| File name: | 1 (1342) |
| Full analysis: | https://app.any.run/tasks/a97119f1-de54-4b15-9e2b-1869ea0e32b2 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 12:19:09 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | C7E0F85448AE6374441637B48C22C390 |
| SHA1: | 1917BCCAD44A911949E23BE852340049113D073A |
| SHA256: | E1F0C5B0A3E1CA62629177B590E86B5C6E04CA91424A2A54DC81AED665C8CFF1 |
| SSDEEP: | 6144:9778Rg9PQDceA5LjAGeEzTjx5wPe5p8GBf/4F1OdTk/8SwjwpyAvEhAzLG96sm7a:9P4mFeA5vAZzPQ+afgF1Odex4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- Unicorn-50702.exe (PID: 7560)
- Unicorn-24807.exe (PID: 7324)
- Unicorn-35989.exe (PID: 7572)
- 1 (1342).exe (PID: 7256)
- Unicorn-29846.exe (PID: 8092)
- Unicorn-12148.exe (PID: 8148)
- Unicorn-59503.exe (PID: 8116)
- Unicorn-5279.exe (PID: 7200)
- Unicorn-7910.exe (PID: 2136)
- Unicorn-39637.exe (PID: 8112)
- Unicorn-28422.exe (PID: 7252)
- Unicorn-56597.exe (PID: 7300)
- Unicorn-6576.exe (PID: 7316)
- Unicorn-32284.exe (PID: 5072)
- Unicorn-35103.exe (PID: 7184)
- Unicorn-58901.exe (PID: 5404)
- Unicorn-30124.exe (PID: 4608)
- Unicorn-61641.exe (PID: 5056)
- Unicorn-64459.exe (PID: 1188)
- Unicorn-61641.exe (PID: 5048)
- Unicorn-64210.exe (PID: 4776)
- Unicorn-64459.exe (PID: 4040)
- Unicorn-64459.exe (PID: 3100)
- Unicorn-56654.exe (PID: 1660)
- Unicorn-64210.exe (PID: 6620)
- Unicorn-10982.exe (PID: 6644)
- Unicorn-53961.exe (PID: 6768)
- Unicorn-53696.exe (PID: 1324)
- Unicorn-53961.exe (PID: 6388)
- Unicorn-34095.exe (PID: 6272)
- Unicorn-16280.exe (PID: 664)
- Unicorn-20687.exe (PID: 2852)
- Unicorn-32301.exe (PID: 7544)
- Unicorn-62835.exe (PID: 6456)
- Unicorn-30775.exe (PID: 7684)
- Unicorn-34247.exe (PID: 7712)
- Unicorn-41081.exe (PID: 7696)
- Unicorn-59912.exe (PID: 7556)
- Unicorn-62643.exe (PID: 7656)
- Unicorn-29548.exe (PID: 3888)
- Unicorn-35975.exe (PID: 8020)
- Unicorn-27807.exe (PID: 7864)
- Unicorn-44143.exe (PID: 7808)
- Unicorn-60842.exe (PID: 8068)
- Unicorn-62425.exe (PID: 7860)
- Unicorn-53965.exe (PID: 6652)
- Unicorn-60095.exe (PID: 8052)
- Unicorn-26354.exe (PID: 4692)
- Unicorn-51927.exe (PID: 7984)
- Unicorn-27423.exe (PID: 5680)
- Unicorn-64542.exe (PID: 5384)
- Unicorn-27423.exe (PID: 4996)
- Unicorn-27423.exe (PID: 4112)
- Unicorn-32061.exe (PID: 7972)
- Unicorn-58834.exe (PID: 8048)
- Unicorn-49904.exe (PID: 7960)
- Unicorn-32061.exe (PID: 7968)
- Unicorn-26748.exe (PID: 4724)
- Unicorn-39248.exe (PID: 3900)
- Unicorn-8656.exe (PID: 2772)
- Unicorn-18605.exe (PID: 632)
- Unicorn-52787.exe (PID: 1040)
- Unicorn-65139.exe (PID: 7172)
- Unicorn-65139.exe (PID: 5400)
- Unicorn-39051.exe (PID: 2552)
- Unicorn-27122.exe (PID: 1568)
- Unicorn-56779.exe (PID: 5228)
- Unicorn-24661.exe (PID: 7404)
- Unicorn-59337.exe (PID: 7196)
- Unicorn-44335.exe (PID: 7632)
- Unicorn-7968.exe (PID: 7920)
- Unicorn-62015.exe (PID: 7880)
- Unicorn-12814.exe (PID: 7912)
- Unicorn-42149.exe (PID: 7888)
- Unicorn-9477.exe (PID: 3332)
- Unicorn-20412.exe (PID: 3300)
- Unicorn-29897.exe (PID: 4620)
- Unicorn-33427.exe (PID: 6344)
- Unicorn-19783.exe (PID: 968)
- Unicorn-54314.exe (PID: 8200)
- Unicorn-12814.exe (PID: 7396)
- Unicorn-41870.exe (PID: 8240)
- Unicorn-1392.exe (PID: 8256)
- Unicorn-18326.exe (PID: 8316)
- Unicorn-1776.exe (PID: 8224)
- Unicorn-14604.exe (PID: 8360)
- Unicorn-18326.exe (PID: 8324)
- Unicorn-28339.exe (PID: 8368)
- Unicorn-24277.exe (PID: 7904)
- Unicorn-34278.exe (PID: 8448)
- Unicorn-32039.exe (PID: 8544)
- Unicorn-34278.exe (PID: 8440)
- Unicorn-18718.exe (PID: 8516)
- Unicorn-44506.exe (PID: 7956)
- Unicorn-23142.exe (PID: 8588)
- Unicorn-56369.exe (PID: 8616)
- Unicorn-26385.exe (PID: 8688)
- Unicorn-40246.exe (PID: 8708)
- Unicorn-20188.exe (PID: 8744)
- Unicorn-51154.exe (PID: 8652)
- Unicorn-65305.exe (PID: 8768)
- Unicorn-31886.exe (PID: 8788)
- Unicorn-6312.exe (PID: 8804)
- Unicorn-19826.exe (PID: 8724)
- Unicorn-43946.exe (PID: 8820)
- Unicorn-39862.exe (PID: 8836)
- Unicorn-42605.exe (PID: 496)
- Unicorn-32056.exe (PID: 8888)
- Unicorn-27802.exe (PID: 8796)
- Unicorn-43754.exe (PID: 8924)
- Unicorn-52669.exe (PID: 8984)
- Unicorn-23526.exe (PID: 8880)
- Unicorn-23526.exe (PID: 8872)
- Unicorn-43754.exe (PID: 8920)
- Unicorn-3468.exe (PID: 9044)
- Unicorn-15165.exe (PID: 8976)
- Unicorn-10849.exe (PID: 8960)
- Unicorn-15165.exe (PID: 8968)
- Unicorn-45098.exe (PID: 9052)
- Unicorn-15720.exe (PID: 9004)
- Unicorn-10379.exe (PID: 9080)
- Unicorn-22631.exe (PID: 9104)
- Unicorn-28497.exe (PID: 9096)
- Unicorn-22631.exe (PID: 9108)
- Unicorn-45461.exe (PID: 9184)
- Unicorn-23723.exe (PID: 2516)
- Unicorn-7884.exe (PID: 4180)
- Unicorn-39860.exe (PID: 9176)
- Unicorn-12041.exe (PID: 2392)
- Unicorn-56509.exe (PID: 9232)
- Unicorn-32270.exe (PID: 9268)
- Unicorn-33976.exe (PID: 9324)
- Unicorn-42336.exe (PID: 9304)
- Unicorn-51796.exe (PID: 9344)
- Unicorn-56774.exe (PID: 9240)
- Unicorn-4833.exe (PID: 9284)
- Unicorn-25254.exe (PID: 9368)
- Unicorn-365.exe (PID: 9384)
- Unicorn-52704.exe (PID: 8176)
- Unicorn-20978.exe (PID: 9392)
- Unicorn-21340.exe (PID: 9436)
- Unicorn-58289.exe (PID: 9468)
- Unicorn-33230.exe (PID: 9416)
- Unicorn-16702.exe (PID: 9460)
- Unicorn-18739.exe (PID: 9492)
- Unicorn-26022.exe (PID: 9656)
- Unicorn-58124.exe (PID: 9512)
- Unicorn-51081.exe (PID: 9564)
- Unicorn-62778.exe (PID: 9600)
- Unicorn-26214.exe (PID: 9540)
- Unicorn-5409.exe (PID: 9588)
- Unicorn-5409.exe (PID: 9572)
- Unicorn-59249.exe (PID: 9716)
- Unicorn-3363.exe (PID: 9724)
- Unicorn-45096.exe (PID: 9828)
- Unicorn-46058.exe (PID: 9808)
- Unicorn-7447.exe (PID: 9708)
- Unicorn-50142.exe (PID: 9800)
- Unicorn-14132.exe (PID: 9748)
- Unicorn-239.exe (PID: 9868)
- Unicorn-43873.exe (PID: 9876)
- Unicorn-11200.exe (PID: 9900)
- Unicorn-16266.exe (PID: 10040)
- Unicorn-39317.exe (PID: 10064)
- Unicorn-28134.exe (PID: 10100)
Executable content was dropped or overwritten
- Unicorn-24807.exe (PID: 7324)
- Unicorn-50702.exe (PID: 7560)
- 1 (1342).exe (PID: 7256)
- Unicorn-35989.exe (PID: 7572)
- Unicorn-12148.exe (PID: 8148)
- Unicorn-32284.exe (PID: 5072)
- Unicorn-5279.exe (PID: 7200)
- Unicorn-29846.exe (PID: 8092)
- Unicorn-39637.exe (PID: 8112)
- Unicorn-64210.exe (PID: 4776)
- Unicorn-28422.exe (PID: 7252)
- Unicorn-59503.exe (PID: 8116)
- Unicorn-6576.exe (PID: 7316)
- Unicorn-35103.exe (PID: 7184)
- Unicorn-58901.exe (PID: 5404)
- Unicorn-61641.exe (PID: 5048)
- Unicorn-30124.exe (PID: 4608)
- Unicorn-61641.exe (PID: 5056)
- Unicorn-64459.exe (PID: 1188)
- Unicorn-64459.exe (PID: 3100)
- Unicorn-64459.exe (PID: 4040)
- Unicorn-64210.exe (PID: 6620)
- Unicorn-56654.exe (PID: 1660)
- Unicorn-7910.exe (PID: 2136)
- Unicorn-10982.exe (PID: 6644)
- Unicorn-53961.exe (PID: 6768)
- Unicorn-26748.exe (PID: 4724)
- Unicorn-53961.exe (PID: 6388)
- Unicorn-29548.exe (PID: 3888)
- Unicorn-56597.exe (PID: 7300)
- Unicorn-20687.exe (PID: 2852)
- Unicorn-32301.exe (PID: 7544)
- Unicorn-62835.exe (PID: 6456)
- Unicorn-30775.exe (PID: 7684)
- Unicorn-41081.exe (PID: 7696)
- Unicorn-62643.exe (PID: 7656)
- Unicorn-59912.exe (PID: 7556)
- Unicorn-35975.exe (PID: 8020)
- Unicorn-27807.exe (PID: 7864)
- Unicorn-24277.exe (PID: 7904)
- Unicorn-44506.exe (PID: 7956)
- Unicorn-62425.exe (PID: 7860)
- Unicorn-53965.exe (PID: 6652)
- Unicorn-60095.exe (PID: 8052)
- Unicorn-26354.exe (PID: 4692)
- Unicorn-27423.exe (PID: 4996)
- Unicorn-51927.exe (PID: 7984)
- Unicorn-27423.exe (PID: 5680)
- Unicorn-52704.exe (PID: 8176)
- Unicorn-53696.exe (PID: 1324)
- Unicorn-42605.exe (PID: 496)
- Unicorn-27423.exe (PID: 4112)
- Unicorn-32061.exe (PID: 7972)
- Unicorn-49904.exe (PID: 7960)
- Unicorn-39248.exe (PID: 3900)
- Unicorn-8656.exe (PID: 2772)
- Unicorn-18605.exe (PID: 632)
- Unicorn-34095.exe (PID: 6272)
- Unicorn-52787.exe (PID: 1040)
- Unicorn-65139.exe (PID: 7172)
- Unicorn-65139.exe (PID: 5400)
- Unicorn-39051.exe (PID: 2552)
- Unicorn-16280.exe (PID: 664)
- Unicorn-56779.exe (PID: 5228)
- Unicorn-24661.exe (PID: 7404)
- Unicorn-59337.exe (PID: 7196)
- Unicorn-44335.exe (PID: 7632)
- Unicorn-27122.exe (PID: 1568)
- Unicorn-62015.exe (PID: 7880)
- Unicorn-9477.exe (PID: 3332)
- Unicorn-20412.exe (PID: 3300)
- Unicorn-12814.exe (PID: 7396)
- Unicorn-7968.exe (PID: 7920)
- Unicorn-34247.exe (PID: 7712)
- Unicorn-19783.exe (PID: 968)
- Unicorn-54314.exe (PID: 8200)
- Unicorn-1776.exe (PID: 8224)
- Unicorn-29897.exe (PID: 4620)
- Unicorn-41870.exe (PID: 8240)
- Unicorn-1392.exe (PID: 8256)
- Unicorn-18326.exe (PID: 8316)
- Unicorn-14604.exe (PID: 8360)
- Unicorn-28339.exe (PID: 8368)
- Unicorn-44143.exe (PID: 7808)
- Unicorn-34278.exe (PID: 8448)
- Unicorn-60842.exe (PID: 8068)
- Unicorn-32039.exe (PID: 8544)
- Unicorn-34278.exe (PID: 8440)
- Unicorn-18718.exe (PID: 8516)
- Unicorn-23142.exe (PID: 8588)
- Unicorn-56369.exe (PID: 8616)
- Unicorn-51154.exe (PID: 8652)
- Unicorn-26385.exe (PID: 8688)
- Unicorn-40246.exe (PID: 8708)
- Unicorn-19826.exe (PID: 8724)
- Unicorn-31886.exe (PID: 8788)
- Unicorn-6312.exe (PID: 8804)
- Unicorn-27802.exe (PID: 8796)
- Unicorn-65305.exe (PID: 8768)
- Unicorn-39862.exe (PID: 8836)
- Unicorn-23526.exe (PID: 8880)
- Unicorn-32056.exe (PID: 8888)
- Unicorn-43946.exe (PID: 8820)
- Unicorn-43754.exe (PID: 8924)
- Unicorn-52669.exe (PID: 8984)
- Unicorn-43754.exe (PID: 8920)
- Unicorn-10849.exe (PID: 8960)
- Unicorn-15165.exe (PID: 8976)
- Unicorn-45098.exe (PID: 9052)
- Unicorn-15720.exe (PID: 9004)
- Unicorn-64542.exe (PID: 5384)
- Unicorn-3468.exe (PID: 9044)
- Unicorn-58834.exe (PID: 8048)
- Unicorn-22631.exe (PID: 9108)
- Unicorn-22631.exe (PID: 9104)
- Unicorn-28497.exe (PID: 9096)
- Unicorn-45461.exe (PID: 9184)
- Unicorn-7884.exe (PID: 4180)
- Unicorn-39860.exe (PID: 9176)
- Unicorn-23723.exe (PID: 2516)
- Unicorn-56509.exe (PID: 9232)
- Unicorn-32270.exe (PID: 9268)
- Unicorn-56774.exe (PID: 9240)
- Unicorn-12041.exe (PID: 2392)
- Unicorn-4833.exe (PID: 9284)
- Unicorn-33976.exe (PID: 9324)
- Unicorn-25254.exe (PID: 9368)
- Unicorn-365.exe (PID: 9384)
- Unicorn-42149.exe (PID: 7888)
- Unicorn-20978.exe (PID: 9392)
- Unicorn-21340.exe (PID: 9436)
- Unicorn-58289.exe (PID: 9468)
- Unicorn-33230.exe (PID: 9416)
- Unicorn-18739.exe (PID: 9492)
- Unicorn-58124.exe (PID: 9512)
- Unicorn-5409.exe (PID: 9576)
- Unicorn-26022.exe (PID: 9656)
- Unicorn-51081.exe (PID: 9564)
- Unicorn-16702.exe (PID: 9460)
- Unicorn-62778.exe (PID: 9600)
- Unicorn-26214.exe (PID: 9540)
- Unicorn-5409.exe (PID: 9572)
- Unicorn-50142.exe (PID: 9800)
- Unicorn-556.exe (PID: 9648)
- Unicorn-3363.exe (PID: 9724)
- Unicorn-45096.exe (PID: 9828)
- Unicorn-46058.exe (PID: 9808)
- Unicorn-7447.exe (PID: 9708)
- Unicorn-14132.exe (PID: 9748)
- Unicorn-59249.exe (PID: 9716)
- Unicorn-18326.exe (PID: 8324)
- Unicorn-239.exe (PID: 9868)
- Unicorn-43873.exe (PID: 9876)
- Unicorn-11200.exe (PID: 9900)
- Unicorn-15165.exe (PID: 8968)
- Unicorn-10379.exe (PID: 9080)
- Unicorn-32061.exe (PID: 7968)
- Unicorn-39317.exe (PID: 10064)
- Unicorn-51796.exe (PID: 9344)
- Unicorn-16266.exe (PID: 10040)
- Unicorn-28134.exe (PID: 10100)
- Unicorn-53001.exe (PID: 10116)
- Unicorn-30171.exe (PID: 10084)
- Unicorn-17552.exe (PID: 10136)
- Unicorn-14951.exe (PID: 10168)
- Unicorn-24974.exe (PID: 10192)
- Unicorn-5409.exe (PID: 9588)
- Unicorn-33427.exe (PID: 6344)
- Unicorn-20188.exe (PID: 8744)
- Unicorn-48200.exe (PID: 2340)
- Unicorn-23526.exe (PID: 8872)
- Unicorn-53946.exe (PID: 3956)
- Unicorn-17382.exe (PID: 8336)
- Unicorn-53946.exe (PID: 2192)
- Unicorn-6089.exe (PID: 10336)
- Unicorn-53925.exe (PID: 10212)
- Unicorn-20506.exe (PID: 10236)
- Unicorn-55290.exe (PID: 10260)
- Unicorn-40800.exe (PID: 10308)
- Unicorn-55461.exe (PID: 10404)
- Unicorn-38305.exe (PID: 10356)
- Unicorn-13873.exe (PID: 10396)
- Unicorn-19110.exe (PID: 10556)
- Unicorn-39338.exe (PID: 10580)
- Unicorn-59685.exe (PID: 10496)
- Unicorn-25122.exe (PID: 10680)
- Unicorn-56037.exe (PID: 10276)
- Unicorn-26126.exe (PID: 10428)
- Unicorn-2965.exe (PID: 10468)
- Unicorn-48445.exe (PID: 10516)
Executes application which crashes
- Unicorn-28762.exe (PID: 9120)
INFO
Checks supported languages
- 1 (1342).exe (PID: 7256)
- Unicorn-35989.exe (PID: 7572)
- Unicorn-39637.exe (PID: 8112)
- Unicorn-50702.exe (PID: 7560)
- Unicorn-29846.exe (PID: 8092)
- Unicorn-59503.exe (PID: 8116)
- Unicorn-58901.exe (PID: 5404)
- Unicorn-53961.exe (PID: 6388)
- Unicorn-61641.exe (PID: 5048)
- Unicorn-32301.exe (PID: 7544)
- Unicorn-29548.exe (PID: 3888)
- Unicorn-42605.exe (PID: 496)
- Unicorn-27423.exe (PID: 5680)
- Unicorn-8656.exe (PID: 2772)
- Unicorn-65139.exe (PID: 7172)
- Unicorn-39051.exe (PID: 2552)
- Unicorn-64542.exe (PID: 5384)
- Unicorn-56779.exe (PID: 5228)
- Unicorn-59337.exe (PID: 7196)
- Unicorn-24661.exe (PID: 7404)
- Unicorn-12814.exe (PID: 7396)
- Unicorn-12814.exe (PID: 7912)
- Unicorn-20412.exe (PID: 3300)
- Unicorn-54314.exe (PID: 8200)
- Unicorn-1392.exe (PID: 8256)
- Unicorn-28339.exe (PID: 8368)
- Unicorn-32039.exe (PID: 8544)
- Unicorn-18718.exe (PID: 8516)
- Unicorn-51154.exe (PID: 8652)
- Unicorn-43946.exe (PID: 8820)
- Unicorn-43754.exe (PID: 8924)
- Unicorn-15165.exe (PID: 8976)
- Unicorn-28762.exe (PID: 9120)
- Unicorn-18739.exe (PID: 9492)
- Unicorn-58124.exe (PID: 9512)
- Unicorn-42336.exe (PID: 9304)
- Unicorn-51081.exe (PID: 9564)
- Unicorn-5409.exe (PID: 9572)
- Unicorn-16266.exe (PID: 10040)
- Unicorn-39317.exe (PID: 10064)
- Unicorn-53001.exe (PID: 10116)
- Unicorn-17552.exe (PID: 10136)
- Unicorn-24974.exe (PID: 10192)
- Unicorn-28134.exe (PID: 10100)
- Unicorn-56037.exe (PID: 10276)
- Unicorn-17382.exe (PID: 8336)
- Unicorn-26126.exe (PID: 10428)
- Unicorn-2965.exe (PID: 10468)
- Unicorn-25122.exe (PID: 10680)
- Unicorn-11901.exe (PID: 10712)
- Unicorn-32130.exe (PID: 10800)
- Unicorn-57189.exe (PID: 10864)
- Unicorn-37174.exe (PID: 10976)
- Unicorn-52748.exe (PID: 10996)
- Unicorn-7796.exe (PID: 10952)
- Unicorn-38636.exe (PID: 11144)
- Unicorn-24900.exe (PID: 11164)
- Unicorn-46804.exe (PID: 11188)
- Unicorn-28430.exe (PID: 11216)
- Unicorn-18076.exe (PID: 11240)
- Unicorn-54278.exe (PID: 2656)
- Unicorn-62446.exe (PID: 10860)
- Unicorn-63001.exe (PID: 872)
- Unicorn-609.exe (PID: 11348)
- Unicorn-33474.exe (PID: 11428)
- Unicorn-33474.exe (PID: 11420)
- Unicorn-61870.exe (PID: 11480)
- Unicorn-60976.exe (PID: 11568)
- Unicorn-48724.exe (PID: 11600)
- Unicorn-2316.exe (PID: 11676)
- Unicorn-41953.exe (PID: 11828)
- Unicorn-33287.exe (PID: 11836)
- Unicorn-3048.exe (PID: 12000)
- Unicorn-51118.exe (PID: 12116)
- Unicorn-14096.exe (PID: 12164)
- Unicorn-29966.exe (PID: 11900)
- Unicorn-28512.exe (PID: 12200)
- Unicorn-16068.exe (PID: 12256)
- Unicorn-61185.exe (PID: 9132)
- Unicorn-63131.exe (PID: 12272)
- Unicorn-64522.exe (PID: 12328)
- Unicorn-64522.exe (PID: 12320)
- Unicorn-23852.exe (PID: 12416)
- Unicorn-58200.exe (PID: 12464)
- Unicorn-64885.exe (PID: 12496)
- Unicorn-30571.exe (PID: 12608)
- Unicorn-831.exe (PID: 12440)
- Unicorn-61206.exe (PID: 12736)
- Unicorn-34271.exe (PID: 12768)
- Unicorn-13904.exe (PID: 13060)
- Unicorn-6525.exe (PID: 13148)
- Unicorn-41756.exe (PID: 13192)
- Unicorn-34730.exe (PID: 13260)
- Unicorn-40520.exe (PID: 13388)
- Unicorn-11548.exe (PID: 13472)
- Unicorn-51834.exe (PID: 13524)
- Unicorn-47558.exe (PID: 13604)
- Unicorn-26873.exe (PID: 13628)
- Unicorn-32566.exe (PID: 13676)
- Unicorn-49265.exe (PID: 13804)
- Unicorn-5264.exe (PID: 13900)
- Unicorn-38896.exe (PID: 14152)
- Unicorn-16775.exe (PID: 14184)
- Unicorn-5456.exe (PID: 14300)
- Unicorn-53016.exe (PID: 14416)
- Unicorn-33680.exe (PID: 14408)
- Unicorn-42295.exe (PID: 14424)
- Unicorn-11652.exe (PID: 14504)
- Unicorn-39229.exe (PID: 14588)
- Unicorn-19628.exe (PID: 14596)
- Unicorn-53784.exe (PID: 14692)
- Unicorn-60469.exe (PID: 14732)
- Unicorn-52301.exe (PID: 14756)
- Unicorn-52109.exe (PID: 14820)
- Unicorn-37116.exe (PID: 14916)
- Unicorn-168.exe (PID: 14932)
- Unicorn-60740.exe (PID: 14096)
- Unicorn-45093.exe (PID: 15048)
- Unicorn-28564.exe (PID: 14996)
- Unicorn-11408.exe (PID: 15072)
- Unicorn-13602.exe (PID: 15240)
- Unicorn-9104.exe (PID: 15232)
- Unicorn-65404.exe (PID: 15280)
- Unicorn-59240.exe (PID: 15248)
- Unicorn-65404.exe (PID: 15304)
- Unicorn-55512.exe (PID: 15472)
- Unicorn-7595.exe (PID: 15496)
- Unicorn-10011.exe (PID: 15676)
- Unicorn-37714.exe (PID: 15760)
- Unicorn-3187.exe (PID: 15740)
- Unicorn-53785.exe (PID: 15784)
- Unicorn-13572.exe (PID: 15816)
- Unicorn-21740.exe (PID: 15864)
- Unicorn-21548.exe (PID: 15948)
- Unicorn-6695.exe (PID: 15984)
- Unicorn-59286.exe (PID: 16068)
- Unicorn-22700.exe (PID: 16168)
- Unicorn-20608.exe (PID: 15708)
The sample compiled with chinese language support
- 1 (1342).exe (PID: 7256)
- Unicorn-29846.exe (PID: 8092)
- Unicorn-58901.exe (PID: 5404)
- Unicorn-30124.exe (PID: 4608)
- Unicorn-50702.exe (PID: 7560)
- Unicorn-64459.exe (PID: 1188)
- Unicorn-64459.exe (PID: 3100)
- Unicorn-61641.exe (PID: 5048)
- Unicorn-61641.exe (PID: 5056)
- Unicorn-64459.exe (PID: 4040)
- Unicorn-64210.exe (PID: 4776)
- Unicorn-56654.exe (PID: 1660)
- Unicorn-7910.exe (PID: 2136)
- Unicorn-64210.exe (PID: 6620)
- Unicorn-10982.exe (PID: 6644)
- Unicorn-39637.exe (PID: 8112)
- Unicorn-26748.exe (PID: 4724)
- Unicorn-6576.exe (PID: 7316)
- Unicorn-53961.exe (PID: 6388)
- Unicorn-29548.exe (PID: 3888)
- Unicorn-24807.exe (PID: 7324)
- Unicorn-12148.exe (PID: 8148)
- Unicorn-56597.exe (PID: 7300)
- Unicorn-35989.exe (PID: 7572)
- Unicorn-5279.exe (PID: 7200)
- Unicorn-20687.exe (PID: 2852)
- Unicorn-35103.exe (PID: 7184)
- Unicorn-32301.exe (PID: 7544)
- Unicorn-59503.exe (PID: 8116)
- Unicorn-62835.exe (PID: 6456)
- Unicorn-30775.exe (PID: 7684)
- Unicorn-32284.exe (PID: 5072)
- Unicorn-41081.exe (PID: 7696)
- Unicorn-59912.exe (PID: 7556)
- Unicorn-62643.exe (PID: 7656)
- Unicorn-35975.exe (PID: 8020)
- Unicorn-27807.exe (PID: 7864)
- Unicorn-24277.exe (PID: 7904)
- Unicorn-44506.exe (PID: 7956)
- Unicorn-62425.exe (PID: 7860)
- Unicorn-53965.exe (PID: 6652)
- Unicorn-60095.exe (PID: 8052)
- Unicorn-26354.exe (PID: 4692)
- Unicorn-53961.exe (PID: 6768)
- Unicorn-27423.exe (PID: 4112)
- Unicorn-27423.exe (PID: 4996)
- Unicorn-42605.exe (PID: 496)
- Unicorn-51927.exe (PID: 7984)
- Unicorn-27423.exe (PID: 5680)
- Unicorn-53696.exe (PID: 1324)
- Unicorn-52704.exe (PID: 8176)
- Unicorn-32061.exe (PID: 7972)
- Unicorn-49904.exe (PID: 7960)
- Unicorn-39248.exe (PID: 3900)
- Unicorn-8656.exe (PID: 2772)
- Unicorn-18605.exe (PID: 632)
- Unicorn-34095.exe (PID: 6272)
- Unicorn-52787.exe (PID: 1040)
- Unicorn-65139.exe (PID: 7172)
- Unicorn-65139.exe (PID: 5400)
- Unicorn-39051.exe (PID: 2552)
- Unicorn-27122.exe (PID: 1568)
- Unicorn-56779.exe (PID: 5228)
- Unicorn-24661.exe (PID: 7404)
- Unicorn-59337.exe (PID: 7196)
- Unicorn-44335.exe (PID: 7632)
- Unicorn-16280.exe (PID: 664)
- Unicorn-7968.exe (PID: 7920)
- Unicorn-62015.exe (PID: 7880)
- Unicorn-9477.exe (PID: 3332)
- Unicorn-20412.exe (PID: 3300)
- Unicorn-34247.exe (PID: 7712)
- Unicorn-19783.exe (PID: 968)
- Unicorn-54314.exe (PID: 8200)
- Unicorn-29897.exe (PID: 4620)
- Unicorn-12814.exe (PID: 7396)
- Unicorn-41870.exe (PID: 8240)
- Unicorn-1392.exe (PID: 8256)
- Unicorn-18326.exe (PID: 8316)
- Unicorn-1776.exe (PID: 8224)
- Unicorn-44143.exe (PID: 7808)
- Unicorn-34278.exe (PID: 8448)
- Unicorn-32039.exe (PID: 8544)
- Unicorn-60842.exe (PID: 8068)
- Unicorn-14604.exe (PID: 8360)
- Unicorn-28339.exe (PID: 8368)
- Unicorn-34278.exe (PID: 8440)
- Unicorn-18718.exe (PID: 8516)
- Unicorn-23142.exe (PID: 8588)
- Unicorn-56369.exe (PID: 8616)
- Unicorn-26385.exe (PID: 8688)
- Unicorn-40246.exe (PID: 8708)
- Unicorn-51154.exe (PID: 8652)
- Unicorn-6312.exe (PID: 8804)
- Unicorn-31886.exe (PID: 8788)
- Unicorn-27802.exe (PID: 8796)
- Unicorn-19826.exe (PID: 8724)
- Unicorn-65305.exe (PID: 8768)
- Unicorn-39862.exe (PID: 8836)
- Unicorn-23526.exe (PID: 8880)
- Unicorn-32056.exe (PID: 8888)
- Unicorn-43946.exe (PID: 8820)
- Unicorn-43754.exe (PID: 8924)
- Unicorn-52669.exe (PID: 8984)
- Unicorn-43754.exe (PID: 8920)
- Unicorn-15165.exe (PID: 8976)
- Unicorn-45098.exe (PID: 9052)
- Unicorn-15720.exe (PID: 9004)
- Unicorn-3468.exe (PID: 9044)
- Unicorn-10849.exe (PID: 8960)
- Unicorn-22631.exe (PID: 9108)
- Unicorn-58834.exe (PID: 8048)
- Unicorn-28497.exe (PID: 9096)
- Unicorn-22631.exe (PID: 9104)
- Unicorn-64542.exe (PID: 5384)
- Unicorn-45461.exe (PID: 9184)
- Unicorn-23723.exe (PID: 2516)
- Unicorn-28422.exe (PID: 7252)
- Unicorn-7884.exe (PID: 4180)
- Unicorn-39860.exe (PID: 9176)
- Unicorn-12041.exe (PID: 2392)
- Unicorn-56509.exe (PID: 9232)
- Unicorn-32270.exe (PID: 9268)
- Unicorn-4833.exe (PID: 9284)
- Unicorn-33976.exe (PID: 9324)
- Unicorn-56774.exe (PID: 9240)
- Unicorn-42149.exe (PID: 7888)
- Unicorn-25254.exe (PID: 9368)
- Unicorn-365.exe (PID: 9384)
- Unicorn-20978.exe (PID: 9392)
- Unicorn-21340.exe (PID: 9436)
- Unicorn-58289.exe (PID: 9468)
- Unicorn-33230.exe (PID: 9416)
- Unicorn-58124.exe (PID: 9512)
- Unicorn-5409.exe (PID: 9576)
- Unicorn-26022.exe (PID: 9656)
- Unicorn-51081.exe (PID: 9564)
- Unicorn-16702.exe (PID: 9460)
- Unicorn-18739.exe (PID: 9492)
- Unicorn-62778.exe (PID: 9600)
- Unicorn-26214.exe (PID: 9540)
- Unicorn-5409.exe (PID: 9572)
- Unicorn-50142.exe (PID: 9800)
- Unicorn-556.exe (PID: 9648)
- Unicorn-3363.exe (PID: 9724)
- Unicorn-45096.exe (PID: 9828)
- Unicorn-46058.exe (PID: 9808)
- Unicorn-7447.exe (PID: 9708)
- Unicorn-59249.exe (PID: 9716)
- Unicorn-14132.exe (PID: 9748)
- Unicorn-18326.exe (PID: 8324)
- Unicorn-239.exe (PID: 9868)
- Unicorn-43873.exe (PID: 9876)
- Unicorn-11200.exe (PID: 9900)
- Unicorn-15165.exe (PID: 8968)
- Unicorn-10379.exe (PID: 9080)
- Unicorn-32061.exe (PID: 7968)
- Unicorn-39317.exe (PID: 10064)
- Unicorn-51796.exe (PID: 9344)
- Unicorn-16266.exe (PID: 10040)
- Unicorn-33427.exe (PID: 6344)
- Unicorn-28134.exe (PID: 10100)
- Unicorn-53001.exe (PID: 10116)
- Unicorn-30171.exe (PID: 10084)
- Unicorn-17552.exe (PID: 10136)
- Unicorn-14951.exe (PID: 10168)
- Unicorn-24974.exe (PID: 10192)
- Unicorn-20506.exe (PID: 10236)
- Unicorn-20188.exe (PID: 8744)
- Unicorn-48200.exe (PID: 2340)
- Unicorn-23526.exe (PID: 8872)
- Unicorn-53946.exe (PID: 3956)
- Unicorn-17382.exe (PID: 8336)
- Unicorn-53946.exe (PID: 2192)
- Unicorn-6089.exe (PID: 10336)
- Unicorn-5409.exe (PID: 9588)
- Unicorn-53925.exe (PID: 10212)
- Unicorn-56037.exe (PID: 10276)
- Unicorn-55290.exe (PID: 10260)
- Unicorn-40800.exe (PID: 10308)
- Unicorn-55461.exe (PID: 10404)
- Unicorn-38305.exe (PID: 10356)
- Unicorn-13873.exe (PID: 10396)
- Unicorn-19110.exe (PID: 10556)
- Unicorn-39338.exe (PID: 10580)
- Unicorn-59685.exe (PID: 10496)
- Unicorn-26126.exe (PID: 10428)
- Unicorn-2965.exe (PID: 10468)
- Unicorn-48445.exe (PID: 10516)
- Unicorn-25122.exe (PID: 10680)
Reads the computer name
- 1 (1342).exe (PID: 7256)
- Unicorn-50702.exe (PID: 7560)
- Unicorn-35989.exe (PID: 7572)
- Unicorn-64210.exe (PID: 6620)
- Unicorn-35103.exe (PID: 7184)
- Unicorn-12148.exe (PID: 8148)
- Unicorn-29846.exe (PID: 8092)
- Unicorn-61641.exe (PID: 5056)
- Unicorn-58901.exe (PID: 5404)
- Unicorn-53696.exe (PID: 1324)
- Unicorn-39248.exe (PID: 3900)
- Unicorn-53961.exe (PID: 6388)
- Unicorn-56654.exe (PID: 1660)
- Unicorn-32301.exe (PID: 7544)
- Unicorn-30775.exe (PID: 7684)
- Unicorn-34247.exe (PID: 7712)
- Unicorn-27807.exe (PID: 7864)
- Unicorn-24277.exe (PID: 7904)
- Unicorn-44143.exe (PID: 7808)
- Unicorn-62425.exe (PID: 7860)
- Unicorn-60095.exe (PID: 8052)
- Unicorn-27423.exe (PID: 4112)
- Unicorn-32061.exe (PID: 7972)
- Unicorn-18605.exe (PID: 632)
- Unicorn-52787.exe (PID: 1040)
- Unicorn-62015.exe (PID: 7880)
- Unicorn-19783.exe (PID: 968)
- Unicorn-14604.exe (PID: 8360)
- Unicorn-32039.exe (PID: 8544)
- Unicorn-51154.exe (PID: 8652)
- Unicorn-56774.exe (PID: 9240)
- Unicorn-4833.exe (PID: 9284)
- Unicorn-58289.exe (PID: 9468)
- Unicorn-33230.exe (PID: 9416)
- Unicorn-365.exe (PID: 9384)
- Unicorn-14132.exe (PID: 9748)
Create files in a temporary directory
- Unicorn-24807.exe (PID: 7324)
- 1 (1342).exe (PID: 7256)
- Unicorn-35989.exe (PID: 7572)
- Unicorn-5279.exe (PID: 7200)
- Unicorn-32284.exe (PID: 5072)
- Unicorn-64210.exe (PID: 4776)
- Unicorn-28422.exe (PID: 7252)
- Unicorn-12148.exe (PID: 8148)
- Unicorn-50702.exe (PID: 7560)
- Unicorn-39637.exe (PID: 8112)
- Unicorn-35103.exe (PID: 7184)
- Unicorn-58901.exe (PID: 5404)
- Unicorn-29846.exe (PID: 8092)
- Unicorn-61641.exe (PID: 5048)
- Unicorn-61641.exe (PID: 5056)
- Unicorn-64459.exe (PID: 1188)
- Unicorn-30124.exe (PID: 4608)
- Unicorn-64459.exe (PID: 4040)
- Unicorn-7910.exe (PID: 2136)
- Unicorn-53961.exe (PID: 6768)
- Unicorn-26748.exe (PID: 4724)
- Unicorn-53961.exe (PID: 6388)
- Unicorn-29548.exe (PID: 3888)
- Unicorn-6576.exe (PID: 7316)
- Unicorn-32301.exe (PID: 7544)
- Unicorn-59912.exe (PID: 7556)
- Unicorn-59503.exe (PID: 8116)
- Unicorn-27807.exe (PID: 7864)
- Unicorn-64459.exe (PID: 3100)
- Unicorn-24277.exe (PID: 7904)
- Unicorn-56654.exe (PID: 1660)
- Unicorn-60095.exe (PID: 8052)
- Unicorn-32061.exe (PID: 7972)
- Unicorn-18605.exe (PID: 632)
- Unicorn-12814.exe (PID: 7396)
- Unicorn-34278.exe (PID: 8440)
- Unicorn-64210.exe (PID: 6620)
- Unicorn-53965.exe (PID: 6652)
- Unicorn-10982.exe (PID: 6644)
- Unicorn-43754.exe (PID: 8920)
- Unicorn-53696.exe (PID: 1324)
- Unicorn-28497.exe (PID: 9096)
- Unicorn-56597.exe (PID: 7300)
- Unicorn-62835.exe (PID: 6456)
- Unicorn-9477.exe (PID: 3332)
- Unicorn-20412.exe (PID: 3300)
- Unicorn-29897.exe (PID: 4620)
- Unicorn-25254.exe (PID: 9368)
- Unicorn-30775.exe (PID: 7684)
- Unicorn-16702.exe (PID: 9460)
- Unicorn-20978.exe (PID: 9392)
- Unicorn-42149.exe (PID: 7888)
- Unicorn-28339.exe (PID: 8368)
- Unicorn-11200.exe (PID: 9900)
- Unicorn-62425.exe (PID: 7860)
- Unicorn-7884.exe (PID: 4180)
- Unicorn-33976.exe (PID: 9324)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
608
Monitored processes
472
Malicious processes
72
Suspicious processes
64
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 496 | C:\Users\admin\AppData\Local\Temp\Unicorn-42605.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-42605.exe | 1 (1342).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 632 | C:\Users\admin\AppData\Local\Temp\Unicorn-18605.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-18605.exe | Unicorn-35989.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 664 | C:\Users\admin\AppData\Local\Temp\Unicorn-16280.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-16280.exe | Unicorn-5279.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 864 | C:\Users\admin\AppData\Local\Temp\Unicorn-2057.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-2057.exe | — | Unicorn-62778.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 872 | C:\Users\admin\AppData\Local\Temp\Unicorn-63001.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63001.exe | — | Unicorn-27423.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 968 | C:\Users\admin\AppData\Local\Temp\Unicorn-19783.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-19783.exe | Unicorn-29548.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1040 | C:\Users\admin\AppData\Local\Temp\Unicorn-52787.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-52787.exe | Unicorn-5279.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1188 | C:\Users\admin\AppData\Local\Temp\Unicorn-64459.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-64459.exe | Unicorn-64210.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1324 | C:\Users\admin\AppData\Local\Temp\Unicorn-53696.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53696.exe | Unicorn-24807.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1568 | C:\Users\admin\AppData\Local\Temp\Unicorn-27122.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-27122.exe | Unicorn-32301.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
11 096
Read events
11 096
Write events
0
Delete events
0
Modification events
Executable files
663
Suspicious files
2
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7256 | 1 (1342).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24807.exe | executable | |
MD5:D0C477B958DEF80E9031F7F131E38E07 | SHA256:530A97B2CEC5E02496F917556402F375D96C20DFE50D59FA7D1FE2B21F888620 | |||
| 7560 | Unicorn-50702.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-29846.exe | executable | |
MD5:0EF7DF6B4ECAAF6CC2A221BAB654DAD8 | SHA256:1470BBC8EF4A885FEC32A6340A54291EFC347D4D9EFB09BA76A45309DB798898 | |||
| 7324 | Unicorn-24807.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-39637.exe | executable | |
MD5:2BA65A15EB0B115FB033A05E9B877188 | SHA256:866050C32486F2FAB457D3CCB20FF9BF30EDDA5B8F1EF69B3CB00E6D341F1052 | |||
| 7324 | Unicorn-24807.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-50702.exe | executable | |
MD5:3BEBDDFDC582381C852A27E574A64891 | SHA256:F35BCA605A8B27E37820D59DE145F8FC0D67154EE8758DEEC49B766A586F251A | |||
| 7256 | 1 (1342).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-35989.exe | executable | |
MD5:33A755A1298474AE962F9634CCF81012 | SHA256:70A63FB16D712D3699E6DC372F6658054D68E72AA4489FCC9A4BC52B064A3ECF | |||
| 7324 | Unicorn-24807.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-28422.exe | executable | |
MD5:697F03DC302F6B86DACBDEC180A551E4 | SHA256:6159DE905DCAEB5DE2365B3E4259FF3D8623C2BA048A038826CC2503499E93A6 | |||
| 7572 | Unicorn-35989.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-59503.exe | executable | |
MD5:B7685F6CF7D90E53C56AF66F32EFA8E9 | SHA256:DE2C832E5D9D83375F285F6770377A433F201B8DF1DDE287C4FC0F5A3BFE1CC5 | |||
| 8092 | Unicorn-29846.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5279.exe | executable | |
MD5:531775075FA259DAD7BAFDE925D6F007 | SHA256:0CBBBA0EA01FBC85AA4451DDF823F25257B71C857E5BA2ED65AC1DD9ED93AB9C | |||
| 7256 | 1 (1342).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-12148.exe | executable | |
MD5:1FC395D712A827C22D18C7454D035FCD | SHA256:6157C65E028D4B33763172130820D28B851298C7DF9FF6D6F79E9AAB660DEA05 | |||
| 8148 | Unicorn-12148.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-7910.exe | executable | |
MD5:68F9E0ED75F21A488E36FB7A563E5FA3 | SHA256:E214908775309804382FB6A0E000193F0CD700066530307B073E98A5FCF9026A | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
25
DNS requests
16
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.16.164.99:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
8280 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7380 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
8280 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.16.164.99:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.160.14:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
2104 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |