File name:

1 (141)

Full analysis: https://app.any.run/tasks/f8e5e581-88dd-42b4-b579-8c37a4eba634
Verdict: Malicious activity
Analysis date: March 24, 2025, 14:56:15
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

3B0ADA7CBB2A5D25EB7E0A8FA3712B70

SHA1:

2245E2BE0123D568D19ADC508D41C97AAC135B22

SHA256:

C22534689E2C05501AF02C24535586DD0E8FBADC6304A259A31C2E4414EB4F61

SSDEEP:

6144:3UkBr2IJYDaHA5wBtU4rCcUx5S2qsvJGBu/xyeHgbk/8SwjwpyAvEhFl3fwcsUSa:379dPHA5WtR721hauJyeHgKx4DxmDsR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Starts itself from another location

      • Unicorn-58939.exe (PID: 6068)
      • Unicorn-34243.exe (PID: 3888)
      • Unicorn-36599.exe (PID: 976)
      • 1 (141).exe (PID: 4212)
      • Unicorn-58991.exe (PID: 5176)
      • Unicorn-57766.exe (PID: 4724)
      • Unicorn-36281.exe (PID: 6516)
      • Unicorn-22545.exe (PID: 6640)
      • Unicorn-45063.exe (PID: 1244)
      • Unicorn-12198.exe (PID: 536)
      • Unicorn-41674.exe (PID: 2096)
      • Unicorn-38409.exe (PID: 1452)
      • Unicorn-906.exe (PID: 5332)
      • Unicorn-906.exe (PID: 5392)
      • Unicorn-4585.exe (PID: 1912)
      • Unicorn-48327.exe (PID: 5892)
      • Unicorn-31534.exe (PID: 6480)
      • Unicorn-52966.exe (PID: 1328)
      • Unicorn-44435.exe (PID: 6148)
      • Unicorn-17692.exe (PID: 4464)
      • Unicorn-2826.exe (PID: 5772)
      • Unicorn-28077.exe (PID: 4628)
      • Unicorn-31415.exe (PID: 5056)
      • Unicorn-32484.exe (PID: 7172)
      • Unicorn-32484.exe (PID: 2692)
      • Unicorn-32484.exe (PID: 1040)
      • Unicorn-26353.exe (PID: 7180)
      • Unicorn-51457.exe (PID: 7204)
      • Unicorn-50787.exe (PID: 7572)
      • Unicorn-18669.exe (PID: 7580)
      • Unicorn-50211.exe (PID: 7588)
      • Unicorn-49449.exe (PID: 7620)
      • Unicorn-33875.exe (PID: 7636)
      • Unicorn-11216.exe (PID: 7660)
      • Unicorn-34067.exe (PID: 7684)
      • Unicorn-17539.exe (PID: 7704)
      • Unicorn-55042.exe (PID: 7728)
      • Unicorn-51098.exe (PID: 7748)
      • Unicorn-43387.exe (PID: 7776)
      • Unicorn-6993.exe (PID: 7796)
      • Unicorn-53017.exe (PID: 7832)
      • Unicorn-10522.exe (PID: 7812)
      • Unicorn-42811.exe (PID: 7848)
      • Unicorn-6417.exe (PID: 7876)
      • Unicorn-30751.exe (PID: 7924)
      • Unicorn-30751.exe (PID: 7932)
      • Unicorn-63978.exe (PID: 7964)
      • Unicorn-37957.exe (PID: 8040)
      • Unicorn-57293.exe (PID: 8064)
      • Unicorn-57293.exe (PID: 8048)
      • Unicorn-38919.exe (PID: 7940)
      • Unicorn-40521.exe (PID: 7212)
      • Unicorn-40438.exe (PID: 7292)
      • Unicorn-8166.exe (PID: 7392)
      • Unicorn-12826.exe (PID: 1128)
      • Unicorn-57943.exe (PID: 8184)
      • Unicorn-8550.exe (PID: 8176)
      • Unicorn-32863.exe (PID: 7372)
      • Unicorn-57943.exe (PID: 7272)
      • Unicorn-7397.exe (PID: 7308)
      • Unicorn-35939.exe (PID: 7280)
      • Unicorn-34761.exe (PID: 7512)
      • Unicorn-26126.exe (PID: 7384)
      • Unicorn-26702.exe (PID: 7296)
      • Unicorn-34892.exe (PID: 7492)
      • Unicorn-45042.exe (PID: 7480)
      • Unicorn-35084.exe (PID: 7536)
      • Unicorn-30101.exe (PID: 7340)
      • Unicorn-4850.exe (PID: 7360)
      • Unicorn-4850.exe (PID: 7332)
      • Unicorn-28268.exe (PID: 5400)
      • Unicorn-18447.exe (PID: 4608)
      • Unicorn-8364.exe (PID: 5984)
      • Unicorn-14725.exe (PID: 8200)
      • Unicorn-34591.exe (PID: 8208)
      • Unicorn-1269.exe (PID: 4740)
      • Unicorn-43121.exe (PID: 5360)
      • Unicorn-18447.exe (PID: 6632)
      • Unicorn-55779.exe (PID: 8548)
      • Unicorn-21955.exe (PID: 7156)
      • Unicorn-51503.exe (PID: 8424)
      • Unicorn-62987.exe (PID: 5964)
      • Unicorn-3764.exe (PID: 8252)
      • Unicorn-2878.exe (PID: 8388)
      • Unicorn-15130.exe (PID: 8416)
      • Unicorn-63734.exe (PID: 8224)
      • Unicorn-32213.exe (PID: 8328)
      • Unicorn-19023.exe (PID: 8292)
      • Unicorn-2878.exe (PID: 8396)
      • Unicorn-11046.exe (PID: 8408)
      • Unicorn-9702.exe (PID: 2980)
      • Unicorn-6962.exe (PID: 8432)
      • Unicorn-43557.exe (PID: 8056)
      • Unicorn-40521.exe (PID: 7220)
      • Unicorn-40381.exe (PID: 8336)
      • Unicorn-18639.exe (PID: 8460)
      • Unicorn-63158.exe (PID: 8024)
      • Unicorn-23958.exe (PID: 8768)
      • Unicorn-39635.exe (PID: 8280)
      • Unicorn-28042.exe (PID: 8784)
      • Unicorn-63978.exe (PID: 8012)
      • Unicorn-45006.exe (PID: 8740)
      • Unicorn-4357.exe (PID: 8792)
      • Unicorn-58741.exe (PID: 8724)
      • Unicorn-18092.exe (PID: 8816)
      • Unicorn-57891.exe (PID: 8900)
      • Unicorn-29376.exe (PID: 8916)
      • Unicorn-65255.exe (PID: 8940)
      • Unicorn-65255.exe (PID: 8924)
      • Unicorn-8462.exe (PID: 8808)
      • Unicorn-47056.exe (PID: 9028)
      • Unicorn-55941.exe (PID: 8732)
      • Unicorn-31274.exe (PID: 9036)
      • Unicorn-35826.exe (PID: 8800)
      • Unicorn-15822.exe (PID: 8776)
      • Unicorn-45582.exe (PID: 8988)
      • Unicorn-34804.exe (PID: 9140)
      • Unicorn-26636.exe (PID: 9124)
      • Unicorn-29821.exe (PID: 9184)
      • Unicorn-34804.exe (PID: 9132)
      • Unicorn-14938.exe (PID: 9116)
      • Unicorn-48985.exe (PID: 8672)
      • Unicorn-57855.exe (PID: 5380)
      • Unicorn-57855.exe (PID: 3332)
      • Unicorn-6559.exe (PID: 8660)
      • Unicorn-14082.exe (PID: 9272)
      • Unicorn-65129.exe (PID: 9244)
      • Unicorn-48985.exe (PID: 9224)
      • Unicorn-40725.exe (PID: 9312)
      • Unicorn-40625.exe (PID: 8700)
      • Unicorn-9998.exe (PID: 9260)
      • Unicorn-51394.exe (PID: 8664)
      • Unicorn-4768.exe (PID: 9512)
      • Unicorn-13506.exe (PID: 9404)
      • Unicorn-7376.exe (PID: 9436)
      • Unicorn-22613.exe (PID: 9460)
      • Unicorn-7376.exe (PID: 9428)
      • Unicorn-48985.exe (PID: 8980)
      • Unicorn-27295.exe (PID: 9636)
      • Unicorn-35198.exe (PID: 9628)
      • Unicorn-43994.exe (PID: 9616)
      • Unicorn-55499.exe (PID: 9728)
      • Unicorn-26719.exe (PID: 9652)
      • Unicorn-57537.exe (PID: 9760)
      • Unicorn-55691.exe (PID: 9576)
      • Unicorn-57206.exe (PID: 9796)
      • Unicorn-36209.exe (PID: 9812)
      • Unicorn-56075.exe (PID: 9820)
      • Unicorn-19701.exe (PID: 9944)

    • Executable content was dropped or overwritten

      • Unicorn-34243.exe (PID: 3888)
      • 1 (141).exe (PID: 4212)
      • Unicorn-58991.exe (PID: 5176)
      • Unicorn-36599.exe (PID: 976)
      • Unicorn-57766.exe (PID: 4724)
      • Unicorn-58939.exe (PID: 6068)
      • Unicorn-36281.exe (PID: 6516)
      • Unicorn-45063.exe (PID: 1244)
      • Unicorn-12198.exe (PID: 536)
      • Unicorn-38409.exe (PID: 1452)
      • Unicorn-906.exe (PID: 5332)
      • Unicorn-4585.exe (PID: 1912)
      • Unicorn-48327.exe (PID: 5892)
      • Unicorn-44435.exe (PID: 6148)
      • Unicorn-52966.exe (PID: 1328)
      • Unicorn-17692.exe (PID: 4464)
      • Unicorn-31534.exe (PID: 6480)
      • Unicorn-28077.exe (PID: 4628)
      • Unicorn-2826.exe (PID: 5772)
      • Unicorn-31415.exe (PID: 5056)
      • Unicorn-40521.exe (PID: 7212)
      • Unicorn-40521.exe (PID: 7220)
      • Unicorn-26353.exe (PID: 7180)
      • Unicorn-906.exe (PID: 5392)
      • Unicorn-41674.exe (PID: 2096)
      • Unicorn-50787.exe (PID: 7572)
      • Unicorn-18669.exe (PID: 7580)
      • Unicorn-49449.exe (PID: 7620)
      • Unicorn-11216.exe (PID: 7660)
      • Unicorn-33875.exe (PID: 7636)
      • Unicorn-17539.exe (PID: 7704)
      • Unicorn-34067.exe (PID: 7684)
      • Unicorn-55042.exe (PID: 7728)
      • Unicorn-43387.exe (PID: 7776)
      • Unicorn-10522.exe (PID: 7812)
      • Unicorn-53017.exe (PID: 7832)
      • Unicorn-42811.exe (PID: 7848)
      • Unicorn-6417.exe (PID: 7876)
      • Unicorn-30751.exe (PID: 7924)
      • Unicorn-30751.exe (PID: 7932)
      • Unicorn-32484.exe (PID: 7172)
      • Unicorn-63978.exe (PID: 7964)
      • Unicorn-43557.exe (PID: 8056)
      • Unicorn-57293.exe (PID: 8064)
      • Unicorn-37957.exe (PID: 8040)
      • Unicorn-63158.exe (PID: 8024)
      • Unicorn-57293.exe (PID: 8048)
      • Unicorn-32484.exe (PID: 2692)
      • Unicorn-38919.exe (PID: 7940)
      • Unicorn-22545.exe (PID: 6640)
      • Unicorn-40438.exe (PID: 7292)
      • Unicorn-12826.exe (PID: 1128)
      • Unicorn-8166.exe (PID: 7392)
      • Unicorn-8550.exe (PID: 8176)
      • Unicorn-7397.exe (PID: 7308)
      • Unicorn-57943.exe (PID: 7272)
      • Unicorn-50211.exe (PID: 7588)
      • Unicorn-51457.exe (PID: 7204)
      • Unicorn-26126.exe (PID: 7384)
      • Unicorn-34761.exe (PID: 7512)
      • Unicorn-26702.exe (PID: 7296)
      • Unicorn-34892.exe (PID: 7492)
      • Unicorn-45042.exe (PID: 7480)
      • Unicorn-35084.exe (PID: 7536)
      • Unicorn-30101.exe (PID: 7340)
      • Unicorn-4850.exe (PID: 7332)
      • Unicorn-51098.exe (PID: 7748)
      • Unicorn-4850.exe (PID: 7360)
      • Unicorn-28268.exe (PID: 5400)
      • Unicorn-18447.exe (PID: 4608)
      • Unicorn-6993.exe (PID: 7796)
      • Unicorn-8364.exe (PID: 5984)
      • Unicorn-1269.exe (PID: 4740)
      • Unicorn-34591.exe (PID: 8208)
      • Unicorn-18447.exe (PID: 6632)
      • Unicorn-63734.exe (PID: 8224)
      • Unicorn-21955.exe (PID: 7156)
      • Unicorn-55779.exe (PID: 8548)
      • Unicorn-32213.exe (PID: 8328)
      • Unicorn-51503.exe (PID: 8424)
      • Unicorn-62987.exe (PID: 5964)
      • Unicorn-3764.exe (PID: 8252)
      • Unicorn-2878.exe (PID: 8388)
      • Unicorn-40381.exe (PID: 8336)
      • Unicorn-2878.exe (PID: 8396)
      • Unicorn-9702.exe (PID: 2980)
      • Unicorn-6962.exe (PID: 8432)
      • Unicorn-63978.exe (PID: 8012)
      • Unicorn-19023.exe (PID: 8292)
      • Unicorn-11046.exe (PID: 8408)
      • Unicorn-18639.exe (PID: 8460)
      • Unicorn-39635.exe (PID: 8280)
      • Unicorn-23958.exe (PID: 8768)
      • Unicorn-28042.exe (PID: 8784)
      • Unicorn-57943.exe (PID: 8184)
      • Unicorn-58741.exe (PID: 8724)
      • Unicorn-18092.exe (PID: 8816)
      • Unicorn-8462.exe (PID: 8808)
      • Unicorn-45006.exe (PID: 8740)
      • Unicorn-32863.exe (PID: 7372)
      • Unicorn-29376.exe (PID: 8916)
      • Unicorn-35939.exe (PID: 7280)
      • Unicorn-65255.exe (PID: 8924)
      • Unicorn-57891.exe (PID: 8900)
      • Unicorn-55941.exe (PID: 8732)
      • Unicorn-31274.exe (PID: 9036)
      • Unicorn-35826.exe (PID: 8800)
      • Unicorn-15822.exe (PID: 8776)
      • Unicorn-47056.exe (PID: 9028)
      • Unicorn-45582.exe (PID: 8988)
      • Unicorn-26636.exe (PID: 9124)
      • Unicorn-29821.exe (PID: 9184)
      • Unicorn-34804.exe (PID: 9132)
      • Unicorn-57855.exe (PID: 5380)
      • Unicorn-57855.exe (PID: 3332)
      • Unicorn-48985.exe (PID: 8672)
      • Unicorn-6559.exe (PID: 8660)
      • Unicorn-14938.exe (PID: 9116)
      • Unicorn-65129.exe (PID: 9244)
      • Unicorn-22805.exe (PID: 9016)
      • Unicorn-48985.exe (PID: 9224)
      • Unicorn-40625.exe (PID: 8700)
      • Unicorn-40725.exe (PID: 9312)
      • Unicorn-14082.exe (PID: 9272)
      • Unicorn-7376.exe (PID: 9428)
      • Unicorn-13506.exe (PID: 9404)
      • Unicorn-48985.exe (PID: 8980)
      • Unicorn-22613.exe (PID: 9460)
      • Unicorn-9998.exe (PID: 9260)
      • Unicorn-51394.exe (PID: 8664)
      • Unicorn-27295.exe (PID: 9636)
      • Unicorn-35198.exe (PID: 9628)
      • Unicorn-26719.exe (PID: 9652)
      • Unicorn-57537.exe (PID: 9760)
      • Unicorn-55499.exe (PID: 9728)
      • Unicorn-55691.exe (PID: 9576)
      • Unicorn-43994.exe (PID: 9616)
      • Unicorn-56075.exe (PID: 9820)
      • Unicorn-57206.exe (PID: 9796)
      • Unicorn-36209.exe (PID: 9812)
      • Unicorn-15130.exe (PID: 8416)
      • Unicorn-19701.exe (PID: 9944)
      • Unicorn-10486.exe (PID: 9788)
      • Unicorn-33839.exe (PID: 10120)
      • Unicorn-32484.exe (PID: 1040)
      • Unicorn-17429.exe (PID: 10160)
      • Unicorn-38669.exe (PID: 10196)
      • Unicorn-35183.exe (PID: 10236)
      • Unicorn-10486.exe (PID: 6972)
      • Unicorn-6765.exe (PID: 9884)
      • Unicorn-51135.exe (PID: 7948)
      • Unicorn-3201.exe (PID: 9176)
      • Unicorn-56371.exe (PID: 732)
      • Unicorn-7917.exe (PID: 8440)
      • Unicorn-23699.exe (PID: 9924)
      • Unicorn-12816.exe (PID: 664)
      • Unicorn-32421.exe (PID: 9960)
      • Unicorn-42775.exe (PID: 9100)
      • Unicorn-42775.exe (PID: 9684)
      • Unicorn-61249.exe (PID: 9872)
      • Unicorn-22163.exe (PID: 10088)
      • Unicorn-34804.exe (PID: 9140)
      • Unicorn-13292.exe (PID: 9908)
      • Unicorn-4357.exe (PID: 8792)
      • Unicorn-32744.exe (PID: 8620)
      • Unicorn-10870.exe (PID: 3676)
      • Unicorn-44098.exe (PID: 8836)
      • Unicorn-10870.exe (PID: 6800)
      • Unicorn-53418.exe (PID: 9928)
      • Unicorn-26312.exe (PID: 10020)
      • Unicorn-20383.exe (PID: 10272)
      • Unicorn-44887.exe (PID: 10264)
      • Unicorn-28913.exe (PID: 9936)
      • Unicorn-7376.exe (PID: 9436)
      • Unicorn-58025.exe (PID: 9888)
      • Unicorn-60647.exe (PID: 10440)
      • Unicorn-44311.exe (PID: 10400)
      • Unicorn-14725.exe (PID: 8200)
      • Unicorn-32805.exe (PID: 10532)
      • Unicorn-43121.exe (PID: 5360)
      • Unicorn-33189.exe (PID: 10352)
      • Unicorn-44866.exe (PID: 10448)
      • Unicorn-35358.exe (PID: 10484)
      • Unicorn-62463.exe (PID: 10552)
      • Unicorn-49142.exe (PID: 10496)
      • Unicorn-1415.exe (PID: 10580)
      • Unicorn-63423.exe (PID: 10612)
      • Unicorn-7938.exe (PID: 10328)
      • Unicorn-13454.exe (PID: 9700)
      • Unicorn-47087.exe (PID: 10560)
      • Unicorn-25213.exe (PID: 10644)
      • Unicorn-55146.exe (PID: 10744)
      • Unicorn-35851.exe (PID: 8584)
      • Unicorn-46615.exe (PID: 10840)
      • Unicorn-15841.exe (PID: 10336)
      • Unicorn-47684.exe (PID: 10856)
      • Unicorn-23891.exe (PID: 10416)
      • Unicorn-48845.exe (PID: 10964)
      • Unicorn-25624.exe (PID: 10916)
      • Unicorn-30206.exe (PID: 10900)
      • Unicorn-46045.exe (PID: 10980)
      • Unicorn-54710.exe (PID: 10996)
      • Unicorn-25044.exe (PID: 10972)
      • Unicorn-46045.exe (PID: 10988)
      • Unicorn-5005.exe (PID: 10908)
      • Unicorn-24340.exe (PID: 10892)
      • Unicorn-65255.exe (PID: 8940)
      • Unicorn-35109.exe (PID: 10956)
      • Unicorn-56682.exe (PID: 11112)
      • Unicorn-63341.exe (PID: 11052)
      • Unicorn-11757.exe (PID: 11096)
      • Unicorn-4768.exe (PID: 9512)
      • Unicorn-11757.exe (PID: 11088)
      • Unicorn-56127.exe (PID: 11140)
      • Unicorn-6734.exe (PID: 11060)
      • Unicorn-12472.exe (PID: 11220)
      • Unicorn-37169.exe (PID: 11176)
      • Unicorn-2266.exe (PID: 11236)
      • Unicorn-56106.exe (PID: 11204)
      • Unicorn-56127.exe (PID: 11148)
      • Unicorn-61865.exe (PID: 6184)
      • Unicorn-50633.exe (PID: 11284)
      • Unicorn-55743.exe (PID: 6708)
      • Unicorn-43491.exe (PID: 11244)
      • Unicorn-11646.exe (PID: 11300)
      • Unicorn-24645.exe (PID: 2084)
      • Unicorn-48130.exe (PID: 1748)
      • Unicorn-3094.exe (PID: 11456)
      • Unicorn-40427.exe (PID: 11388)
      • Unicorn-41173.exe (PID: 11328)
      • Unicorn-11838.exe (PID: 11400)
      • Unicorn-40427.exe (PID: 11384)
      • Unicorn-49150.exe (PID: 10880)
      • Unicorn-60463.exe (PID: 11440)
      • Unicorn-43862.exe (PID: 11484)
      • Unicorn-62693.exe (PID: 11564)
      • Unicorn-60655.exe (PID: 11544)
      • Unicorn-15273.exe (PID: 11664)
      • Unicorn-33005.exe (PID: 11356)

    • Executes application which crashes

      • Unicorn-28613.exe (PID: 7900)
      • Unicorn-28613.exe (PID: 7908)
      • Unicorn-28613.exe (PID: 7916)
      • Unicorn-28613.exe (PID: 7892)
      • Unicorn-63734.exe (PID: 8224)

  • INFO

    • Checks supported languages

      • 1 (141).exe (PID: 4212)
      • Unicorn-58991.exe (PID: 5176)
      • Unicorn-57766.exe (PID: 4724)
      • Unicorn-4585.exe (PID: 1912)
      • Unicorn-58939.exe (PID: 6068)
      • Unicorn-34243.exe (PID: 3888)
      • Unicorn-22545.exe (PID: 6640)
      • Unicorn-38409.exe (PID: 1452)
      • Unicorn-48327.exe (PID: 5892)
      • Unicorn-12198.exe (PID: 536)
      • Unicorn-32484.exe (PID: 2692)
      • Unicorn-51457.exe (PID: 7204)
      • Unicorn-2826.exe (PID: 5772)
      • Unicorn-11216.exe (PID: 7660)
      • Unicorn-34067.exe (PID: 7684)
      • Unicorn-17539.exe (PID: 7704)
      • Unicorn-49449.exe (PID: 7620)
      • Unicorn-51098.exe (PID: 7748)
      • Unicorn-10522.exe (PID: 7812)
      • Unicorn-53017.exe (PID: 7832)
      • Unicorn-38919.exe (PID: 7940)
      • Unicorn-63978.exe (PID: 7964)
      • Unicorn-63978.exe (PID: 8012)
      • Unicorn-35939.exe (PID: 7280)
      • Unicorn-7397.exe (PID: 7308)
      • Unicorn-8166.exe (PID: 7392)
      • Unicorn-35084.exe (PID: 7536)
      • Unicorn-57943.exe (PID: 8184)
      • Unicorn-4850.exe (PID: 7332)
      • Unicorn-8364.exe (PID: 5984)
      • Unicorn-62987.exe (PID: 5964)
      • Unicorn-3764.exe (PID: 8252)
      • Unicorn-39635.exe (PID: 8280)
      • Unicorn-32213.exe (PID: 8328)
      • Unicorn-14725.exe (PID: 8200)
      • Unicorn-63734.exe (PID: 8224)
      • Unicorn-15130.exe (PID: 8416)
      • Unicorn-51503.exe (PID: 8424)
      • Unicorn-11046.exe (PID: 8408)
      • Unicorn-18639.exe (PID: 8460)
      • Unicorn-4357.exe (PID: 8792)
      • Unicorn-8462.exe (PID: 8808)
      • Unicorn-23958.exe (PID: 8768)
      • Unicorn-65255.exe (PID: 8940)
      • Unicorn-65255.exe (PID: 8924)
      • Unicorn-47056.exe (PID: 9028)
      • Unicorn-58741.exe (PID: 8724)
      • Unicorn-14938.exe (PID: 9116)
      • Unicorn-6559.exe (PID: 8660)
      • Unicorn-22805.exe (PID: 9016)
      • Unicorn-18092.exe (PID: 8816)
      • Unicorn-14082.exe (PID: 9272)
      • Unicorn-48985.exe (PID: 8980)
      • Unicorn-55499.exe (PID: 9728)
      • Unicorn-65129.exe (PID: 9244)
      • Unicorn-56075.exe (PID: 9820)
      • Unicorn-33839.exe (PID: 10120)
      • Unicorn-36209.exe (PID: 9812)
      • Unicorn-19701.exe (PID: 9944)
      • Unicorn-42775.exe (PID: 9100)
      • Unicorn-42775.exe (PID: 9684)
      • Unicorn-61249.exe (PID: 9872)
      • Unicorn-6765.exe (PID: 9884)
      • Unicorn-51135.exe (PID: 7948)
      • Unicorn-13292.exe (PID: 9908)
      • Unicorn-12816.exe (PID: 664)
      • Unicorn-7917.exe (PID: 8440)
      • Unicorn-58025.exe (PID: 9888)
      • Unicorn-26312.exe (PID: 10020)
      • Unicorn-44887.exe (PID: 10264)
      • Unicorn-44311.exe (PID: 10400)
      • Unicorn-23891.exe (PID: 10416)
      • Unicorn-49142.exe (PID: 10496)
      • Unicorn-20383.exe (PID: 10272)
      • Unicorn-35358.exe (PID: 10484)
      • Unicorn-62463.exe (PID: 10552)
      • Unicorn-55146.exe (PID: 10744)
      • Unicorn-25624.exe (PID: 10916)
      • Unicorn-1415.exe (PID: 10580)
      • Unicorn-46045.exe (PID: 10988)
      • Unicorn-46045.exe (PID: 10980)
      • Unicorn-11757.exe (PID: 11088)
      • Unicorn-6734.exe (PID: 11060)
      • Unicorn-56127.exe (PID: 11140)
      • Unicorn-56127.exe (PID: 11148)
      • Unicorn-56106.exe (PID: 11204)
      • Unicorn-12472.exe (PID: 11220)
      • Unicorn-25044.exe (PID: 10972)
      • Unicorn-2266.exe (PID: 11236)
      • Unicorn-55743.exe (PID: 6708)
      • Unicorn-48130.exe (PID: 1748)
      • Unicorn-49150.exe (PID: 10880)
      • Unicorn-33005.exe (PID: 11356)
      • Unicorn-41173.exe (PID: 11328)
      • Unicorn-43491.exe (PID: 11244)
      • Unicorn-11838.exe (PID: 11400)
      • Unicorn-3094.exe (PID: 11456)
      • Unicorn-52222.exe (PID: 11600)
      • Unicorn-52222.exe (PID: 11608)
      • Unicorn-60655.exe (PID: 11544)
      • Unicorn-59120.exe (PID: 11536)
      • Unicorn-15273.exe (PID: 11664)
      • Unicorn-57126.exe (PID: 11648)
      • Unicorn-57126.exe (PID: 11656)
      • Unicorn-89.exe (PID: 11740)
      • Unicorn-60846.exe (PID: 11812)
      • Unicorn-16115.exe (PID: 11852)
      • Unicorn-2008.exe (PID: 11892)
      • Unicorn-16115.exe (PID: 11844)
      • Unicorn-25413.exe (PID: 11716)
      • Unicorn-9653.exe (PID: 11968)
      • Unicorn-59046.exe (PID: 12016)
      • Unicorn-45663.exe (PID: 12056)
      • Unicorn-4822.exe (PID: 12080)
      • Unicorn-58107.exe (PID: 12108)
      • Unicorn-19628.exe (PID: 11924)
      • Unicorn-10944.exe (PID: 12128)
      • Unicorn-48853.exe (PID: 12180)
      • Unicorn-26203.exe (PID: 12212)
      • Unicorn-10058.exe (PID: 12256)
      • Unicorn-1890.exe (PID: 12248)
      • Unicorn-38223.exe (PID: 12348)
      • Unicorn-33987.exe (PID: 12332)
      • Unicorn-34179.exe (PID: 12384)
      • Unicorn-18803.exe (PID: 12428)
      • Unicorn-18803.exe (PID: 12432)
      • Unicorn-32015.exe (PID: 12684)
      • Unicorn-27848.exe (PID: 12560)
      • Unicorn-62331.exe (PID: 13228)
      • Unicorn-441.exe (PID: 780)
      • Unicorn-21661.exe (PID: 13164)
      • Unicorn-28313.exe (PID: 12752)
      • Unicorn-62963.exe (PID: 12964)
      • Unicorn-52633.exe (PID: 12972)
      • Unicorn-5656.exe (PID: 12996)
      • Unicorn-19408.exe (PID: 13136)
      • Unicorn-14033.exe (PID: 13404)
      • Unicorn-33442.exe (PID: 13320)
      • Unicorn-3072.exe (PID: 13332)
      • Unicorn-60633.exe (PID: 13368)
      • Unicorn-39689.exe (PID: 13464)
      • Unicorn-33004.exe (PID: 13504)
      • Unicorn-7811.exe (PID: 13072)

    • Reads the computer name

      • 1 (141).exe (PID: 4212)
      • Unicorn-58991.exe (PID: 5176)
      • Unicorn-57766.exe (PID: 4724)
      • Unicorn-22545.exe (PID: 6640)
      • Unicorn-38409.exe (PID: 1452)
      • Unicorn-48327.exe (PID: 5892)
      • Unicorn-44435.exe (PID: 6148)
      • Unicorn-2826.exe (PID: 5772)
      • Unicorn-31534.exe (PID: 6480)
      • Unicorn-28077.exe (PID: 4628)
      • Unicorn-40521.exe (PID: 7212)
      • Unicorn-18669.exe (PID: 7580)
      • Unicorn-49449.exe (PID: 7620)
      • Unicorn-50787.exe (PID: 7572)
      • Unicorn-17539.exe (PID: 7704)
      • Unicorn-43387.exe (PID: 7776)
      • Unicorn-42811.exe (PID: 7848)
      • Unicorn-28613.exe (PID: 7900)
      • Unicorn-63158.exe (PID: 8024)
      • Unicorn-38919.exe (PID: 7940)
      • Unicorn-57943.exe (PID: 7272)
      • Unicorn-32863.exe (PID: 7372)
      • Unicorn-35939.exe (PID: 7280)
      • Unicorn-45042.exe (PID: 7480)
      • Unicorn-14725.exe (PID: 8200)
      • Unicorn-34591.exe (PID: 8208)
      • Unicorn-39635.exe (PID: 8280)
      • Unicorn-40381.exe (PID: 8336)
      • Unicorn-11046.exe (PID: 8408)
      • Unicorn-9702.exe (PID: 2980)
      • Unicorn-55779.exe (PID: 8548)
      • Unicorn-4357.exe (PID: 8792)
      • Unicorn-65255.exe (PID: 8940)
      • Unicorn-35826.exe (PID: 8800)
      • Unicorn-48985.exe (PID: 9224)
      • Unicorn-13506.exe (PID: 9404)
      • Unicorn-7376.exe (PID: 9436)
      • Unicorn-22613.exe (PID: 9460)
      • Unicorn-35198.exe (PID: 9628)
      • Unicorn-26719.exe (PID: 9652)
      • Unicorn-56075.exe (PID: 9820)

    • The sample compiled with chinese language support

      • 1 (141).exe (PID: 4212)
      • Unicorn-3201.exe (PID: 9176)
      • Unicorn-65129.exe (PID: 9244)
      • Unicorn-32421.exe (PID: 9960)
      • Unicorn-7376.exe (PID: 9428)
      • Unicorn-48985.exe (PID: 9224)
      • Unicorn-32744.exe (PID: 8620)
      • Unicorn-48985.exe (PID: 8980)
      • Unicorn-7376.exe (PID: 9436)
      • Unicorn-58025.exe (PID: 9888)
      • Unicorn-10870.exe (PID: 6800)
      • Unicorn-26719.exe (PID: 9652)
      • Unicorn-28268.exe (PID: 5400)
      • Unicorn-57537.exe (PID: 9760)
      • Unicorn-63423.exe (PID: 10612)
      • Unicorn-19701.exe (PID: 9944)
      • Unicorn-38409.exe (PID: 1452)
      • Unicorn-2878.exe (PID: 8396)
      • Unicorn-19023.exe (PID: 8292)
      • Unicorn-9702.exe (PID: 2980)
      • Unicorn-40521.exe (PID: 7220)
      • Unicorn-37957.exe (PID: 8040)
      • Unicorn-6962.exe (PID: 8432)
      • Unicorn-43557.exe (PID: 8056)
      • Unicorn-30751.exe (PID: 7932)
      • Unicorn-42811.exe (PID: 7848)
      • Unicorn-25213.exe (PID: 10644)
      • Unicorn-40438.exe (PID: 7292)
      • Unicorn-30751.exe (PID: 7924)
      • Unicorn-57293.exe (PID: 8064)
      • Unicorn-15130.exe (PID: 8416)
      • Unicorn-45063.exe (PID: 1244)
      • Unicorn-35084.exe (PID: 7536)
      • Unicorn-32863.exe (PID: 7372)
      • Unicorn-49449.exe (PID: 7620)
      • Unicorn-29376.exe (PID: 8916)
      • Unicorn-28042.exe (PID: 8784)
      • Unicorn-45042.exe (PID: 7480)
      • Unicorn-58939.exe (PID: 6068)
      • Unicorn-29821.exe (PID: 9184)
      • Unicorn-26636.exe (PID: 9124)
      • Unicorn-4850.exe (PID: 7360)
      • Unicorn-14938.exe (PID: 9116)
      • Unicorn-4850.exe (PID: 7332)
      • Unicorn-8550.exe (PID: 8176)
      • Unicorn-57891.exe (PID: 8900)
      • Unicorn-26702.exe (PID: 7296)
      • Unicorn-57943.exe (PID: 7272)
      • Unicorn-6765.exe (PID: 9884)
      • Unicorn-8364.exe (PID: 5984)
      • Unicorn-7917.exe (PID: 8440)
      • Unicorn-55042.exe (PID: 7728)
      • Unicorn-56371.exe (PID: 732)
      • Unicorn-47056.exe (PID: 9028)
      • Unicorn-51394.exe (PID: 8664)
      • Unicorn-23699.exe (PID: 9924)
      • Unicorn-36599.exe (PID: 976)
      • Unicorn-12816.exe (PID: 664)
      • Unicorn-22613.exe (PID: 9460)
      • Unicorn-13506.exe (PID: 9404)
      • Unicorn-57855.exe (PID: 3332)
      • Unicorn-35851.exe (PID: 8584)
      • Unicorn-6559.exe (PID: 8660)
      • Unicorn-17539.exe (PID: 7704)
      • Unicorn-35198.exe (PID: 9628)
      • Unicorn-10870.exe (PID: 3676)
      • Unicorn-53418.exe (PID: 9928)
      • Unicorn-28913.exe (PID: 9936)
      • Unicorn-44887.exe (PID: 10264)
      • Unicorn-6993.exe (PID: 7796)
      • Unicorn-55499.exe (PID: 9728)
      • Unicorn-18447.exe (PID: 4608)
      • Unicorn-7938.exe (PID: 10328)
      • Unicorn-18447.exe (PID: 6632)
      • Unicorn-44098.exe (PID: 8836)
      • Unicorn-55691.exe (PID: 9576)
      • Unicorn-27295.exe (PID: 9636)
      • Unicorn-20383.exe (PID: 10272)
      • Unicorn-12198.exe (PID: 536)
      • Unicorn-23891.exe (PID: 10416)
      • Unicorn-44866.exe (PID: 10448)
      • Unicorn-47684.exe (PID: 10856)
      • Unicorn-2826.exe (PID: 5772)
      • Unicorn-36209.exe (PID: 9812)
      • Unicorn-10522.exe (PID: 7812)
      • Unicorn-28077.exe (PID: 4628)
      • Unicorn-55779.exe (PID: 8548)
      • Unicorn-34243.exe (PID: 3888)
      • Unicorn-32213.exe (PID: 8328)
      • Unicorn-47087.exe (PID: 10560)
      • Unicorn-35358.exe (PID: 10484)
      • Unicorn-43387.exe (PID: 7776)
      • Unicorn-15841.exe (PID: 10336)
      • Unicorn-32805.exe (PID: 10532)
      • Unicorn-57206.exe (PID: 9796)
      • Unicorn-3764.exe (PID: 8252)
      • Unicorn-48845.exe (PID: 10964)
      • Unicorn-54710.exe (PID: 10996)
      • Unicorn-49142.exe (PID: 10496)
      • Unicorn-62463.exe (PID: 10552)
      • Unicorn-1415.exe (PID: 10580)
      • Unicorn-53017.exe (PID: 7832)
      • Unicorn-31415.exe (PID: 5056)
      • Unicorn-30206.exe (PID: 10900)
      • Unicorn-25624.exe (PID: 10916)
      • Unicorn-46045.exe (PID: 10980)
      • Unicorn-62987.exe (PID: 5964)
      • Unicorn-40381.exe (PID: 8336)
      • Unicorn-24340.exe (PID: 10892)
      • Unicorn-25044.exe (PID: 10972)
      • Unicorn-63978.exe (PID: 7964)
      • Unicorn-18639.exe (PID: 8460)
      • Unicorn-6417.exe (PID: 7876)
      • Unicorn-44311.exe (PID: 10400)
      • Unicorn-63158.exe (PID: 8024)
      • Unicorn-57293.exe (PID: 8048)
      • Unicorn-39635.exe (PID: 8280)
      • Unicorn-55146.exe (PID: 10744)
      • Unicorn-34591.exe (PID: 8208)
      • Unicorn-5005.exe (PID: 10908)
      • Unicorn-38919.exe (PID: 7940)
      • Unicorn-50787.exe (PID: 7572)
      • Unicorn-33839.exe (PID: 10120)
      • Unicorn-57943.exe (PID: 8184)
      • Unicorn-23958.exe (PID: 8768)
      • Unicorn-36281.exe (PID: 6516)
      • Unicorn-57766.exe (PID: 4724)
      • Unicorn-58741.exe (PID: 8724)
      • Unicorn-17429.exe (PID: 10160)
      • Unicorn-906.exe (PID: 5332)
      • Unicorn-45006.exe (PID: 8740)
      • Unicorn-4357.exe (PID: 8792)
      • Unicorn-18092.exe (PID: 8816)
      • Unicorn-58991.exe (PID: 5176)
      • Unicorn-22163.exe (PID: 10088)
      • Unicorn-22545.exe (PID: 6640)
      • Unicorn-46045.exe (PID: 10988)
      • Unicorn-26353.exe (PID: 7180)
      • Unicorn-38669.exe (PID: 10196)
      • Unicorn-55941.exe (PID: 8732)
      • Unicorn-51457.exe (PID: 7204)
      • Unicorn-34892.exe (PID: 7492)
      • Unicorn-35183.exe (PID: 10236)
      • Unicorn-50211.exe (PID: 7588)
      • Unicorn-26126.exe (PID: 7384)
      • Unicorn-32484.exe (PID: 1040)
      • Unicorn-35109.exe (PID: 10956)
      • Unicorn-48327.exe (PID: 5892)
      • Unicorn-18669.exe (PID: 7580)
      • Unicorn-31274.exe (PID: 9036)
      • Unicorn-10486.exe (PID: 6972)
      • Unicorn-65255.exe (PID: 8940)
      • Unicorn-42775.exe (PID: 9684)
      • Unicorn-34067.exe (PID: 7684)
      • Unicorn-11216.exe (PID: 7660)
      • Unicorn-15822.exe (PID: 8776)
      • Unicorn-44435.exe (PID: 6148)
      • Unicorn-42775.exe (PID: 9100)
      • Unicorn-45582.exe (PID: 8988)
      • Unicorn-13292.exe (PID: 9908)
      • Unicorn-48985.exe (PID: 8672)
      • Unicorn-63341.exe (PID: 11052)
      • Unicorn-34804.exe (PID: 9132)
      • Unicorn-56682.exe (PID: 11112)
      • Unicorn-13454.exe (PID: 9700)
      • Unicorn-17692.exe (PID: 4464)
      • Unicorn-52966.exe (PID: 1328)
      • Unicorn-35826.exe (PID: 8800)
      • Unicorn-51098.exe (PID: 7748)
      • Unicorn-4768.exe (PID: 9512)
      • Unicorn-906.exe (PID: 5392)
      • Unicorn-43994.exe (PID: 9616)
      • Unicorn-26312.exe (PID: 10020)
      • Unicorn-43121.exe (PID: 5360)
      • Unicorn-1269.exe (PID: 4740)
      • Unicorn-33189.exe (PID: 10352)
      • Unicorn-56127.exe (PID: 11140)
      • Unicorn-51503.exe (PID: 8424)
      • Unicorn-61249.exe (PID: 9872)
      • Unicorn-11757.exe (PID: 11096)
      • Unicorn-46615.exe (PID: 10840)
      • Unicorn-6734.exe (PID: 11060)
      • Unicorn-11757.exe (PID: 11088)
      • Unicorn-56106.exe (PID: 11204)
      • Unicorn-12472.exe (PID: 11220)
      • Unicorn-2266.exe (PID: 11236)
      • Unicorn-37169.exe (PID: 11176)
      • Unicorn-2878.exe (PID: 8388)
      • Unicorn-32484.exe (PID: 7172)
      • Unicorn-63978.exe (PID: 8012)
      • Unicorn-56127.exe (PID: 11148)
      • Unicorn-12826.exe (PID: 1128)
      • Unicorn-40625.exe (PID: 8700)
      • Unicorn-34761.exe (PID: 7512)
      • Unicorn-61865.exe (PID: 6184)
      • Unicorn-65255.exe (PID: 8924)
      • Unicorn-8166.exe (PID: 7392)
      • Unicorn-51135.exe (PID: 7948)
      • Unicorn-50633.exe (PID: 11284)
      • Unicorn-60647.exe (PID: 10440)
      • Unicorn-55743.exe (PID: 6708)
      • Unicorn-43491.exe (PID: 11244)
      • Unicorn-4585.exe (PID: 1912)
      • Unicorn-41674.exe (PID: 2096)
      • Unicorn-40521.exe (PID: 7212)
      • Unicorn-11646.exe (PID: 11300)
      • Unicorn-24645.exe (PID: 2084)
      • Unicorn-56075.exe (PID: 9820)
      • Unicorn-48130.exe (PID: 1748)
      • Unicorn-40427.exe (PID: 11388)
      • Unicorn-41173.exe (PID: 11328)
      • Unicorn-3094.exe (PID: 11456)
      • Unicorn-11838.exe (PID: 11400)
      • Unicorn-30101.exe (PID: 7340)
      • Unicorn-49150.exe (PID: 10880)
      • Unicorn-33005.exe (PID: 11356)
      • Unicorn-60463.exe (PID: 11440)
      • Unicorn-60655.exe (PID: 11544)
      • Unicorn-8462.exe (PID: 8808)
      • Unicorn-62693.exe (PID: 11564)
      • Unicorn-43862.exe (PID: 11484)
      • Unicorn-10486.exe (PID: 9788)
      • Unicorn-31534.exe (PID: 6480)
      • Unicorn-32484.exe (PID: 2692)
      • Unicorn-57855.exe (PID: 5380)
      • Unicorn-15273.exe (PID: 11664)
      • Unicorn-22805.exe (PID: 9016)
      • Unicorn-40427.exe (PID: 11384)
      • Unicorn-34804.exe (PID: 9140)
      • Unicorn-40725.exe (PID: 9312)

    • Create files in a temporary directory

      • 1 (141).exe (PID: 4212)
      • Unicorn-34243.exe (PID: 3888)
      • Unicorn-36599.exe (PID: 976)
      • Unicorn-36281.exe (PID: 6516)
      • Unicorn-57766.exe (PID: 4724)
      • Unicorn-58991.exe (PID: 5176)
      • Unicorn-38409.exe (PID: 1452)
      • Unicorn-52966.exe (PID: 1328)
      • Unicorn-58939.exe (PID: 6068)
      • Unicorn-44435.exe (PID: 6148)
      • Unicorn-12198.exe (PID: 536)
      • Unicorn-4585.exe (PID: 1912)
      • Unicorn-40521.exe (PID: 7220)
      • Unicorn-48327.exe (PID: 5892)
      • Unicorn-45063.exe (PID: 1244)
      • Unicorn-31534.exe (PID: 6480)
      • Unicorn-49449.exe (PID: 7620)
      • Unicorn-11216.exe (PID: 7660)
      • Unicorn-42811.exe (PID: 7848)
      • Unicorn-17692.exe (PID: 4464)
      • Unicorn-30751.exe (PID: 7924)
      • Unicorn-57293.exe (PID: 8064)
      • Unicorn-63158.exe (PID: 8024)
      • Unicorn-63978.exe (PID: 7964)
      • Unicorn-38919.exe (PID: 7940)
      • Unicorn-41674.exe (PID: 2096)
      • Unicorn-26353.exe (PID: 7180)
      • Unicorn-37957.exe (PID: 8040)
      • Unicorn-57293.exe (PID: 8048)
      • Unicorn-906.exe (PID: 5332)
      • Unicorn-18092.exe (PID: 8816)
      • Unicorn-35939.exe (PID: 7280)
      • Unicorn-6559.exe (PID: 8660)
      • Unicorn-14938.exe (PID: 9116)
      • Unicorn-14082.exe (PID: 9272)
      • Unicorn-40625.exe (PID: 8700)
      • Unicorn-18447.exe (PID: 4608)
      • Unicorn-18447.exe (PID: 6632)
      • Unicorn-51503.exe (PID: 8424)
      • Unicorn-19701.exe (PID: 9944)
      • Unicorn-21955.exe (PID: 7156)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 1128)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 4068)
      • BackgroundTransferHost.exe (PID: 7328)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 1128)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 1128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (90.6)
.exe | Win32 Executable (generic) (4.9)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:01:19 13:34:56+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 176128
InitializedDataSize: 299008
UninitializedDataSize: -
EntryPoint: 0x13d4
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
CompanyName: UEFI
ProductName: Kawaii-Unicorn
FileVersion: 1
ProductVersion: 1
InternalName: Kawaii-Unicorn
OriginalFileName: Kawaii-Unicorn.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
496
Monitored processes
356
Malicious processes
51
Suspicious processes
55

Behavior graph

Click at the process to see the details
start 1 (141).exe sppextcomobj.exe no specs slui.exe no specs unicorn-58991.exe unicorn-36599.exe unicorn-57766.exe unicorn-58939.exe unicorn-34243.exe unicorn-36281.exe unicorn-22545.exe unicorn-45063.exe unicorn-4585.exe unicorn-12198.exe unicorn-38409.exe unicorn-906.exe unicorn-906.exe unicorn-41674.exe unicorn-35809.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs unicorn-48327.exe unicorn-31534.exe unicorn-52966.exe unicorn-44435.exe unicorn-17692.exe unicorn-2826.exe unicorn-28077.exe unicorn-31415.exe unicorn-32484.exe unicorn-32484.exe unicorn-32484.exe unicorn-26353.exe unicorn-51457.exe unicorn-40521.exe unicorn-40521.exe backgroundtransferhost.exe no specs unicorn-50787.exe unicorn-18669.exe unicorn-50211.exe unicorn-49449.exe unicorn-33875.exe unicorn-11216.exe unicorn-34067.exe unicorn-17539.exe unicorn-55042.exe unicorn-51098.exe unicorn-43387.exe unicorn-6993.exe unicorn-10522.exe unicorn-53017.exe unicorn-42811.exe unicorn-6417.exe unicorn-28613.exe unicorn-28613.exe unicorn-28613.exe unicorn-28613.exe unicorn-30751.exe unicorn-30751.exe unicorn-38919.exe unicorn-63978.exe unicorn-63978.exe unicorn-63158.exe unicorn-37957.exe unicorn-57293.exe unicorn-43557.exe unicorn-57293.exe unicorn-8550.exe unicorn-57943.exe unicorn-57943.exe unicorn-35939.exe unicorn-40438.exe unicorn-26702.exe unicorn-12826.exe unicorn-7397.exe unicorn-32863.exe unicorn-26126.exe unicorn-8166.exe unicorn-45042.exe unicorn-34892.exe unicorn-34761.exe unicorn-35084.exe unicorn-30101.exe unicorn-4850.exe unicorn-4850.exe unicorn-35861.exe no specs unicorn-8364.exe unicorn-18447.exe unicorn-18447.exe unicorn-43121.exe unicorn-62987.exe unicorn-28268.exe unicorn-21955.exe unicorn-1269.exe unicorn-9702.exe unicorn-14725.exe unicorn-34591.exe unicorn-63734.exe unicorn-3764.exe unicorn-39635.exe unicorn-19023.exe unicorn-32213.exe unicorn-40381.exe unicorn-2878.exe unicorn-2878.exe unicorn-11046.exe unicorn-15130.exe unicorn-51503.exe unicorn-6962.exe unicorn-18639.exe unicorn-55779.exe unicorn-58741.exe unicorn-55941.exe unicorn-45006.exe unicorn-23958.exe unicorn-15822.exe unicorn-28042.exe unicorn-4357.exe unicorn-35826.exe unicorn-8462.exe unicorn-18092.exe unicorn-57891.exe unicorn-29376.exe unicorn-65255.exe unicorn-65255.exe unicorn-45582.exe unicorn-47056.exe unicorn-31274.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs unicorn-14938.exe unicorn-26636.exe unicorn-34804.exe unicorn-34804.exe werfault.exe no specs unicorn-29821.exe unicorn-57855.exe unicorn-57855.exe unicorn-40625.exe unicorn-6559.exe unicorn-22805.exe unicorn-51394.exe unicorn-48985.exe unicorn-48985.exe unicorn-48985.exe unicorn-65129.exe unicorn-9998.exe unicorn-14082.exe unicorn-40725.exe unicorn-13506.exe unicorn-7376.exe unicorn-7376.exe unicorn-22613.exe unicorn-4768.exe unicorn-55691.exe unicorn-43994.exe unicorn-35198.exe unicorn-27295.exe unicorn-26719.exe unicorn-55499.exe unicorn-57537.exe unicorn-57206.exe unicorn-36209.exe unicorn-56075.exe unicorn-19701.exe unicorn-22163.exe unicorn-33839.exe unicorn-17429.exe unicorn-38669.exe unicorn-35183.exe unicorn-10486.exe unicorn-10486.exe unicorn-42775.exe unicorn-42775.exe unicorn-61249.exe unicorn-6765.exe unicorn-51135.exe unicorn-13292.exe unicorn-3201.exe unicorn-23699.exe unicorn-7917.exe unicorn-35851.exe unicorn-32744.exe unicorn-32421.exe unicorn-56371.exe unicorn-12816.exe unicorn-44098.exe unicorn-10870.exe unicorn-10870.exe unicorn-58025.exe unicorn-28913.exe unicorn-26312.exe unicorn-53418.exe unicorn-13454.exe unicorn-44887.exe unicorn-20383.exe unicorn-7938.exe unicorn-15841.exe unicorn-16107.exe no specs unicorn-33189.exe unicorn-44311.exe unicorn-23891.exe unicorn-60647.exe unicorn-44866.exe unicorn-35358.exe unicorn-49142.exe unicorn-32805.exe unicorn-62463.exe unicorn-47087.exe unicorn-1415.exe unicorn-63423.exe unicorn-25213.exe unicorn-55146.exe unicorn-46615.exe unicorn-47684.exe unicorn-24340.exe unicorn-30206.exe unicorn-5005.exe unicorn-25624.exe unicorn-35109.exe unicorn-48845.exe unicorn-25044.exe unicorn-46045.exe unicorn-46045.exe unicorn-54710.exe unicorn-63341.exe unicorn-6734.exe unicorn-11757.exe unicorn-11757.exe unicorn-56682.exe unicorn-56127.exe unicorn-56127.exe unicorn-37169.exe unicorn-56106.exe unicorn-12472.exe unicorn-2266.exe unicorn-43491.exe unicorn-55743.exe unicorn-61865.exe unicorn-48130.exe unicorn-49150.exe unicorn-24645.exe unicorn-50633.exe unicorn-11646.exe unicorn-41173.exe unicorn-33005.exe unicorn-40427.exe unicorn-40427.exe unicorn-11838.exe unicorn-60463.exe unicorn-3094.exe unicorn-43862.exe unicorn-59120.exe no specs unicorn-60655.exe unicorn-62693.exe unicorn-1240.exe no specs unicorn-52222.exe no specs unicorn-52222.exe no specs unicorn-27791.exe no specs unicorn-57126.exe no specs unicorn-57126.exe no specs unicorn-15273.exe unicorn-11189.exe no specs unicorn-25413.exe no specs unicorn-46026.exe no specs unicorn-89.exe no specs unicorn-89.exe no specs unicorn-354.exe no specs unicorn-47509.exe no specs unicorn-60846.exe no specs unicorn-16669.exe no specs unicorn-16115.exe no specs unicorn-16115.exe no specs unicorn-61423.exe no specs unicorn-2008.exe no specs unicorn-57339.exe no specs unicorn-19628.exe no specs unicorn-16861.exe no specs unicorn-50131.exe no specs unicorn-9653.exe no specs unicorn-41771.exe no specs unicorn-59046.exe no specs unicorn-8449.exe no specs unicorn-45663.exe no specs unicorn-4822.exe no specs unicorn-58107.exe no specs unicorn-10944.exe no specs unicorn-21159.exe no specs unicorn-46815.exe no specs unicorn-48853.exe no specs unicorn-27826.exe no specs unicorn-26203.exe no specs unicorn-1890.exe no specs unicorn-10058.exe no specs unicorn-18227.exe no specs unicorn-9482.exe no specs unicorn-33987.exe no specs unicorn-38223.exe no specs unicorn-34179.exe no specs unicorn-43307.exe no specs unicorn-18803.exe no specs unicorn-18803.exe no specs unicorn-18803.exe no specs unicorn-39415.exe no specs unicorn-27848.exe no specs unicorn-18611.exe no specs unicorn-32015.exe no specs unicorn-19763.exe no specs werfault.exe no specs unicorn-11210.exe no specs unicorn-19933.exe no specs unicorn-15294.exe no specs unicorn-29253.exe no specs unicorn-40759.exe no specs unicorn-52633.exe no specs unicorn-5656.exe no specs unicorn-33145.exe no specs unicorn-36483.exe no specs unicorn-44651.exe no specs unicorn-8449.exe no specs unicorn-8449.exe no specs werfault.exe no specs unicorn-13493.exe no specs unicorn-21661.exe no specs unicorn-62331.exe no specs unicorn-11084.exe no specs unicorn-29637.exe no specs unicorn-24542.exe no specs unicorn-28313.exe no specs unicorn-52243.exe no specs unicorn-441.exe no specs unicorn-38102.exe no specs unicorn-36783.exe no specs unicorn-51174.exe no specs unicorn-62963.exe no specs unicorn-7811.exe no specs unicorn-7811.exe no specs unicorn-46151.exe no specs unicorn-25274.exe no specs unicorn-19408.exe no specs unicorn-33442.exe no specs unicorn-3072.exe no specs unicorn-60633.exe no specs unicorn-14033.exe no specs unicorn-14033.exe no specs unicorn-50625.exe no specs unicorn-39689.exe no specs unicorn-39689.exe no specs unicorn-33004.exe no specs unicorn-6825.exe no specs unicorn-6825.exe no specs unicorn-19461.exe no specs unicorn-45449.exe no specs unicorn-53260.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
536C:\Users\admin\AppData\Local\Temp\Unicorn-12198.exeC:\Users\admin\AppData\Local\Temp\Unicorn-12198.exe
Unicorn-34243.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-12198.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
664C:\Users\admin\AppData\Local\Temp\Unicorn-12816.exeC:\Users\admin\AppData\Local\Temp\Unicorn-12816.exe
Unicorn-62987.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-12816.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
732C:\Users\admin\AppData\Local\Temp\Unicorn-56371.exeC:\Users\admin\AppData\Local\Temp\Unicorn-56371.exe
Unicorn-51503.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-56371.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
780C:\Users\admin\AppData\Local\Temp\Unicorn-441.exeC:\Users\admin\AppData\Local\Temp\Unicorn-441.exe—Unicorn-43387.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-441.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
856"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
976C:\Users\admin\AppData\Local\Temp\Unicorn-36599.exeC:\Users\admin\AppData\Local\Temp\Unicorn-36599.exe
Unicorn-58991.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-36599.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1040C:\Users\admin\AppData\Local\Temp\Unicorn-32484.exeC:\Users\admin\AppData\Local\Temp\Unicorn-32484.exe
Unicorn-906.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-32484.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1128"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1128C:\Users\admin\AppData\Local\Temp\Unicorn-12826.exeC:\Users\admin\AppData\Local\Temp\Unicorn-12826.exe
Unicorn-49449.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-12826.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1244C:\Users\admin\AppData\Local\Temp\Unicorn-45063.exeC:\Users\admin\AppData\Local\Temp\Unicorn-45063.exe
Unicorn-58939.exe
User:
admin
Company:
UEFI
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\unicorn-45063.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
Total events
18 689
Read events
18 674
Write events
15
Delete events
0

Modification events

(PID) Process:(4068) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4068) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4068) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1128) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1128) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1128) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2984) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2984) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2984) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(856) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
1 054
Suspicious files
16
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
1128BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\22b64bf0-9c7b-4304-a68a-2388aaec0f7c.down_data —
MD5:—
SHA256:—
5176Unicorn-58991.exeC:\Users\admin\AppData\Local\Temp\Unicorn-36599.exeexecutable
MD5:E8CF5FDF39197136DC1DB7DED44DDD57
SHA256:38D4587CFAE2B1B19EA2117D1511E97B2EC70761F8459704213CC4D7FC5C5272
42121 (141).exeC:\Users\admin\AppData\Local\Temp\Unicorn-58991.exeexecutable
MD5:498DEE46E244E85012C33D90B2047900
SHA256:2590544852E76536783875DE6097EC60150A1362DAEE05FAEA42B7AFB85B4ED8
5176Unicorn-58991.exeC:\Users\admin\AppData\Local\Temp\Unicorn-22545.exeexecutable
MD5:92AD984BE19021CBBBC91B04EC3778D7
SHA256:E1E0B57CC09358169467B4991069716B8C1C92A67F2787910130DF379BC5275F
6516Unicorn-36281.exeC:\Users\admin\AppData\Local\Temp\Unicorn-906.exeexecutable
MD5:353525DED0B157CE5EED17F87374F525
SHA256:360951BCEDB9D9E32FC1A41F2CB81E73E480F03FF663BA811524A7D18A266346
42121 (141).exeC:\Users\admin\AppData\Local\Temp\Unicorn-57766.exeexecutable
MD5:09093B3D1F7327D6A6EF11CB4FC8A5E9
SHA256:C58F72CCB43E63D2F02700244B1CDF037B65B88326F1CE4E45BBC0C5222A8C30
5176Unicorn-58991.exeC:\Users\admin\AppData\Local\Temp\Unicorn-35809.exeexecutable
MD5:FDE6BCEEC4D9900DC12CC55370B6B087
SHA256:21F2B81334330D0977DBE0BDD5955CB57D7C9B7F2DD615AC214FB3825110CA13
976Unicorn-36599.exeC:\Users\admin\AppData\Local\Temp\Unicorn-4585.exeexecutable
MD5:FA3931EFF5F857AEDDE6A60AE5023CD6
SHA256:0C303C73DCCDDAE181E0AD8B26B3CDC0A3F9F47A6CFA87A11992A57410FDD5DC
6068Unicorn-58939.exeC:\Users\admin\AppData\Local\Temp\Unicorn-45063.exeexecutable
MD5:208D051AB3B37CA2D523C458C20206E0
SHA256:ADFF4178B801A24A7EC6932807FE0211B53177D5DBC4E027CC0669567F941C91
4724Unicorn-57766.exeC:\Users\admin\AppData\Local\Temp\Unicorn-34243.exeexecutable
MD5:1659E7ECA4C8E91DDA8BE8F6CB282CCE
SHA256:7F4012DCD61046C04E95E5ACFFE388EB1F2F004C304C7ECAE9E74E48881D740D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
24
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6480
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.168:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1128
BackgroundTransferHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.168:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
8836
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8836
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.168:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
6480
backgroundTaskHost.exe
20.74.47.205:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.168
  • 23.48.23.147
  • 23.48.23.164
  • 23.48.23.150
  • 23.48.23.159
  • 23.48.23.156
  • 23.48.23.158
  • 23.48.23.169
  • 23.48.23.162
whitelisted
client.wns.windows.com
  • 20.198.162.78
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.73
  • 20.190.159.71
  • 40.126.31.3
  • 20.190.159.64
  • 40.126.31.130
  • 20.190.159.75
  • 20.190.159.129
  • 40.126.31.71
  • 20.190.159.2
  • 40.126.31.73
  • 40.126.31.1
  • 20.190.159.0
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
www.bing.com
  • 104.126.37.154
  • 104.126.37.163
  • 104.126.37.162
  • 104.126.37.171
  • 104.126.37.160
  • 104.126.37.153
  • 104.126.37.147
  • 104.126.37.176
  • 104.126.37.152
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (141)