| File name: | 1 (1203) |
| Full analysis: | https://app.any.run/tasks/02dfe07f-6e60-45ba-911e-e62ba145678b |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 11:19:54 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | A48F0B79CEC14AFEDF4A63E61B3E59A0 |
| SHA1: | B076706E140D4FE5DE0933D84788646E8FB1C9DA |
| SHA256: | 440E1A53371AC82C1D62CED5F665881B3991A8D8CFF85014AAD4C1BE519DB07A |
| SSDEEP: | 6144:j7mgzJWc8DJHA5iTmkeW98ax5tpFWvJGBJ/x1eUA8k/8SwjwpyAvhhzHjjA0FKva:jaGoBHA5+mnMpghaJJ1eUAix4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- 1 (1203).exe (PID: 2560)
- Unicorn-51787.exe (PID: 5216)
- Unicorn-14667.exe (PID: 7712)
- Unicorn-34765.exe (PID: 7732)
- Unicorn-443.exe (PID: 6988)
- Unicorn-24948.exe (PID: 900)
- Unicorn-54283.exe (PID: 3676)
- Unicorn-47406.exe (PID: 4040)
- Unicorn-57184.exe (PID: 7000)
- Unicorn-16898.exe (PID: 7580)
- Unicorn-12067.exe (PID: 7436)
- Unicorn-61076.exe (PID: 7696)
- Unicorn-37126.exe (PID: 7684)
- Unicorn-54946.exe (PID: 7764)
- Unicorn-44475.exe (PID: 7472)
- Unicorn-47008.exe (PID: 7844)
- Unicorn-59815.exe (PID: 7824)
- Unicorn-59068.exe (PID: 7828)
- Unicorn-3899.exe (PID: 7588)
- Unicorn-27910.exe (PID: 8056)
- Unicorn-47776.exe (PID: 8064)
- Unicorn-35524.exe (PID: 8088)
- Unicorn-27356.exe (PID: 8096)
- Unicorn-27356.exe (PID: 8104)
- Unicorn-64667.exe (PID: 8116)
- Unicorn-24157.exe (PID: 8012)
- Unicorn-64304.exe (PID: 8036)
- Unicorn-59763.exe (PID: 7876)
- Unicorn-53898.exe (PID: 7020)
- Unicorn-18996.exe (PID: 7892)
- Unicorn-64667.exe (PID: 7904)
- Unicorn-51098.exe (PID: 4448)
- Unicorn-61564.exe (PID: 7656)
- Unicorn-12171.exe (PID: 8152)
- Unicorn-21086.exe (PID: 5408)
- Unicorn-63410.exe (PID: 8180)
- Unicorn-20148.exe (PID: 8144)
- Unicorn-53567.exe (PID: 6268)
- Unicorn-37636.exe (PID: 5640)
- Unicorn-41839.exe (PID: 4784)
- Unicorn-50443.exe (PID: 5800)
- Unicorn-17984.exe (PID: 516)
- Unicorn-48610.exe (PID: 4228)
- Unicorn-50272.exe (PID: 1912)
- Unicorn-38404.exe (PID: 5116)
- Unicorn-59379.exe (PID: 1324)
- Unicorn-35436.exe (PID: 2240)
- Unicorn-5347.exe (PID: 6736)
- Unicorn-5347.exe (PID: 6388)
- Unicorn-43604.exe (PID: 6676)
- Unicorn-62716.exe (PID: 5256)
- Unicorn-62716.exe (PID: 1628)
- Unicorn-42842.exe (PID: 1128)
- Unicorn-35436.exe (PID: 7508)
- Unicorn-31906.exe (PID: 736)
- Unicorn-40074.exe (PID: 6576)
- Unicorn-33197.exe (PID: 6512)
- Unicorn-13862.exe (PID: 1240)
- Unicorn-64771.exe (PID: 1568)
- Unicorn-35436.exe (PID: 2420)
- Unicorn-19100.exe (PID: 7448)
- Unicorn-40074.exe (PID: 2984)
- Unicorn-19868.exe (PID: 7572)
- Unicorn-19078.exe (PID: 7444)
- Unicorn-20038.exe (PID: 3268)
- Unicorn-42134.exe (PID: 2616)
- Unicorn-39063.exe (PID: 7340)
- Unicorn-60516.exe (PID: 5556)
- Unicorn-27460.exe (PID: 7412)
- Unicorn-47880.exe (PID: 7428)
- Unicorn-64963.exe (PID: 6148)
- Unicorn-17106.exe (PID: 732)
- Unicorn-11705.exe (PID: 7036)
- Unicorn-56048.exe (PID: 5892)
- Unicorn-31736.exe (PID: 7516)
- Unicorn-49032.exe (PID: 4300)
- Unicorn-29166.exe (PID: 2644)
- Unicorn-62170.exe (PID: 2236)
- Unicorn-53308.exe (PID: 1188)
- Unicorn-57008.exe (PID: 8232)
- Unicorn-26565.exe (PID: 8196)
- Unicorn-41056.exe (PID: 8000)
- Unicorn-8767.exe (PID: 8348)
- Unicorn-61979.exe (PID: 8308)
- Unicorn-62415.exe (PID: 8388)
- Unicorn-18781.exe (PID: 8412)
- Unicorn-41440.exe (PID: 8372)
- Unicorn-12446.exe (PID: 8252)
- Unicorn-35576.exe (PID: 8748)
- Unicorn-2903.exe (PID: 8728)
- Unicorn-48212.exe (PID: 8648)
- Unicorn-24070.exe (PID: 8688)
- Unicorn-53810.exe (PID: 1040)
- Unicorn-12586.exe (PID: 8856)
- Unicorn-12778.exe (PID: 8824)
- Unicorn-12778.exe (PID: 8816)
- Unicorn-36728.exe (PID: 8808)
- Unicorn-48596.exe (PID: 8880)
- Unicorn-63640.exe (PID: 5544)
- Unicorn-48596.exe (PID: 8876)
- Unicorn-11455.exe (PID: 8932)
- Unicorn-57127.exe (PID: 8924)
- Unicorn-12594.exe (PID: 9012)
- Unicorn-53043.exe (PID: 8940)
- Unicorn-53892.exe (PID: 8984)
- Unicorn-61676.exe (PID: 9076)
- Unicorn-61676.exe (PID: 9068)
- Unicorn-49424.exe (PID: 9092)
- Unicorn-64799.exe (PID: 9120)
- Unicorn-32896.exe (PID: 9104)
- Unicorn-61868.exe (PID: 9028)
- Unicorn-32896.exe (PID: 9112)
- Unicorn-20644.exe (PID: 9132)
- Unicorn-48530.exe (PID: 9180)
- Unicorn-10098.exe (PID: 4696)
- Unicorn-1930.exe (PID: 5552)
- Unicorn-54660.exe (PID: 9188)
- Unicorn-21966.exe (PID: 8432)
- Unicorn-17254.exe (PID: 1300)
- Unicorn-62212.exe (PID: 1512)
- Unicorn-58168.exe (PID: 2192)
- Unicorn-30518.exe (PID: 8344)
- Unicorn-5075.exe (PID: 1616)
- Unicorn-23641.exe (PID: 8336)
- Unicorn-30732.exe (PID: 9284)
- Unicorn-17690.exe (PID: 8472)
- Unicorn-13435.exe (PID: 4120)
- Unicorn-36985.exe (PID: 8464)
- Unicorn-34624.exe (PID: 9340)
- Unicorn-24601.exe (PID: 9276)
- Unicorn-37748.exe (PID: 8272)
- Unicorn-19173.exe (PID: 664)
- Unicorn-55983.exe (PID: 9236)
Executable content was dropped or overwritten
- Unicorn-51787.exe (PID: 5216)
- 1 (1203).exe (PID: 2560)
- Unicorn-443.exe (PID: 6988)
- Unicorn-24948.exe (PID: 900)
- Unicorn-54283.exe (PID: 3676)
- Unicorn-47406.exe (PID: 4040)
- Unicorn-14667.exe (PID: 7712)
- Unicorn-34765.exe (PID: 7732)
- Unicorn-57184.exe (PID: 7000)
- Unicorn-16898.exe (PID: 7580)
- Unicorn-12067.exe (PID: 7436)
- Unicorn-61076.exe (PID: 7696)
- Unicorn-3899.exe (PID: 7588)
- Unicorn-44475.exe (PID: 7472)
- Unicorn-47008.exe (PID: 7844)
- Unicorn-59815.exe (PID: 7824)
- Unicorn-59068.exe (PID: 7828)
- Unicorn-54946.exe (PID: 7764)
- Unicorn-24157.exe (PID: 8012)
- Unicorn-64304.exe (PID: 8036)
- Unicorn-27910.exe (PID: 8056)
- Unicorn-47776.exe (PID: 8064)
- Unicorn-27356.exe (PID: 8096)
- Unicorn-27356.exe (PID: 8104)
- Unicorn-64667.exe (PID: 7904)
- Unicorn-59763.exe (PID: 7876)
- Unicorn-37126.exe (PID: 7684)
- Unicorn-51098.exe (PID: 4448)
- Unicorn-61564.exe (PID: 7656)
- Unicorn-21086.exe (PID: 5408)
- Unicorn-12171.exe (PID: 8152)
- Unicorn-63410.exe (PID: 8180)
- Unicorn-20148.exe (PID: 8144)
- Unicorn-53567.exe (PID: 6268)
- Unicorn-50272.exe (PID: 1912)
- Unicorn-37636.exe (PID: 5640)
- Unicorn-50443.exe (PID: 5800)
- Unicorn-17984.exe (PID: 516)
- Unicorn-48610.exe (PID: 4228)
- Unicorn-38404.exe (PID: 5116)
- Unicorn-41839.exe (PID: 4784)
- Unicorn-5347.exe (PID: 6736)
- Unicorn-5347.exe (PID: 6388)
- Unicorn-35436.exe (PID: 2240)
- Unicorn-43604.exe (PID: 6676)
- Unicorn-59379.exe (PID: 1324)
- Unicorn-53810.exe (PID: 1040)
- Unicorn-62716.exe (PID: 1628)
- Unicorn-64667.exe (PID: 8116)
- Unicorn-42842.exe (PID: 1128)
- Unicorn-35436.exe (PID: 7508)
- Unicorn-31906.exe (PID: 736)
- Unicorn-35524.exe (PID: 8088)
- Unicorn-33197.exe (PID: 6512)
- Unicorn-63640.exe (PID: 5544)
- Unicorn-13862.exe (PID: 1240)
- Unicorn-53898.exe (PID: 7020)
- Unicorn-19100.exe (PID: 7448)
- Unicorn-40074.exe (PID: 2984)
- Unicorn-35436.exe (PID: 2420)
- Unicorn-39063.exe (PID: 7340)
- Unicorn-19078.exe (PID: 7444)
- Unicorn-20038.exe (PID: 3268)
- Unicorn-31736.exe (PID: 7516)
- Unicorn-19868.exe (PID: 7572)
- Unicorn-42134.exe (PID: 2616)
- Unicorn-60516.exe (PID: 5556)
- Unicorn-27460.exe (PID: 7412)
- Unicorn-47880.exe (PID: 7428)
- Unicorn-64963.exe (PID: 6148)
- Unicorn-17106.exe (PID: 732)
- Unicorn-56048.exe (PID: 5892)
- Unicorn-11705.exe (PID: 7036)
- Unicorn-41056.exe (PID: 8000)
- Unicorn-29166.exe (PID: 2644)
- Unicorn-49032.exe (PID: 4300)
- Unicorn-62170.exe (PID: 2236)
- Unicorn-53308.exe (PID: 1188)
- Unicorn-57008.exe (PID: 8232)
- Unicorn-26565.exe (PID: 8196)
- Unicorn-8767.exe (PID: 8348)
- Unicorn-62415.exe (PID: 8388)
- Unicorn-18781.exe (PID: 8412)
- Unicorn-12446.exe (PID: 8252)
- Unicorn-61979.exe (PID: 8308)
- Unicorn-2903.exe (PID: 8728)
- Unicorn-12778.exe (PID: 8824)
- Unicorn-48212.exe (PID: 8648)
- Unicorn-24070.exe (PID: 8688)
- Unicorn-35576.exe (PID: 8748)
- Unicorn-12586.exe (PID: 8856)
- Unicorn-48596.exe (PID: 8880)
- Unicorn-12778.exe (PID: 8816)
- Unicorn-36728.exe (PID: 8808)
- Unicorn-64771.exe (PID: 1568)
- Unicorn-48596.exe (PID: 8876)
- Unicorn-11455.exe (PID: 8932)
- Unicorn-57127.exe (PID: 8924)
- Unicorn-53043.exe (PID: 8940)
- Unicorn-53892.exe (PID: 8984)
- Unicorn-61868.exe (PID: 9028)
- Unicorn-61676.exe (PID: 9076)
- Unicorn-61676.exe (PID: 9068)
- Unicorn-49424.exe (PID: 9092)
- Unicorn-64799.exe (PID: 9120)
- Unicorn-32896.exe (PID: 9104)
- Unicorn-32896.exe (PID: 9112)
- Unicorn-20644.exe (PID: 9132)
- Unicorn-48530.exe (PID: 9180)
- Unicorn-10098.exe (PID: 4696)
- Unicorn-54660.exe (PID: 9188)
- Unicorn-21966.exe (PID: 8432)
- Unicorn-5075.exe (PID: 1616)
- Unicorn-62212.exe (PID: 1512)
- Unicorn-23641.exe (PID: 8336)
- Unicorn-17254.exe (PID: 1300)
- Unicorn-58168.exe (PID: 2192)
- Unicorn-37748.exe (PID: 8272)
- Unicorn-44254.exe (PID: 8340)
- Unicorn-19173.exe (PID: 664)
- Unicorn-17690.exe (PID: 8472)
- Unicorn-34624.exe (PID: 9340)
- Unicorn-36985.exe (PID: 8464)
- Unicorn-24601.exe (PID: 9276)
- Unicorn-55983.exe (PID: 9236)
- Unicorn-13435.exe (PID: 4120)
- Unicorn-41440.exe (PID: 8372)
- Unicorn-43560.exe (PID: 9480)
- Unicorn-13819.exe (PID: 9408)
- Unicorn-60088.exe (PID: 9468)
- Unicorn-63218.exe (PID: 9548)
- Unicorn-40222.exe (PID: 9460)
- Unicorn-56196.exe (PID: 9428)
- Unicorn-7358.exe (PID: 9500)
- Unicorn-39838.exe (PID: 9600)
- Unicorn-14587.exe (PID: 9660)
- Unicorn-18996.exe (PID: 7892)
- Unicorn-48604.exe (PID: 9716)
- Unicorn-5578.exe (PID: 9360)
- Unicorn-48722.exe (PID: 9392)
- Unicorn-15142.exe (PID: 9624)
- Unicorn-41950.exe (PID: 9804)
- Unicorn-41204.exe (PID: 9856)
- Unicorn-53648.exe (PID: 9848)
- Unicorn-53456.exe (PID: 9908)
- Unicorn-4255.exe (PID: 9892)
- Unicorn-20954.exe (PID: 9964)
- Unicorn-28760.exe (PID: 9932)
- Unicorn-49543.exe (PID: 9984)
- Unicorn-51026.exe (PID: 9992)
- Unicorn-36544.exe (PID: 10028)
- Unicorn-21669.exe (PID: 9760)
- Unicorn-29837.exe (PID: 9752)
- Unicorn-36350.exe (PID: 9812)
- Unicorn-4447.exe (PID: 9796)
- Unicorn-342.exe (PID: 10072)
- Unicorn-22320.exe (PID: 10164)
- Unicorn-5761.exe (PID: 9444)
- Unicorn-40244.exe (PID: 9724)
- Unicorn-62716.exe (PID: 5256)
- Unicorn-40074.exe (PID: 6576)
- Unicorn-42164.exe (PID: 10184)
- Unicorn-1930.exe (PID: 5552)
- Unicorn-30518.exe (PID: 8344)
- Unicorn-12594.exe (PID: 10036)
- Unicorn-44447.exe (PID: 10020)
- Unicorn-13383.exe (PID: 10088)
- Unicorn-30732.exe (PID: 9284)
- Unicorn-39350.exe (PID: 10148)
- Unicorn-4374.exe (PID: 10132)
- Unicorn-26840.exe (PID: 9640)
- Unicorn-12594.exe (PID: 9012)
- Unicorn-43088.exe (PID: 7200)
- Unicorn-20482.exe (PID: 9572)
- Unicorn-13605.exe (PID: 9956)
- Unicorn-27904.exe (PID: 6724)
- Unicorn-27904.exe (PID: 7512)
- Unicorn-23363.exe (PID: 10044)
Executes application which crashes
- Unicorn-29572.exe (PID: 8268)
- Unicorn-10858.exe (PID: 7592)
INFO
Create files in a temporary directory
- 1 (1203).exe (PID: 2560)
- Unicorn-51787.exe (PID: 5216)
- Unicorn-14667.exe (PID: 7712)
- Unicorn-16898.exe (PID: 7580)
- Unicorn-61076.exe (PID: 7696)
- Unicorn-12067.exe (PID: 7436)
- Unicorn-3899.exe (PID: 7588)
- Unicorn-57184.exe (PID: 7000)
- Unicorn-64304.exe (PID: 8036)
- Unicorn-47776.exe (PID: 8064)
- Unicorn-64667.exe (PID: 7904)
- Unicorn-54946.exe (PID: 7764)
- Unicorn-443.exe (PID: 6988)
- Unicorn-34765.exe (PID: 7732)
- Unicorn-61564.exe (PID: 7656)
- Unicorn-21086.exe (PID: 5408)
- Unicorn-12171.exe (PID: 8152)
- Unicorn-24948.exe (PID: 900)
- Unicorn-63410.exe (PID: 8180)
- Unicorn-59068.exe (PID: 7828)
- Unicorn-24157.exe (PID: 8012)
- Unicorn-37636.exe (PID: 5640)
- Unicorn-50443.exe (PID: 5800)
- Unicorn-48610.exe (PID: 4228)
- Unicorn-54283.exe (PID: 3676)
- Unicorn-27356.exe (PID: 8096)
- Unicorn-27356.exe (PID: 8104)
- Unicorn-53810.exe (PID: 1040)
- Unicorn-47406.exe (PID: 4040)
- Unicorn-31906.exe (PID: 736)
- Unicorn-35436.exe (PID: 2420)
- Unicorn-37126.exe (PID: 7684)
- Unicorn-40074.exe (PID: 2984)
- Unicorn-39063.exe (PID: 7340)
- Unicorn-47008.exe (PID: 7844)
- Unicorn-51098.exe (PID: 4448)
- Unicorn-19868.exe (PID: 7572)
- Unicorn-19078.exe (PID: 7444)
- Unicorn-17106.exe (PID: 732)
- Unicorn-56048.exe (PID: 5892)
- Unicorn-60516.exe (PID: 5556)
- Unicorn-29166.exe (PID: 2644)
- Unicorn-50272.exe (PID: 1912)
- Unicorn-57008.exe (PID: 8232)
- Unicorn-62415.exe (PID: 8388)
- Unicorn-5347.exe (PID: 6736)
- Unicorn-59763.exe (PID: 7876)
- Unicorn-62716.exe (PID: 1628)
- Unicorn-5347.exe (PID: 6388)
- Unicorn-36728.exe (PID: 8808)
- Unicorn-42842.exe (PID: 1128)
- Unicorn-12586.exe (PID: 8856)
- Unicorn-12778.exe (PID: 8824)
- Unicorn-33197.exe (PID: 6512)
- Unicorn-48596.exe (PID: 8880)
- Unicorn-19100.exe (PID: 7448)
- Unicorn-44475.exe (PID: 7472)
- Unicorn-53898.exe (PID: 7020)
- Unicorn-42134.exe (PID: 2616)
- Unicorn-61676.exe (PID: 9068)
- Unicorn-47880.exe (PID: 7428)
- Unicorn-53567.exe (PID: 6268)
- Unicorn-20148.exe (PID: 8144)
- Unicorn-59815.exe (PID: 7824)
- Unicorn-49032.exe (PID: 4300)
- Unicorn-54660.exe (PID: 9188)
- Unicorn-21966.exe (PID: 8432)
- Unicorn-5075.exe (PID: 1616)
- Unicorn-17254.exe (PID: 1300)
- Unicorn-58168.exe (PID: 2192)
- Unicorn-19173.exe (PID: 664)
- Unicorn-61979.exe (PID: 8308)
The sample compiled with chinese language support
- 1 (1203).exe (PID: 2560)
- Unicorn-17254.exe (PID: 1300)
- Unicorn-37636.exe (PID: 5640)
- Unicorn-5578.exe (PID: 9360)
- Unicorn-18781.exe (PID: 8412)
- Unicorn-59379.exe (PID: 1324)
- Unicorn-50443.exe (PID: 5800)
- Unicorn-61076.exe (PID: 7696)
- Unicorn-13819.exe (PID: 9408)
- Unicorn-43560.exe (PID: 9480)
- Unicorn-63218.exe (PID: 9548)
- Unicorn-22320.exe (PID: 10164)
- Unicorn-43088.exe (PID: 7200)
- Unicorn-40222.exe (PID: 9460)
- Unicorn-5347.exe (PID: 6736)
- Unicorn-17106.exe (PID: 732)
- Unicorn-24601.exe (PID: 9276)
- Unicorn-54283.exe (PID: 3676)
- Unicorn-48722.exe (PID: 9392)
- Unicorn-24070.exe (PID: 8688)
- Unicorn-26840.exe (PID: 9640)
- Unicorn-14587.exe (PID: 9660)
- Unicorn-43604.exe (PID: 6676)
- Unicorn-35524.exe (PID: 8088)
- Unicorn-15142.exe (PID: 9624)
- Unicorn-18996.exe (PID: 7892)
- Unicorn-59763.exe (PID: 7876)
- Unicorn-12778.exe (PID: 8816)
- Unicorn-62716.exe (PID: 1628)
- Unicorn-12778.exe (PID: 8824)
- Unicorn-62716.exe (PID: 5256)
- Unicorn-27356.exe (PID: 8104)
- Unicorn-48212.exe (PID: 8648)
- Unicorn-35436.exe (PID: 2240)
- Unicorn-5347.exe (PID: 6388)
- Unicorn-41440.exe (PID: 8372)
- Unicorn-53810.exe (PID: 1040)
- Unicorn-35436.exe (PID: 7508)
- Unicorn-48596.exe (PID: 8880)
- Unicorn-64667.exe (PID: 8116)
- Unicorn-64667.exe (PID: 7904)
- Unicorn-31906.exe (PID: 736)
- Unicorn-48604.exe (PID: 9716)
- Unicorn-42164.exe (PID: 10184)
- Unicorn-47406.exe (PID: 4040)
- Unicorn-40244.exe (PID: 9724)
- Unicorn-42842.exe (PID: 1128)
- Unicorn-12586.exe (PID: 8856)
- Unicorn-40074.exe (PID: 6576)
- Unicorn-27904.exe (PID: 6724)
- Unicorn-63640.exe (PID: 5544)
- Unicorn-20482.exe (PID: 9572)
- Unicorn-53898.exe (PID: 7020)
- Unicorn-51098.exe (PID: 4448)
- Unicorn-41204.exe (PID: 9856)
- Unicorn-49543.exe (PID: 9984)
- Unicorn-19868.exe (PID: 7572)
- Unicorn-53892.exe (PID: 8984)
- Unicorn-53043.exe (PID: 8940)
- Unicorn-61676.exe (PID: 9068)
- Unicorn-59815.exe (PID: 7824)
- Unicorn-60516.exe (PID: 5556)
- Unicorn-63410.exe (PID: 8180)
- Unicorn-24948.exe (PID: 900)
- Unicorn-47880.exe (PID: 7428)
- Unicorn-27904.exe (PID: 7512)
- Unicorn-61676.exe (PID: 9076)
- Unicorn-29837.exe (PID: 9752)
- Unicorn-3899.exe (PID: 7588)
- Unicorn-64771.exe (PID: 1568)
- Unicorn-12171.exe (PID: 8152)
- Unicorn-50272.exe (PID: 1912)
- Unicorn-23363.exe (PID: 10044)
- Unicorn-44254.exe (PID: 8340)
- Unicorn-20148.exe (PID: 8144)
- Unicorn-53567.exe (PID: 6268)
- Unicorn-20644.exe (PID: 9132)
- Unicorn-44447.exe (PID: 10020)
- Unicorn-10098.exe (PID: 4696)
- Unicorn-24157.exe (PID: 8012)
- Unicorn-49424.exe (PID: 9092)
- Unicorn-49032.exe (PID: 4300)
- Unicorn-13383.exe (PID: 10088)
- Unicorn-53456.exe (PID: 9908)
- Unicorn-54660.exe (PID: 9188)
- Unicorn-53308.exe (PID: 1188)
- Unicorn-62212.exe (PID: 1512)
- Unicorn-41839.exe (PID: 4784)
- Unicorn-27460.exe (PID: 7412)
- Unicorn-16898.exe (PID: 7580)
- Unicorn-36985.exe (PID: 8464)
- Unicorn-12067.exe (PID: 7436)
- Unicorn-17690.exe (PID: 8472)
- Unicorn-27910.exe (PID: 8056)
- Unicorn-5075.exe (PID: 1616)
- Unicorn-34624.exe (PID: 9340)
- Unicorn-55983.exe (PID: 9236)
- Unicorn-61979.exe (PID: 8308)
- Unicorn-62415.exe (PID: 8388)
- Unicorn-36544.exe (PID: 10028)
- Unicorn-30732.exe (PID: 9284)
- Unicorn-39350.exe (PID: 10148)
- Unicorn-47776.exe (PID: 8064)
- Unicorn-4374.exe (PID: 10132)
- Unicorn-21966.exe (PID: 8432)
- Unicorn-56196.exe (PID: 9428)
- Unicorn-64304.exe (PID: 8036)
- Unicorn-19173.exe (PID: 664)
- Unicorn-41056.exe (PID: 8000)
- Unicorn-36728.exe (PID: 8808)
- Unicorn-13605.exe (PID: 9956)
- Unicorn-51787.exe (PID: 5216)
- Unicorn-33197.exe (PID: 6512)
- Unicorn-57127.exe (PID: 8924)
- Unicorn-35436.exe (PID: 2420)
- Unicorn-21669.exe (PID: 9760)
- Unicorn-48596.exe (PID: 8876)
- Unicorn-60088.exe (PID: 9468)
- Unicorn-13862.exe (PID: 1240)
- Unicorn-11455.exe (PID: 8932)
- Unicorn-40074.exe (PID: 2984)
- Unicorn-36350.exe (PID: 9812)
- Unicorn-21086.exe (PID: 5408)
- Unicorn-443.exe (PID: 6988)
- Unicorn-44475.exe (PID: 7472)
- Unicorn-54946.exe (PID: 7764)
- Unicorn-27356.exe (PID: 8096)
- Unicorn-41950.exe (PID: 9804)
- Unicorn-34765.exe (PID: 7732)
- Unicorn-48610.exe (PID: 4228)
- Unicorn-19078.exe (PID: 7444)
- Unicorn-42134.exe (PID: 2616)
- Unicorn-4255.exe (PID: 9892)
- Unicorn-57184.exe (PID: 7000)
- Unicorn-32896.exe (PID: 9104)
- Unicorn-20038.exe (PID: 3268)
- Unicorn-61868.exe (PID: 9028)
- Unicorn-31736.exe (PID: 7516)
- Unicorn-11705.exe (PID: 7036)
- Unicorn-342.exe (PID: 10072)
- Unicorn-56048.exe (PID: 5892)
- Unicorn-32896.exe (PID: 9112)
- Unicorn-51026.exe (PID: 9992)
- Unicorn-64963.exe (PID: 6148)
- Unicorn-12594.exe (PID: 9012)
- Unicorn-53648.exe (PID: 9848)
- Unicorn-37126.exe (PID: 7684)
- Unicorn-59068.exe (PID: 7828)
- Unicorn-12594.exe (PID: 10036)
- Unicorn-28760.exe (PID: 9932)
- Unicorn-17984.exe (PID: 516)
- Unicorn-14667.exe (PID: 7712)
- Unicorn-62170.exe (PID: 2236)
- Unicorn-30518.exe (PID: 8344)
- Unicorn-23641.exe (PID: 8336)
- Unicorn-29166.exe (PID: 2644)
- Unicorn-26565.exe (PID: 8196)
- Unicorn-37748.exe (PID: 8272)
- Unicorn-13435.exe (PID: 4120)
- Unicorn-58168.exe (PID: 2192)
- Unicorn-8767.exe (PID: 8348)
- Unicorn-5761.exe (PID: 9444)
- Unicorn-48530.exe (PID: 9180)
- Unicorn-57008.exe (PID: 8232)
- Unicorn-47008.exe (PID: 7844)
- Unicorn-7358.exe (PID: 9500)
- Unicorn-61564.exe (PID: 7656)
- Unicorn-39063.exe (PID: 7340)
Reads the computer name
- 1 (1203).exe (PID: 2560)
- Unicorn-51787.exe (PID: 5216)
- Unicorn-14667.exe (PID: 7712)
- Unicorn-34765.exe (PID: 7732)
- Unicorn-54283.exe (PID: 3676)
- Unicorn-47406.exe (PID: 4040)
- Unicorn-443.exe (PID: 6988)
- Unicorn-54946.exe (PID: 7764)
- Unicorn-3899.exe (PID: 7588)
- Unicorn-59815.exe (PID: 7824)
- Unicorn-24157.exe (PID: 8012)
- Unicorn-53898.exe (PID: 7020)
- Unicorn-51098.exe (PID: 4448)
- Unicorn-12171.exe (PID: 8152)
- Unicorn-50443.exe (PID: 5800)
- Unicorn-48610.exe (PID: 4228)
- Unicorn-33197.exe (PID: 6512)
- Unicorn-53810.exe (PID: 1040)
- Unicorn-35436.exe (PID: 7508)
- Unicorn-13862.exe (PID: 1240)
- Unicorn-42134.exe (PID: 2616)
- Unicorn-10858.exe (PID: 7592)
- Unicorn-12446.exe (PID: 8252)
- Unicorn-53043.exe (PID: 8940)
- Unicorn-61868.exe (PID: 9028)
- Unicorn-33088.exe (PID: 9044)
- Unicorn-64799.exe (PID: 9120)
- Unicorn-30518.exe (PID: 8344)
- Unicorn-19173.exe (PID: 664)
Checks supported languages
- 1 (1203).exe (PID: 2560)
- Unicorn-51787.exe (PID: 5216)
- Unicorn-14667.exe (PID: 7712)
- Unicorn-34765.exe (PID: 7732)
- Unicorn-24948.exe (PID: 900)
- Unicorn-16898.exe (PID: 7580)
- Unicorn-54946.exe (PID: 7764)
- Unicorn-3899.exe (PID: 7588)
- Unicorn-27910.exe (PID: 8056)
- Unicorn-37126.exe (PID: 7684)
- Unicorn-64667.exe (PID: 8116)
- Unicorn-18996.exe (PID: 7892)
- Unicorn-59763.exe (PID: 7876)
- Unicorn-47776.exe (PID: 8064)
- Unicorn-50272.exe (PID: 1912)
- Unicorn-53567.exe (PID: 6268)
- Unicorn-62716.exe (PID: 5256)
- Unicorn-33197.exe (PID: 6512)
- Unicorn-19100.exe (PID: 7448)
- Unicorn-40074.exe (PID: 6576)
- Unicorn-63640.exe (PID: 5544)
- Unicorn-20038.exe (PID: 3268)
- Unicorn-31736.exe (PID: 7516)
- Unicorn-47880.exe (PID: 7428)
- Unicorn-57008.exe (PID: 8232)
- Unicorn-53308.exe (PID: 1188)
- Unicorn-56048.exe (PID: 5892)
- Unicorn-41440.exe (PID: 8372)
- Unicorn-62415.exe (PID: 8388)
- Unicorn-2903.exe (PID: 8728)
- Unicorn-61868.exe (PID: 9028)
- Unicorn-61676.exe (PID: 9076)
- Unicorn-1930.exe (PID: 5552)
- Unicorn-33088.exe (PID: 9044)
- Unicorn-21966.exe (PID: 8432)
- Unicorn-55983.exe (PID: 9236)
- Unicorn-34624.exe (PID: 9340)
- Unicorn-53456.exe (PID: 9908)
- Unicorn-20482.exe (PID: 9572)
- Unicorn-13383.exe (PID: 10088)
- Unicorn-4374.exe (PID: 10132)
- Unicorn-51375.exe (PID: 10452)
- Unicorn-22040.exe (PID: 10488)
- Unicorn-14042.exe (PID: 10564)
- Unicorn-31669.exe (PID: 10612)
- Unicorn-18894.exe (PID: 10804)
- Unicorn-38568.exe (PID: 10888)
- Unicorn-3326.exe (PID: 11144)
- Unicorn-31749.exe (PID: 6708)
- Unicorn-42158.exe (PID: 11516)
- Unicorn-8163.exe (PID: 11672)
- Unicorn-43694.exe (PID: 11936)
- Unicorn-47224.exe (PID: 11944)
- Unicorn-9659.exe (PID: 12132)
- Unicorn-29544.exe (PID: 11868)
- Unicorn-43908.exe (PID: 12276)
- Unicorn-55371.exe (PID: 12224)
- Unicorn-53922.exe (PID: 12364)
- Unicorn-18636.exe (PID: 12608)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 8140)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 8140)
- BackgroundTransferHost.exe (PID: 7888)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 8140)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 8140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:20 00:32:00+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
454
Monitored processes
318
Malicious processes
45
Suspicious processes
45
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 516 | C:\Users\admin\AppData\Local\Temp\Unicorn-17984.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-17984.exe | Unicorn-27910.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 664 | C:\Users\admin\AppData\Local\Temp\Unicorn-19173.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-19173.exe | Unicorn-54946.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 728 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 732 | C:\Users\admin\AppData\Local\Temp\Unicorn-17106.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-17106.exe | Unicorn-24157.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 736 | C:\Users\admin\AppData\Local\Temp\Unicorn-31906.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-31906.exe | Unicorn-44475.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 900 | C:\Users\admin\AppData\Local\Temp\Unicorn-24948.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24948.exe | Unicorn-14667.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1040 | C:\Users\admin\AppData\Local\Temp\Unicorn-53810.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53810.exe | Unicorn-47406.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1128 | C:\Users\admin\AppData\Local\Temp\Unicorn-42842.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-42842.exe | Unicorn-51787.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1188 | C:\Users\admin\AppData\Local\Temp\Unicorn-53308.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53308.exe | Unicorn-37636.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1240 | C:\Users\admin\AppData\Local\Temp\Unicorn-13862.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13862.exe | 1 (1203).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
11 520
Read events
11 505
Write events
15
Delete events
0
Modification events
| (PID) Process: | (7888) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7888) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7888) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (8140) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (8140) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (8140) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (1628) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (1628) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (1628) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (728) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
956
Suspicious files
11
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 8140 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\373ae07f-3470-42c2-8989-b6a398248b37.down_data | — | |
MD5:— | SHA256:— | |||
| 2560 | 1 (1203).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-34765.exe | executable | |
MD5:2675ADF2248F5E94EE93B80D8264AF6F | SHA256:E3FFC70FF265B6C409B3E090E545BE279148DBFEAF4B640B3745FC71128EBD0A | |||
| 8140 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:34C8A149D6CF4FD4705C28A669999A6D | SHA256:7BB3FFF3E0F3E4C998BDA6237C61C61DD5060909BFC21438FD455F24863CA263 | |||
| 8140 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\373ae07f-3470-42c2-8989-b6a398248b37.9cca9f04-2f02-40d9-9ff4-6df65bc1b7ff.down_meta | binary | |
MD5:132AC8DD761D1F4AC90324367D20606E | SHA256:5F341321155787CF7F0BD41A7CD58452F7DA1E42B337758C4945B33C21960AFD | |||
| 8140 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
| 5216 | Unicorn-51787.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-14667.exe | executable | |
MD5:C14E6DB3C5E195036265C371DBC7376D | SHA256:D6C906F8F078F697A20499480029D24EEF0B5DCFD7F7CCDDADD25034156CE6EF | |||
| 2560 | 1 (1203).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-51787.exe | executable | |
MD5:5DA8B454C6A8D3F3D9950EAD5D8460AF | SHA256:97EF68CF9B0233B4EC4A4EBA7A3E9D090A4E8714BE0240B63423191DBCE77710 | |||
| 8140 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\9b46e2d5-92d1-4260-b9d9-86f9ecd290f1.9cca9f04-2f02-40d9-9ff4-6df65bc1b7ff.down_meta | binary | |
MD5:132AC8DD761D1F4AC90324367D20606E | SHA256:5F341321155787CF7F0BD41A7CD58452F7DA1E42B337758C4945B33C21960AFD | |||
| 900 | Unicorn-24948.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-57184.exe | executable | |
MD5:CD55AAE55319B38D15D900329070CF9C | SHA256:5E46601D1C8383E7BD434481F50A92D4A9DAB26F5E9B417E809AFD25D6345E6B | |||
| 2560 | 1 (1203).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-47406.exe | executable | |
MD5:D1272F0B5A4938D41137596B45157B1A | SHA256:97EF68CF9B0233B4EC4A4EBA7A3E9D090A4E8714BE0240B63423191DBCE77710 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
26
DNS requests
16
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
8140 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5244 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
8444 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
8444 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2104 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.159.131:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
2112 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5244 | backgroundTaskHost.exe | 20.103.156.88:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |