| File name: | 1 (1352) |
| Full analysis: | https://app.any.run/tasks/60109f18-ed83-4cf2-8922-6ffb9d5b9b32 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 12:11:00 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | C55E9505C732749DDD756897B49ACF60 |
| SHA1: | CC233DDCEB64DF07362E1845A9D5A9BCCB692711 |
| SHA256: | FA4288EACB2E4B004AE7B994048981E397458178A69C832D022E94C8B8CBC902 |
| SSDEEP: | 6144:tpHv2gvz0DiwA58HeCeRke1xBYB+lpSGB0LIydYsck/8SwuwpyAvEhvXCIChMsKL:t9uYHwA5YedOBowa0sydYs3x1DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- 1 (1352).exe (PID: 5680)
- Unicorn-24356.exe (PID: 2340)
- Unicorn-55404.exe (PID: 5416)
- Unicorn-3551.exe (PID: 5640)
- Unicorn-13468.exe (PID: 7404)
- Unicorn-5663.exe (PID: 7424)
- Unicorn-45949.exe (PID: 7452)
- Unicorn-39819.exe (PID: 7444)
- Unicorn-39857.exe (PID: 7956)
- Unicorn-28351.exe (PID: 7988)
- Unicorn-3100.exe (PID: 8012)
- Unicorn-10566.exe (PID: 8036)
- Unicorn-15628.exe (PID: 8060)
- Unicorn-1164.exe (PID: 8092)
- Unicorn-47101.exe (PID: 8100)
- Unicorn-15628.exe (PID: 8068)
- Unicorn-18678.exe (PID: 6512)
- Unicorn-19769.exe (PID: 7544)
- Unicorn-24546.exe (PID: 2552)
- Unicorn-40983.exe (PID: 2040)
- Unicorn-30184.exe (PID: 6436)
- Unicorn-10448.exe (PID: 4188)
- Unicorn-30687.exe (PID: 7572)
- Unicorn-56203.exe (PID: 736)
- Unicorn-43396.exe (PID: 7596)
- Unicorn-5470.exe (PID: 1912)
- Unicorn-2670.exe (PID: 7636)
- Unicorn-57272.exe (PID: 4380)
- Unicorn-57272.exe (PID: 7640)
- Unicorn-52633.exe (PID: 7612)
- Unicorn-43396.exe (PID: 7588)
- Unicorn-21667.exe (PID: 7532)
- Unicorn-65160.exe (PID: 7696)
- Unicorn-5553.exe (PID: 7488)
- Unicorn-33412.exe (PID: 5956)
- Unicorn-28212.exe (PID: 7548)
- Unicorn-41942.exe (PID: 4988)
- Unicorn-21195.exe (PID: 7400)
- Unicorn-29821.exe (PID: 7252)
- Unicorn-34673.exe (PID: 6564)
- Unicorn-18014.exe (PID: 6268)
- Unicorn-2000.exe (PID: 7744)
- Unicorn-52633.exe (PID: 7604)
- Unicorn-21466.exe (PID: 7808)
- Unicorn-42326.exe (PID: 7772)
- Unicorn-1808.exe (PID: 7712)
- Unicorn-10251.exe (PID: 7980)
- Unicorn-22504.exe (PID: 7952)
- Unicorn-17442.exe (PID: 7928)
- Unicorn-44185.exe (PID: 8160)
- Unicorn-44185.exe (PID: 8152)
- Unicorn-48824.exe (PID: 8176)
- Unicorn-44185.exe (PID: 8136)
- Unicorn-58475.exe (PID: 7900)
- Unicorn-44740.exe (PID: 7908)
- Unicorn-34948.exe (PID: 8128)
- Unicorn-17250.exe (PID: 2088)
- Unicorn-44740.exe (PID: 7916)
- Unicorn-44740.exe (PID: 516)
- Unicorn-39139.exe (PID: 7224)
- Unicorn-42732.exe (PID: 2616)
- Unicorn-54792.exe (PID: 2316)
- Unicorn-19188.exe (PID: 2392)
- Unicorn-62258.exe (PID: 7020)
- Unicorn-43094.exe (PID: 3176)
- Unicorn-44688.exe (PID: 7336)
- Unicorn-60583.exe (PID: 2772)
- Unicorn-36401.exe (PID: 7360)
- Unicorn-61874.exe (PID: 5360)
- Unicorn-12643.exe (PID: 6972)
- Unicorn-32509.exe (PID: 7328)
- Unicorn-65181.exe (PID: 6676)
- Unicorn-23765.exe (PID: 7184)
- Unicorn-43863.exe (PID: 7316)
- Unicorn-51783.exe (PID: 6540)
- Unicorn-3344.exe (PID: 7292)
- Unicorn-36785.exe (PID: 7852)
- Unicorn-37531.exe (PID: 7832)
- Unicorn-57480.exe (PID: 7828)
- Unicorn-51158.exe (PID: 968)
- Unicorn-26623.exe (PID: 7864)
- Unicorn-58248.exe (PID: 4652)
- Unicorn-38190.exe (PID: 8240)
- Unicorn-58824.exe (PID: 8480)
- Unicorn-38958.exe (PID: 8472)
- Unicorn-62192.exe (PID: 7764)
- Unicorn-35005.exe (PID: 8516)
- Unicorn-13846.exe (PID: 8616)
- Unicorn-14631.exe (PID: 8584)
- Unicorn-2187.exe (PID: 8624)
- Unicorn-26692.exe (PID: 8640)
- Unicorn-35606.exe (PID: 8608)
- Unicorn-8662.exe (PID: 8564)
- Unicorn-63375.exe (PID: 8600)
- Unicorn-7703.exe (PID: 8632)
- Unicorn-9047.exe (PID: 8716)
- Unicorn-3448.exe (PID: 8592)
- Unicorn-49333.exe (PID: 8764)
- Unicorn-27844.exe (PID: 8748)
- Unicorn-44180.exe (PID: 8792)
- Unicorn-44180.exe (PID: 8800)
- Unicorn-53417.exe (PID: 8816)
- Unicorn-24637.exe (PID: 8740)
- Unicorn-56240.exe (PID: 8860)
- Unicorn-56240.exe (PID: 8868)
- Unicorn-24445.exe (PID: 8900)
- Unicorn-40266.exe (PID: 8976)
- Unicorn-18122.exe (PID: 9076)
- Unicorn-40266.exe (PID: 8984)
- Unicorn-24445.exe (PID: 8892)
- Unicorn-18122.exe (PID: 9068)
- Unicorn-23568.exe (PID: 8924)
- Unicorn-40266.exe (PID: 9000)
- Unicorn-27652.exe (PID: 8908)
- Unicorn-17023.exe (PID: 8916)
- Unicorn-41942.exe (PID: 8944)
- Unicorn-28206.exe (PID: 8952)
- Unicorn-22206.exe (PID: 9032)
- Unicorn-28072.exe (PID: 9040)
- Unicorn-48684.exe (PID: 9104)
- Unicorn-51202.exe (PID: 8992)
- Unicorn-61201.exe (PID: 9128)
- Unicorn-28297.exe (PID: 9112)
- Unicorn-29681.exe (PID: 9200)
- Unicorn-59238.exe (PID: 7012)
- Unicorn-28612.exe (PID: 6228)
- Unicorn-25405.exe (PID: 8556)
- Unicorn-65368.exe (PID: 3268)
- Unicorn-36780.exe (PID: 9220)
- Unicorn-18205.exe (PID: 9316)
- Unicorn-36780.exe (PID: 8712)
- Unicorn-42679.exe (PID: 7148)
- Unicorn-29166.exe (PID: 4892)
- Unicorn-55939.exe (PID: 9308)
- Unicorn-16853.exe (PID: 9384)
- Unicorn-50686.exe (PID: 9396)
- Unicorn-9431.exe (PID: 9252)
- Unicorn-17791.exe (PID: 9300)
- Unicorn-48840.exe (PID: 9332)
- Unicorn-29297.exe (PID: 9260)
- Unicorn-23879.exe (PID: 9468)
- Unicorn-17599.exe (PID: 9448)
- Unicorn-10583.exe (PID: 9532)
- Unicorn-64282.exe (PID: 9556)
- Unicorn-15710.exe (PID: 9268)
- Unicorn-7922.exe (PID: 9404)
- Unicorn-24144.exe (PID: 9484)
- Unicorn-30449.exe (PID: 9540)
- Unicorn-54953.exe (PID: 9644)
- Unicorn-37847.exe (PID: 9604)
- Unicorn-30449.exe (PID: 9548)
- Unicorn-5622.exe (PID: 9596)
- Unicorn-63121.exe (PID: 9628)
- Unicorn-15766.exe (PID: 9676)
- Unicorn-37910.exe (PID: 9660)
- Unicorn-42103.exe (PID: 9476)
- Unicorn-24144.exe (PID: 9492)
- Unicorn-21897.exe (PID: 9684)
- Unicorn-56799.exe (PID: 9712)
Executable content was dropped or overwritten
- Unicorn-24356.exe (PID: 2340)
- 1 (1352).exe (PID: 5680)
- Unicorn-3551.exe (PID: 5640)
- Unicorn-55404.exe (PID: 5416)
- Unicorn-13468.exe (PID: 7404)
- Unicorn-5663.exe (PID: 7424)
- Unicorn-39819.exe (PID: 7444)
- Unicorn-10566.exe (PID: 8036)
- Unicorn-39857.exe (PID: 7956)
- Unicorn-28351.exe (PID: 7988)
- Unicorn-3100.exe (PID: 8012)
- Unicorn-15628.exe (PID: 8068)
- Unicorn-1164.exe (PID: 8092)
- Unicorn-30184.exe (PID: 6436)
- Unicorn-18678.exe (PID: 6512)
- Unicorn-10448.exe (PID: 4188)
- Unicorn-40983.exe (PID: 2040)
- Unicorn-24546.exe (PID: 2552)
- Unicorn-19769.exe (PID: 7544)
- Unicorn-30687.exe (PID: 7572)
- Unicorn-56203.exe (PID: 736)
- Unicorn-43396.exe (PID: 7596)
- Unicorn-5470.exe (PID: 1912)
- Unicorn-52633.exe (PID: 7604)
- Unicorn-57272.exe (PID: 4380)
- Unicorn-45949.exe (PID: 7452)
- Unicorn-15628.exe (PID: 8060)
- Unicorn-65160.exe (PID: 7696)
- Unicorn-5553.exe (PID: 7488)
- Unicorn-33412.exe (PID: 5956)
- Unicorn-28212.exe (PID: 7548)
- Unicorn-21667.exe (PID: 7532)
- Unicorn-41942.exe (PID: 4988)
- Unicorn-29821.exe (PID: 7252)
- Unicorn-21195.exe (PID: 7400)
- Unicorn-34673.exe (PID: 6564)
- Unicorn-18014.exe (PID: 6268)
- Unicorn-2000.exe (PID: 7744)
- Unicorn-21466.exe (PID: 7808)
- Unicorn-42326.exe (PID: 7772)
- Unicorn-62192.exe (PID: 7764)
- Unicorn-17442.exe (PID: 7928)
- Unicorn-10251.exe (PID: 7980)
- Unicorn-1808.exe (PID: 7712)
- Unicorn-22504.exe (PID: 7952)
- Unicorn-44185.exe (PID: 8160)
- Unicorn-44185.exe (PID: 8136)
- Unicorn-48824.exe (PID: 8176)
- Unicorn-55103.exe (PID: 8188)
- Unicorn-58475.exe (PID: 7900)
- Unicorn-44185.exe (PID: 8152)
- Unicorn-44740.exe (PID: 7916)
- Unicorn-57272.exe (PID: 7640)
- Unicorn-17250.exe (PID: 2088)
- Unicorn-39139.exe (PID: 7224)
- Unicorn-43396.exe (PID: 7588)
- Unicorn-42732.exe (PID: 2616)
- Unicorn-52633.exe (PID: 7612)
- Unicorn-54792.exe (PID: 2316)
- Unicorn-62258.exe (PID: 7020)
- Unicorn-43094.exe (PID: 3176)
- Unicorn-19188.exe (PID: 2392)
- Unicorn-44688.exe (PID: 7336)
- Unicorn-36401.exe (PID: 7360)
- Unicorn-61874.exe (PID: 5360)
- Unicorn-12643.exe (PID: 6972)
- Unicorn-60583.exe (PID: 2772)
- Unicorn-65181.exe (PID: 6676)
- Unicorn-23765.exe (PID: 7184)
- Unicorn-51783.exe (PID: 6540)
- Unicorn-36785.exe (PID: 7852)
- Unicorn-26623.exe (PID: 7864)
- Unicorn-37531.exe (PID: 7832)
- Unicorn-57480.exe (PID: 7828)
- Unicorn-51158.exe (PID: 968)
- Unicorn-5539.exe (PID: 8444)
- Unicorn-58248.exe (PID: 4652)
- Unicorn-58824.exe (PID: 8480)
- Unicorn-35005.exe (PID: 8516)
- Unicorn-38190.exe (PID: 8240)
- Unicorn-8662.exe (PID: 8564)
- Unicorn-2187.exe (PID: 8624)
- Unicorn-13846.exe (PID: 8616)
- Unicorn-35606.exe (PID: 8608)
- Unicorn-7703.exe (PID: 8632)
- Unicorn-3448.exe (PID: 8592)
- Unicorn-63375.exe (PID: 8600)
- Unicorn-44740.exe (PID: 516)
- Unicorn-44185.exe (PID: 8144)
- Unicorn-49333.exe (PID: 8764)
- Unicorn-27844.exe (PID: 8748)
- Unicorn-32509.exe (PID: 7328)
- Unicorn-53417.exe (PID: 8816)
- Unicorn-44180.exe (PID: 8792)
- Unicorn-44180.exe (PID: 8800)
- Unicorn-24637.exe (PID: 8740)
- Unicorn-43863.exe (PID: 7316)
- Unicorn-44180.exe (PID: 8808)
- Unicorn-56240.exe (PID: 8860)
- Unicorn-24445.exe (PID: 8900)
- Unicorn-18122.exe (PID: 9076)
- Unicorn-40266.exe (PID: 9000)
- Unicorn-40266.exe (PID: 8976)
- Unicorn-27652.exe (PID: 8908)
- Unicorn-40266.exe (PID: 8984)
- Unicorn-24445.exe (PID: 8892)
- Unicorn-17023.exe (PID: 8916)
- Unicorn-18122.exe (PID: 9068)
- Unicorn-41942.exe (PID: 8944)
- Unicorn-28206.exe (PID: 8952)
- Unicorn-28072.exe (PID: 9040)
- Unicorn-48684.exe (PID: 9104)
- Unicorn-28297.exe (PID: 9112)
- Unicorn-22206.exe (PID: 9032)
- Unicorn-51202.exe (PID: 8992)
- Unicorn-61201.exe (PID: 9128)
- Unicorn-29681.exe (PID: 9200)
- Unicorn-59238.exe (PID: 7012)
- Unicorn-65368.exe (PID: 3268)
- Unicorn-28612.exe (PID: 6228)
- Unicorn-25405.exe (PID: 8556)
- Unicorn-36780.exe (PID: 9220)
- Unicorn-18205.exe (PID: 9316)
- Unicorn-36780.exe (PID: 8712)
- Unicorn-42679.exe (PID: 7148)
- Unicorn-16853.exe (PID: 9384)
- Unicorn-55939.exe (PID: 9308)
- Unicorn-50686.exe (PID: 9396)
- Unicorn-17791.exe (PID: 9300)
- Unicorn-48840.exe (PID: 9332)
- Unicorn-29166.exe (PID: 4892)
- Unicorn-9431.exe (PID: 9252)
- Unicorn-7922.exe (PID: 9404)
- Unicorn-17599.exe (PID: 9448)
- Unicorn-23879.exe (PID: 9468)
- Unicorn-24144.exe (PID: 9484)
- Unicorn-42103.exe (PID: 9476)
- Unicorn-10583.exe (PID: 9532)
- Unicorn-64282.exe (PID: 9556)
- Unicorn-24336.exe (PID: 9324)
- Unicorn-15710.exe (PID: 9268)
- Unicorn-37847.exe (PID: 9604)
- Unicorn-63121.exe (PID: 9628)
- Unicorn-5622.exe (PID: 9596)
- Unicorn-15766.exe (PID: 9676)
- Unicorn-54953.exe (PID: 9644)
- Unicorn-30449.exe (PID: 9540)
- Unicorn-30449.exe (PID: 9548)
- Unicorn-37910.exe (PID: 9660)
- Unicorn-52606.exe (PID: 9912)
- Unicorn-49416.exe (PID: 9808)
- Unicorn-49608.exe (PID: 9720)
- Unicorn-21897.exe (PID: 9684)
- Unicorn-25524.exe (PID: 9788)
- Unicorn-5368.exe (PID: 9760)
- Unicorn-51040.exe (PID: 9748)
- Unicorn-31217.exe (PID: 9828)
- Unicorn-31963.exe (PID: 9856)
- Unicorn-34948.exe (PID: 8128)
- Unicorn-44740.exe (PID: 7908)
- Unicorn-2670.exe (PID: 7636)
- Unicorn-47101.exe (PID: 8100)
- Unicorn-29764.exe (PID: 9944)
- Unicorn-56799.exe (PID: 9712)
- Unicorn-56240.exe (PID: 8868)
- Unicorn-7459.exe (PID: 10136)
- Unicorn-38958.exe (PID: 8472)
- Unicorn-18472.exe (PID: 10048)
- Unicorn-64143.exe (PID: 10040)
- Unicorn-9047.exe (PID: 8716)
- Unicorn-29297.exe (PID: 9260)
- Unicorn-24144.exe (PID: 9492)
- Unicorn-14631.exe (PID: 8584)
- Unicorn-26692.exe (PID: 8640)
- Unicorn-23568.exe (PID: 8924)
- Unicorn-29764.exe (PID: 9952)
- Unicorn-40345.exe (PID: 10008)
- Unicorn-3344.exe (PID: 7292)
- Unicorn-17494.exe (PID: 10056)
- Unicorn-7651.exe (PID: 10104)
Executes application which crashes
- Unicorn-16477.exe (PID: 13188)
INFO
Checks supported languages
- 1 (1352).exe (PID: 5680)
- Unicorn-3551.exe (PID: 5640)
- Unicorn-55404.exe (PID: 5416)
- Unicorn-13468.exe (PID: 7404)
- Unicorn-5663.exe (PID: 7424)
- Unicorn-39819.exe (PID: 7444)
- Unicorn-45949.exe (PID: 7452)
- Unicorn-10566.exe (PID: 8036)
- Unicorn-1164.exe (PID: 8092)
- Unicorn-30184.exe (PID: 6436)
- Unicorn-10448.exe (PID: 4188)
- Unicorn-40983.exe (PID: 2040)
- Unicorn-56203.exe (PID: 736)
- Unicorn-57272.exe (PID: 4380)
- Unicorn-52633.exe (PID: 7612)
- Unicorn-52633.exe (PID: 7604)
- Unicorn-2670.exe (PID: 7636)
- Unicorn-19769.exe (PID: 7544)
- Unicorn-65160.exe (PID: 7696)
- Unicorn-2000.exe (PID: 7744)
- Unicorn-18014.exe (PID: 6268)
- Unicorn-1808.exe (PID: 7712)
- Unicorn-22504.exe (PID: 7952)
- Unicorn-10251.exe (PID: 7980)
- Unicorn-34948.exe (PID: 8128)
- Unicorn-48824.exe (PID: 8176)
- Unicorn-44740.exe (PID: 7908)
- Unicorn-44185.exe (PID: 8152)
- Unicorn-44185.exe (PID: 8160)
- Unicorn-55103.exe (PID: 8188)
- Unicorn-44740.exe (PID: 516)
- Unicorn-17250.exe (PID: 2088)
- Unicorn-62258.exe (PID: 7020)
- Unicorn-12643.exe (PID: 6972)
- Unicorn-44688.exe (PID: 7336)
- Unicorn-32509.exe (PID: 7328)
- Unicorn-36401.exe (PID: 7360)
- Unicorn-42732.exe (PID: 2616)
- Unicorn-43094.exe (PID: 3176)
- Unicorn-65181.exe (PID: 6676)
- Unicorn-61874.exe (PID: 5360)
- Unicorn-3344.exe (PID: 7292)
- Unicorn-51783.exe (PID: 6540)
- Unicorn-37531.exe (PID: 7832)
- Unicorn-57480.exe (PID: 7828)
- Unicorn-51158.exe (PID: 968)
- Unicorn-58248.exe (PID: 4652)
- Unicorn-26623.exe (PID: 7864)
- Unicorn-38958.exe (PID: 8472)
- Unicorn-35005.exe (PID: 8516)
- Unicorn-38190.exe (PID: 8240)
- Unicorn-8662.exe (PID: 8564)
- Unicorn-35606.exe (PID: 8608)
- Unicorn-13846.exe (PID: 8616)
- Unicorn-2187.exe (PID: 8624)
- Unicorn-3448.exe (PID: 8592)
- Unicorn-7703.exe (PID: 8632)
- Unicorn-24637.exe (PID: 8740)
- Unicorn-44180.exe (PID: 8808)
- Unicorn-9047.exe (PID: 8716)
- Unicorn-44180.exe (PID: 8800)
- Unicorn-24445.exe (PID: 8900)
- Unicorn-27652.exe (PID: 8908)
- Unicorn-56240.exe (PID: 8868)
- Unicorn-56240.exe (PID: 8860)
- Unicorn-17023.exe (PID: 8916)
- Unicorn-40266.exe (PID: 8976)
- Unicorn-22206.exe (PID: 9032)
- Unicorn-18122.exe (PID: 9076)
- Unicorn-48684.exe (PID: 9104)
- Unicorn-28297.exe (PID: 9112)
- Unicorn-51202.exe (PID: 8992)
- Unicorn-24445.exe (PID: 8892)
- Unicorn-23568.exe (PID: 8924)
- Unicorn-40266.exe (PID: 9000)
- Unicorn-42679.exe (PID: 7148)
- Unicorn-25405.exe (PID: 8556)
- Unicorn-61201.exe (PID: 9128)
- Unicorn-36780.exe (PID: 9220)
- Unicorn-9431.exe (PID: 9252)
- Unicorn-29297.exe (PID: 9260)
- Unicorn-48840.exe (PID: 9332)
- Unicorn-29166.exe (PID: 4892)
- Unicorn-7922.exe (PID: 9404)
- Unicorn-24336.exe (PID: 9324)
- Unicorn-23879.exe (PID: 9468)
- Unicorn-42103.exe (PID: 9476)
- Unicorn-24144.exe (PID: 9484)
- Unicorn-24144.exe (PID: 9492)
- Unicorn-17791.exe (PID: 9300)
- Unicorn-18205.exe (PID: 9316)
- Unicorn-64282.exe (PID: 9556)
- Unicorn-37847.exe (PID: 9604)
- Unicorn-54953.exe (PID: 9644)
- Unicorn-49608.exe (PID: 9720)
- Unicorn-37910.exe (PID: 9660)
- Unicorn-56799.exe (PID: 9712)
- Unicorn-25524.exe (PID: 9788)
- Unicorn-30449.exe (PID: 9540)
- Unicorn-31963.exe (PID: 9856)
- Unicorn-31217.exe (PID: 9828)
- Unicorn-29764.exe (PID: 9944)
- Unicorn-7459.exe (PID: 10136)
- Unicorn-17494.exe (PID: 10056)
- Unicorn-49416.exe (PID: 9808)
- Unicorn-21277.exe (PID: 10528)
- Unicorn-47125.exe (PID: 10540)
- Unicorn-14452.exe (PID: 10604)
- Unicorn-26705.exe (PID: 10632)
- Unicorn-6647.exe (PID: 10680)
- Unicorn-45864.exe (PID: 10652)
- Unicorn-7061.exe (PID: 10704)
- Unicorn-4261.exe (PID: 10720)
- Unicorn-58863.exe (PID: 10736)
- Unicorn-33974.exe (PID: 10816)
- Unicorn-36195.exe (PID: 10944)
- Unicorn-36195.exe (PID: 10936)
- Unicorn-47571.exe (PID: 11004)
- Unicorn-17258.exe (PID: 11020)
- Unicorn-23124.exe (PID: 11028)
- Unicorn-55604.exe (PID: 11104)
- Unicorn-35318.exe (PID: 10980)
- Unicorn-61306.exe (PID: 10996)
- Unicorn-6538.exe (PID: 10864)
- Unicorn-6538.exe (PID: 10872)
- Unicorn-58479.exe (PID: 10824)
- Unicorn-7607.exe (PID: 10972)
- Unicorn-6154.exe (PID: 11200)
- Unicorn-35065.exe (PID: 11276)
- Unicorn-54031.exe (PID: 11160)
- Unicorn-14266.exe (PID: 11176)
- Unicorn-13694.exe (PID: 11152)
- Unicorn-13694.exe (PID: 11144)
- Unicorn-17990.exe (PID: 11428)
- Unicorn-36373.exe (PID: 11420)
- Unicorn-7031.exe (PID: 11388)
- Unicorn-15438.exe (PID: 11460)
- Unicorn-23798.exe (PID: 11544)
- Unicorn-57540.exe (PID: 11584)
- Unicorn-59569.exe (PID: 11296)
- Unicorn-7031.exe (PID: 11380)
- Unicorn-55220.exe (PID: 11312)
- Unicorn-22813.exe (PID: 11432)
- Unicorn-37534.exe (PID: 11536)
- Unicorn-27690.exe (PID: 11680)
- Unicorn-47291.exe (PID: 11664)
- Unicorn-28567.exe (PID: 11636)
- Unicorn-5546.exe (PID: 11736)
- Unicorn-2439.exe (PID: 11728)
- Unicorn-42111.exe (PID: 11768)
- Unicorn-37150.exe (PID: 11856)
- Unicorn-48168.exe (PID: 11628)
- Unicorn-48433.exe (PID: 11652)
- Unicorn-23414.exe (PID: 11816)
- Unicorn-43015.exe (PID: 11844)
- Unicorn-19228.exe (PID: 11924)
- Unicorn-16206.exe (PID: 11960)
- Unicorn-3134.exe (PID: 12012)
- Unicorn-49071.exe (PID: 12020)
- Unicorn-11110.exe (PID: 12052)
- Unicorn-51623.exe (PID: 11992)
- Unicorn-29335.exe (PID: 12064)
- Unicorn-6337.exe (PID: 12128)
- Unicorn-39311.exe (PID: 11792)
- Unicorn-11484.exe (PID: 11904)
- Unicorn-25059.exe (PID: 12164)
- Unicorn-48687.exe (PID: 12180)
- Unicorn-30434.exe (PID: 12220)
- Unicorn-8168.exe (PID: 12204)
- Unicorn-63683.exe (PID: 12096)
- Unicorn-18374.exe (PID: 12136)
- Unicorn-50161.exe (PID: 3124)
- Unicorn-17489.exe (PID: 4692)
- Unicorn-25657.exe (PID: 12280)
- Unicorn-9320.exe (PID: 1600)
- Unicorn-5044.exe (PID: 12352)
- Unicorn-36648.exe (PID: 12336)
- Unicorn-3710.exe (PID: 12380)
- Unicorn-58521.exe (PID: 776)
- Unicorn-5407.exe (PID: 12412)
- Unicorn-45693.exe (PID: 12476)
- Unicorn-37010.exe (PID: 12548)
- Unicorn-12563.exe (PID: 12556)
- Unicorn-10865.exe (PID: 12612)
- Unicorn-49777.exe (PID: 12460)
- Unicorn-58137.exe (PID: 12504)
- Unicorn-50746.exe (PID: 12540)
- Unicorn-59289.exe (PID: 12600)
- Unicorn-38293.exe (PID: 12668)
- Unicorn-19910.exe (PID: 12676)
- Unicorn-5428.exe (PID: 12720)
- Unicorn-38760.exe (PID: 13004)
- Unicorn-275.exe (PID: 12740)
- Unicorn-5703.exe (PID: 12760)
The sample compiled with chinese language support
- 1 (1352).exe (PID: 5680)
- Unicorn-5368.exe (PID: 9760)
- Unicorn-25524.exe (PID: 9788)
- Unicorn-37847.exe (PID: 9604)
Reads the computer name
- 1 (1352).exe (PID: 5680)
- Unicorn-55404.exe (PID: 5416)
- Unicorn-13468.exe (PID: 7404)
- Unicorn-5663.exe (PID: 7424)
- Unicorn-3551.exe (PID: 5640)
- Unicorn-45949.exe (PID: 7452)
- Unicorn-39819.exe (PID: 7444)
- Unicorn-39857.exe (PID: 7956)
- Unicorn-15628.exe (PID: 8068)
- Unicorn-47101.exe (PID: 8100)
- Unicorn-3100.exe (PID: 8012)
- Unicorn-10566.exe (PID: 8036)
- Unicorn-43396.exe (PID: 7596)
- Unicorn-40983.exe (PID: 2040)
- Unicorn-52633.exe (PID: 7604)
- Unicorn-5470.exe (PID: 1912)
- Unicorn-65160.exe (PID: 7696)
- Unicorn-5553.exe (PID: 7488)
- Unicorn-18014.exe (PID: 6268)
- Unicorn-2000.exe (PID: 7744)
- Unicorn-62192.exe (PID: 7764)
- Unicorn-44185.exe (PID: 8152)
- Unicorn-10251.exe (PID: 7980)
- Unicorn-48824.exe (PID: 8176)
- Unicorn-44185.exe (PID: 8160)
- Unicorn-44185.exe (PID: 8144)
- Unicorn-44185.exe (PID: 8136)
- Unicorn-44740.exe (PID: 516)
- Unicorn-44740.exe (PID: 7916)
- Unicorn-61874.exe (PID: 5360)
- Unicorn-65181.exe (PID: 6676)
- Unicorn-23765.exe (PID: 7184)
- Unicorn-43863.exe (PID: 7316)
- Unicorn-3344.exe (PID: 7292)
- Unicorn-36785.exe (PID: 7852)
- Unicorn-17250.exe (PID: 2088)
- Unicorn-43094.exe (PID: 3176)
- Unicorn-51158.exe (PID: 968)
- Unicorn-58248.exe (PID: 4652)
- Unicorn-38958.exe (PID: 8472)
- Unicorn-58824.exe (PID: 8480)
- Unicorn-8662.exe (PID: 8564)
- Unicorn-9047.exe (PID: 8716)
- Unicorn-49333.exe (PID: 8764)
- Unicorn-53417.exe (PID: 8816)
- Unicorn-56240.exe (PID: 8868)
- Unicorn-14631.exe (PID: 8584)
- Unicorn-3448.exe (PID: 8592)
- Unicorn-40266.exe (PID: 9000)
- Unicorn-27652.exe (PID: 8908)
- Unicorn-41942.exe (PID: 8944)
- Unicorn-23568.exe (PID: 8924)
- Unicorn-18122.exe (PID: 9068)
- Unicorn-22206.exe (PID: 9032)
- Unicorn-24445.exe (PID: 8892)
- Unicorn-48684.exe (PID: 9104)
- Unicorn-59238.exe (PID: 7012)
- Unicorn-65368.exe (PID: 3268)
- Unicorn-28612.exe (PID: 6228)
- Unicorn-36780.exe (PID: 8712)
- Unicorn-29166.exe (PID: 4892)
- Unicorn-55939.exe (PID: 9308)
- Unicorn-50686.exe (PID: 9396)
- Unicorn-7922.exe (PID: 9404)
- Unicorn-9431.exe (PID: 9252)
- Unicorn-23879.exe (PID: 9468)
- Unicorn-10583.exe (PID: 9532)
- Unicorn-30449.exe (PID: 9548)
- Unicorn-16853.exe (PID: 9384)
- Unicorn-54953.exe (PID: 9644)
- Unicorn-56799.exe (PID: 9712)
Create files in a temporary directory
- Unicorn-24356.exe (PID: 2340)
- Unicorn-5663.exe (PID: 7424)
- Unicorn-55404.exe (PID: 5416)
- Unicorn-13468.exe (PID: 7404)
- Unicorn-3100.exe (PID: 8012)
- Unicorn-3551.exe (PID: 5640)
- 1 (1352).exe (PID: 5680)
- Unicorn-30184.exe (PID: 6436)
- Unicorn-15628.exe (PID: 8068)
- Unicorn-39857.exe (PID: 7956)
- Unicorn-28351.exe (PID: 7988)
- Unicorn-40983.exe (PID: 2040)
- Unicorn-30687.exe (PID: 7572)
- Unicorn-10566.exe (PID: 8036)
- Unicorn-56203.exe (PID: 736)
- Unicorn-43396.exe (PID: 7596)
- Unicorn-5470.exe (PID: 1912)
- Unicorn-52633.exe (PID: 7604)
- Unicorn-57272.exe (PID: 4380)
- Unicorn-28212.exe (PID: 7548)
- Unicorn-39819.exe (PID: 7444)
- Unicorn-5553.exe (PID: 7488)
- Unicorn-21667.exe (PID: 7532)
- Unicorn-65160.exe (PID: 7696)
- Unicorn-41942.exe (PID: 4988)
- Unicorn-29821.exe (PID: 7252)
- Unicorn-34673.exe (PID: 6564)
- Unicorn-21466.exe (PID: 7808)
- Unicorn-42326.exe (PID: 7772)
- Unicorn-10251.exe (PID: 7980)
- Unicorn-1808.exe (PID: 7712)
- Unicorn-22504.exe (PID: 7952)
- Unicorn-44185.exe (PID: 8136)
- Unicorn-44185.exe (PID: 8152)
- Unicorn-44740.exe (PID: 7916)
- Unicorn-17250.exe (PID: 2088)
- Unicorn-39139.exe (PID: 7224)
- Unicorn-52633.exe (PID: 7612)
- Unicorn-15628.exe (PID: 8060)
- Unicorn-42732.exe (PID: 2616)
- Unicorn-45949.exe (PID: 7452)
- Unicorn-19188.exe (PID: 2392)
- Unicorn-62258.exe (PID: 7020)
- Unicorn-12643.exe (PID: 6972)
- Unicorn-43094.exe (PID: 3176)
- Unicorn-60583.exe (PID: 2772)
- Unicorn-18678.exe (PID: 6512)
- Unicorn-36401.exe (PID: 7360)
- Unicorn-61874.exe (PID: 5360)
- Unicorn-33412.exe (PID: 5956)
- Unicorn-23765.exe (PID: 7184)
- Unicorn-51783.exe (PID: 6540)
- Unicorn-36785.exe (PID: 7852)
- Unicorn-21195.exe (PID: 7400)
- Unicorn-62192.exe (PID: 7764)
- Unicorn-2187.exe (PID: 8624)
- Unicorn-17442.exe (PID: 7928)
- Unicorn-48824.exe (PID: 8176)
- Unicorn-57272.exe (PID: 7640)
- Unicorn-1164.exe (PID: 8092)
- Unicorn-65181.exe (PID: 6676)
- Unicorn-10448.exe (PID: 4188)
- Unicorn-57480.exe (PID: 7828)
- Unicorn-18014.exe (PID: 6268)
- Unicorn-51158.exe (PID: 968)
- Unicorn-58248.exe (PID: 4652)
- Unicorn-38190.exe (PID: 8240)
- Unicorn-40266.exe (PID: 8976)
- Unicorn-18122.exe (PID: 9076)
- Unicorn-28206.exe (PID: 8952)
- Unicorn-28072.exe (PID: 9040)
- Unicorn-61201.exe (PID: 9128)
- Unicorn-58824.exe (PID: 8480)
- Unicorn-65368.exe (PID: 3268)
- Unicorn-28612.exe (PID: 6228)
- Unicorn-42679.exe (PID: 7148)
- Unicorn-16853.exe (PID: 9384)
- Unicorn-24336.exe (PID: 9324)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 7724)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 7724)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 7724)
- BackgroundTransferHost.exe (PID: 7504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
494
Monitored processes
357
Malicious processes
45
Suspicious processes
43
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 456 | C:\Users\admin\AppData\Local\Temp\Unicorn-47696.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-47696.exe | — | Unicorn-24336.exe | |||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 516 | C:\Users\admin\AppData\Local\Temp\Unicorn-44740.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-44740.exe | Unicorn-47101.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 664 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) | |||||||||||||||
| 736 | C:\Users\admin\AppData\Local\Temp\Unicorn-56203.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56203.exe | Unicorn-5663.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 776 | C:\Users\admin\AppData\Local\Temp\Unicorn-58521.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-58521.exe | — | Unicorn-17023.exe | |||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 872 | C:\Users\admin\AppData\Local\Temp\Unicorn-56497.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56497.exe | — | Unicorn-8662.exe | |||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 968 | C:\Users\admin\AppData\Local\Temp\Unicorn-51158.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-51158.exe | Unicorn-3100.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1600 | C:\Users\admin\AppData\Local\Temp\Unicorn-9320.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9320.exe | — | Unicorn-18122.exe | |||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1912 | C:\Users\admin\AppData\Local\Temp\Unicorn-5470.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5470.exe | Unicorn-3551.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 2040 | C:\Users\admin\AppData\Local\Temp\Unicorn-40983.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-40983.exe | Unicorn-3100.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
Total events
8 532
Read events
8 517
Write events
15
Delete events
0
Modification events
| (PID) Process: | (7504) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7504) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7504) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7724) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7724) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7724) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7896) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7896) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7896) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2148) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
892
Suspicious files
5
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7724 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\5c4a5f76-d87f-4921-9d49-daa1f373da68.down_data | — | |
MD5:— | SHA256:— | |||
| 7724 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6ec4e148-75b0-4aaa-86ef-a7f676a7994f.up_meta_secure | binary | |
MD5:4EDEACA5E159952E5954CC012BD877D4 | SHA256:905716D2A4019D7EFBF186142EBABDB3E92BB5F735BA6331A4CE1218189FDB06 | |||
| 7724 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:051FB8530D4D8A6DFF51699981FA167E | SHA256:370086DED15D2D393B3AC9FC7B3965311C3960E54F7848767025D4F6B8F64E33 | |||
| 2340 | Unicorn-24356.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-5663.exe | executable | |
MD5:E7F47E4446543B6C925E50FD4F1015DE | SHA256:A6CAAEE9B4FA678E5305FE72932537B89B8A4A3EE7FB18C3E18C4AF584EB1EC8 | |||
| 5416 | Unicorn-55404.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13468.exe | executable | |
MD5:79A1CC3E3C40C17D2B735E045270E542 | SHA256:AA14960ED532D7BC97BECA48CD2D03A9595602DF884EA0CCE67250E33C4A588D | |||
| 2340 | Unicorn-24356.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-55404.exe | executable | |
MD5:E9CC7FAA492C2147EEA957D76D1B6F82 | SHA256:5A7F663CE6564FEB3B6D016B4B36A0D2A80B90FA3DA4142B3E5A9D0F064A137C | |||
| 7724 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
| 5680 | 1 (1352).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24356.exe | executable | |
MD5:7A7AB9AD87C95E03F209D9385C5F8013 | SHA256:57E698774A35B3214DE83559C4CBC0D89F4D6B8B1074D5AC90A87BB03F320745 | |||
| 5680 | 1 (1352).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3551.exe | executable | |
MD5:A6EB0985190DF5E174AC5B51FFC0E7A5 | SHA256:6C5EC06BC4AAA3E62BA613BCEF7FE1257252B2FF5AAD5C6B36C434B04C91BCC2 | |||
| 7956 | Unicorn-39857.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-30184.exe | executable | |
MD5:ECB85502C33E20F1B5876F3FD3D319D1 | SHA256:56ECD84D22B4D179CD30E8022D0F70958720CD795B7C9DBF87A8576FE716F2A1 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
19
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.16.164.24:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5380 | backgroundTaskHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
7724 | BackgroundTransferHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
8284 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
8284 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 2.16.164.24:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
5496 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
300 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 40.126.31.71:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2104 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5380 | backgroundTaskHost.exe | 20.223.36.55:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |