-61619.exe | executable | |
MD5:5BEFFEA1EC08BE9032CBFEF59EC5D6CE | SHA256:E0EA6E110E79D5484C56E122EC9DF089B1316D1E7501EAA13B54F85ED2DCA0C6 | |||
| 6400 | Unicorn-14530.exe | C:\Users\admin\Desktop\Unicorn-14058.exe | executable | |
MD5:DD4F778D425B77F0DD292644EC989C59 | SHA256:81FF489CBB6FF269C030DC9F95EC5ADBD7521E3EB979D173C308832F693BAA8E | |||
| 6316 | 002945eb40f7c7bc8739a7b1cf9932ead0c867b9dd2f24da7ad3b1f649d04cad.exe | C:\Users\admin\Desktop\Unicorn-57129.exe | executable | |
MD5:C073AB01ED377BFA505E2DCE11C82EDE | SHA256:8625694ADADFE540C5F5E6C5ACDD1C2CBA63FBB7D137FC91C3DC6C545F3ED619 | |||
| 7088 | Unicorn-14058.exe | C:\Users\admin\Desktop\Unicorn-65371.exe | executable | |
MD5:C2085DC1A5BF82ADAB2214298103ADD2 | SHA256:686348DC6B9F222E350B21FCAD42D0F5E9C5F18763294B394ED205B45D2EA716 | |||
| 6776 | Unicorn-61619.exe | C:\Users\admin\Desktop\Unicorn-43393.exe | executable | |
MD5:4CBD5AFE8D8129C08645805CF0F4976A | SHA256:838D16563F6AC8685A54EA0CA4D85A71872300C8C2D26712C595E2FBD379928F | |||
| 6316 | 002945eb40f7c7bc8739a7b1cf9932ead0c867b9dd2f24da7ad3b1f649d04cad.exe | C:\Users\admin\Desktop\Unicorn-56118.exe | executable | |
MD5:ED7D54432C6234FA92FEB9C9E75C0F71 | SHA256:6AE48CE0F527FF09895786D53FF35F10ACC15012077C1EC3B5D31E95898763B6 | |||
| 2652 | Unicorn-56118.exe | C:\Users\admin\Desktop\Unicorn-5890.exe | executable | |
MD5:74D4D11859B61B8CDB320021C886642B | SHA256:2537D9326DD352A643189294B3670C7B2948838078FC8C8F1FBEBFA1AB1A2DD7 | |||
| 6400 | Unicorn-14530.exe | C:\Users\admin\Desktop\Unicorn-37337.exe | executable | |
MD5:068B4E718E98B023853142E67258ACAD | SHA256:F29968E141F358A7E933BFBF6AF0CD03FA9979E914BE1D0156EE8DA4A73EED76 | |||
| 6180 | Unicorn-5890.exe | C:\Users\admin\Desktop\Unicorn-49035.exe | executable | |
MD5:A9B1789F32DFD353D9BA1CCE4FD31754 | SHA256:69B3FC3F69654033880BD49274BA08A8724538388B674F5FC202EE4230071456 | |||
| 6776 | Unicorn-61619.exe | C:\Users\admin\Desktop\Unicorn-14316.exe | executable | |
MD5:593F9B285C3986F4421A8D351BBF31D0 | SHA256:1E84EFF821B44D2F4DCE3F0412E276FBF4BE042E1953FF8A1B61279125002124 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
32
DNS requests
14
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5488 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.166:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
3832 | RUXIMICS.exe | GET | 200 | 23.48.23.166:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6944 | svchost.exe | GET | 200 | 23.48.23.166:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6944 | svchost.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5488 | MoUsoCoreWorker.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
3832 | RUXIMICS.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5488 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
6944 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 92.123.104.67:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
3832 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5488 | MoUsoCoreWorker.exe | 23.48.23.166:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
6944 | svchost.exe | 23.48.23.166:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
3832 | RUXIMICS.exe | 23.48.23.166:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5488 | MoUsoCoreWorker.exe | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
watson.events.data.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |