| File name: | 1 (1120) |
| Full analysis: | https://app.any.run/tasks/8620107d-f7f7-4768-a663-5108b3b4845f |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 09:14:41 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 3133031C0A889DE9CEC2967CEB5AB9A0 |
| SHA1: | ACDFE3DF7426825128ACCDC29064239A021CECEB |
| SHA256: | 41608D7F563F3ED228907B481A6C791219F4A9FAE9059846E6994BD0B9C58E84 |
| SSDEEP: | 6144:zBj4Cr5ufDlOA5jz7keCMlRx5nBqlp8GBZLWydU84k/81wuwprAvEhMeFAeblSFa:zRP1mOA5X7nXBM+aZ6ydU8Ux4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- 1 (1120).exe (PID: 4776)
- Unicorn-37128.exe (PID: 1072)
- Unicorn-47128.exe (PID: 7048)
- Unicorn-16272.exe (PID: 6700)
- Unicorn-8658.exe (PID: 1056)
- Unicorn-57334.exe (PID: 3268)
- Unicorn-63464.exe (PID: 1132)
- Unicorn-56920.exe (PID: 3676)
- Unicorn-46033.exe (PID: 5988)
- Unicorn-58285.exe (PID: 1052)
- Unicorn-13915.exe (PID: 4488)
- Unicorn-7268.exe (PID: 5756)
- Unicorn-55955.exe (PID: 1040)
- Unicorn-58285.exe (PID: 3240)
- Unicorn-13972.exe (PID: 1128)
- Unicorn-52155.exe (PID: 4920)
- Unicorn-39.exe (PID: 2692)
- Unicorn-18818.exe (PID: 736)
- Unicorn-37755.exe (PID: 2960)
- Unicorn-55208.exe (PID: 2984)
- Unicorn-27964.exe (PID: 6112)
- Unicorn-64720.exe (PID: 728)
- Unicorn-7086.exe (PID: 5112)
- Unicorn-64720.exe (PID: 6388)
- Unicorn-64720.exe (PID: 1672)
- Unicorn-5305.exe (PID: 7172)
- Unicorn-64720.exe (PID: 2236)
- Unicorn-53023.exe (PID: 7184)
- Unicorn-59909.exe (PID: 5548)
- Unicorn-50413.exe (PID: 7324)
- Unicorn-21310.exe (PID: 7344)
- Unicorn-57512.exe (PID: 7360)
- Unicorn-57002.exe (PID: 7372)
- Unicorn-51757.exe (PID: 7392)
- Unicorn-40059.exe (PID: 7408)
- Unicorn-18893.exe (PID: 7424)
- Unicorn-1222.exe (PID: 7456)
- Unicorn-7609.exe (PID: 7472)
- Unicorn-30076.exe (PID: 7492)
- Unicorn-39867.exe (PID: 7512)
- Unicorn-25800.exe (PID: 7540)
- Unicorn-40090.exe (PID: 7560)
- Unicorn-47372.exe (PID: 7592)
- Unicorn-59624.exe (PID: 7652)
- Unicorn-55540.exe (PID: 7636)
- Unicorn-59624.exe (PID: 7660)
- Unicorn-55540.exe (PID: 7612)
- Unicorn-59624.exe (PID: 7644)
- Unicorn-47927.exe (PID: 7700)
- Unicorn-56095.exe (PID: 7764)
- Unicorn-10158.exe (PID: 7756)
- Unicorn-55540.exe (PID: 7628)
- Unicorn-56095.exe (PID: 7748)
- Unicorn-7351.exe (PID: 5772)
- Unicorn-2255.exe (PID: 7688)
- Unicorn-20215.exe (PID: 7772)
- Unicorn-55540.exe (PID: 7620)
- Unicorn-56095.exe (PID: 7740)
- Unicorn-14615.exe (PID: 7800)
- Unicorn-33950.exe (PID: 7792)
- Unicorn-12151.exe (PID: 7960)
- Unicorn-21943.exe (PID: 7980)
- Unicorn-21197.exe (PID: 8000)
- Unicorn-63718.exe (PID: 8076)
- Unicorn-9307.exe (PID: 8068)
- Unicorn-3599.exe (PID: 8060)
- Unicorn-27318.exe (PID: 8020)
- Unicorn-3407.exe (PID: 8116)
- Unicorn-61331.exe (PID: 8132)
- Unicorn-15660.exe (PID: 8140)
- Unicorn-56500.exe (PID: 8180)
- Unicorn-38134.exe (PID: 6652)
- Unicorn-60584.exe (PID: 8188)
- Unicorn-9106.exe (PID: 4268)
- Unicorn-58555.exe (PID: 812)
- Unicorn-37388.exe (PID: 8220)
- Unicorn-18037.exe (PID: 6668)
- Unicorn-4715.exe (PID: 7264)
- Unicorn-25136.exe (PID: 8196)
- Unicorn-34181.exe (PID: 8268)
- Unicorn-37123.exe (PID: 8228)
- Unicorn-17522.exe (PID: 8240)
- Unicorn-29582.exe (PID: 8288)
- Unicorn-4450.exe (PID: 6656)
- Unicorn-17697.exe (PID: 8148)
- Unicorn-823.exe (PID: 8432)
- Unicorn-10837.exe (PID: 4408)
- Unicorn-58192.exe (PID: 8408)
- Unicorn-50024.exe (PID: 8384)
- Unicorn-35119.exe (PID: 8560)
- Unicorn-4907.exe (PID: 8440)
- Unicorn-17714.exe (PID: 8572)
- Unicorn-823.exe (PID: 8424)
- Unicorn-35586.exe (PID: 8672)
- Unicorn-17160.exe (PID: 8480)
- Unicorn-17160.exe (PID: 8488)
- Unicorn-17160.exe (PID: 8524)
- Unicorn-25328.exe (PID: 8580)
- Unicorn-49322.exe (PID: 8776)
- Unicorn-39618.exe (PID: 8612)
- Unicorn-54985.exe (PID: 8648)
- Unicorn-18120.exe (PID: 9044)
- Unicorn-51731.exe (PID: 8968)
- Unicorn-25328.exe (PID: 8588)
- Unicorn-57023.exe (PID: 8600)
- Unicorn-25328.exe (PID: 8532)
- Unicorn-35119.exe (PID: 8636)
- Unicorn-50606.exe (PID: 8724)
- Unicorn-59344.exe (PID: 8924)
- Unicorn-49322.exe (PID: 8680)
- Unicorn-34070.exe (PID: 8716)
- Unicorn-53406.exe (PID: 8864)
- Unicorn-39670.exe (PID: 8700)
- Unicorn-17160.exe (PID: 8516)
- Unicorn-55260.exe (PID: 8908)
- Unicorn-51136.exe (PID: 8692)
- Unicorn-1493.exe (PID: 7732)
- Unicorn-35119.exe (PID: 8628)
- Unicorn-25328.exe (PID: 8656)
- Unicorn-38275.exe (PID: 9076)
- Unicorn-62831.exe (PID: 8508)
- Unicorn-35586.exe (PID: 8664)
- Unicorn-59271.exe (PID: 8784)
- Unicorn-2505.exe (PID: 1096)
- Unicorn-12181.exe (PID: 8984)
- Unicorn-14590.exe (PID: 9064)
- Unicorn-39308.exe (PID: 9228)
- Unicorn-60968.exe (PID: 8040)
- Unicorn-6635.exe (PID: 4756)
- Unicorn-51861.exe (PID: 9056)
- Unicorn-11596.exe (PID: 9244)
- Unicorn-23849.exe (PID: 9264)
- Unicorn-12565.exe (PID: 9300)
- Unicorn-32763.exe (PID: 900)
- Unicorn-23086.exe (PID: 9280)
- Unicorn-30839.exe (PID: 9428)
- Unicorn-62442.exe (PID: 9444)
- Unicorn-22348.exe (PID: 9364)
- Unicorn-16724.exe (PID: 9480)
- Unicorn-54035.exe (PID: 9636)
- Unicorn-16724.exe (PID: 9476)
- Unicorn-55426.exe (PID: 9576)
- Unicorn-19656.exe (PID: 9388)
- Unicorn-57216.exe (PID: 9412)
- Unicorn-61648.exe (PID: 9552)
- Unicorn-55426.exe (PID: 9604)
- Unicorn-49396.exe (PID: 9512)
- Unicorn-55426.exe (PID: 9584)
- Unicorn-49396.exe (PID: 9528)
- Unicorn-53288.exe (PID: 9672)
- Unicorn-49396.exe (PID: 9520)
- Unicorn-27200.exe (PID: 9696)
- Unicorn-46360.exe (PID: 9768)
- Unicorn-46360.exe (PID: 9744)
- Unicorn-27200.exe (PID: 9688)
- Unicorn-55426.exe (PID: 9596)
- Unicorn-8363.exe (PID: 9568)
- Unicorn-60095.exe (PID: 9792)
- Unicorn-688.exe (PID: 9736)
- Unicorn-13407.exe (PID: 9800)
- Unicorn-17492.exe (PID: 9808)
- Unicorn-57295.exe (PID: 9728)
- Unicorn-61379.exe (PID: 9784)
- Unicorn-46360.exe (PID: 9752)
- Unicorn-46360.exe (PID: 9760)
- Unicorn-40759.exe (PID: 9820)
- Unicorn-31781.exe (PID: 9856)
- Unicorn-62151.exe (PID: 9944)
- Unicorn-46360.exe (PID: 9776)
- Unicorn-34766.exe (PID: 10216)
- Unicorn-13075.exe (PID: 8472)
- Unicorn-52202.exe (PID: 9932)
- Unicorn-17160.exe (PID: 8496)
- Unicorn-7242.exe (PID: 9024)
- Unicorn-15166.exe (PID: 9320)
- Unicorn-25328.exe (PID: 8540)
- Unicorn-12456.exe (PID: 9380)
- Unicorn-9541.exe (PID: 9340)
- Unicorn-42576.exe (PID: 9452)
Executable content was dropped or overwritten
- 1 (1120).exe (PID: 4776)
- Unicorn-37128.exe (PID: 1072)
- Unicorn-47128.exe (PID: 7048)
- Unicorn-16272.exe (PID: 6700)
- Unicorn-8658.exe (PID: 1056)
- Unicorn-56920.exe (PID: 3676)
- Unicorn-63464.exe (PID: 1132)
- Unicorn-46033.exe (PID: 5988)
- Unicorn-58285.exe (PID: 1052)
- Unicorn-39.exe (PID: 2692)
- Unicorn-13915.exe (PID: 4488)
- Unicorn-59909.exe (PID: 5548)
- Unicorn-7268.exe (PID: 5756)
- Unicorn-55955.exe (PID: 1040)
- Unicorn-27964.exe (PID: 6112)
- Unicorn-18818.exe (PID: 736)
- Unicorn-37755.exe (PID: 2960)
- Unicorn-55208.exe (PID: 2984)
- Unicorn-64720.exe (PID: 728)
- Unicorn-64720.exe (PID: 1672)
- Unicorn-7351.exe (PID: 5772)
- Unicorn-53023.exe (PID: 7184)
- Unicorn-58285.exe (PID: 3240)
- Unicorn-57334.exe (PID: 3268)
- Unicorn-50413.exe (PID: 7324)
- Unicorn-21310.exe (PID: 7344)
- Unicorn-57512.exe (PID: 7360)
- Unicorn-57002.exe (PID: 7372)
- Unicorn-40059.exe (PID: 7408)
- Unicorn-30076.exe (PID: 7492)
- Unicorn-1222.exe (PID: 7456)
- Unicorn-18893.exe (PID: 7424)
- Unicorn-7609.exe (PID: 7472)
- Unicorn-51757.exe (PID: 7392)
- Unicorn-25800.exe (PID: 7540)
- Unicorn-47372.exe (PID: 7592)
- Unicorn-40090.exe (PID: 7560)
- Unicorn-39867.exe (PID: 7512)
- Unicorn-59624.exe (PID: 7644)
- Unicorn-59624.exe (PID: 7652)
- Unicorn-55540.exe (PID: 7636)
- Unicorn-10158.exe (PID: 7756)
- Unicorn-55540.exe (PID: 7612)
- Unicorn-47927.exe (PID: 7700)
- Unicorn-33950.exe (PID: 7792)
- Unicorn-14615.exe (PID: 7800)
- Unicorn-64720.exe (PID: 2236)
- Unicorn-64720.exe (PID: 6388)
- Unicorn-52155.exe (PID: 4920)
- Unicorn-7086.exe (PID: 5112)
- Unicorn-12151.exe (PID: 7960)
- Unicorn-21943.exe (PID: 7980)
- Unicorn-27318.exe (PID: 8020)
- Unicorn-21197.exe (PID: 8000)
- Unicorn-13972.exe (PID: 1128)
- Unicorn-60968.exe (PID: 8040)
- Unicorn-63718.exe (PID: 8076)
- Unicorn-9307.exe (PID: 8068)
- Unicorn-3599.exe (PID: 8060)
- Unicorn-17697.exe (PID: 8148)
- Unicorn-15660.exe (PID: 8140)
- Unicorn-34181.exe (PID: 8268)
- Unicorn-56500.exe (PID: 8180)
- Unicorn-3407.exe (PID: 8116)
- Unicorn-38134.exe (PID: 6652)
- Unicorn-37388.exe (PID: 8220)
- Unicorn-58555.exe (PID: 812)
- Unicorn-60584.exe (PID: 8188)
- Unicorn-37123.exe (PID: 8228)
- Unicorn-17522.exe (PID: 8240)
- Unicorn-10837.exe (PID: 4408)
- Unicorn-29582.exe (PID: 8288)
- Unicorn-823.exe (PID: 8432)
- Unicorn-50024.exe (PID: 8384)
- Unicorn-58192.exe (PID: 8408)
- Unicorn-823.exe (PID: 8424)
- Unicorn-35119.exe (PID: 8560)
- Unicorn-4907.exe (PID: 8440)
- Unicorn-13075.exe (PID: 8472)
- Unicorn-59624.exe (PID: 7660)
- Unicorn-49322.exe (PID: 8776)
- Unicorn-17160.exe (PID: 8488)
- Unicorn-17160.exe (PID: 8524)
- Unicorn-25328.exe (PID: 8532)
- Unicorn-35586.exe (PID: 8672)
- Unicorn-25328.exe (PID: 8580)
- Unicorn-18120.exe (PID: 9044)
- Unicorn-39618.exe (PID: 8612)
- Unicorn-54985.exe (PID: 8648)
- Unicorn-17160.exe (PID: 8496)
- Unicorn-25328.exe (PID: 8588)
- Unicorn-35119.exe (PID: 8636)
- Unicorn-50606.exe (PID: 8724)
- Unicorn-59344.exe (PID: 8924)
- Unicorn-49322.exe (PID: 8680)
- Unicorn-34070.exe (PID: 8716)
- Unicorn-53406.exe (PID: 8864)
- Unicorn-2255.exe (PID: 7688)
- Unicorn-39670.exe (PID: 8700)
- Unicorn-20215.exe (PID: 7772)
- Unicorn-25328.exe (PID: 8656)
- Unicorn-55540.exe (PID: 7628)
- Unicorn-17160.exe (PID: 8516)
- Unicorn-55260.exe (PID: 8908)
- Unicorn-5305.exe (PID: 7172)
- Unicorn-35119.exe (PID: 8628)
- Unicorn-1493.exe (PID: 7732)
- Unicorn-55540.exe (PID: 7620)
- Unicorn-59271.exe (PID: 8784)
- Unicorn-62831.exe (PID: 8508)
- Unicorn-38275.exe (PID: 9076)
- Unicorn-35586.exe (PID: 8664)
- Unicorn-2505.exe (PID: 1096)
- Unicorn-12181.exe (PID: 8984)
- Unicorn-14590.exe (PID: 9064)
- Unicorn-51861.exe (PID: 9056)
- Unicorn-6635.exe (PID: 4756)
- Unicorn-39308.exe (PID: 9228)
- Unicorn-32763.exe (PID: 900)
- Unicorn-11596.exe (PID: 9244)
- Unicorn-12565.exe (PID: 9300)
- Unicorn-23849.exe (PID: 9264)
- Unicorn-23086.exe (PID: 9280)
- Unicorn-61331.exe (PID: 8132)
- Unicorn-12883.exe (PID: 6872)
- Unicorn-15166.exe (PID: 9320)
- Unicorn-30839.exe (PID: 9428)
- Unicorn-12456.exe (PID: 9380)
- Unicorn-62442.exe (PID: 9444)
- Unicorn-22348.exe (PID: 9364)
- Unicorn-9541.exe (PID: 9340)
- Unicorn-42576.exe (PID: 9452)
- Unicorn-54035.exe (PID: 9636)
- Unicorn-16724.exe (PID: 9476)
- Unicorn-55426.exe (PID: 9576)
- Unicorn-57216.exe (PID: 9412)
- Unicorn-49396.exe (PID: 9528)
- Unicorn-49396.exe (PID: 9512)
- Unicorn-55426.exe (PID: 9584)
- Unicorn-53288.exe (PID: 9672)
- Unicorn-61648.exe (PID: 9552)
- Unicorn-46360.exe (PID: 9768)
- Unicorn-27200.exe (PID: 9688)
- Unicorn-55426.exe (PID: 9596)
- Unicorn-27200.exe (PID: 9696)
- Unicorn-46360.exe (PID: 9744)
- Unicorn-46360.exe (PID: 9752)
- Unicorn-60095.exe (PID: 9792)
- Unicorn-13407.exe (PID: 9800)
- Unicorn-17492.exe (PID: 9808)
- Unicorn-688.exe (PID: 9736)
- Unicorn-46360.exe (PID: 9760)
- Unicorn-31781.exe (PID: 9856)
- Unicorn-52202.exe (PID: 9932)
- Unicorn-62151.exe (PID: 9944)
- Unicorn-40759.exe (PID: 9820)
- Unicorn-34766.exe (PID: 10216)
- Unicorn-17714.exe (PID: 8572)
- Unicorn-57023.exe (PID: 8600)
- Unicorn-25328.exe (PID: 8540)
- Unicorn-56095.exe (PID: 7764)
- Unicorn-51136.exe (PID: 8692)
- Unicorn-51731.exe (PID: 8968)
- Unicorn-7242.exe (PID: 9024)
- Unicorn-25136.exe (PID: 8196)
- Unicorn-18037.exe (PID: 6668)
- Unicorn-17160.exe (PID: 8480)
- Unicorn-61379.exe (PID: 9784)
- Unicorn-55426.exe (PID: 9604)
- Unicorn-46360.exe (PID: 9776)
- Unicorn-49396.exe (PID: 9520)
- Unicorn-56095.exe (PID: 7740)
- Unicorn-4450.exe (PID: 6656)
- Unicorn-28888.exe (PID: 10312)
- Unicorn-59375.exe (PID: 10460)
- Unicorn-56095.exe (PID: 7748)
- Unicorn-35084.exe (PID: 10596)
- Unicorn-43060.exe (PID: 10632)
- Unicorn-57295.exe (PID: 9728)
- Unicorn-19656.exe (PID: 9388)
- Unicorn-16724.exe (PID: 9480)
- Unicorn-8363.exe (PID: 9568)
INFO
The sample compiled with chinese language support
- 1 (1120).exe (PID: 4776)
- Unicorn-38134.exe (PID: 6652)
Checks supported languages
- 1 (1120).exe (PID: 4776)
- Unicorn-37128.exe (PID: 1072)
- Unicorn-16272.exe (PID: 6700)
- Unicorn-57334.exe (PID: 3268)
- Unicorn-8658.exe (PID: 1056)
- Unicorn-56920.exe (PID: 3676)
- Unicorn-39.exe (PID: 2692)
- Unicorn-52155.exe (PID: 4920)
- Unicorn-58285.exe (PID: 3240)
- Unicorn-58285.exe (PID: 1052)
- Unicorn-46033.exe (PID: 5988)
- Unicorn-59909.exe (PID: 5548)
- Unicorn-37755.exe (PID: 2960)
- Unicorn-55955.exe (PID: 1040)
- Unicorn-18818.exe (PID: 736)
- Unicorn-27964.exe (PID: 6112)
- Unicorn-64720.exe (PID: 1672)
- Unicorn-2505.exe (PID: 1096)
- Unicorn-7351.exe (PID: 5772)
- Unicorn-57002.exe (PID: 7372)
- Unicorn-64720.exe (PID: 728)
- Unicorn-64720.exe (PID: 2236)
- Unicorn-39867.exe (PID: 7512)
- Unicorn-25800.exe (PID: 7540)
- Unicorn-59624.exe (PID: 7652)
- Unicorn-55540.exe (PID: 7628)
- Unicorn-3599.exe (PID: 8060)
- Unicorn-61331.exe (PID: 8132)
- Unicorn-17697.exe (PID: 8148)
- Unicorn-63718.exe (PID: 8076)
- Unicorn-58555.exe (PID: 812)
- Unicorn-12883.exe (PID: 6872)
- Unicorn-25136.exe (PID: 8196)
- Unicorn-37388.exe (PID: 8220)
- Unicorn-37123.exe (PID: 8228)
- Unicorn-29582.exe (PID: 8288)
- Unicorn-34181.exe (PID: 8268)
- Unicorn-50024.exe (PID: 8384)
- Unicorn-823.exe (PID: 8424)
- Unicorn-17160.exe (PID: 8480)
- Unicorn-25328.exe (PID: 8532)
- Unicorn-17160.exe (PID: 8496)
- Unicorn-25328.exe (PID: 8588)
- Unicorn-17160.exe (PID: 8516)
- Unicorn-39618.exe (PID: 8612)
- Unicorn-54985.exe (PID: 8648)
- Unicorn-39670.exe (PID: 8700)
- Unicorn-51136.exe (PID: 8692)
- Unicorn-53406.exe (PID: 8864)
- Unicorn-51731.exe (PID: 8968)
- Unicorn-59344.exe (PID: 8924)
- Unicorn-50606.exe (PID: 8724)
- Unicorn-49322.exe (PID: 8776)
- Unicorn-32763.exe (PID: 900)
- Unicorn-39308.exe (PID: 9228)
- Unicorn-23849.exe (PID: 9264)
- Unicorn-23086.exe (PID: 9280)
- Unicorn-12565.exe (PID: 9300)
- Unicorn-38275.exe (PID: 9076)
- Unicorn-12456.exe (PID: 9380)
- Unicorn-30839.exe (PID: 9428)
- Unicorn-57216.exe (PID: 9412)
- Unicorn-62442.exe (PID: 9444)
- Unicorn-9541.exe (PID: 9340)
- Unicorn-49396.exe (PID: 9528)
- Unicorn-16724.exe (PID: 9480)
- Unicorn-55426.exe (PID: 9584)
- Unicorn-54035.exe (PID: 9636)
- Unicorn-27200.exe (PID: 9696)
- Unicorn-8363.exe (PID: 9568)
- Unicorn-55426.exe (PID: 9596)
- Unicorn-55426.exe (PID: 9604)
- Unicorn-61379.exe (PID: 9784)
- Unicorn-13407.exe (PID: 9800)
- Unicorn-62151.exe (PID: 9944)
- Unicorn-31781.exe (PID: 9856)
- Unicorn-60095.exe (PID: 9792)
- Unicorn-34766.exe (PID: 10216)
- Unicorn-28888.exe (PID: 10312)
- Unicorn-57295.exe (PID: 9728)
- Unicorn-688.exe (PID: 9736)
- Unicorn-59375.exe (PID: 10460)
- Unicorn-35084.exe (PID: 10596)
- Unicorn-23002.exe (PID: 10660)
- Unicorn-15047.exe (PID: 10772)
- Unicorn-11840.exe (PID: 10828)
- Unicorn-11840.exe (PID: 10820)
- Unicorn-52380.exe (PID: 10720)
- Unicorn-56827.exe (PID: 10744)
- Unicorn-40429.exe (PID: 10876)
- Unicorn-48597.exe (PID: 10936)
- Unicorn-40429.exe (PID: 10880)
- Unicorn-20284.exe (PID: 11072)
- Unicorn-65400.exe (PID: 11008)
- Unicorn-5985.exe (PID: 11044)
- Unicorn-20284.exe (PID: 11068)
- Unicorn-49941.exe (PID: 11108)
- Unicorn-740.exe (PID: 11164)
- Unicorn-17077.exe (PID: 11224)
- Unicorn-25799.exe (PID: 6940)
- Unicorn-45665.exe (PID: 11272)
- Unicorn-20092.exe (PID: 5668)
- Unicorn-42135.exe (PID: 11360)
- Unicorn-29883.exe (PID: 11304)
- Unicorn-43619.exe (PID: 11280)
- Unicorn-36428.exe (PID: 11332)
- Unicorn-3298.exe (PID: 11532)
- Unicorn-58886.exe (PID: 11484)
- Unicorn-39169.exe (PID: 11500)
- Unicorn-45151.exe (PID: 11508)
- Unicorn-56583.exe (PID: 11472)
- Unicorn-65016.exe (PID: 11684)
- Unicorn-62970.exe (PID: 11644)
- Unicorn-45151.exe (PID: 11492)
- Unicorn-54388.exe (PID: 11428)
- Unicorn-49749.exe (PID: 11288)
- Unicorn-62970.exe (PID: 11652)
- Unicorn-9079.exe (PID: 11920)
- Unicorn-12286.exe (PID: 11696)
- Unicorn-23221.exe (PID: 11936)
- Unicorn-23792.exe (PID: 11884)
- Unicorn-23527.exe (PID: 11892)
- Unicorn-8716.exe (PID: 11444)
- Unicorn-36776.exe (PID: 12192)
- Unicorn-11155.exe (PID: 12208)
- Unicorn-27905.exe (PID: 12224)
- Unicorn-56080.exe (PID: 12260)
- Unicorn-14170.exe (PID: 12232)
- Unicorn-24337.exe (PID: 12092)
- Unicorn-35306.exe (PID: 12124)
- Unicorn-1279.exe (PID: 5776)
- Unicorn-33652.exe (PID: 12296)
- Unicorn-54949.exe (PID: 12316)
- Unicorn-14492.exe (PID: 12276)
- Unicorn-60164.exe (PID: 12268)
- Unicorn-5063.exe (PID: 924)
- Unicorn-19537.exe (PID: 12356)
- Unicorn-52764.exe (PID: 12416)
- Unicorn-6827.exe (PID: 12424)
- Unicorn-58331.exe (PID: 12396)
- Unicorn-59671.exe (PID: 12496)
- Unicorn-39058.exe (PID: 12524)
- Unicorn-39058.exe (PID: 12532)
- Unicorn-47803.exe (PID: 12368)
- Unicorn-40402.exe (PID: 12584)
- Unicorn-48571.exe (PID: 12604)
- Unicorn-9021.exe (PID: 12668)
- Unicorn-48571.exe (PID: 12628)
- Unicorn-20859.exe (PID: 12688)
- Unicorn-46847.exe (PID: 12732)
- Unicorn-59427.exe (PID: 12972)
- Unicorn-20889.exe (PID: 12868)
- Unicorn-36318.exe (PID: 12568)
- Unicorn-31749.exe (PID: 13028)
- Unicorn-49478.exe (PID: 12952)
- Unicorn-49478.exe (PID: 12944)
- Unicorn-31218.exe (PID: 13012)
- Unicorn-60652.exe (PID: 13188)
- Unicorn-30310.exe (PID: 13104)
- Unicorn-1554.exe (PID: 12884)
- Unicorn-7154.exe (PID: 12900)
- Unicorn-7154.exe (PID: 12876)
- Unicorn-39884.exe (PID: 13036)
- Unicorn-15920.exe (PID: 13128)
- Unicorn-8244.exe (PID: 13212)
- Unicorn-8327.exe (PID: 13416)
- Unicorn-8244.exe (PID: 13208)
- Unicorn-41000.exe (PID: 13476)
- Unicorn-2197.exe (PID: 13408)
- Unicorn-41685.exe (PID: 13604)
- Unicorn-58296.exe (PID: 13656)
- Unicorn-41685.exe (PID: 13596)
- Unicorn-37684.exe (PID: 13676)
- Unicorn-25240.exe (PID: 13716)
- Unicorn-5971.exe (PID: 13804)
- Unicorn-35437.exe (PID: 13908)
- Unicorn-43221.exe (PID: 14016)
- Unicorn-18717.exe (PID: 13984)
- Unicorn-18717.exe (PID: 13980)
- Unicorn-38068.exe (PID: 14032)
- Unicorn-59988.exe (PID: 14060)
- Unicorn-15016.exe (PID: 13876)
- Unicorn-58488.exe (PID: 14456)
- Unicorn-32338.exe (PID: 6184)
- Unicorn-25269.exe (PID: 14364)
- Unicorn-53915.exe (PID: 14684)
- Unicorn-65307.exe (PID: 14556)
- Unicorn-61123.exe (PID: 14584)
- Unicorn-22582.exe (PID: 14720)
- Unicorn-3496.exe (PID: 14184)
- Unicorn-1778.exe (PID: 14952)
- Unicorn-14719.exe (PID: 15292)
- Unicorn-22198.exe (PID: 15008)
- Unicorn-34450.exe (PID: 15116)
- Unicorn-46952.exe (PID: 14964)
- Unicorn-59479.exe (PID: 456)
- Unicorn-51171.exe (PID: 14748)
- Unicorn-51171.exe (PID: 14744)
- Unicorn-19375.exe (PID: 14800)
- Unicorn-19375.exe (PID: 14796)
- Unicorn-31627.exe (PID: 14836)
- Unicorn-12581.exe (PID: 15584)
- Unicorn-53614.exe (PID: 1912)
- Unicorn-39878.exe (PID: 7604)
- Unicorn-53614.exe (PID: 13692)
- Unicorn-33656.exe (PID: 15416)
- Unicorn-4413.exe (PID: 15440)
- Unicorn-7071.exe (PID: 15676)
- Unicorn-33656.exe (PID: 15408)
- Unicorn-7891.exe (PID: 15748)
- Unicorn-10311.exe (PID: 15664)
- Unicorn-9781.exe (PID: 15644)
- Unicorn-14798.exe (PID: 15916)
- Unicorn-40563.exe (PID: 15792)
- Unicorn-13838.exe (PID: 15276)
- Unicorn-18826.exe (PID: 15740)
- Unicorn-50490.exe (PID: 16452)
- Unicorn-64767.exe (PID: 16088)
- Unicorn-42431.exe (PID: 16176)
- Unicorn-15374.exe (PID: 16208)
- Unicorn-30178.exe (PID: 16168)
- Unicorn-42044.exe (PID: 16248)
- Unicorn-29655.exe (PID: 2596)
- Unicorn-63811.exe (PID: 16424)
- Unicorn-49636.exe (PID: 16520)
- Unicorn-7670.exe (PID: 16716)
- Unicorn-22966.exe (PID: 15948)
- Unicorn-22327.exe (PID: 16016)
- Unicorn-47528.exe (PID: 16000)
- Unicorn-41724.exe (PID: 16984)
- Unicorn-6201.exe (PID: 16936)
- Unicorn-41724.exe (PID: 17000)
- Unicorn-7161.exe (PID: 17216)
- Unicorn-6201.exe (PID: 16952)
- Unicorn-46903.exe (PID: 17136)
- Unicorn-12529.exe (PID: 17280)
- Unicorn-58963.exe (PID: 17248)
- Unicorn-17110.exe (PID: 17272)
- Unicorn-4891.exe (PID: 17232)
- Unicorn-23798.exe (PID: 16788)
- Unicorn-59678.exe (PID: 16764)
Reads the computer name
- 1 (1120).exe (PID: 4776)
- Unicorn-37128.exe (PID: 1072)
- Unicorn-47128.exe (PID: 7048)
- Unicorn-16272.exe (PID: 6700)
- Unicorn-8658.exe (PID: 1056)
- Unicorn-52155.exe (PID: 4920)
- Unicorn-58285.exe (PID: 1052)
- Unicorn-13972.exe (PID: 1128)
- Unicorn-59909.exe (PID: 5548)
- Unicorn-55208.exe (PID: 2984)
- Unicorn-50413.exe (PID: 7324)
- Unicorn-53023.exe (PID: 7184)
- Unicorn-21310.exe (PID: 7344)
- Unicorn-51757.exe (PID: 7392)
- Unicorn-18893.exe (PID: 7424)
- Unicorn-1222.exe (PID: 7456)
- Unicorn-39867.exe (PID: 7512)
- Unicorn-56095.exe (PID: 7764)
- Unicorn-59624.exe (PID: 7652)
- Unicorn-56095.exe (PID: 7748)
- Unicorn-2255.exe (PID: 7688)
- Unicorn-55540.exe (PID: 7620)
- Unicorn-33950.exe (PID: 7792)
- Unicorn-21943.exe (PID: 7980)
- Unicorn-27318.exe (PID: 8020)
- Unicorn-10158.exe (PID: 7756)
- Unicorn-9307.exe (PID: 8068)
- Unicorn-3407.exe (PID: 8116)
- Unicorn-56500.exe (PID: 8180)
- Unicorn-25136.exe (PID: 8196)
- Unicorn-60584.exe (PID: 8188)
- Unicorn-9106.exe (PID: 4268)
- Unicorn-18037.exe (PID: 6668)
- Unicorn-823.exe (PID: 8424)
- Unicorn-50024.exe (PID: 8384)
- Unicorn-4907.exe (PID: 8440)
- Unicorn-13075.exe (PID: 8472)
- Unicorn-17160.exe (PID: 8524)
- Unicorn-25328.exe (PID: 8532)
- Unicorn-35119.exe (PID: 8636)
- Unicorn-18120.exe (PID: 9044)
- Unicorn-34070.exe (PID: 8716)
- Unicorn-53406.exe (PID: 8864)
- Unicorn-17160.exe (PID: 8516)
- Unicorn-39308.exe (PID: 9228)
- Unicorn-57023.exe (PID: 8600)
- Unicorn-6635.exe (PID: 4756)
- Unicorn-12565.exe (PID: 9300)
- Unicorn-23086.exe (PID: 9280)
- Unicorn-30839.exe (PID: 9428)
- Unicorn-19656.exe (PID: 9388)
- Unicorn-16724.exe (PID: 9476)
- Unicorn-55426.exe (PID: 9604)
- Unicorn-57216.exe (PID: 9412)
- Unicorn-53288.exe (PID: 9672)
- Unicorn-55426.exe (PID: 9596)
- Unicorn-55426.exe (PID: 9584)
- Unicorn-688.exe (PID: 9736)
- Unicorn-46360.exe (PID: 9760)
- Unicorn-62151.exe (PID: 9944)
- Unicorn-52202.exe (PID: 9932)
Create files in a temporary directory
- 1 (1120).exe (PID: 4776)
- Unicorn-37128.exe (PID: 1072)
- Unicorn-47128.exe (PID: 7048)
- Unicorn-16272.exe (PID: 6700)
- Unicorn-8658.exe (PID: 1056)
- Unicorn-63464.exe (PID: 1132)
- Unicorn-46033.exe (PID: 5988)
- Unicorn-58285.exe (PID: 1052)
- Unicorn-39.exe (PID: 2692)
- Unicorn-7268.exe (PID: 5756)
- Unicorn-55955.exe (PID: 1040)
- Unicorn-59909.exe (PID: 5548)
- Unicorn-18818.exe (PID: 736)
- Unicorn-27964.exe (PID: 6112)
- Unicorn-56920.exe (PID: 3676)
- Unicorn-55208.exe (PID: 2984)
- Unicorn-64720.exe (PID: 1672)
- Unicorn-64720.exe (PID: 728)
- Unicorn-7351.exe (PID: 5772)
- Unicorn-53023.exe (PID: 7184)
- Unicorn-57334.exe (PID: 3268)
- Unicorn-50413.exe (PID: 7324)
- Unicorn-21310.exe (PID: 7344)
- Unicorn-13915.exe (PID: 4488)
- Unicorn-1222.exe (PID: 7456)
- Unicorn-7609.exe (PID: 7472)
- Unicorn-30076.exe (PID: 7492)
- Unicorn-51757.exe (PID: 7392)
- Unicorn-25800.exe (PID: 7540)
- Unicorn-40090.exe (PID: 7560)
- Unicorn-47372.exe (PID: 7592)
- Unicorn-39867.exe (PID: 7512)
- Unicorn-55540.exe (PID: 7636)
- Unicorn-55540.exe (PID: 7612)
- Unicorn-47927.exe (PID: 7700)
- Unicorn-33950.exe (PID: 7792)
- Unicorn-58285.exe (PID: 3240)
- Unicorn-14615.exe (PID: 7800)
- Unicorn-64720.exe (PID: 2236)
- Unicorn-10158.exe (PID: 7756)
- Unicorn-52155.exe (PID: 4920)
- Unicorn-64720.exe (PID: 6388)
- Unicorn-7086.exe (PID: 5112)
- Unicorn-21943.exe (PID: 7980)
- Unicorn-21197.exe (PID: 8000)
- Unicorn-13972.exe (PID: 1128)
- Unicorn-12151.exe (PID: 7960)
- Unicorn-57512.exe (PID: 7360)
- Unicorn-3599.exe (PID: 8060)
- Unicorn-57002.exe (PID: 7372)
- Unicorn-3407.exe (PID: 8116)
- Unicorn-63718.exe (PID: 8076)
- Unicorn-40059.exe (PID: 7408)
- Unicorn-17697.exe (PID: 8148)
- Unicorn-56500.exe (PID: 8180)
- Unicorn-15660.exe (PID: 8140)
- Unicorn-38134.exe (PID: 6652)
- Unicorn-18893.exe (PID: 7424)
- Unicorn-58555.exe (PID: 812)
- Unicorn-29582.exe (PID: 8288)
- Unicorn-17522.exe (PID: 8240)
- Unicorn-10837.exe (PID: 4408)
- Unicorn-37755.exe (PID: 2960)
- Unicorn-58192.exe (PID: 8408)
- Unicorn-59624.exe (PID: 7652)
- Unicorn-823.exe (PID: 8424)
- Unicorn-4907.exe (PID: 8440)
- Unicorn-17714.exe (PID: 8572)
- Unicorn-35586.exe (PID: 8672)
- Unicorn-17160.exe (PID: 8496)
- Unicorn-59624.exe (PID: 7644)
- Unicorn-54985.exe (PID: 8648)
- Unicorn-34070.exe (PID: 8716)
- Unicorn-17160.exe (PID: 8516)
- Unicorn-55260.exe (PID: 8908)
- Unicorn-59344.exe (PID: 8924)
- Unicorn-53406.exe (PID: 8864)
- Unicorn-2255.exe (PID: 7688)
- Unicorn-39670.exe (PID: 8700)
- Unicorn-1493.exe (PID: 7732)
- Unicorn-35119.exe (PID: 8628)
- Unicorn-55540.exe (PID: 7620)
- Unicorn-5305.exe (PID: 7172)
- Unicorn-14590.exe (PID: 9064)
- Unicorn-12181.exe (PID: 8984)
- Unicorn-9307.exe (PID: 8068)
- Unicorn-27318.exe (PID: 8020)
- Unicorn-39308.exe (PID: 9228)
- Unicorn-60968.exe (PID: 8040)
- Unicorn-11596.exe (PID: 9244)
- Unicorn-23086.exe (PID: 9280)
- Unicorn-34181.exe (PID: 8268)
- Unicorn-12456.exe (PID: 9380)
- Unicorn-60584.exe (PID: 8188)
- Unicorn-30839.exe (PID: 9428)
- Unicorn-9541.exe (PID: 9340)
- Unicorn-57216.exe (PID: 9412)
- Unicorn-55426.exe (PID: 9596)
- Unicorn-46360.exe (PID: 9744)
- Unicorn-46360.exe (PID: 9768)
- Unicorn-46360.exe (PID: 9752)
- Unicorn-17492.exe (PID: 9808)
- Unicorn-688.exe (PID: 9736)
- Unicorn-40759.exe (PID: 9820)
- Unicorn-34766.exe (PID: 10216)
- Unicorn-59624.exe (PID: 7660)
- Unicorn-823.exe (PID: 8432)
- Unicorn-39618.exe (PID: 8612)
- Unicorn-25328.exe (PID: 8656)
- Unicorn-62831.exe (PID: 8508)
- Unicorn-35586.exe (PID: 8664)
- Unicorn-61331.exe (PID: 8132)
- Unicorn-12883.exe (PID: 6872)
- Unicorn-18037.exe (PID: 6668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:20 00:32:00+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
660
Monitored processes
529
Malicious processes
82
Suspicious processes
73
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 456 | C:\Users\admin\AppData\Local\Temp\Unicorn-59479.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-59479.exe | — | Unicorn-64720.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 728 | C:\Users\admin\AppData\Local\Temp\Unicorn-64720.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-64720.exe | Unicorn-58285.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 736 | C:\Users\admin\AppData\Local\Temp\Unicorn-18818.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-18818.exe | Unicorn-16272.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 812 | C:\Users\admin\AppData\Local\Temp\Unicorn-58555.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-58555.exe | Unicorn-27964.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 872 | C:\Users\admin\AppData\Local\Temp\Unicorn-57371.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-57371.exe | — | Unicorn-57002.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 900 | C:\Users\admin\AppData\Local\Temp\Unicorn-32763.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-32763.exe | Unicorn-57512.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 924 | C:\Users\admin\AppData\Local\Temp\Unicorn-5063.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5063.exe | — | Unicorn-32763.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1040 | C:\Users\admin\AppData\Local\Temp\Unicorn-55955.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-55955.exe | Unicorn-47128.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1052 | C:\Users\admin\AppData\Local\Temp\Unicorn-58285.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-58285.exe | Unicorn-63464.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1056 | C:\Users\admin\AppData\Local\Temp\Unicorn-8658.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8658.exe | 1 (1120).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
10 616
Read events
10 616
Write events
0
Delete events
0
Modification events
Executable files
923
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3676 | Unicorn-56920.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46033.exe | executable | |
MD5:ADE16430403884EECC2585EAA24A82C9 | SHA256:7CCAFAA6FAFEEB7552AA486D2CC9BC09482FE69DA984D04F3502EEAFB8442D4F | |||
| 1072 | Unicorn-37128.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56920.exe | executable | |
MD5:625289FFF6723D330309044016576241 | SHA256:A90550ABD63244810E52B6782A5C3B83DEBDCD1122F6B5F9CDF6F94C7D335170 | |||
| 1056 | Unicorn-8658.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-59909.exe | executable | |
MD5:3CF73B9EA23CDD0668E44D63BCA2A640 | SHA256:44A0498A69A99508B8E0ECDBBEFA5DB5AC4B293AEA4170419B4B582AB6FF598E | |||
| 4776 | 1 (1120).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-8658.exe | executable | |
MD5:637B40A5151B34A0FF6E9427F0549B2C | SHA256:DA8F33179FA17C4475CA9DF67F251EF6E1859BF0DCB88450C0BD30F346D095C5 | |||
| 7048 | Unicorn-47128.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-39.exe | executable | |
MD5:9B74689A431A6CB791E2C9822D7ADFC9 | SHA256:F0D71AEDE49F16D2B7C373FE2DF101EB99A3671859A01EA83FA673C115A8B4C8 | |||
| 6700 | Unicorn-16272.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13915.exe | executable | |
MD5:632D33015F917ECCFBFE34DA22EB4D99 | SHA256:2B62822F5320D9B17778B6FE852FA1A7B5BEF85A500FB28BD1754274F44DDF20 | |||
| 1132 | Unicorn-63464.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-58285.exe | executable | |
MD5:494FC7F53A5B7C90213E1CFBE9AD41B3 | SHA256:0F7296AAA39A7D6315E4275670212FC9E559F953ABCFB98A7CC60137F98DD7D9 | |||
| 4776 | 1 (1120).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13972.exe | executable | |
MD5:E35051CBE7629BC1FB37C78E08534F96 | SHA256:A1ED0A9333175D524B3E894EB3EA871EF2A5E6B83306AE3A41A4673D9A8F686B | |||
| 4488 | Unicorn-13915.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-55208.exe | executable | |
MD5:81F40451A327718B88E9944092189785 | SHA256:1423A4DF102C9F5D512DC7205A2CED91C8EECFAF4261E2351E7FA799CA4A6E89 | |||
| 7048 | Unicorn-47128.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-55955.exe | executable | |
MD5:A137C70C8BC55CF741ADA2609E996523 | SHA256:3F36F6A5EF2D688DA5330DE316C69FF86DFC2DF3319DC798998419E7AFB5A808 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
16
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5640 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.166:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
9000 | SIHClient.exe | GET | 200 | 2.22.33.235:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
9000 | SIHClient.exe | GET | 200 | 2.22.33.235:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.48.23.166:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
2104 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2112 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.159.73:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
5640 | backgroundTaskHost.exe | 20.199.58.43:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |