| File name: | 1 (158) |
| Full analysis: | https://app.any.run/tasks/8a7cf835-204b-4c73-b77c-d495728a0371 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 17:02:27 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 3D1355FA91E39F3ED9E279E8088E5CF0 |
| SHA1: | 539670C598DAA2DE2C2BF494576C3D6D9A74D3FC |
| SHA256: | 14800998D00C4D4E4D6313FCE0901E0819027391ED1D8976BB49A1400681C60D |
| SSDEEP: | 6144:9778ng9PQDce65LjLGeEzBjx5wPq5p8GBf/WF1OdHk/8SwjwpyAvEhB1LTd6sKSa:9POmFe65/LZhP0+afOF1OdXx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- Unicorn-9435.exe (PID: 6676)
- Unicorn-37396.exe (PID: 2088)
- Unicorn-61578.exe (PID: 4172)
- 1 (158).exe (PID: 3888)
- Unicorn-6097.exe (PID: 1040)
- Unicorn-32325.exe (PID: 2320)
- Unicorn-33717.exe (PID: 4980)
- Unicorn-33717.exe (PID: 5400)
- Unicorn-36296.exe (PID: 1168)
- Unicorn-4378.exe (PID: 6040)
- Unicorn-53652.exe (PID: 2268)
- Unicorn-53823.exe (PID: 1300)
- Unicorn-32254.exe (PID: 6004)
- Unicorn-60211.exe (PID: 4560)
- Unicorn-51580.exe (PID: 6816)
- Unicorn-65338.exe (PID: 5124)
- Unicorn-34934.exe (PID: 2692)
- Unicorn-60398.exe (PID: 660)
- Unicorn-41924.exe (PID: 6736)
- Unicorn-12573.exe (PID: 5352)
- Unicorn-57362.exe (PID: 1072)
- Unicorn-60398.exe (PID: 6240)
- Unicorn-63998.exe (PID: 4244)
- Unicorn-11425.exe (PID: 2192)
- Unicorn-45562.exe (PID: 7336)
- Unicorn-11690.exe (PID: 5408)
- Unicorn-58452.exe (PID: 6228)
- Unicorn-38385.exe (PID: 5436)
- Unicorn-25041.exe (PID: 7304)
- Unicorn-55027.exe (PID: 7356)
- Unicorn-398.exe (PID: 7260)
- Unicorn-57362.exe (PID: 976)
- Unicorn-58674.exe (PID: 7432)
- Unicorn-36024.exe (PID: 7424)
- Unicorn-44939.exe (PID: 7464)
- Unicorn-14337.exe (PID: 7796)
- Unicorn-10829.exe (PID: 7760)
- Unicorn-49895.exe (PID: 7820)
- Unicorn-21669.exe (PID: 7640)
- Unicorn-47176.exe (PID: 7964)
- Unicorn-13242.exe (PID: 7924)
- Unicorn-24149.exe (PID: 7980)
- Unicorn-46771.exe (PID: 7860)
- Unicorn-60004.exe (PID: 8036)
- Unicorn-44415.exe (PID: 8084)
- Unicorn-63896.exe (PID: 8060)
- Unicorn-29369.exe (PID: 8044)
- Unicorn-54966.exe (PID: 8132)
- Unicorn-34623.exe (PID: 8092)
- Unicorn-46792.exe (PID: 8160)
- Unicorn-51452.exe (PID: 8124)
- Unicorn-64088.exe (PID: 8028)
- Unicorn-57435.exe (PID: 8108)
- Unicorn-57958.exe (PID: 8152)
- Unicorn-16402.exe (PID: 8116)
- Unicorn-47560.exe (PID: 8100)
- Unicorn-27716.exe (PID: 7204)
- Unicorn-55297.exe (PID: 8176)
- Unicorn-7414.exe (PID: 4652)
- Unicorn-23632.exe (PID: 7220)
- Unicorn-17384.exe (PID: 7244)
- Unicorn-23715.exe (PID: 7700)
- Unicorn-63661.exe (PID: 3968)
- Unicorn-57072.exe (PID: 7724)
- Unicorn-14784.exe (PID: 5212)
- Unicorn-45567.exe (PID: 4724)
- Unicorn-21276.exe (PID: 5960)
- Unicorn-6776.exe (PID: 668)
- Unicorn-62287.exe (PID: 7708)
- Unicorn-10538.exe (PID: 5232)
- Unicorn-44555.exe (PID: 7740)
- Unicorn-21276.exe (PID: 4868)
- Unicorn-5323.exe (PID: 7312)
- Unicorn-38742.exe (PID: 4628)
- Unicorn-58608.exe (PID: 6264)
- Unicorn-32057.exe (PID: 8212)
- Unicorn-32057.exe (PID: 8220)
- Unicorn-48219.exe (PID: 8260)
- Unicorn-16699.exe (PID: 5036)
- Unicorn-60663.exe (PID: 8276)
- Unicorn-2507.exe (PID: 8284)
- Unicorn-15323.exe (PID: 8504)
- Unicorn-30761.exe (PID: 8592)
- Unicorn-53372.exe (PID: 7692)
- Unicorn-30404.exe (PID: 2288)
- Unicorn-18461.exe (PID: 7856)
- Unicorn-56548.exe (PID: 8668)
- Unicorn-31551.exe (PID: 8640)
- Unicorn-16824.exe (PID: 8812)
- Unicorn-12500.exe (PID: 8660)
- Unicorn-16824.exe (PID: 8828)
- Unicorn-7539.exe (PID: 8724)
- Unicorn-36860.exe (PID: 8992)
- Unicorn-34128.exe (PID: 8804)
- Unicorn-19022.exe (PID: 8784)
- Unicorn-37244.exe (PID: 8796)
- Unicorn-16824.exe (PID: 8820)
- Unicorn-118.exe (PID: 8740)
- Unicorn-31960.exe (PID: 8916)
- Unicorn-52931.exe (PID: 9044)
- Unicorn-47066.exe (PID: 9028)
- Unicorn-19984.exe (PID: 8748)
- Unicorn-41498.exe (PID: 9000)
- Unicorn-51342.exe (PID: 9136)
- Unicorn-49496.exe (PID: 8756)
- Unicorn-57094.exe (PID: 8908)
- Unicorn-6308.exe (PID: 8320)
- Unicorn-28692.exe (PID: 9080)
- Unicorn-22230.exe (PID: 8312)
- Unicorn-28692.exe (PID: 9072)
- Unicorn-38758.exe (PID: 8448)
- Unicorn-33165.exe (PID: 9192)
Executable content was dropped or overwritten
- Unicorn-61578.exe (PID: 4172)
- Unicorn-9435.exe (PID: 6676)
- 1 (158).exe (PID: 3888)
- Unicorn-6097.exe (PID: 1040)
- Unicorn-32325.exe (PID: 2320)
- Unicorn-37396.exe (PID: 2088)
- Unicorn-33717.exe (PID: 5400)
- Unicorn-36296.exe (PID: 1168)
- Unicorn-4378.exe (PID: 6040)
- Unicorn-53652.exe (PID: 2268)
- Unicorn-32254.exe (PID: 6004)
- Unicorn-33717.exe (PID: 4980)
- Unicorn-38385.exe (PID: 5436)
- Unicorn-60211.exe (PID: 4560)
- Unicorn-51580.exe (PID: 6816)
- Unicorn-65338.exe (PID: 5124)
- Unicorn-34934.exe (PID: 2692)
- Unicorn-60398.exe (PID: 660)
- Unicorn-41924.exe (PID: 6736)
- Unicorn-53823.exe (PID: 1300)
- Unicorn-12573.exe (PID: 5352)
- Unicorn-57362.exe (PID: 1072)
- Unicorn-11690.exe (PID: 5408)
- Unicorn-63998.exe (PID: 4244)
- Unicorn-11425.exe (PID: 2192)
- Unicorn-45562.exe (PID: 7336)
- Unicorn-60398.exe (PID: 6240)
- Unicorn-25041.exe (PID: 7304)
- Unicorn-57362.exe (PID: 976)
- Unicorn-58452.exe (PID: 6228)
- Unicorn-55027.exe (PID: 7356)
- Unicorn-398.exe (PID: 7260)
- Unicorn-36024.exe (PID: 7424)
- Unicorn-44939.exe (PID: 7464)
- Unicorn-21669.exe (PID: 7640)
- Unicorn-58674.exe (PID: 7432)
- Unicorn-14337.exe (PID: 7796)
- Unicorn-49895.exe (PID: 7820)
- Unicorn-46771.exe (PID: 7860)
- Unicorn-47176.exe (PID: 7964)
- Unicorn-13242.exe (PID: 7924)
- Unicorn-24149.exe (PID: 7980)
- Unicorn-63896.exe (PID: 8060)
- Unicorn-60004.exe (PID: 8036)
- Unicorn-54966.exe (PID: 8132)
- Unicorn-44415.exe (PID: 8084)
- Unicorn-10730.exe (PID: 8076)
- Unicorn-29369.exe (PID: 8044)
- Unicorn-57435.exe (PID: 8108)
- Unicorn-34623.exe (PID: 8092)
- Unicorn-46792.exe (PID: 8160)
- Unicorn-51452.exe (PID: 8124)
- Unicorn-16402.exe (PID: 8116)
- Unicorn-47560.exe (PID: 8100)
- Unicorn-43284.exe (PID: 8068)
- Unicorn-7414.exe (PID: 4652)
- Unicorn-23632.exe (PID: 7220)
- Unicorn-17384.exe (PID: 7244)
- Unicorn-14784.exe (PID: 5212)
- Unicorn-18461.exe (PID: 7856)
- Unicorn-63661.exe (PID: 3968)
- Unicorn-53372.exe (PID: 7692)
- Unicorn-57072.exe (PID: 7724)
- Unicorn-62287.exe (PID: 7708)
- Unicorn-21276.exe (PID: 5960)
- Unicorn-30404.exe (PID: 2288)
- Unicorn-10538.exe (PID: 5232)
- Unicorn-44555.exe (PID: 7740)
- Unicorn-21276.exe (PID: 4868)
- Unicorn-5323.exe (PID: 7312)
- Unicorn-38742.exe (PID: 4628)
- Unicorn-32057.exe (PID: 8220)
- Unicorn-32057.exe (PID: 8212)
- Unicorn-58608.exe (PID: 6264)
- Unicorn-48219.exe (PID: 8260)
- Unicorn-2507.exe (PID: 8284)
- Unicorn-16699.exe (PID: 5036)
- Unicorn-64088.exe (PID: 8028)
- Unicorn-57958.exe (PID: 8152)
- Unicorn-27716.exe (PID: 7204)
- Unicorn-30761.exe (PID: 8592)
- Unicorn-6776.exe (PID: 668)
- Unicorn-15323.exe (PID: 8504)
- Unicorn-45567.exe (PID: 4724)
- Unicorn-10829.exe (PID: 7760)
- Unicorn-56548.exe (PID: 8668)
- Unicorn-31551.exe (PID: 8640)
- Unicorn-12500.exe (PID: 8660)
- Unicorn-16824.exe (PID: 8812)
- Unicorn-16824.exe (PID: 8828)
- Unicorn-7539.exe (PID: 8724)
- Unicorn-34128.exe (PID: 8804)
- Unicorn-19792.exe (PID: 8692)
- Unicorn-37244.exe (PID: 8796)
- Unicorn-35863.exe (PID: 8708)
- Unicorn-60663.exe (PID: 8276)
- Unicorn-31960.exe (PID: 8916)
- Unicorn-118.exe (PID: 8740)
- Unicorn-49496.exe (PID: 8756)
- Unicorn-16824.exe (PID: 8820)
- Unicorn-19984.exe (PID: 8748)
- Unicorn-47066.exe (PID: 9028)
- Unicorn-41498.exe (PID: 9000)
- Unicorn-51342.exe (PID: 9136)
- Unicorn-52931.exe (PID: 9044)
- Unicorn-28692.exe (PID: 9072)
- Unicorn-6308.exe (PID: 8320)
- Unicorn-22230.exe (PID: 8312)
- Unicorn-57094.exe (PID: 8908)
- Unicorn-28692.exe (PID: 9080)
- Unicorn-9018.exe (PID: 9180)
- Unicorn-38758.exe (PID: 8448)
- Unicorn-61364.exe (PID: 9020)
- Unicorn-5915.exe (PID: 9292)
- Unicorn-51826.exe (PID: 8928)
- Unicorn-63092.exe (PID: 9260)
- Unicorn-33330.exe (PID: 9036)
- Unicorn-25162.exe (PID: 8976)
- Unicorn-28884.exe (PID: 9172)
- Unicorn-55297.exe (PID: 8176)
- Unicorn-24534.exe (PID: 9516)
- Unicorn-9807.exe (PID: 8328)
- Unicorn-26144.exe (PID: 8896)
- Unicorn-27296.exe (PID: 9368)
- Unicorn-51800.exe (PID: 9316)
- Unicorn-47716.exe (PID: 9340)
- Unicorn-33165.exe (PID: 9192)
- Unicorn-39740.exe (PID: 9388)
- Unicorn-23715.exe (PID: 7700)
- Unicorn-31572.exe (PID: 9448)
- Unicorn-36402.exe (PID: 9704)
- Unicorn-58498.exe (PID: 9760)
- Unicorn-29141.exe (PID: 9484)
- Unicorn-46845.exe (PID: 9548)
- Unicorn-39740.exe (PID: 9380)
- Unicorn-23715.exe (PID: 9572)
- Unicorn-15406.exe (PID: 9492)
- Unicorn-23715.exe (PID: 9564)
- Unicorn-18936.exe (PID: 9468)
- Unicorn-28064.exe (PID: 9580)
- Unicorn-35909.exe (PID: 9556)
- Unicorn-60051.exe (PID: 9672)
- Unicorn-7067.exe (PID: 9432)
- Unicorn-22060.exe (PID: 9244)
- Unicorn-17849.exe (PID: 9604)
- Unicorn-58681.exe (PID: 9820)
- Unicorn-65183.exe (PID: 9712)
- Unicorn-4882.exe (PID: 9812)
- Unicorn-36860.exe (PID: 8992)
- Unicorn-45936.exe (PID: 10008)
- Unicorn-49999.exe (PID: 9836)
- Unicorn-39806.exe (PID: 10000)
- Unicorn-37192.exe (PID: 9884)
- Unicorn-23596.exe (PID: 9744)
- Unicorn-45936.exe (PID: 10016)
- Unicorn-36402.exe (PID: 9696)
- Unicorn-49999.exe (PID: 9828)
- Unicorn-21741.exe (PID: 9796)
- Unicorn-31825.exe (PID: 9624)
- Unicorn-19022.exe (PID: 8784)
- Unicorn-57207.exe (PID: 9776)
- Unicorn-47233.exe (PID: 9876)
- Unicorn-47233.exe (PID: 9868)
- Unicorn-63092.exe (PID: 9252)
- Unicorn-64051.exe (PID: 9592)
- Unicorn-36860.exe (PID: 9008)
- Unicorn-45531.exe (PID: 9956)
- Unicorn-30677.exe (PID: 9976)
- Unicorn-47498.exe (PID: 9860)
- Unicorn-40700.exe (PID: 9908)
- Unicorn-16005.exe (PID: 9992)
INFO
Checks supported languages
- 1 (158).exe (PID: 3888)
- Unicorn-9435.exe (PID: 6676)
- Unicorn-37396.exe (PID: 2088)
- Unicorn-61578.exe (PID: 4172)
- Unicorn-6097.exe (PID: 1040)
- Unicorn-32325.exe (PID: 2320)
- Unicorn-33717.exe (PID: 4980)
- Unicorn-33717.exe (PID: 5400)
- Unicorn-36296.exe (PID: 1168)
- Unicorn-53652.exe (PID: 2268)
- Unicorn-32254.exe (PID: 6004)
- Unicorn-53823.exe (PID: 1300)
- Unicorn-38385.exe (PID: 5436)
- Unicorn-60211.exe (PID: 4560)
- Unicorn-51580.exe (PID: 6816)
- Unicorn-4378.exe (PID: 6040)
- Unicorn-34934.exe (PID: 2692)
- Unicorn-65338.exe (PID: 5124)
- Unicorn-12573.exe (PID: 5352)
- Unicorn-58452.exe (PID: 6228)
- Unicorn-11425.exe (PID: 2192)
- Unicorn-63998.exe (PID: 4244)
- Unicorn-11690.exe (PID: 5408)
- Unicorn-57362.exe (PID: 1072)
- Unicorn-41924.exe (PID: 6736)
- Unicorn-60398.exe (PID: 6240)
- Unicorn-398.exe (PID: 7260)
- Unicorn-45562.exe (PID: 7336)
- Unicorn-55027.exe (PID: 7356)
- Unicorn-25041.exe (PID: 7304)
- Unicorn-36024.exe (PID: 7424)
- Unicorn-44939.exe (PID: 7464)
- Unicorn-58674.exe (PID: 7432)
- Unicorn-21669.exe (PID: 7640)
- Unicorn-10829.exe (PID: 7760)
- Unicorn-14337.exe (PID: 7796)
- Unicorn-49895.exe (PID: 7820)
- Unicorn-46771.exe (PID: 7860)
- Unicorn-13242.exe (PID: 7924)
- Unicorn-47176.exe (PID: 7964)
- Unicorn-24149.exe (PID: 7980)
- Unicorn-60004.exe (PID: 8036)
- Unicorn-64088.exe (PID: 8028)
- Unicorn-16402.exe (PID: 8116)
- Unicorn-57435.exe (PID: 8108)
- Unicorn-51452.exe (PID: 8124)
- Unicorn-55297.exe (PID: 8176)
- Unicorn-23632.exe (PID: 7220)
- Unicorn-27716.exe (PID: 7204)
- Unicorn-63896.exe (PID: 8060)
- Unicorn-10730.exe (PID: 8076)
- Unicorn-29369.exe (PID: 8044)
- Unicorn-53372.exe (PID: 7692)
- Unicorn-23715.exe (PID: 7700)
- Unicorn-14784.exe (PID: 5212)
- Unicorn-62287.exe (PID: 7708)
- Unicorn-18461.exe (PID: 7856)
- Unicorn-45567.exe (PID: 4724)
- Unicorn-44555.exe (PID: 7740)
- Unicorn-63661.exe (PID: 3968)
- Unicorn-21276.exe (PID: 5960)
- Unicorn-21276.exe (PID: 4868)
- Unicorn-6776.exe (PID: 668)
- Unicorn-17384.exe (PID: 7244)
- Unicorn-30404.exe (PID: 2288)
- Unicorn-10538.exe (PID: 5232)
- Unicorn-38742.exe (PID: 4628)
- Unicorn-58608.exe (PID: 6264)
- Unicorn-5323.exe (PID: 7312)
- Unicorn-32057.exe (PID: 8220)
- Unicorn-16699.exe (PID: 5036)
- Unicorn-60663.exe (PID: 8276)
- Unicorn-2507.exe (PID: 8284)
- Unicorn-48219.exe (PID: 8260)
- Unicorn-56548.exe (PID: 8668)
- Unicorn-12500.exe (PID: 8660)
- Unicorn-19792.exe (PID: 8692)
- Unicorn-35863.exe (PID: 8708)
- Unicorn-15323.exe (PID: 8504)
- Unicorn-30761.exe (PID: 8592)
- Unicorn-31551.exe (PID: 8640)
- Unicorn-7539.exe (PID: 8724)
- Unicorn-19984.exe (PID: 8748)
- Unicorn-118.exe (PID: 8740)
- Unicorn-16824.exe (PID: 8820)
- Unicorn-49496.exe (PID: 8756)
- Unicorn-34128.exe (PID: 8804)
- Unicorn-37244.exe (PID: 8796)
- Unicorn-16824.exe (PID: 8812)
- Unicorn-57094.exe (PID: 8908)
- Unicorn-31960.exe (PID: 8916)
- Unicorn-51826.exe (PID: 8928)
- Unicorn-19022.exe (PID: 8784)
- Unicorn-16824.exe (PID: 8828)
- Unicorn-25162.exe (PID: 8976)
- Unicorn-47066.exe (PID: 9028)
- Unicorn-36860.exe (PID: 9008)
- Unicorn-36860.exe (PID: 8992)
- Unicorn-41498.exe (PID: 9000)
- Unicorn-52931.exe (PID: 9044)
- Unicorn-61364.exe (PID: 9020)
- Unicorn-28692.exe (PID: 9080)
- Unicorn-63263.exe (PID: 8252)
- Unicorn-33165.exe (PID: 9192)
- Unicorn-22230.exe (PID: 8312)
- Unicorn-9018.exe (PID: 9180)
- Unicorn-6308.exe (PID: 8320)
- Unicorn-51342.exe (PID: 9136)
- Unicorn-28884.exe (PID: 9172)
- Unicorn-38758.exe (PID: 8448)
- Unicorn-26144.exe (PID: 8896)
- Unicorn-22060.exe (PID: 9244)
- Unicorn-63092.exe (PID: 9252)
- Unicorn-5915.exe (PID: 9292)
- Unicorn-51800.exe (PID: 9316)
- Unicorn-27296.exe (PID: 9368)
- Unicorn-39740.exe (PID: 9380)
- Unicorn-31572.exe (PID: 9448)
- Unicorn-47716.exe (PID: 9340)
- Unicorn-15406.exe (PID: 9492)
- Unicorn-23715.exe (PID: 9572)
- Unicorn-24534.exe (PID: 9516)
- Unicorn-28064.exe (PID: 9580)
- Unicorn-46845.exe (PID: 9548)
- Unicorn-64051.exe (PID: 9592)
- Unicorn-35909.exe (PID: 9556)
- Unicorn-31825.exe (PID: 9624)
- Unicorn-23715.exe (PID: 9564)
- Unicorn-65183.exe (PID: 9712)
- Unicorn-57207.exe (PID: 9776)
- Unicorn-23596.exe (PID: 9744)
- Unicorn-4882.exe (PID: 9812)
- Unicorn-60051.exe (PID: 9672)
- Unicorn-36402.exe (PID: 9704)
- Unicorn-36402.exe (PID: 9696)
- Unicorn-47233.exe (PID: 9868)
- Unicorn-49999.exe (PID: 9828)
- Unicorn-16005.exe (PID: 9992)
- Unicorn-49999.exe (PID: 9836)
- Unicorn-47233.exe (PID: 9876)
- Unicorn-45531.exe (PID: 9956)
- Unicorn-30677.exe (PID: 9976)
- Unicorn-45936.exe (PID: 10016)
- Unicorn-47555.exe (PID: 10328)
- Unicorn-54790.exe (PID: 10260)
- Unicorn-64275.exe (PID: 6488)
- Unicorn-36594.exe (PID: 10288)
- Unicorn-55723.exe (PID: 10316)
- Unicorn-58483.exe (PID: 10444)
- Unicorn-43470.exe (PID: 10416)
- Unicorn-33661.exe (PID: 10468)
- Unicorn-19926.exe (PID: 10460)
- Unicorn-41934.exe (PID: 7632)
- Unicorn-31056.exe (PID: 7684)
- Unicorn-62442.exe (PID: 10548)
- Unicorn-52791.exe (PID: 10528)
- Unicorn-10441.exe (PID: 10592)
- Unicorn-11758.exe (PID: 10572)
- Unicorn-31359.exe (PID: 10556)
- Unicorn-61181.exe (PID: 10888)
- Unicorn-48707.exe (PID: 10540)
- Unicorn-25493.exe (PID: 10564)
- Unicorn-40538.exe (PID: 10660)
- Unicorn-40538.exe (PID: 10652)
- Unicorn-37554.exe (PID: 10820)
- Unicorn-35878.exe (PID: 10740)
- Unicorn-50891.exe (PID: 10772)
- Unicorn-35251.exe (PID: 10836)
- Unicorn-21618.exe (PID: 11028)
- Unicorn-57498.exe (PID: 10996)
- Unicorn-49823.exe (PID: 11136)
- Unicorn-16958.exe (PID: 11096)
- Unicorn-49330.exe (PID: 11056)
- Unicorn-8790.exe (PID: 11108)
- Unicorn-45931.exe (PID: 11188)
- Unicorn-21648.exe (PID: 11180)
- Unicorn-49330.exe (PID: 11076)
- Unicorn-45931.exe (PID: 11196)
- Unicorn-45931.exe (PID: 11204)
- Unicorn-14026.exe (PID: 11256)
- Unicorn-9558.exe (PID: 5984)
- Unicorn-56158.exe (PID: 11296)
- Unicorn-13014.exe (PID: 11384)
- Unicorn-4879.exe (PID: 11352)
- Unicorn-7149.exe (PID: 11344)
- Unicorn-7149.exe (PID: 11360)
- Unicorn-58951.exe (PID: 11368)
- Unicorn-4349.exe (PID: 11400)
- Unicorn-58951.exe (PID: 11376)
- Unicorn-38722.exe (PID: 11248)
- Unicorn-66.exe (PID: 11324)
- Unicorn-36506.exe (PID: 11640)
- Unicorn-32229.exe (PID: 11584)
- Unicorn-8109.exe (PID: 11480)
- Unicorn-47851.exe (PID: 11552)
- Unicorn-59283.exe (PID: 11560)
- Unicorn-54431.exe (PID: 11596)
- Unicorn-46918.exe (PID: 11720)
- Unicorn-12001.exe (PID: 11680)
- Unicorn-31898.exe (PID: 11728)
- Unicorn-59362.exe (PID: 11760)
- Unicorn-23730.exe (PID: 11740)
- Unicorn-20745.exe (PID: 11824)
- Unicorn-48978.exe (PID: 11840)
- Unicorn-18442.exe (PID: 11848)
- Unicorn-49142.exe (PID: 11516)
- Unicorn-20820.exe (PID: 11964)
- Unicorn-29818.exe (PID: 11872)
- Unicorn-15.exe (PID: 11984)
- Unicorn-13227.exe (PID: 12052)
- Unicorn-1167.exe (PID: 12068)
- Unicorn-33648.exe (PID: 12000)
- Unicorn-44622.exe (PID: 12128)
- Unicorn-46668.exe (PID: 12152)
- Unicorn-46860.exe (PID: 12180)
- Unicorn-37540.exe (PID: 12116)
- Unicorn-50368.exe (PID: 12208)
- Unicorn-46476.exe (PID: 3800)
- Unicorn-21972.exe (PID: 2656)
- Unicorn-39424.exe (PID: 5892)
- Unicorn-38308.exe (PID: 12268)
- Unicorn-13611.exe (PID: 12260)
- Unicorn-63544.exe (PID: 8228)
The sample compiled with chinese language support
- 1 (158).exe (PID: 3888)
- Unicorn-6097.exe (PID: 1040)
- Unicorn-32325.exe (PID: 2320)
- Unicorn-37396.exe (PID: 2088)
- Unicorn-33717.exe (PID: 5400)
- Unicorn-9435.exe (PID: 6676)
- Unicorn-36296.exe (PID: 1168)
- Unicorn-4378.exe (PID: 6040)
- Unicorn-53652.exe (PID: 2268)
- Unicorn-61578.exe (PID: 4172)
- Unicorn-33717.exe (PID: 4980)
- Unicorn-38385.exe (PID: 5436)
- Unicorn-60211.exe (PID: 4560)
- Unicorn-32254.exe (PID: 6004)
- Unicorn-51580.exe (PID: 6816)
- Unicorn-65338.exe (PID: 5124)
- Unicorn-34934.exe (PID: 2692)
- Unicorn-41924.exe (PID: 6736)
- Unicorn-53823.exe (PID: 1300)
- Unicorn-60398.exe (PID: 660)
- Unicorn-57362.exe (PID: 1072)
- Unicorn-12573.exe (PID: 5352)
- Unicorn-63998.exe (PID: 4244)
- Unicorn-11425.exe (PID: 2192)
- Unicorn-60398.exe (PID: 6240)
- Unicorn-58452.exe (PID: 6228)
- Unicorn-11690.exe (PID: 5408)
- Unicorn-45562.exe (PID: 7336)
- Unicorn-25041.exe (PID: 7304)
- Unicorn-57362.exe (PID: 976)
- Unicorn-55027.exe (PID: 7356)
- Unicorn-398.exe (PID: 7260)
- Unicorn-58674.exe (PID: 7432)
- Unicorn-36024.exe (PID: 7424)
- Unicorn-44939.exe (PID: 7464)
- Unicorn-21669.exe (PID: 7640)
- Unicorn-14337.exe (PID: 7796)
- Unicorn-49895.exe (PID: 7820)
- Unicorn-47176.exe (PID: 7964)
- Unicorn-24149.exe (PID: 7980)
- Unicorn-46771.exe (PID: 7860)
- Unicorn-13242.exe (PID: 7924)
Reads the computer name
- 1 (158).exe (PID: 3888)
- Unicorn-9435.exe (PID: 6676)
- Unicorn-37396.exe (PID: 2088)
- Unicorn-61578.exe (PID: 4172)
- Unicorn-6097.exe (PID: 1040)
- Unicorn-32325.exe (PID: 2320)
- Unicorn-33717.exe (PID: 4980)
- Unicorn-33717.exe (PID: 5400)
- Unicorn-53652.exe (PID: 2268)
- Unicorn-36296.exe (PID: 1168)
- Unicorn-32254.exe (PID: 6004)
- Unicorn-4378.exe (PID: 6040)
- Unicorn-60211.exe (PID: 4560)
- Unicorn-65338.exe (PID: 5124)
- Unicorn-51580.exe (PID: 6816)
- Unicorn-34934.exe (PID: 2692)
- Unicorn-60398.exe (PID: 660)
- Unicorn-41924.exe (PID: 6736)
- Unicorn-12573.exe (PID: 5352)
- Unicorn-57362.exe (PID: 1072)
- Unicorn-57362.exe (PID: 976)
- Unicorn-63998.exe (PID: 4244)
- Unicorn-58452.exe (PID: 6228)
- Unicorn-11690.exe (PID: 5408)
- Unicorn-45562.exe (PID: 7336)
- Unicorn-55027.exe (PID: 7356)
- Unicorn-44939.exe (PID: 7464)
- Unicorn-58674.exe (PID: 7432)
- Unicorn-36024.exe (PID: 7424)
- Unicorn-25041.exe (PID: 7304)
- Unicorn-10829.exe (PID: 7760)
- Unicorn-49895.exe (PID: 7820)
- Unicorn-14337.exe (PID: 7796)
- Unicorn-46771.exe (PID: 7860)
- Unicorn-47176.exe (PID: 7964)
- Unicorn-13242.exe (PID: 7924)
- Unicorn-63896.exe (PID: 8060)
- Unicorn-60004.exe (PID: 8036)
- Unicorn-44415.exe (PID: 8084)
- Unicorn-34623.exe (PID: 8092)
- Unicorn-57958.exe (PID: 8152)
- Unicorn-51452.exe (PID: 8124)
- Unicorn-16402.exe (PID: 8116)
- Unicorn-27716.exe (PID: 7204)
- Unicorn-43284.exe (PID: 8068)
- Unicorn-55297.exe (PID: 8176)
- Unicorn-46792.exe (PID: 8160)
- Unicorn-17384.exe (PID: 7244)
- Unicorn-14784.exe (PID: 5212)
- Unicorn-45567.exe (PID: 4724)
- Unicorn-63661.exe (PID: 3968)
- Unicorn-53372.exe (PID: 7692)
- Unicorn-23715.exe (PID: 7700)
- Unicorn-62287.exe (PID: 7708)
- Unicorn-21276.exe (PID: 5960)
- Unicorn-10538.exe (PID: 5232)
- Unicorn-58608.exe (PID: 6264)
- Unicorn-21276.exe (PID: 4868)
- Unicorn-32057.exe (PID: 8220)
- Unicorn-32057.exe (PID: 8212)
- Unicorn-15323.exe (PID: 8504)
- Unicorn-31551.exe (PID: 8640)
- Unicorn-12500.exe (PID: 8660)
- Unicorn-35863.exe (PID: 8708)
- Unicorn-19792.exe (PID: 8692)
- Unicorn-118.exe (PID: 8740)
- Unicorn-49496.exe (PID: 8756)
- Unicorn-19022.exe (PID: 8784)
- Unicorn-57094.exe (PID: 8908)
- Unicorn-28692.exe (PID: 9080)
- Unicorn-6308.exe (PID: 8320)
- Unicorn-33165.exe (PID: 9192)
- Unicorn-36860.exe (PID: 9008)
- Unicorn-9018.exe (PID: 9180)
- Unicorn-61364.exe (PID: 9020)
Create files in a temporary directory
- Unicorn-61578.exe (PID: 4172)
- 1 (158).exe (PID: 3888)
- Unicorn-9435.exe (PID: 6676)
- Unicorn-6097.exe (PID: 1040)
- Unicorn-37396.exe (PID: 2088)
- Unicorn-53652.exe (PID: 2268)
- Unicorn-4378.exe (PID: 6040)
- Unicorn-32254.exe (PID: 6004)
- Unicorn-60211.exe (PID: 4560)
- Unicorn-51580.exe (PID: 6816)
- Unicorn-65338.exe (PID: 5124)
- Unicorn-34934.exe (PID: 2692)
- Unicorn-60398.exe (PID: 660)
- Unicorn-53823.exe (PID: 1300)
- Unicorn-12573.exe (PID: 5352)
- Unicorn-57362.exe (PID: 1072)
- Unicorn-33717.exe (PID: 4980)
- Unicorn-25041.exe (PID: 7304)
- Unicorn-45562.exe (PID: 7336)
- Unicorn-60398.exe (PID: 6240)
- Unicorn-63998.exe (PID: 4244)
- Unicorn-32325.exe (PID: 2320)
- Unicorn-38385.exe (PID: 5436)
- Unicorn-398.exe (PID: 7260)
- Unicorn-33717.exe (PID: 5400)
- Unicorn-58674.exe (PID: 7432)
- Unicorn-36296.exe (PID: 1168)
- Unicorn-49895.exe (PID: 7820)
- Unicorn-46771.exe (PID: 7860)
- Unicorn-14337.exe (PID: 7796)
- Unicorn-47176.exe (PID: 7964)
- Unicorn-13242.exe (PID: 7924)
- Unicorn-54966.exe (PID: 8132)
- Unicorn-60004.exe (PID: 8036)
- Unicorn-51452.exe (PID: 8124)
- Unicorn-57435.exe (PID: 8108)
- Unicorn-10730.exe (PID: 8076)
- Unicorn-34623.exe (PID: 8092)
- Unicorn-16402.exe (PID: 8116)
- Unicorn-57362.exe (PID: 976)
- Unicorn-58452.exe (PID: 6228)
- Unicorn-43284.exe (PID: 8068)
- Unicorn-55027.exe (PID: 7356)
- Unicorn-11690.exe (PID: 5408)
- Unicorn-53372.exe (PID: 7692)
- Unicorn-57072.exe (PID: 7724)
- Unicorn-44555.exe (PID: 7740)
- Unicorn-14784.exe (PID: 5212)
- Unicorn-21276.exe (PID: 5960)
- Unicorn-10538.exe (PID: 5232)
- Unicorn-38742.exe (PID: 4628)
- Unicorn-36024.exe (PID: 7424)
- Unicorn-21276.exe (PID: 4868)
- Unicorn-21669.exe (PID: 7640)
- Unicorn-5323.exe (PID: 7312)
- Unicorn-58608.exe (PID: 6264)
- Unicorn-41924.exe (PID: 6736)
- Unicorn-32057.exe (PID: 8212)
- Unicorn-32057.exe (PID: 8220)
- Unicorn-24149.exe (PID: 7980)
- Unicorn-48219.exe (PID: 8260)
- Unicorn-18461.exe (PID: 7856)
- Unicorn-2507.exe (PID: 8284)
- Unicorn-16699.exe (PID: 5036)
- Unicorn-29369.exe (PID: 8044)
- Unicorn-46792.exe (PID: 8160)
- Unicorn-57958.exe (PID: 8152)
- Unicorn-11425.exe (PID: 2192)
- Unicorn-63896.exe (PID: 8060)
- Unicorn-47560.exe (PID: 8100)
- Unicorn-17384.exe (PID: 7244)
- Unicorn-7414.exe (PID: 4652)
- Unicorn-23632.exe (PID: 7220)
- Unicorn-63661.exe (PID: 3968)
- Unicorn-30761.exe (PID: 8592)
- Unicorn-6776.exe (PID: 668)
- Unicorn-15323.exe (PID: 8504)
- Unicorn-30404.exe (PID: 2288)
- Unicorn-56548.exe (PID: 8668)
- Unicorn-12500.exe (PID: 8660)
- Unicorn-16824.exe (PID: 8828)
- Unicorn-31551.exe (PID: 8640)
- Unicorn-35863.exe (PID: 8708)
- Unicorn-52931.exe (PID: 9044)
- Unicorn-31960.exe (PID: 8916)
- Unicorn-19984.exe (PID: 8748)
- Unicorn-47066.exe (PID: 9028)
- Unicorn-51342.exe (PID: 9136)
- Unicorn-49496.exe (PID: 8756)
- Unicorn-41498.exe (PID: 9000)
- Unicorn-6308.exe (PID: 8320)
- Unicorn-28692.exe (PID: 9080)
- Unicorn-57094.exe (PID: 8908)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 2192)
- BackgroundTransferHost.exe (PID: 976)
- BackgroundTransferHost.exe (PID: 208)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 976)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 976)
- slui.exe (PID: 4024)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
430
Monitored processes
298
Malicious processes
42
Suspicious processes
45
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 660 | C:\Users\admin\AppData\Local\Temp\Unicorn-60398.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-60398.exe | Unicorn-53823.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 668 | C:\Users\admin\AppData\Local\Temp\Unicorn-6776.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-6776.exe | Unicorn-49895.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 976 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 976 | C:\Users\admin\AppData\Local\Temp\Unicorn-57362.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-57362.exe | Unicorn-32325.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1040 | C:\Users\admin\AppData\Local\Temp\Unicorn-6097.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-6097.exe | 1 (158).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1072 | C:\Users\admin\AppData\Local\Temp\Unicorn-57362.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-57362.exe | Unicorn-33717.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1168 | C:\Users\admin\AppData\Local\Temp\Unicorn-36296.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-36296.exe | Unicorn-6097.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1300 | C:\Users\admin\AppData\Local\Temp\Unicorn-53823.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53823.exe | Unicorn-61578.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1672 | C:\Users\admin\AppData\Local\Temp\Unicorn-60191.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-60191.exe | — | Unicorn-60004.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
8 153
Read events
8 138
Write events
15
Delete events
0
Modification events
| (PID) Process: | (2192) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2192) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2192) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (976) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (976) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (976) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7240) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7240) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7240) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (208) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
714
Suspicious files
5
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 976 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\4e3d734e-3c99-4ec2-86b0-f1e1251ca593.down_data | — | |
MD5:— | SHA256:— | |||
| 6676 | Unicorn-9435.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-37396.exe | executable | |
MD5:4515B41DC54052C88173768BF9FE2A06 | SHA256:A6966336B261B6CC54BACA8DD35EFB72DE5087CE97FE17348BB2DDAE1C9066C1 | |||
| 2088 | Unicorn-37396.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-51580.exe | executable | |
MD5:8FFF3F3DAC521221FC72859C4B257DDF | SHA256:E0854D79F34D0BE50C3AF8594B08643847D07BDD20DC1B81224DF3A46B986C6F | |||
| 2088 | Unicorn-37396.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53823.exe | executable | |
MD5:64292D025F1C151DAD201A4C5642C78C | SHA256:B5B8D38941B610FC8F239BDBC0BB44A9AF3ADB16C92756B0D0D1A0ABFA0DB667 | |||
| 5400 | Unicorn-33717.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-38385.exe | executable | |
MD5:C1FF9A82CFA1720383C4EA38603E3B3C | SHA256:91C9AD43B1AABA8F000656CCB00576A8CDC7E0AAB06EFC86C7EF59B3FE0B111F | |||
| 3888 | 1 (158).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-4378.exe | executable | |
MD5:9772CC1DC780F28121FA89BDAA398505 | SHA256:5CF720C699627836A15E5AF2F12D36A8F2A149145BC4DBA3BD51E1A9E78868FC | |||
| 976 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:DD25E57154D1B3534619F867F48BFF0B | SHA256:5813E46B4F4E4A8852BDE3EBBAE73CCAE44A4870C65616B4C41A568C11647D3A | |||
| 976 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
| 976 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\94e1f889-645d-4fb6-a056-37074948dad0.up_meta_secure | binary | |
MD5:5A6E643ECE634391CAFFA20464A15BCB | SHA256:7E79084D692D74DC089B6B370D339E2E1F56154DF3838FC9DF15791CC10F75DD | |||
| 1040 | Unicorn-6097.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-65338.exe | executable | |
MD5:5650C03072B328AF67F2DA0D86EB7441 | SHA256:A273A244CF526DD2BED82521D98F6B8E00750D99D03A1B7C1738BEB8BA38181F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
26
DNS requests
15
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.184:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6800 | backgroundTaskHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
7184 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7184 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
976 | BackgroundTransferHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2616 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5496 | MoUsoCoreWorker.exe | 23.48.23.184:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2112 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
3216 | svchost.exe | 20.198.162.78:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | SG | whitelisted |
6544 | svchost.exe | 20.190.159.129:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 23.54.109.203:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
6800 | backgroundTaskHost.exe | 20.223.35.26:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |