| File name: | 1 (1285) |
| Full analysis: | https://app.any.run/tasks/155a7e20-052d-47e9-957a-3846b1b20ef3 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 13:22:37 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | B88DF284262BD79DC2B8B9DA6969F9B0 |
| SHA1: | 9827794EAC2BBF58B0C2464C2AC366E037BD4698 |
| SHA256: | 432A3F8A7803394157E5FA9BF42134D4963B0B3B37F0499AFECB2C7FBCA5939C |
| SSDEEP: | 6144:aEkBS7IJvDsZA5iHx0eYnAUx5tB2nvJGBC/xyeHimk/8SwjwpyAvEhRpJXprs0Ia:aLcMeZA5mx3uBuhaCJyeHiZx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- Unicorn-963.exe (PID: 7204)
- 1 (1285).exe (PID: 7152)
- Unicorn-36458.exe (PID: 7856)
- Unicorn-64492.exe (PID: 7864)
- Unicorn-50268.exe (PID: 8128)
- Unicorn-19302.exe (PID: 8160)
- Unicorn-43252.exe (PID: 8152)
- Unicorn-33037.exe (PID: 8188)
- Unicorn-53688.exe (PID: 6808)
- Unicorn-17102.exe (PID: 7664)
- Unicorn-12463.exe (PID: 7384)
- Unicorn-55534.exe (PID: 7788)
- Unicorn-57315.exe (PID: 7464)
- Unicorn-4295.exe (PID: 7796)
- Unicorn-12463.exe (PID: 7644)
- Unicorn-49967.exe (PID: 7412)
- Unicorn-43911.exe (PID: 2552)
- Unicorn-65120.exe (PID: 5964)
- Unicorn-52401.exe (PID: 4188)
- Unicorn-27788.exe (PID: 8004)
- Unicorn-38570.exe (PID: 2040)
- Unicorn-15535.exe (PID: 8016)
- Unicorn-11451.exe (PID: 8024)
- Unicorn-58192.exe (PID: 7820)
- Unicorn-48955.exe (PID: 8052)
- Unicorn-64736.exe (PID: 8068)
- Unicorn-3283.exe (PID: 8060)
- Unicorn-12520.exe (PID: 6068)
- Unicorn-46354.exe (PID: 3300)
- Unicorn-44051.exe (PID: 6516)
- Unicorn-35385.exe (PID: 8096)
- Unicorn-24450.exe (PID: 6392)
- Unicorn-57912.exe (PID: 7988)
- Unicorn-53589.exe (PID: 7952)
- Unicorn-1887.exe (PID: 7940)
- Unicorn-22478.exe (PID: 7396)
- Unicorn-26932.exe (PID: 5072)
- Unicorn-34176.exe (PID: 7720)
- Unicorn-21658.exe (PID: 7908)
- Unicorn-53126.exe (PID: 6132)
- Unicorn-50896.exe (PID: 7356)
- Unicorn-52183.exe (PID: 5024)
- Unicorn-36252.exe (PID: 3888)
- Unicorn-52588.exe (PID: 6740)
- Unicorn-40336.exe (PID: 4784)
- Unicorn-36252.exe (PID: 5324)
- Unicorn-11363.exe (PID: 5376)
- Unicorn-57035.exe (PID: 516)
- Unicorn-3195.exe (PID: 2284)
- Unicorn-11363.exe (PID: 7084)
- Unicorn-3195.exe (PID: 6112)
- Unicorn-44783.exe (PID: 672)
- Unicorn-27243.exe (PID: 4896)
- Unicorn-50350.exe (PID: 4620)
- Unicorn-21377.exe (PID: 7568)
- Unicorn-14678.exe (PID: 6272)
- Unicorn-3195.exe (PID: 680)
- Unicorn-18577.exe (PID: 5892)
- Unicorn-11363.exe (PID: 1312)
- Unicorn-24362.exe (PID: 7324)
- Unicorn-24362.exe (PID: 6640)
- Unicorn-37020.exe (PID: 5936)
- Unicorn-49635.exe (PID: 7572)
- Unicorn-32360.exe (PID: 7372)
- Unicorn-36444.exe (PID: 616)
- Unicorn-54679.exe (PID: 7904)
- Unicorn-20278.exe (PID: 7336)
- Unicorn-38098.exe (PID: 7580)
- Unicorn-29428.exe (PID: 7848)
- Unicorn-8742.exe (PID: 5384)
- Unicorn-58016.exe (PID: 7828)
- Unicorn-12899.exe (PID: 5984)
- Unicorn-12899.exe (PID: 2772)
- Unicorn-38150.exe (PID: 7448)
- Unicorn-39634.exe (PID: 7836)
- Unicorn-45764.exe (PID: 7444)
- Unicorn-16029.exe (PID: 2392)
- Unicorn-32936.exe (PID: 4696)
- Unicorn-20684.exe (PID: 1056)
- Unicorn-63754.exe (PID: 1012)
- Unicorn-62271.exe (PID: 5260)
- Unicorn-13262.exe (PID: 2092)
- Unicorn-64191.exe (PID: 8200)
- Unicorn-6459.exe (PID: 5772)
- Unicorn-47492.exe (PID: 6816)
- Unicorn-56672.exe (PID: 5164)
- Unicorn-39686.exe (PID: 8220)
- Unicorn-6651.exe (PID: 8372)
- Unicorn-45499.exe (PID: 8408)
- Unicorn-45499.exe (PID: 8416)
- Unicorn-47876.exe (PID: 8352)
- Unicorn-51960.exe (PID: 8316)
- Unicorn-20994.exe (PID: 8428)
- Unicorn-25330.exe (PID: 8600)
- Unicorn-53556.exe (PID: 8560)
- Unicorn-5809.exe (PID: 7480)
- Unicorn-49088.exe (PID: 8616)
- Unicorn-45004.exe (PID: 8624)
- Unicorn-12331.exe (PID: 8648)
- Unicorn-17760.exe (PID: 8708)
- Unicorn-8247.exe (PID: 8656)
- Unicorn-42264.exe (PID: 8684)
- Unicorn-56746.exe (PID: 8736)
- Unicorn-42072.exe (PID: 8780)
- Unicorn-19221.exe (PID: 8964)
- Unicorn-50240.exe (PID: 8748)
- Unicorn-42072.exe (PID: 8772)
- Unicorn-42072.exe (PID: 8788)
- Unicorn-55071.exe (PID: 8852)
- Unicorn-51179.exe (PID: 8716)
- Unicorn-9399.exe (PID: 8860)
- Unicorn-50048.exe (PID: 8900)
- Unicorn-42072.exe (PID: 8796)
- Unicorn-17930.exe (PID: 8928)
- Unicorn-25087.exe (PID: 8956)
- Unicorn-24457.exe (PID: 9036)
- Unicorn-24457.exe (PID: 9028)
- Unicorn-37986.exe (PID: 9080)
- Unicorn-26696.exe (PID: 8988)
- Unicorn-1615.exe (PID: 9180)
- Unicorn-30323.exe (PID: 9020)
- Unicorn-43586.exe (PID: 9088)
- Unicorn-47884.exe (PID: 9188)
Executable content was dropped or overwritten
- 1 (1285).exe (PID: 7152)
- Unicorn-963.exe (PID: 7204)
- Unicorn-36458.exe (PID: 7856)
- Unicorn-64492.exe (PID: 7864)
- Unicorn-50268.exe (PID: 8128)
- Unicorn-43252.exe (PID: 8152)
- Unicorn-33037.exe (PID: 8188)
- Unicorn-53688.exe (PID: 6808)
- Unicorn-17102.exe (PID: 7664)
- Unicorn-12463.exe (PID: 7384)
- Unicorn-19302.exe (PID: 8160)
- Unicorn-57315.exe (PID: 7464)
- Unicorn-4295.exe (PID: 7796)
- Unicorn-12463.exe (PID: 7644)
- Unicorn-49967.exe (PID: 7412)
- Unicorn-55534.exe (PID: 7788)
- Unicorn-43911.exe (PID: 2552)
- Unicorn-52401.exe (PID: 4188)
- Unicorn-65120.exe (PID: 5964)
- Unicorn-38570.exe (PID: 2040)
- Unicorn-27788.exe (PID: 8004)
- Unicorn-11451.exe (PID: 8024)
- Unicorn-15535.exe (PID: 8016)
- Unicorn-58192.exe (PID: 7820)
- Unicorn-64736.exe (PID: 8068)
- Unicorn-12520.exe (PID: 6068)
- Unicorn-24450.exe (PID: 6392)
- Unicorn-57912.exe (PID: 7988)
- Unicorn-53589.exe (PID: 7952)
- Unicorn-1887.exe (PID: 7940)
- Unicorn-53126.exe (PID: 6132)
- Unicorn-50896.exe (PID: 7356)
- Unicorn-21658.exe (PID: 7908)
- Unicorn-34176.exe (PID: 7720)
- Unicorn-26932.exe (PID: 5072)
- Unicorn-52183.exe (PID: 5024)
- Unicorn-56672.exe (PID: 5164)
- Unicorn-52588.exe (PID: 6740)
- Unicorn-40336.exe (PID: 4784)
- Unicorn-36252.exe (PID: 3888)
- Unicorn-36252.exe (PID: 5324)
- Unicorn-11363.exe (PID: 5376)
- Unicorn-3283.exe (PID: 8060)
- Unicorn-3195.exe (PID: 2284)
- Unicorn-57035.exe (PID: 516)
- Unicorn-11363.exe (PID: 7084)
- Unicorn-14678.exe (PID: 6272)
- Unicorn-27243.exe (PID: 4896)
- Unicorn-50350.exe (PID: 4620)
- Unicorn-3195.exe (PID: 6112)
- Unicorn-20278.exe (PID: 7336)
- Unicorn-18577.exe (PID: 5892)
- Unicorn-35385.exe (PID: 8096)
- Unicorn-11363.exe (PID: 1312)
- Unicorn-44051.exe (PID: 6516)
- Unicorn-24362.exe (PID: 7324)
- Unicorn-46354.exe (PID: 3300)
- Unicorn-37020.exe (PID: 5936)
- Unicorn-49635.exe (PID: 7572)
- Unicorn-32360.exe (PID: 7372)
- Unicorn-5809.exe (PID: 7480)
- Unicorn-36444.exe (PID: 616)
- Unicorn-54679.exe (PID: 7904)
- Unicorn-29428.exe (PID: 7848)
- Unicorn-8742.exe (PID: 5384)
- Unicorn-12899.exe (PID: 2772)
- Unicorn-58016.exe (PID: 7828)
- Unicorn-38150.exe (PID: 7448)
- Unicorn-39634.exe (PID: 7836)
- Unicorn-45764.exe (PID: 7444)
- Unicorn-22478.exe (PID: 7396)
- Unicorn-16029.exe (PID: 2392)
- Unicorn-12899.exe (PID: 5984)
- Unicorn-20684.exe (PID: 1056)
- Unicorn-63754.exe (PID: 1012)
- Unicorn-62271.exe (PID: 5260)
- Unicorn-13262.exe (PID: 2092)
- Unicorn-6459.exe (PID: 5772)
- Unicorn-47492.exe (PID: 6816)
- Unicorn-64191.exe (PID: 8200)
- Unicorn-39686.exe (PID: 8220)
- Unicorn-47876.exe (PID: 8352)
- Unicorn-51960.exe (PID: 8316)
- Unicorn-45499.exe (PID: 8408)
- Unicorn-45499.exe (PID: 8416)
- Unicorn-6651.exe (PID: 8372)
- Unicorn-21377.exe (PID: 7568)
- Unicorn-44783.exe (PID: 672)
- Unicorn-24362.exe (PID: 6640)
- Unicorn-53556.exe (PID: 8560)
- Unicorn-20994.exe (PID: 8428)
- Unicorn-25330.exe (PID: 8600)
- Unicorn-49088.exe (PID: 8616)
- Unicorn-45004.exe (PID: 8624)
- Unicorn-8247.exe (PID: 8656)
- Unicorn-17760.exe (PID: 8708)
- Unicorn-38098.exe (PID: 7580)
- Unicorn-42072.exe (PID: 8780)
- Unicorn-12331.exe (PID: 8648)
- Unicorn-56746.exe (PID: 8736)
- Unicorn-42264.exe (PID: 8684)
- Unicorn-42072.exe (PID: 8788)
- Unicorn-50240.exe (PID: 8748)
- Unicorn-42072.exe (PID: 8772)
- Unicorn-9399.exe (PID: 8860)
- Unicorn-17930.exe (PID: 8928)
- Unicorn-55071.exe (PID: 8852)
- Unicorn-51179.exe (PID: 8716)
- Unicorn-42072.exe (PID: 8796)
- Unicorn-50048.exe (PID: 8900)
- Unicorn-45732.exe (PID: 8892)
- Unicorn-25087.exe (PID: 8956)
- Unicorn-24457.exe (PID: 9036)
- Unicorn-24457.exe (PID: 9028)
- Unicorn-37986.exe (PID: 9080)
- Unicorn-26696.exe (PID: 8988)
- Unicorn-1615.exe (PID: 9180)
- Unicorn-43586.exe (PID: 9088)
- Unicorn-30323.exe (PID: 9020)
- Unicorn-47884.exe (PID: 9188)
- Unicorn-41886.exe (PID: 9096)
- Unicorn-7043.exe (PID: 9208)
- Unicorn-30323.exe (PID: 9012)
- Unicorn-18698.exe (PID: 9116)
- Unicorn-52662.exe (PID: 9144)
- Unicorn-60136.exe (PID: 9168)
- Unicorn-59487.exe (PID: 8588)
- Unicorn-64775.exe (PID: 8476)
- Unicorn-49730.exe (PID: 1300)
- Unicorn-48955.exe (PID: 8052)
- Unicorn-15574.exe (PID: 5404)
- Unicorn-40846.exe (PID: 9264)
- Unicorn-3195.exe (PID: 680)
- Unicorn-57567.exe (PID: 9244)
- Unicorn-57567.exe (PID: 9252)
- Unicorn-22804.exe (PID: 9224)
- Unicorn-44568.exe (PID: 9308)
- Unicorn-56436.exe (PID: 9320)
- Unicorn-20064.exe (PID: 9236)
- Unicorn-12066.exe (PID: 9360)
- Unicorn-62750.exe (PID: 9376)
- Unicorn-48658.exe (PID: 9404)
- Unicorn-19221.exe (PID: 8964)
- Unicorn-41252.exe (PID: 9444)
- Unicorn-44760.exe (PID: 9676)
- Unicorn-57588.exe (PID: 9412)
- Unicorn-49975.exe (PID: 9516)
- Unicorn-10233.exe (PID: 9596)
- Unicorn-4303.exe (PID: 9524)
- Unicorn-32936.exe (PID: 4696)
- Unicorn-28616.exe (PID: 9576)
- Unicorn-3025.exe (PID: 9784)
- Unicorn-39367.exe (PID: 9744)
- Unicorn-4666.exe (PID: 9656)
- Unicorn-32892.exe (PID: 9504)
- Unicorn-28616.exe (PID: 9584)
- Unicorn-15906.exe (PID: 9704)
- Unicorn-41422.exe (PID: 9536)
- Unicorn-24340.exe (PID: 9696)
- Unicorn-50743.exe (PID: 9776)
- Unicorn-14893.exe (PID: 9852)
- Unicorn-45912.exe (PID: 9736)
- Unicorn-44952.exe (PID: 9556)
- Unicorn-42944.exe (PID: 9928)
- Unicorn-57515.exe (PID: 9832)
- Unicorn-53311.exe (PID: 9760)
- Unicorn-15123.exe (PID: 10048)
- Unicorn-6379.exe (PID: 9908)
- Unicorn-3618.exe (PID: 9996)
- Unicorn-44843.exe (PID: 9972)
- Unicorn-60795.exe (PID: 10040)
- Unicorn-11594.exe (PID: 10016)
- Unicorn-32612.exe (PID: 10100)
- Unicorn-58911.exe (PID: 9768)
- Unicorn-38542.exe (PID: 10108)
- Unicorn-1593.exe (PID: 10116)
INFO
Reads the computer name
- 1 (1285).exe (PID: 7152)
- Unicorn-963.exe (PID: 7204)
- Unicorn-36458.exe (PID: 7856)
- Unicorn-64492.exe (PID: 7864)
- Unicorn-43252.exe (PID: 8152)
- Unicorn-50268.exe (PID: 8128)
- Unicorn-19302.exe (PID: 8160)
- Unicorn-12463.exe (PID: 7644)
- Unicorn-55534.exe (PID: 7788)
- Unicorn-57315.exe (PID: 7464)
- Unicorn-65120.exe (PID: 5964)
- Unicorn-49967.exe (PID: 7412)
- Unicorn-48955.exe (PID: 8052)
- Unicorn-3283.exe (PID: 8060)
- Unicorn-27788.exe (PID: 8004)
- Unicorn-11451.exe (PID: 8024)
- Unicorn-1887.exe (PID: 7940)
- Unicorn-53126.exe (PID: 6132)
- Unicorn-22478.exe (PID: 7396)
- Unicorn-52183.exe (PID: 5024)
- Unicorn-18577.exe (PID: 5892)
- Unicorn-11363.exe (PID: 5376)
- Unicorn-11363.exe (PID: 7084)
- Unicorn-14678.exe (PID: 6272)
- Unicorn-32360.exe (PID: 7372)
- Unicorn-36444.exe (PID: 616)
- Unicorn-54679.exe (PID: 7904)
- Unicorn-13262.exe (PID: 2092)
- Unicorn-20684.exe (PID: 1056)
- Unicorn-63754.exe (PID: 1012)
- Unicorn-58016.exe (PID: 7828)
- Unicorn-38150.exe (PID: 7448)
- Unicorn-47492.exe (PID: 6816)
- Unicorn-64191.exe (PID: 8200)
- Unicorn-8579.exe (PID: 9496)
- Unicorn-6651.exe (PID: 8372)
- Unicorn-45499.exe (PID: 8408)
- Unicorn-20994.exe (PID: 8428)
- Unicorn-53556.exe (PID: 8560)
- Unicorn-9399.exe (PID: 8860)
- Unicorn-42072.exe (PID: 8796)
- Unicorn-25087.exe (PID: 8956)
- Unicorn-37986.exe (PID: 9080)
- Unicorn-24457.exe (PID: 9028)
- Unicorn-26696.exe (PID: 8988)
- Unicorn-41886.exe (PID: 9096)
- Unicorn-7043.exe (PID: 9208)
- Unicorn-49730.exe (PID: 1300)
The sample compiled with chinese language support
- 1 (1285).exe (PID: 7152)
- Unicorn-43252.exe (PID: 8152)
- Unicorn-4295.exe (PID: 7796)
- Unicorn-55534.exe (PID: 7788)
- Unicorn-12520.exe (PID: 6068)
- Unicorn-32360.exe (PID: 7372)
- Unicorn-49088.exe (PID: 8616)
- Unicorn-52401.exe (PID: 4188)
- Unicorn-57912.exe (PID: 7988)
- Unicorn-37020.exe (PID: 5936)
- Unicorn-5809.exe (PID: 7480)
- Unicorn-12331.exe (PID: 8648)
- Unicorn-36444.exe (PID: 616)
- Unicorn-54679.exe (PID: 7904)
- Unicorn-8247.exe (PID: 8656)
- Unicorn-38098.exe (PID: 7580)
- Unicorn-1887.exe (PID: 7940)
- Unicorn-42072.exe (PID: 8780)
- Unicorn-17760.exe (PID: 8708)
- Unicorn-29428.exe (PID: 7848)
- Unicorn-8742.exe (PID: 5384)
- Unicorn-53126.exe (PID: 6132)
- Unicorn-43911.exe (PID: 2552)
- Unicorn-56746.exe (PID: 8736)
- Unicorn-12899.exe (PID: 5984)
- Unicorn-50268.exe (PID: 8128)
- Unicorn-42264.exe (PID: 8684)
- Unicorn-42072.exe (PID: 8788)
- Unicorn-42072.exe (PID: 8772)
- Unicorn-50240.exe (PID: 8748)
- Unicorn-9399.exe (PID: 8860)
- Unicorn-50896.exe (PID: 7356)
- Unicorn-39634.exe (PID: 7836)
- Unicorn-55071.exe (PID: 8852)
- Unicorn-16029.exe (PID: 2392)
- Unicorn-13262.exe (PID: 2092)
- Unicorn-51179.exe (PID: 8716)
- Unicorn-17930.exe (PID: 8928)
- Unicorn-45764.exe (PID: 7444)
- Unicorn-22478.exe (PID: 7396)
- Unicorn-65120.exe (PID: 5964)
- Unicorn-17102.exe (PID: 7664)
- Unicorn-34176.exe (PID: 7720)
- Unicorn-50048.exe (PID: 8900)
- Unicorn-20684.exe (PID: 1056)
- Unicorn-42072.exe (PID: 8796)
- Unicorn-62271.exe (PID: 5260)
- Unicorn-63754.exe (PID: 1012)
- Unicorn-21658.exe (PID: 7908)
- Unicorn-52183.exe (PID: 5024)
- Unicorn-12463.exe (PID: 7384)
- Unicorn-27788.exe (PID: 8004)
- Unicorn-25087.exe (PID: 8956)
- Unicorn-26932.exe (PID: 5072)
- Unicorn-64492.exe (PID: 7864)
- Unicorn-45732.exe (PID: 8892)
- Unicorn-6459.exe (PID: 5772)
- Unicorn-24457.exe (PID: 9036)
- Unicorn-47492.exe (PID: 6816)
- Unicorn-58016.exe (PID: 7828)
- Unicorn-38150.exe (PID: 7448)
- Unicorn-24457.exe (PID: 9028)
- Unicorn-52588.exe (PID: 6740)
- Unicorn-56672.exe (PID: 5164)
- Unicorn-64191.exe (PID: 8200)
- Unicorn-37986.exe (PID: 9080)
- Unicorn-26696.exe (PID: 8988)
- Unicorn-1615.exe (PID: 9180)
- Unicorn-43586.exe (PID: 9088)
- Unicorn-30323.exe (PID: 9020)
- Unicorn-47884.exe (PID: 9188)
- Unicorn-15535.exe (PID: 8016)
- Unicorn-39686.exe (PID: 8220)
- Unicorn-41886.exe (PID: 9096)
- Unicorn-11451.exe (PID: 8024)
- Unicorn-30323.exe (PID: 9012)
- Unicorn-7043.exe (PID: 9208)
- Unicorn-18698.exe (PID: 9116)
- Unicorn-6651.exe (PID: 8372)
- Unicorn-52662.exe (PID: 9144)
- Unicorn-40336.exe (PID: 4784)
- Unicorn-36252.exe (PID: 3888)
- Unicorn-64775.exe (PID: 8476)
- Unicorn-36252.exe (PID: 5324)
- Unicorn-60136.exe (PID: 9168)
- Unicorn-47876.exe (PID: 8352)
- Unicorn-59487.exe (PID: 8588)
- Unicorn-49730.exe (PID: 1300)
- Unicorn-48955.exe (PID: 8052)
- Unicorn-64736.exe (PID: 8068)
- Unicorn-51960.exe (PID: 8316)
- Unicorn-45499.exe (PID: 8416)
- Unicorn-11363.exe (PID: 5376)
- Unicorn-15574.exe (PID: 5404)
- Unicorn-45499.exe (PID: 8408)
- Unicorn-20994.exe (PID: 8428)
- Unicorn-3283.exe (PID: 8060)
- Unicorn-57035.exe (PID: 516)
- Unicorn-3195.exe (PID: 2284)
- Unicorn-14678.exe (PID: 6272)
- Unicorn-3195.exe (PID: 6112)
- Unicorn-40846.exe (PID: 9264)
- Unicorn-24450.exe (PID: 6392)
- Unicorn-44783.exe (PID: 672)
- Unicorn-12463.exe (PID: 7644)
- Unicorn-3195.exe (PID: 680)
- Unicorn-27243.exe (PID: 4896)
- Unicorn-35385.exe (PID: 8096)
- Unicorn-18577.exe (PID: 5892)
- Unicorn-11363.exe (PID: 1312)
- Unicorn-53556.exe (PID: 8560)
- Unicorn-44051.exe (PID: 6516)
- Unicorn-19302.exe (PID: 8160)
- Unicorn-49967.exe (PID: 7412)
- Unicorn-24362.exe (PID: 7324)
- Unicorn-22804.exe (PID: 9224)
- Unicorn-57567.exe (PID: 9252)
- Unicorn-57567.exe (PID: 9244)
- Unicorn-57315.exe (PID: 7464)
- Unicorn-33037.exe (PID: 8188)
- Unicorn-963.exe (PID: 7204)
- Unicorn-44568.exe (PID: 9308)
- Unicorn-36458.exe (PID: 7856)
- Unicorn-25330.exe (PID: 8600)
- Unicorn-20064.exe (PID: 9236)
- Unicorn-49635.exe (PID: 7572)
- Unicorn-56436.exe (PID: 9320)
- Unicorn-53589.exe (PID: 7952)
- Unicorn-12066.exe (PID: 9360)
- Unicorn-48658.exe (PID: 9404)
- Unicorn-20278.exe (PID: 7336)
- Unicorn-50350.exe (PID: 4620)
- Unicorn-62750.exe (PID: 9376)
- Unicorn-53688.exe (PID: 6808)
- Unicorn-19221.exe (PID: 8964)
- Unicorn-38570.exe (PID: 2040)
- Unicorn-32936.exe (PID: 4696)
- Unicorn-41252.exe (PID: 9444)
- Unicorn-4303.exe (PID: 9524)
- Unicorn-44760.exe (PID: 9676)
- Unicorn-49975.exe (PID: 9516)
- Unicorn-57588.exe (PID: 9412)
- Unicorn-10233.exe (PID: 9596)
- Unicorn-24362.exe (PID: 6640)
- Unicorn-28616.exe (PID: 9576)
- Unicorn-24340.exe (PID: 9696)
- Unicorn-4666.exe (PID: 9656)
- Unicorn-32892.exe (PID: 9504)
- Unicorn-28616.exe (PID: 9584)
- Unicorn-39367.exe (PID: 9744)
- Unicorn-58192.exe (PID: 7820)
- Unicorn-41422.exe (PID: 9536)
- Unicorn-3025.exe (PID: 9784)
- Unicorn-57515.exe (PID: 9832)
- Unicorn-14893.exe (PID: 9852)
- Unicorn-50743.exe (PID: 9776)
- Unicorn-46354.exe (PID: 3300)
- Unicorn-11363.exe (PID: 7084)
- Unicorn-45912.exe (PID: 9736)
- Unicorn-12899.exe (PID: 2772)
- Unicorn-45004.exe (PID: 8624)
- Unicorn-44952.exe (PID: 9556)
- Unicorn-15906.exe (PID: 9704)
- Unicorn-53311.exe (PID: 9760)
- Unicorn-58911.exe (PID: 9768)
- Unicorn-6379.exe (PID: 9908)
- Unicorn-15123.exe (PID: 10048)
- Unicorn-44843.exe (PID: 9972)
- Unicorn-60795.exe (PID: 10040)
- Unicorn-21377.exe (PID: 7568)
- Unicorn-3618.exe (PID: 9996)
- Unicorn-11594.exe (PID: 10016)
- Unicorn-42944.exe (PID: 9928)
- Unicorn-38542.exe (PID: 10108)
- Unicorn-32612.exe (PID: 10100)
- Unicorn-1593.exe (PID: 10116)
Checks supported languages
- Unicorn-963.exe (PID: 7204)
- 1 (1285).exe (PID: 7152)
- Unicorn-43252.exe (PID: 8152)
- Unicorn-64492.exe (PID: 7864)
- Unicorn-36458.exe (PID: 7856)
- Unicorn-50268.exe (PID: 8128)
- Unicorn-19302.exe (PID: 8160)
- Unicorn-17102.exe (PID: 7664)
- Unicorn-12463.exe (PID: 7384)
- Unicorn-33037.exe (PID: 8188)
- Unicorn-52401.exe (PID: 4188)
- Unicorn-43911.exe (PID: 2552)
- Unicorn-49967.exe (PID: 7412)
- Unicorn-48955.exe (PID: 8052)
- Unicorn-3283.exe (PID: 8060)
- Unicorn-57912.exe (PID: 7988)
- Unicorn-53589.exe (PID: 7952)
- Unicorn-53126.exe (PID: 6132)
- Unicorn-22478.exe (PID: 7396)
- Unicorn-24450.exe (PID: 6392)
- Unicorn-44783.exe (PID: 672)
- Unicorn-50350.exe (PID: 4620)
- Unicorn-11363.exe (PID: 1312)
- Unicorn-3195.exe (PID: 6112)
- Unicorn-27243.exe (PID: 4896)
- Unicorn-38098.exe (PID: 7580)
- Unicorn-49635.exe (PID: 7572)
- Unicorn-32360.exe (PID: 7372)
- Unicorn-57035.exe (PID: 516)
- Unicorn-54679.exe (PID: 7904)
- Unicorn-58016.exe (PID: 7828)
- Unicorn-13262.exe (PID: 2092)
- Unicorn-38150.exe (PID: 7448)
- Unicorn-29428.exe (PID: 7848)
- Unicorn-20684.exe (PID: 1056)
- Unicorn-62271.exe (PID: 5260)
- Unicorn-47492.exe (PID: 6816)
- Unicorn-51960.exe (PID: 8316)
- Unicorn-45499.exe (PID: 8408)
- Unicorn-25330.exe (PID: 8600)
- Unicorn-20994.exe (PID: 8428)
- Unicorn-42264.exe (PID: 8684)
- Unicorn-17760.exe (PID: 8708)
- Unicorn-42072.exe (PID: 8772)
- Unicorn-42072.exe (PID: 8796)
- Unicorn-55071.exe (PID: 8852)
- Unicorn-50048.exe (PID: 8900)
- Unicorn-45732.exe (PID: 8892)
- Unicorn-42072.exe (PID: 8788)
- Unicorn-24457.exe (PID: 9028)
- Unicorn-30323.exe (PID: 9020)
- Unicorn-37986.exe (PID: 9080)
- Unicorn-52662.exe (PID: 9144)
- Unicorn-30323.exe (PID: 9012)
- Unicorn-59487.exe (PID: 8588)
- Unicorn-15574.exe (PID: 5404)
- Unicorn-22804.exe (PID: 9224)
- Unicorn-44568.exe (PID: 9308)
- Unicorn-7043.exe (PID: 9208)
- Unicorn-56436.exe (PID: 9320)
- Unicorn-48658.exe (PID: 9404)
- Unicorn-44760.exe (PID: 9676)
- Unicorn-28616.exe (PID: 9584)
- Unicorn-44952.exe (PID: 9556)
- Unicorn-50743.exe (PID: 9776)
- Unicorn-53311.exe (PID: 9760)
- Unicorn-39367.exe (PID: 9744)
- Unicorn-57515.exe (PID: 9832)
- Unicorn-41422.exe (PID: 9536)
- Unicorn-11594.exe (PID: 10016)
- Unicorn-1593.exe (PID: 10116)
- Unicorn-28912.exe (PID: 7340)
- Unicorn-39886.exe (PID: 10280)
- Unicorn-56606.exe (PID: 10252)
- Unicorn-47168.exe (PID: 10360)
- Unicorn-3566.exe (PID: 10476)
- Unicorn-64827.exe (PID: 10552)
- Unicorn-31770.exe (PID: 10592)
- Unicorn-39119.exe (PID: 10604)
- Unicorn-56467.exe (PID: 10668)
- Unicorn-52383.exe (PID: 10676)
- Unicorn-22472.exe (PID: 10392)
- Unicorn-14666.exe (PID: 10412)
- Unicorn-7266.exe (PID: 10620)
- Unicorn-4526.exe (PID: 10748)
- Unicorn-50934.exe (PID: 10692)
- Unicorn-6009.exe (PID: 10784)
- Unicorn-4471.exe (PID: 11008)
- Unicorn-24361.exe (PID: 10988)
- Unicorn-40690.exe (PID: 11048)
- Unicorn-12606.exe (PID: 11024)
- Unicorn-24392.exe (PID: 10756)
- Unicorn-57967.exe (PID: 11232)
- Unicorn-12295.exe (PID: 11252)
- Unicorn-12030.exe (PID: 11244)
- Unicorn-12877.exe (PID: 4976)
- Unicorn-40182.exe (PID: 3968)
- Unicorn-58159.exe (PID: 11180)
- Unicorn-13255.exe (PID: 2968)
- Unicorn-23269.exe (PID: 11284)
- Unicorn-58180.exe (PID: 11352)
- Unicorn-24421.exe (PID: 11448)
- Unicorn-18034.exe (PID: 11460)
- Unicorn-55611.exe (PID: 11536)
- Unicorn-51164.exe (PID: 11492)
- Unicorn-23269.exe (PID: 11300)
- Unicorn-5663.exe (PID: 11584)
- Unicorn-11646.exe (PID: 11664)
- Unicorn-25381.exe (PID: 11652)
- Unicorn-52679.exe (PID: 11704)
- Unicorn-29465.exe (PID: 11636)
- Unicorn-23706.exe (PID: 11740)
- Unicorn-31055.exe (PID: 11776)
- Unicorn-9945.exe (PID: 11896)
- Unicorn-32066.exe (PID: 11844)
- Unicorn-35766.exe (PID: 11992)
- Unicorn-42486.exe (PID: 12000)
- Unicorn-41600.exe (PID: 12420)
- Unicorn-34370.exe (PID: 12428)
- Unicorn-53150.exe (PID: 12528)
- Unicorn-61126.exe (PID: 12548)
- Unicorn-40322.exe (PID: 12564)
- Unicorn-38476.exe (PID: 12540)
Create files in a temporary directory
- Unicorn-963.exe (PID: 7204)
- 1 (1285).exe (PID: 7152)
- Unicorn-36458.exe (PID: 7856)
- Unicorn-33037.exe (PID: 8188)
- Unicorn-64492.exe (PID: 7864)
- Unicorn-50268.exe (PID: 8128)
- Unicorn-55534.exe (PID: 7788)
- Unicorn-57315.exe (PID: 7464)
- Unicorn-49967.exe (PID: 7412)
- Unicorn-19302.exe (PID: 8160)
- Unicorn-53688.exe (PID: 6808)
- Unicorn-17102.exe (PID: 7664)
- Unicorn-65120.exe (PID: 5964)
- Unicorn-38570.exe (PID: 2040)
- Unicorn-12463.exe (PID: 7384)
- Unicorn-15535.exe (PID: 8016)
- Unicorn-43252.exe (PID: 8152)
- Unicorn-57912.exe (PID: 7988)
- Unicorn-53126.exe (PID: 6132)
- Unicorn-34176.exe (PID: 7720)
- Unicorn-21658.exe (PID: 7908)
- Unicorn-52183.exe (PID: 5024)
- Unicorn-27788.exe (PID: 8004)
- Unicorn-3283.exe (PID: 8060)
- Unicorn-3195.exe (PID: 2284)
- Unicorn-11363.exe (PID: 7084)
- Unicorn-14678.exe (PID: 6272)
- Unicorn-64736.exe (PID: 8068)
- Unicorn-3195.exe (PID: 6112)
- Unicorn-27243.exe (PID: 4896)
- Unicorn-24450.exe (PID: 6392)
- Unicorn-50350.exe (PID: 4620)
- Unicorn-44051.exe (PID: 6516)
- Unicorn-18577.exe (PID: 5892)
- Unicorn-49635.exe (PID: 7572)
- Unicorn-32360.exe (PID: 7372)
- Unicorn-53589.exe (PID: 7952)
- Unicorn-36444.exe (PID: 616)
- Unicorn-29428.exe (PID: 7848)
- Unicorn-1887.exe (PID: 7940)
- Unicorn-8742.exe (PID: 5384)
- Unicorn-50896.exe (PID: 7356)
- Unicorn-13262.exe (PID: 2092)
- Unicorn-26932.exe (PID: 5072)
- Unicorn-62271.exe (PID: 5260)
- Unicorn-58016.exe (PID: 7828)
- Unicorn-56672.exe (PID: 5164)
- Unicorn-52588.exe (PID: 6740)
- Unicorn-47876.exe (PID: 8352)
- Unicorn-51960.exe (PID: 8316)
- Unicorn-40336.exe (PID: 4784)
- Unicorn-21377.exe (PID: 7568)
- Unicorn-24362.exe (PID: 6640)
- Unicorn-20994.exe (PID: 8428)
- Unicorn-25330.exe (PID: 8600)
- Unicorn-46354.exe (PID: 3300)
- Unicorn-12520.exe (PID: 6068)
- Unicorn-49088.exe (PID: 8616)
- Unicorn-45004.exe (PID: 8624)
- Unicorn-43911.exe (PID: 2552)
- Unicorn-42072.exe (PID: 8788)
- Unicorn-39634.exe (PID: 7836)
- Unicorn-42072.exe (PID: 8796)
- Unicorn-25087.exe (PID: 8956)
- Unicorn-6459.exe (PID: 5772)
- Unicorn-24457.exe (PID: 9036)
- Unicorn-24457.exe (PID: 9028)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 6800)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 6800)
- BackgroundTransferHost.exe (PID: 1760)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 6800)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 6800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
441
Monitored processes
306
Malicious processes
42
Suspicious processes
46
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 516 | C:\Users\admin\AppData\Local\Temp\Unicorn-57035.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-57035.exe | Unicorn-12463.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 616 | C:\Users\admin\AppData\Local\Temp\Unicorn-36444.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-36444.exe | Unicorn-1887.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 672 | C:\Users\admin\AppData\Local\Temp\Unicorn-44783.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-44783.exe | Unicorn-49967.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 680 | C:\Users\admin\AppData\Local\Temp\Unicorn-3195.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3195.exe | Unicorn-46354.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1012 | C:\Users\admin\AppData\Local\Temp\Unicorn-63754.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63754.exe | Unicorn-12463.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1056 | C:\Users\admin\AppData\Local\Temp\Unicorn-20684.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-20684.exe | Unicorn-52183.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1300 | C:\Users\admin\AppData\Local\Temp\Unicorn-49730.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-49730.exe | Unicorn-52401.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1312 | C:\Users\admin\AppData\Local\Temp\Unicorn-11363.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-11363.exe | Unicorn-12520.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1748 | C:\Users\admin\AppData\Local\Temp\Unicorn-51231.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-51231.exe | — | Unicorn-36252.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1760 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
8 008
Read events
7 993
Write events
15
Delete events
0
Modification events
| (PID) Process: | (6800) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6800) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6800) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7952) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7952) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7952) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (4896) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4896) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4896) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (1760) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
984
Suspicious files
5
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6800 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ddbbcdee-f433-40c1-9757-afc65fd07e65.down_data | — | |
MD5:— | SHA256:— | |||
| 7856 | Unicorn-36458.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-43252.exe | executable | |
MD5:26A2D2E61121AD30E84A12594FE62E71 | SHA256:3A624C53E95E9EA640FE0F299E37B5BF883ADCFDB16EE64FD70130292B266644 | |||
| 7152 | 1 (1285).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-33037.exe | executable | |
MD5:505689FAD770556BEA9CBD472EEC1EC6 | SHA256:7414D9E4E3FA8B50B618F3859A0F5704DAD1F4374A9AB3CF30EB89384E2E4A80 | |||
| 7204 | Unicorn-963.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-64492.exe | executable | |
MD5:954232A98D28276B39B0F784600748B3 | SHA256:215714C37A0F05A462422EF2E9F7A928608DCC4FD84D26727F041D6BCE5269E8 | |||
| 7152 | 1 (1285).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-963.exe | executable | |
MD5:1A7B87324FDAF07A1B1B7878CD6F059F | SHA256:0A0449DE25CEE1473CA16F4F94044C882326D2A181999FAC614F4B2762FC52A4 | |||
| 7152 | 1 (1285).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-36458.exe | executable | |
MD5:71C86FC993A98227E04392235B699CD0 | SHA256:2AE5025F44F4EECDC09C79781AD763DC513A1DBA6C526B53E183C5B8EE8B7C8B | |||
| 6800 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\13c77bf1-e24a-4a88-a72e-bd0c3493c03d.84c7a5c6-3937-4231-bd6c-1eaf91e9d1fc.down_meta | binary | |
MD5:5FC97DD3C1EBEC96B68C8D76E696D161 | SHA256:B34CC9329F08B8E112753D35BA076E8FF589EF11F711ADECD0B98CC1E0F8C8A6 | |||
| 6800 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ddbbcdee-f433-40c1-9757-afc65fd07e65.84c7a5c6-3937-4231-bd6c-1eaf91e9d1fc.down_meta | binary | |
MD5:5FC97DD3C1EBEC96B68C8D76E696D161 | SHA256:B34CC9329F08B8E112753D35BA076E8FF589EF11F711ADECD0B98CC1E0F8C8A6 | |||
| 8128 | Unicorn-50268.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53688.exe | executable | |
MD5:CAE99B0F0FC5DEC5D9CE2D1D0925070C | SHA256:732A83316DC5FB64A3FB11F0059F45BF05E527642F627F73473A1E9A417FD874 | |||
| 7204 | Unicorn-963.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-19302.exe | executable | |
MD5:F5D4920B3E3523EDDAF403EC72A7E2CA | SHA256:D9BD6393E39E750BAE7F20FD5F3B92CC7316DB74CC5A6284AA6FE519F3FF42BD | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
17
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.159:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6800 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
6632 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
8360 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
8360 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 23.48.23.159:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
2104 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6708 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 20.198.162.78:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | SG | whitelisted |
6544 | svchost.exe | 20.190.159.128:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
6632 | backgroundTaskHost.exe | 20.223.35.26:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |