| File name: | 1 (1281) |
| Full analysis: | https://app.any.run/tasks/c306abed-0f9a-490c-9081-9418adbe8917 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 13:38:39 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | B58F215F417E6D683B55C4BE9C969460 |
| SHA1: | 06998D6AC13A75BA31328B5E697A6F628F1F7F6A |
| SHA256: | 0CC43E17ABAD2C3CEACD0F70C4CCD233596F213C16052FC4A9F31D124A714E7D |
| SSDEEP: | 6144:i7KpLTIPvDoMA5kzt4eviofx/tBqlvJtBq/WyeL9yk/8SwjwpyAvEhen50C9/ABa:i+1EsMA5otzjBMhbqOyeL90x4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- Unicorn-1260.exe (PID: 5544)
- Unicorn-25210.exe (PID: 4268)
- 1 (1281).exe (PID: 6184)
- Unicorn-27478.exe (PID: 3956)
- Unicorn-47462.exe (PID: 6080)
- Unicorn-47004.exe (PID: 4188)
- Unicorn-21208.exe (PID: 5056)
- Unicorn-37488.exe (PID: 1164)
- Unicorn-3933.exe (PID: 6752)
- Unicorn-14213.exe (PID: 2552)
- Unicorn-61368.exe (PID: 856)
- Unicorn-9937.exe (PID: 6132)
- Unicorn-64161.exe (PID: 5400)
- Unicorn-18106.exe (PID: 6372)
- Unicorn-39272.exe (PID: 6192)
- Unicorn-13658.exe (PID: 1088)
- Unicorn-33756.exe (PID: 4628)
- Unicorn-59552.exe (PID: 2904)
- Unicorn-58873.exe (PID: 3304)
- Unicorn-20950.exe (PID: 5548)
- Unicorn-1297.exe (PID: 2616)
- Unicorn-24842.exe (PID: 2244)
- Unicorn-30440.exe (PID: 1628)
- Unicorn-42500.exe (PID: 4000)
- Unicorn-50306.exe (PID: 728)
- Unicorn-36637.exe (PID: 2772)
- Unicorn-49154.exe (PID: 6512)
- Unicorn-35724.exe (PID: 1532)
- Unicorn-18410.exe (PID: 5892)
- Unicorn-15610.exe (PID: 5360)
- Unicorn-28219.exe (PID: 1128)
- Unicorn-31784.exe (PID: 6228)
- Unicorn-60513.exe (PID: 1452)
- Unicorn-3601.exe (PID: 4200)
- Unicorn-38504.exe (PID: 3896)
- Unicorn-15662.exe (PID: 5868)
- Unicorn-18786.exe (PID: 6436)
- Unicorn-24384.exe (PID: 3140)
- Unicorn-11193.exe (PID: 7184)
- Unicorn-8453.exe (PID: 7208)
- Unicorn-8261.exe (PID: 7244)
- Unicorn-16238.exe (PID: 7264)
- Unicorn-57846.exe (PID: 7524)
- Unicorn-36165.exe (PID: 7232)
- Unicorn-47632.exe (PID: 7668)
- Unicorn-48993.exe (PID: 7436)
- Unicorn-34280.exe (PID: 7464)
- Unicorn-32574.exe (PID: 7380)
- Unicorn-65412.exe (PID: 7640)
- Unicorn-49870.exe (PID: 7488)
- Unicorn-30719.exe (PID: 7304)
- Unicorn-20907.exe (PID: 7736)
- Unicorn-38194.exe (PID: 7828)
- Unicorn-46917.exe (PID: 7808)
- Unicorn-34224.exe (PID: 7400)
- Unicorn-47301.exe (PID: 7676)
- Unicorn-54765.exe (PID: 7852)
- Unicorn-18821.exe (PID: 7504)
- Unicorn-5884.exe (PID: 7420)
- Unicorn-36850.exe (PID: 7296)
- Unicorn-23947.exe (PID: 7860)
- Unicorn-26134.exe (PID: 7776)
- Unicorn-16333.exe (PID: 7868)
- Unicorn-13305.exe (PID: 7356)
- Unicorn-57965.exe (PID: 7456)
- Unicorn-53549.exe (PID: 7340)
- Unicorn-189.exe (PID: 7920)
- Unicorn-17625.exe (PID: 8248)
- Unicorn-7226.exe (PID: 7972)
- Unicorn-12270.exe (PID: 8124)
- Unicorn-5180.exe (PID: 7984)
- Unicorn-49328.exe (PID: 8072)
- Unicorn-46863.exe (PID: 8196)
- Unicorn-2301.exe (PID: 8092)
- Unicorn-27787.exe (PID: 7408)
- Unicorn-16299.exe (PID: 7224)
- Unicorn-15971.exe (PID: 7912)
- Unicorn-24309.exe (PID: 8064)
- Unicorn-18467.exe (PID: 8268)
- Unicorn-41051.exe (PID: 8084)
- Unicorn-53879.exe (PID: 7020)
- Unicorn-21953.exe (PID: 8140)
- Unicorn-65246.exe (PID: 7364)
- Unicorn-6406.exe (PID: 8296)
- Unicorn-27421.exe (PID: 7372)
- Unicorn-64927.exe (PID: 8336)
- Unicorn-55799.exe (PID: 8304)
- Unicorn-25269.exe (PID: 8096)
- Unicorn-38119.exe (PID: 8224)
- Unicorn-28968.exe (PID: 8836)
- Unicorn-26134.exe (PID: 7768)
- Unicorn-57852.exe (PID: 7800)
- Unicorn-1850.exe (PID: 8876)
- Unicorn-47121.exe (PID: 8468)
- Unicorn-10594.exe (PID: 8796)
- Unicorn-64543.exe (PID: 8388)
- Unicorn-8113.exe (PID: 8348)
- Unicorn-45742.exe (PID: 9364)
- Unicorn-24383.exe (PID: 7588)
- Unicorn-12986.exe (PID: 8500)
- Unicorn-25740.exe (PID: 8316)
- Unicorn-42883.exe (PID: 8960)
- Unicorn-10786.exe (PID: 5200)
- Unicorn-16984.exe (PID: 7312)
- Unicorn-24449.exe (PID: 8372)
- Unicorn-51907.exe (PID: 8408)
- Unicorn-7174.exe (PID: 8396)
- Unicorn-16193.exe (PID: 5668)
- Unicorn-328.exe (PID: 9772)
- Unicorn-52426.exe (PID: 9836)
- Unicorn-59286.exe (PID: 8208)
- Unicorn-57749.exe (PID: 8820)
- Unicorn-32529.exe (PID: 9220)
- Unicorn-5690.exe (PID: 9644)
- Unicorn-44066.exe (PID: 9880)
- Unicorn-31975.exe (PID: 1324)
- Unicorn-18467.exe (PID: 7328)
- Unicorn-60755.exe (PID: 7540)
- Unicorn-34283.exe (PID: 8996)
- Unicorn-17419.exe (PID: 8732)
- Unicorn-44035.exe (PID: 9048)
- Unicorn-9198.exe (PID: 9584)
- Unicorn-61243.exe (PID: 10112)
- Unicorn-53377.exe (PID: 7348)
- Unicorn-24553.exe (PID: 9268)
- Unicorn-37403.exe (PID: 9340)
- Unicorn-62314.exe (PID: 7444)
- Unicorn-64180.exe (PID: 8908)
- Unicorn-21068.exe (PID: 7288)
- Unicorn-713.exe (PID: 8440)
- Unicorn-25919.exe (PID: 9536)
- Unicorn-40613.exe (PID: 8616)
- Unicorn-38185.exe (PID: 8364)
- Unicorn-45571.exe (PID: 9348)
- Unicorn-46967.exe (PID: 8968)
- Unicorn-62618.exe (PID: 1280)
- Unicorn-62618.exe (PID: 6708)
- Unicorn-43229.exe (PID: 8608)
- Unicorn-10786.exe (PID: 9088)
- Unicorn-39951.exe (PID: 9036)
- Unicorn-31871.exe (PID: 8324)
- Unicorn-32219.exe (PID: 11060)
- Unicorn-62618.exe (PID: 1312)
- Unicorn-13474.exe (PID: 9444)
- Unicorn-48185.exe (PID: 9492)
- Unicorn-57911.exe (PID: 8536)
- Unicorn-57211.exe (PID: 12224)
- Unicorn-26384.exe (PID: 12240)
- Unicorn-44922.exe (PID: 9416)
- Unicorn-21173.exe (PID: 7744)
- Unicorn-9360.exe (PID: 12712)
- Unicorn-12965.exe (PID: 8452)
- Unicorn-5633.exe (PID: 12664)
- Unicorn-5633.exe (PID: 12656)
- Unicorn-63614.exe (PID: 8812)
- Unicorn-9487.exe (PID: 8584)
- Unicorn-43465.exe (PID: 6572)
- Unicorn-4258.exe (PID: 10040)
- Unicorn-61922.exe (PID: 8576)
- Unicorn-61274.exe (PID: 11752)
- Unicorn-44014.exe (PID: 10832)
- Unicorn-48503.exe (PID: 9276)
- Unicorn-36971.exe (PID: 9652)
- Unicorn-20277.exe (PID: 9236)
- Unicorn-49301.exe (PID: 13068)
- Unicorn-41113.exe (PID: 9680)
- Unicorn-48037.exe (PID: 9896)
- Unicorn-13194.exe (PID: 864)
- Unicorn-35207.exe (PID: 14212)
- Unicorn-32167.exe (PID: 9260)
- Unicorn-50417.exe (PID: 13288)
- Unicorn-42313.exe (PID: 8788)
- Unicorn-15425.exe (PID: 9104)
- Unicorn-26389.exe (PID: 10876)
Executable content was dropped or overwritten
- Unicorn-37488.exe (PID: 1164)
- 1 (1281).exe (PID: 6184)
- Unicorn-25210.exe (PID: 4268)
- Unicorn-1260.exe (PID: 5544)
- Unicorn-27478.exe (PID: 3956)
- Unicorn-47004.exe (PID: 4188)
- Unicorn-47462.exe (PID: 6080)
- Unicorn-3933.exe (PID: 6752)
- Unicorn-21208.exe (PID: 5056)
- Unicorn-14213.exe (PID: 2552)
- Unicorn-58873.exe (PID: 3304)
- Unicorn-9937.exe (PID: 6132)
- Unicorn-64161.exe (PID: 5400)
- Unicorn-61368.exe (PID: 856)
- Unicorn-18106.exe (PID: 6372)
- Unicorn-13658.exe (PID: 1088)
- Unicorn-33756.exe (PID: 4628)
- Unicorn-59552.exe (PID: 2904)
- Unicorn-20950.exe (PID: 5548)
- Unicorn-1297.exe (PID: 2616)
- Unicorn-24842.exe (PID: 2244)
- Unicorn-30440.exe (PID: 1628)
- Unicorn-42500.exe (PID: 4000)
- Unicorn-50306.exe (PID: 728)
- Unicorn-36637.exe (PID: 2772)
- Unicorn-49154.exe (PID: 6512)
- Unicorn-28219.exe (PID: 1128)
- Unicorn-15610.exe (PID: 5360)
- Unicorn-18410.exe (PID: 5892)
- Unicorn-39272.exe (PID: 6192)
- Unicorn-18786.exe (PID: 6436)
- Unicorn-35724.exe (PID: 1532)
- Unicorn-3601.exe (PID: 4200)
- Unicorn-38504.exe (PID: 3896)
- Unicorn-15662.exe (PID: 5868)
- Unicorn-24384.exe (PID: 3140)
- Unicorn-31784.exe (PID: 6228)
- Unicorn-11193.exe (PID: 7184)
- Unicorn-8261.exe (PID: 7244)
- Unicorn-8453.exe (PID: 7208)
- Unicorn-16299.exe (PID: 7224)
- Unicorn-16238.exe (PID: 7264)
- Unicorn-57846.exe (PID: 7524)
- Unicorn-65412.exe (PID: 7640)
- Unicorn-36165.exe (PID: 7232)
- Unicorn-47632.exe (PID: 7668)
- Unicorn-26134.exe (PID: 7768)
- Unicorn-18821.exe (PID: 7504)
- Unicorn-32574.exe (PID: 7380)
- Unicorn-49870.exe (PID: 7488)
- Unicorn-30719.exe (PID: 7304)
- Unicorn-38194.exe (PID: 7828)
- Unicorn-20907.exe (PID: 7736)
- Unicorn-47301.exe (PID: 7676)
- Unicorn-46917.exe (PID: 7808)
- Unicorn-54765.exe (PID: 7852)
- Unicorn-16333.exe (PID: 7868)
- Unicorn-36850.exe (PID: 7296)
- Unicorn-23947.exe (PID: 7860)
- Unicorn-26134.exe (PID: 7776)
- Unicorn-57965.exe (PID: 7456)
- Unicorn-13305.exe (PID: 7356)
- Unicorn-17625.exe (PID: 8248)
- Unicorn-189.exe (PID: 7920)
- Unicorn-7226.exe (PID: 7972)
- Unicorn-12270.exe (PID: 8124)
- Unicorn-53549.exe (PID: 7340)
- Unicorn-49328.exe (PID: 8072)
- Unicorn-46863.exe (PID: 8196)
- Unicorn-2301.exe (PID: 8092)
- Unicorn-15971.exe (PID: 7912)
- Unicorn-55799.exe (PID: 8304)
- Unicorn-60513.exe (PID: 1452)
- Unicorn-24309.exe (PID: 8064)
- Unicorn-41051.exe (PID: 8084)
- Unicorn-65246.exe (PID: 7364)
- Unicorn-18467.exe (PID: 8268)
- Unicorn-53879.exe (PID: 7020)
- Unicorn-6406.exe (PID: 8296)
- Unicorn-48993.exe (PID: 7436)
- Unicorn-21953.exe (PID: 8140)
- Unicorn-38119.exe (PID: 8224)
- Unicorn-64927.exe (PID: 8336)
- Unicorn-57852.exe (PID: 7800)
- Unicorn-25269.exe (PID: 8096)
- Unicorn-27421.exe (PID: 7372)
- Unicorn-1850.exe (PID: 8876)
- Unicorn-47121.exe (PID: 8468)
- Unicorn-57749.exe (PID: 8820)
- Unicorn-28968.exe (PID: 8836)
- Unicorn-21173.exe (PID: 7744)
- Unicorn-10594.exe (PID: 8796)
- Unicorn-64543.exe (PID: 8388)
- Unicorn-12986.exe (PID: 8500)
- Unicorn-8113.exe (PID: 8348)
- Unicorn-45742.exe (PID: 9364)
- Unicorn-24383.exe (PID: 7588)
- Unicorn-25740.exe (PID: 8316)
- Unicorn-10786.exe (PID: 5200)
- Unicorn-5884.exe (PID: 7420)
- Unicorn-16193.exe (PID: 5668)
- Unicorn-42883.exe (PID: 8960)
- Unicorn-15425.exe (PID: 9104)
- Unicorn-24449.exe (PID: 8372)
- Unicorn-51907.exe (PID: 8408)
- Unicorn-16984.exe (PID: 7312)
- Unicorn-52426.exe (PID: 9836)
- Unicorn-44066.exe (PID: 9880)
- Unicorn-34280.exe (PID: 7464)
- Unicorn-59286.exe (PID: 8208)
- Unicorn-328.exe (PID: 9772)
- Unicorn-18467.exe (PID: 7328)
- Unicorn-32529.exe (PID: 9220)
- Unicorn-40613.exe (PID: 8616)
- Unicorn-61243.exe (PID: 10112)
- Unicorn-31975.exe (PID: 1324)
- Unicorn-21068.exe (PID: 7288)
- Unicorn-44035.exe (PID: 9048)
- Unicorn-17419.exe (PID: 8732)
- Unicorn-34283.exe (PID: 8996)
- Unicorn-64180.exe (PID: 8908)
- Unicorn-60755.exe (PID: 7540)
- Unicorn-9198.exe (PID: 9584)
- Unicorn-24553.exe (PID: 9268)
- Unicorn-37403.exe (PID: 9340)
- Unicorn-62314.exe (PID: 7444)
- Unicorn-53377.exe (PID: 7348)
- Unicorn-713.exe (PID: 8440)
- Unicorn-25919.exe (PID: 9536)
- Unicorn-38185.exe (PID: 8364)
- Unicorn-45571.exe (PID: 9348)
- Unicorn-31871.exe (PID: 8324)
- Unicorn-62618.exe (PID: 1280)
- Unicorn-5180.exe (PID: 7984)
- Unicorn-43229.exe (PID: 8608)
- Unicorn-39951.exe (PID: 9036)
- Unicorn-32219.exe (PID: 11060)
- Unicorn-10786.exe (PID: 9088)
- Unicorn-62618.exe (PID: 1312)
- Unicorn-48185.exe (PID: 9492)
- Unicorn-13474.exe (PID: 9444)
- Unicorn-26384.exe (PID: 12240)
- Unicorn-57211.exe (PID: 12224)
- Unicorn-57911.exe (PID: 8536)
- Unicorn-12965.exe (PID: 8452)
- Unicorn-44922.exe (PID: 9416)
- Unicorn-5633.exe (PID: 12664)
- Unicorn-63614.exe (PID: 8812)
- Unicorn-5633.exe (PID: 12656)
- Unicorn-9360.exe (PID: 12712)
- Unicorn-5690.exe (PID: 9644)
- Unicorn-27787.exe (PID: 7408)
- Unicorn-9487.exe (PID: 8584)
- Unicorn-4258.exe (PID: 10040)
- Unicorn-61922.exe (PID: 8576)
- Unicorn-44014.exe (PID: 10832)
- Unicorn-26389.exe (PID: 10876)
- Unicorn-61274.exe (PID: 11752)
- Unicorn-53106.exe (PID: 12280)
- Unicorn-62618.exe (PID: 6708)
- Unicorn-36971.exe (PID: 9652)
- Unicorn-20277.exe (PID: 9236)
- Unicorn-49301.exe (PID: 13068)
- Unicorn-46967.exe (PID: 8968)
- Unicorn-50417.exe (PID: 13288)
- Unicorn-34224.exe (PID: 7400)
- Unicorn-48503.exe (PID: 9276)
- Unicorn-41113.exe (PID: 9680)
- Unicorn-42313.exe (PID: 8788)
- Unicorn-48037.exe (PID: 9896)
- Unicorn-13194.exe (PID: 864)
- Unicorn-31133.exe (PID: 9616)
- Unicorn-32167.exe (PID: 9260)
- Unicorn-62151.exe (PID: 11124)
- Unicorn-8793.exe (PID: 9388)
- Unicorn-47792.exe (PID: 9716)
- Unicorn-13064.exe (PID: 10484)
- Unicorn-43465.exe (PID: 6572)
- Unicorn-21363.exe (PID: 7952)
- Unicorn-53843.exe (PID: 10316)
- Unicorn-35483.exe (PID: 9160)
- Unicorn-23589.exe (PID: 10884)
- Unicorn-16568.exe (PID: 12608)
- Unicorn-47647.exe (PID: 12968)
- Unicorn-43053.exe (PID: 8648)
- Unicorn-53106.exe (PID: 7144)
- Unicorn-62187.exe (PID: 8568)
- Unicorn-42321.exe (PID: 8556)
- Unicorn-46946.exe (PID: 8760)
- Unicorn-4537.exe (PID: 9544)
- Unicorn-40404.exe (PID: 13624)
- Unicorn-7174.exe (PID: 8396)
- Unicorn-53629.exe (PID: 11620)
- Unicorn-13246.exe (PID: 12552)
- Unicorn-22005.exe (PID: 9596)
- Unicorn-56702.exe (PID: 9904)
- Unicorn-64607.exe (PID: 6700)
- Unicorn-20927.exe (PID: 3676)
- Unicorn-54611.exe (PID: 10460)
- Unicorn-23589.exe (PID: 10892)
- Unicorn-18431.exe (PID: 10692)
- Unicorn-6872.exe (PID: 10280)
- Unicorn-27372.exe (PID: 9688)
- Unicorn-3329.exe (PID: 12160)
- Unicorn-61169.exe (PID: 12840)
- Unicorn-7382.exe (PID: 9996)
- Unicorn-2580.exe (PID: 8624)
- Unicorn-32705.exe (PID: 12512)
- Unicorn-26407.exe (PID: 10432)
- Unicorn-7413.exe (PID: 14044)
- Unicorn-35207.exe (PID: 14212)
- Unicorn-21275.exe (PID: 14264)
- Unicorn-45972.exe (PID: 11492)
- Unicorn-14709.exe (PID: 10440)
- Unicorn-7081.exe (PID: 14428)
- Unicorn-58850.exe (PID: 8548)
- Unicorn-1304.exe (PID: 12256)
Executes application which crashes
- Unicorn-29323.exe (PID: 8508)
- Unicorn-29323.exe (PID: 8516)
INFO
Reads the computer name
- Unicorn-37488.exe (PID: 1164)
- 1 (1281).exe (PID: 6184)
- Unicorn-1260.exe (PID: 5544)
- Unicorn-31784.exe (PID: 6228)
- Unicorn-36165.exe (PID: 7232)
- Unicorn-49870.exe (PID: 7488)
- Unicorn-47301.exe (PID: 7676)
- Unicorn-5884.exe (PID: 7420)
- Unicorn-16333.exe (PID: 7868)
- Unicorn-23947.exe (PID: 7860)
- Unicorn-55799.exe (PID: 8304)
- Unicorn-16193.exe (PID: 5668)
- Unicorn-46967.exe (PID: 8968)
- Unicorn-5633.exe (PID: 12664)
- Unicorn-49301.exe (PID: 13068)
Checks supported languages
- 1 (1281).exe (PID: 6184)
- Unicorn-37488.exe (PID: 1164)
- Unicorn-18106.exe (PID: 6372)
- Unicorn-36637.exe (PID: 2772)
- Unicorn-59552.exe (PID: 2904)
- Unicorn-50306.exe (PID: 728)
- Unicorn-15662.exe (PID: 5868)
- Unicorn-65246.exe (PID: 7364)
- Unicorn-62314.exe (PID: 7444)
- Unicorn-18821.exe (PID: 7504)
- Unicorn-32574.exe (PID: 7380)
- Unicorn-49328.exe (PID: 8072)
- Unicorn-12270.exe (PID: 8124)
- Unicorn-21953.exe (PID: 8140)
- Unicorn-38185.exe (PID: 8364)
- Unicorn-7174.exe (PID: 8396)
- Unicorn-58850.exe (PID: 8548)
- Unicorn-43229.exe (PID: 8608)
- Unicorn-9487.exe (PID: 8584)
- Unicorn-10786.exe (PID: 9088)
- Unicorn-24383.exe (PID: 7588)
- Unicorn-46265.exe (PID: 9228)
- Unicorn-16193.exe (PID: 5668)
- Unicorn-40143.exe (PID: 9284)
- Unicorn-328.exe (PID: 9772)
- Unicorn-30195.exe (PID: 9664)
- Unicorn-56545.exe (PID: 9432)
- Unicorn-60682.exe (PID: 9728)
- Unicorn-48037.exe (PID: 9896)
- Unicorn-62758.exe (PID: 10340)
- Unicorn-45867.exe (PID: 10356)
- Unicorn-33615.exe (PID: 1748)
- Unicorn-12182.exe (PID: 10976)
- Unicorn-46893.exe (PID: 11068)
- Unicorn-21119.exe (PID: 11148)
- Unicorn-40417.exe (PID: 10672)
- Unicorn-56038.exe (PID: 11520)
- Unicorn-21340.exe (PID: 11700)
- Unicorn-17397.exe (PID: 10620)
- Unicorn-64206.exe (PID: 11528)
- Unicorn-1436.exe (PID: 11500)
- Unicorn-61274.exe (PID: 11752)
- Unicorn-44575.exe (PID: 11516)
- Unicorn-17064.exe (PID: 12320)
- Unicorn-19368.exe (PID: 12576)
- Unicorn-42773.exe (PID: 12468)
- Unicorn-50417.exe (PID: 13288)
- Unicorn-11776.exe (PID: 12816)
- Unicorn-1762.exe (PID: 12832)
- Unicorn-19368.exe (PID: 12600)
- Unicorn-18395.exe (PID: 13896)
- Unicorn-10781.exe (PID: 14072)
- Unicorn-21275.exe (PID: 14264)
- Unicorn-41097.exe (PID: 14036)
The sample compiled with chinese language support
- 1 (1281).exe (PID: 6184)
- Unicorn-21208.exe (PID: 5056)
- Unicorn-25210.exe (PID: 4268)
- Unicorn-1260.exe (PID: 5544)
- Unicorn-37488.exe (PID: 1164)
- Unicorn-3933.exe (PID: 6752)
- Unicorn-47004.exe (PID: 4188)
- Unicorn-64161.exe (PID: 5400)
- Unicorn-61368.exe (PID: 856)
- Unicorn-18106.exe (PID: 6372)
- Unicorn-14213.exe (PID: 2552)
- Unicorn-9937.exe (PID: 6132)
- Unicorn-47462.exe (PID: 6080)
- Unicorn-33756.exe (PID: 4628)
- Unicorn-27478.exe (PID: 3956)
- Unicorn-13658.exe (PID: 1088)
- Unicorn-59552.exe (PID: 2904)
- Unicorn-20950.exe (PID: 5548)
- Unicorn-1297.exe (PID: 2616)
- Unicorn-24842.exe (PID: 2244)
- Unicorn-30440.exe (PID: 1628)
- Unicorn-58873.exe (PID: 3304)
- Unicorn-42500.exe (PID: 4000)
- Unicorn-50306.exe (PID: 728)
- Unicorn-36637.exe (PID: 2772)
- Unicorn-49154.exe (PID: 6512)
- Unicorn-28219.exe (PID: 1128)
- Unicorn-18410.exe (PID: 5892)
- Unicorn-39272.exe (PID: 6192)
- Unicorn-18786.exe (PID: 6436)
- Unicorn-15610.exe (PID: 5360)
- Unicorn-35724.exe (PID: 1532)
- Unicorn-3601.exe (PID: 4200)
- Unicorn-38504.exe (PID: 3896)
- Unicorn-15662.exe (PID: 5868)
- Unicorn-31784.exe (PID: 6228)
- Unicorn-11193.exe (PID: 7184)
- Unicorn-8453.exe (PID: 7208)
- Unicorn-16299.exe (PID: 7224)
- Unicorn-8261.exe (PID: 7244)
- Unicorn-24384.exe (PID: 3140)
- Unicorn-16238.exe (PID: 7264)
- Unicorn-57846.exe (PID: 7524)
- Unicorn-65412.exe (PID: 7640)
- Unicorn-36165.exe (PID: 7232)
- Unicorn-47632.exe (PID: 7668)
- Unicorn-26134.exe (PID: 7768)
- Unicorn-18821.exe (PID: 7504)
- Unicorn-32574.exe (PID: 7380)
- Unicorn-49870.exe (PID: 7488)
- Unicorn-30719.exe (PID: 7304)
- Unicorn-20907.exe (PID: 7736)
- Unicorn-13305.exe (PID: 7356)
- Unicorn-38194.exe (PID: 7828)
- Unicorn-189.exe (PID: 7920)
- Unicorn-47301.exe (PID: 7676)
- Unicorn-46917.exe (PID: 7808)
- Unicorn-54765.exe (PID: 7852)
- Unicorn-36850.exe (PID: 7296)
- Unicorn-23947.exe (PID: 7860)
- Unicorn-26134.exe (PID: 7776)
- Unicorn-16333.exe (PID: 7868)
- Unicorn-57965.exe (PID: 7456)
- Unicorn-53549.exe (PID: 7340)
- Unicorn-17625.exe (PID: 8248)
- Unicorn-7226.exe (PID: 7972)
- Unicorn-12270.exe (PID: 8124)
- Unicorn-49328.exe (PID: 8072)
- Unicorn-46863.exe (PID: 8196)
- Unicorn-2301.exe (PID: 8092)
- Unicorn-55799.exe (PID: 8304)
- Unicorn-60513.exe (PID: 1452)
- Unicorn-18467.exe (PID: 8268)
- Unicorn-24309.exe (PID: 8064)
- Unicorn-41051.exe (PID: 8084)
- Unicorn-65246.exe (PID: 7364)
- Unicorn-15971.exe (PID: 7912)
- Unicorn-53879.exe (PID: 7020)
- Unicorn-6406.exe (PID: 8296)
- Unicorn-48993.exe (PID: 7436)
- Unicorn-21953.exe (PID: 8140)
- Unicorn-38119.exe (PID: 8224)
- Unicorn-27421.exe (PID: 7372)
- Unicorn-64927.exe (PID: 8336)
- Unicorn-25269.exe (PID: 8096)
- Unicorn-57749.exe (PID: 8820)
- Unicorn-1850.exe (PID: 8876)
- Unicorn-57852.exe (PID: 7800)
- Unicorn-28968.exe (PID: 8836)
- Unicorn-47121.exe (PID: 8468)
- Unicorn-21173.exe (PID: 7744)
- Unicorn-10594.exe (PID: 8796)
- Unicorn-8113.exe (PID: 8348)
- Unicorn-64543.exe (PID: 8388)
- Unicorn-24383.exe (PID: 7588)
- Unicorn-25740.exe (PID: 8316)
- Unicorn-12986.exe (PID: 8500)
- Unicorn-45742.exe (PID: 9364)
- Unicorn-15425.exe (PID: 9104)
- Unicorn-10786.exe (PID: 5200)
- Unicorn-5884.exe (PID: 7420)
- Unicorn-42883.exe (PID: 8960)
- Unicorn-24449.exe (PID: 8372)
- Unicorn-16193.exe (PID: 5668)
- Unicorn-51907.exe (PID: 8408)
- Unicorn-16984.exe (PID: 7312)
- Unicorn-44066.exe (PID: 9880)
- Unicorn-34280.exe (PID: 7464)
- Unicorn-59286.exe (PID: 8208)
- Unicorn-328.exe (PID: 9772)
- Unicorn-52426.exe (PID: 9836)
- Unicorn-18467.exe (PID: 7328)
- Unicorn-61243.exe (PID: 10112)
- Unicorn-21068.exe (PID: 7288)
- Unicorn-31975.exe (PID: 1324)
- Unicorn-32529.exe (PID: 9220)
- Unicorn-60755.exe (PID: 7540)
- Unicorn-34283.exe (PID: 8996)
- Unicorn-17419.exe (PID: 8732)
- Unicorn-44035.exe (PID: 9048)
- Unicorn-9198.exe (PID: 9584)
- Unicorn-24553.exe (PID: 9268)
- Unicorn-53377.exe (PID: 7348)
- Unicorn-37403.exe (PID: 9340)
- Unicorn-62314.exe (PID: 7444)
- Unicorn-64180.exe (PID: 8908)
- Unicorn-40613.exe (PID: 8616)
- Unicorn-713.exe (PID: 8440)
- Unicorn-25919.exe (PID: 9536)
- Unicorn-45571.exe (PID: 9348)
- Unicorn-5180.exe (PID: 7984)
- Unicorn-31871.exe (PID: 8324)
- Unicorn-62618.exe (PID: 1280)
- Unicorn-38185.exe (PID: 8364)
- Unicorn-43229.exe (PID: 8608)
- Unicorn-39951.exe (PID: 9036)
- Unicorn-10786.exe (PID: 9088)
- Unicorn-32219.exe (PID: 11060)
- Unicorn-62618.exe (PID: 1312)
- Unicorn-48185.exe (PID: 9492)
- Unicorn-13474.exe (PID: 9444)
- Unicorn-26384.exe (PID: 12240)
- Unicorn-57211.exe (PID: 12224)
- Unicorn-57911.exe (PID: 8536)
- Unicorn-12965.exe (PID: 8452)
- Unicorn-44922.exe (PID: 9416)
- Unicorn-5633.exe (PID: 12664)
- Unicorn-5633.exe (PID: 12656)
- Unicorn-9360.exe (PID: 12712)
- Unicorn-61922.exe (PID: 8576)
- Unicorn-9487.exe (PID: 8584)
- Unicorn-27787.exe (PID: 7408)
- Unicorn-4258.exe (PID: 10040)
- Unicorn-63614.exe (PID: 8812)
- Unicorn-5690.exe (PID: 9644)
- Unicorn-53106.exe (PID: 12280)
- Unicorn-44014.exe (PID: 10832)
- Unicorn-26389.exe (PID: 10876)
- Unicorn-62618.exe (PID: 6708)
- Unicorn-61274.exe (PID: 11752)
- Unicorn-36971.exe (PID: 9652)
- Unicorn-20277.exe (PID: 9236)
- Unicorn-49301.exe (PID: 13068)
- Unicorn-46967.exe (PID: 8968)
- Unicorn-34224.exe (PID: 7400)
- Unicorn-48503.exe (PID: 9276)
- Unicorn-48037.exe (PID: 9896)
- Unicorn-42313.exe (PID: 8788)
- Unicorn-31133.exe (PID: 9616)
- Unicorn-32167.exe (PID: 9260)
- Unicorn-50417.exe (PID: 13288)
- Unicorn-41113.exe (PID: 9680)
- Unicorn-8793.exe (PID: 9388)
- Unicorn-21363.exe (PID: 7952)
- Unicorn-53843.exe (PID: 10316)
- Unicorn-13064.exe (PID: 10484)
- Unicorn-43465.exe (PID: 6572)
- Unicorn-62151.exe (PID: 11124)
- Unicorn-47792.exe (PID: 9716)
- Unicorn-47647.exe (PID: 12968)
- Unicorn-42321.exe (PID: 8556)
- Unicorn-35483.exe (PID: 9160)
- Unicorn-23589.exe (PID: 10884)
- Unicorn-16568.exe (PID: 12608)
- Unicorn-43053.exe (PID: 8648)
- Unicorn-53106.exe (PID: 7144)
- Unicorn-62187.exe (PID: 8568)
- Unicorn-64607.exe (PID: 6700)
- Unicorn-4537.exe (PID: 9544)
- Unicorn-40404.exe (PID: 13624)
- Unicorn-7174.exe (PID: 8396)
- Unicorn-53629.exe (PID: 11620)
- Unicorn-22005.exe (PID: 9596)
- Unicorn-56702.exe (PID: 9904)
- Unicorn-46946.exe (PID: 8760)
- Unicorn-20927.exe (PID: 3676)
- Unicorn-23589.exe (PID: 10892)
- Unicorn-54611.exe (PID: 10460)
- Unicorn-18431.exe (PID: 10692)
- Unicorn-3329.exe (PID: 12160)
- Unicorn-6872.exe (PID: 10280)
- Unicorn-2580.exe (PID: 8624)
- Unicorn-61169.exe (PID: 12840)
- Unicorn-13246.exe (PID: 12552)
- Unicorn-7382.exe (PID: 9996)
- Unicorn-32705.exe (PID: 12512)
- Unicorn-35207.exe (PID: 14212)
- Unicorn-7413.exe (PID: 14044)
- Unicorn-45972.exe (PID: 11492)
- Unicorn-26407.exe (PID: 10432)
- Unicorn-21275.exe (PID: 14264)
- Unicorn-14709.exe (PID: 10440)
- Unicorn-7081.exe (PID: 14428)
- Unicorn-27372.exe (PID: 9688)
- Unicorn-58850.exe (PID: 8548)
- Unicorn-1304.exe (PID: 12256)
- Unicorn-13194.exe (PID: 864)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 4112)
- BackgroundTransferHost.exe (PID: 4620)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 4112)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 4112)
Create files in a temporary directory
- Unicorn-37488.exe (PID: 1164)
- 1 (1281).exe (PID: 6184)
- Unicorn-3933.exe (PID: 6752)
- Unicorn-9937.exe (PID: 6132)
- Unicorn-14213.exe (PID: 2552)
- Unicorn-47462.exe (PID: 6080)
- Unicorn-25210.exe (PID: 4268)
- Unicorn-59552.exe (PID: 2904)
- Unicorn-1260.exe (PID: 5544)
- Unicorn-27478.exe (PID: 3956)
- Unicorn-20950.exe (PID: 5548)
- Unicorn-1297.exe (PID: 2616)
- Unicorn-18106.exe (PID: 6372)
- Unicorn-58873.exe (PID: 3304)
- Unicorn-47004.exe (PID: 4188)
- Unicorn-42500.exe (PID: 4000)
- Unicorn-50306.exe (PID: 728)
- Unicorn-28219.exe (PID: 1128)
- Unicorn-36637.exe (PID: 2772)
- Unicorn-39272.exe (PID: 6192)
- Unicorn-3601.exe (PID: 4200)
- Unicorn-24384.exe (PID: 3140)
- Unicorn-8453.exe (PID: 7208)
- Unicorn-16299.exe (PID: 7224)
- Unicorn-30440.exe (PID: 1628)
- Unicorn-11193.exe (PID: 7184)
- Unicorn-24842.exe (PID: 2244)
- Unicorn-16238.exe (PID: 7264)
- Unicorn-31784.exe (PID: 6228)
- Unicorn-36165.exe (PID: 7232)
- Unicorn-47632.exe (PID: 7668)
- Unicorn-18821.exe (PID: 7504)
- Unicorn-32574.exe (PID: 7380)
- Unicorn-13658.exe (PID: 1088)
- Unicorn-18786.exe (PID: 6436)
- Unicorn-13305.exe (PID: 7356)
- Unicorn-30719.exe (PID: 7304)
- Unicorn-47301.exe (PID: 7676)
- Unicorn-33756.exe (PID: 4628)
- Unicorn-54765.exe (PID: 7852)
- Unicorn-61368.exe (PID: 856)
- Unicorn-23947.exe (PID: 7860)
- Unicorn-26134.exe (PID: 7776)
- Unicorn-12270.exe (PID: 8124)
- Unicorn-46863.exe (PID: 8196)
- Unicorn-15971.exe (PID: 7912)
- Unicorn-49328.exe (PID: 8072)
- Unicorn-60513.exe (PID: 1452)
- Unicorn-41051.exe (PID: 8084)
- Unicorn-48993.exe (PID: 7436)
- Unicorn-38119.exe (PID: 8224)
- Unicorn-27421.exe (PID: 7372)
- Unicorn-64927.exe (PID: 8336)
- Unicorn-18410.exe (PID: 5892)
- Unicorn-57852.exe (PID: 7800)
- Unicorn-21208.exe (PID: 5056)
- Unicorn-25740.exe (PID: 8316)
- Unicorn-15425.exe (PID: 9104)
- Unicorn-16984.exe (PID: 7312)
- Unicorn-17625.exe (PID: 8248)
- Unicorn-16333.exe (PID: 7868)
- Unicorn-57846.exe (PID: 7524)
- Unicorn-39951.exe (PID: 9036)
- Unicorn-21173.exe (PID: 7744)
- Unicorn-44922.exe (PID: 9416)
- Unicorn-46917.exe (PID: 7808)
- Unicorn-49301.exe (PID: 13068)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
629
Monitored processes
491
Malicious processes
76
Suspicious processes
59
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 728 | C:\Users\admin\AppData\Local\Temp\Unicorn-50306.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-50306.exe | Unicorn-9937.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 856 | C:\Users\admin\AppData\Local\Temp\Unicorn-61368.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-61368.exe | Unicorn-37488.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 864 | C:\Users\admin\AppData\Local\Temp\Unicorn-13194.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13194.exe | Unicorn-24383.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1088 | C:\Users\admin\AppData\Local\Temp\Unicorn-13658.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13658.exe | Unicorn-47462.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1128 | C:\Users\admin\AppData\Local\Temp\Unicorn-28219.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-28219.exe | Unicorn-21208.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1164 | C:\Users\admin\AppData\Local\Temp\Unicorn-37488.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-37488.exe | 1 (1281).exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1280 | C:\Users\admin\AppData\Local\Temp\Unicorn-62618.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-62618.exe | Unicorn-33756.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1312 | C:\Users\admin\AppData\Local\Temp\Unicorn-62618.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-62618.exe | Unicorn-59552.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1324 | C:\Users\admin\AppData\Local\Temp\Unicorn-31975.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-31975.exe | Unicorn-15971.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1452 | C:\Users\admin\AppData\Local\Temp\Unicorn-60513.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-60513.exe | Unicorn-25210.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
Total events
13 841
Read events
13 826
Write events
15
Delete events
0
Modification events
| (PID) Process: | (4620) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4620) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4620) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (4112) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4112) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4112) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (5640) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (5640) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (5640) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (1660) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
799
Suspicious files
9
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4112 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8dbcc9b1-c2a5-4dfa-963e-c0ea66e8b06c.down_data | — | |
MD5:— | SHA256:— | |||
| 6184 | 1 (1281).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-47004.exe | executable | |
MD5:73244F1EEF960A4DB4A0F5DEA5421A42 | SHA256:C379ABECE96064F4EFABC554E49E1B49274953605E55E099EF4F185C3B6AECC8 | |||
| 6184 | 1 (1281).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-1260.exe | executable | |
MD5:2E2CA1243BECF528731899A09003B57F | SHA256:E89E170ABA3B0DD9190C6174BB5B18B609A239AE5EC3C7CB99FCBBAEE44C8B67 | |||
| 4112 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8dbcc9b1-c2a5-4dfa-963e-c0ea66e8b06c.4adc2463-87d3-4fc1-8242-7971b38dd8d5.down_meta | binary | |
MD5:3E26BE12237054D0E11B42E349ED87CB | SHA256:0B9A6579123F14167F107A3F7A580CE69AB282CB91C7A77819EF8469949CDDC1 | |||
| 4112 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
| 5544 | Unicorn-1260.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3933.exe | executable | |
MD5:DDAB1AC981E565FB0CDD885ADEB79635 | SHA256:4E80EA60187B86B1D281F8643B6CF7B5C8B7EB9F2CC3222846C6B100D9BDCA17 | |||
| 4112 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4C0F673340DC9A5EBDFBE8B7EA1DB8A8 | SHA256:A5701AED7AA1738753DCD2D4359AA794CE2E1B8B24E293C4211103CF91FF5CF1 | |||
| 1164 | Unicorn-37488.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-21208.exe | executable | |
MD5:FD1DDC28290D7CD8057015A3E3C55E1D | SHA256:79E74A1BF85BD07CDD21688D10D6DF9A5B3A7F67D197AD81967CAAA20CC7D33E | |||
| 1164 | Unicorn-37488.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-61368.exe | executable | |
MD5:42C296A9A1505BD957D8AA5153E542CE | SHA256:EF3959687E78BE54287A0F57925E9D3C684D336634589CEE80940B784702C7FF | |||
| 4112 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\36809386-3863-444a-967e-ff16e6c65cdd.4adc2463-87d3-4fc1-8242-7971b38dd8d5.down_meta | binary | |
MD5:3E26BE12237054D0E11B42E349ED87CB | SHA256:0B9A6579123F14167F107A3F7A580CE69AB282CB91C7A77819EF8469949CDDC1 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
24
DNS requests
14
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4112 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
7876 | SIHClient.exe | GET | 200 | 2.19.217.218:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
2852 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
7876 | SIHClient.exe | GET | 200 | 2.19.217.218:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2104 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 40.126.32.138:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
2112 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2852 | backgroundTaskHost.exe | 20.31.169.57:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2852 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |