| File name: | 1 (1303) |
| Full analysis: | https://app.any.run/tasks/256815c5-3c46-49b3-b1f1-23118f4d6522 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 13:12:36 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | BA5F1377A13F88A66B1C6CF3962B71B0 |
| SHA1: | 060EBDCCE912B507A7B82A9E873818237712C447 |
| SHA256: | 27966DC9F248C5979655A7A077CBC9CBD8AC5F010B7FBC1AA6F08C2A550CDDD9 |
| SSDEEP: | 6144:67w9MJ4PQDjUA5c6F8Xs1Bjx5wPq5P8GB5/WymO8Jk/8SwjwpgAvEhFfX1g6sFca:6sSWCUA5fFCTP0Ea5OymO8Nx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- Unicorn-29365.exe (PID: 4628)
- 1 (1303).exe (PID: 5376)
- Unicorn-414.exe (PID: 5328)
- Unicorn-65354.exe (PID: 4188)
- Unicorn-64534.exe (PID: 2268)
- Unicorn-61841.exe (PID: 1568)
- Unicorn-14778.exe (PID: 6824)
- Unicorn-31206.exe (PID: 5212)
- Unicorn-37119.exe (PID: 5756)
- Unicorn-46595.exe (PID: 2552)
- Unicorn-10568.exe (PID: 6576)
- Unicorn-2225.exe (PID: 1164)
- Unicorn-13465.exe (PID: 744)
- Unicorn-14285.exe (PID: 5640)
- Unicorn-16938.exe (PID: 2108)
- Unicorn-17815.exe (PID: 6644)
- Unicorn-33117.exe (PID: 4284)
- Unicorn-61151.exe (PID: 5304)
- Unicorn-59999.exe (PID: 6572)
- Unicorn-32733.exe (PID: 5428)
- Unicorn-24011.exe (PID: 680)
- Unicorn-28972.exe (PID: 968)
- Unicorn-26816.exe (PID: 7240)
- Unicorn-9163.exe (PID: 7036)
- Unicorn-49070.exe (PID: 7172)
- Unicorn-62111.exe (PID: 7196)
- Unicorn-55597.exe (PID: 7268)
- Unicorn-49283.exe (PID: 7232)
- Unicorn-32947.exe (PID: 7276)
- Unicorn-52797.exe (PID: 7260)
- Unicorn-20695.exe (PID: 7248)
- Unicorn-16183.exe (PID: 7440)
- Unicorn-58390.exe (PID: 7220)
- Unicorn-57617.exe (PID: 7488)
- Unicorn-64571.exe (PID: 7664)
- Unicorn-28753.exe (PID: 7500)
- Unicorn-13673.exe (PID: 8164)
- Unicorn-50627.exe (PID: 7416)
- Unicorn-31551.exe (PID: 7432)
- Unicorn-4040.exe (PID: 7396)
- Unicorn-19787.exe (PID: 7640)
- Unicorn-18770.exe (PID: 7580)
- Unicorn-35718.exe (PID: 7604)
- Unicorn-20149.exe (PID: 7792)
- Unicorn-18339.exe (PID: 7388)
- Unicorn-63626.exe (PID: 7424)
- Unicorn-50565.exe (PID: 7592)
- Unicorn-28692.exe (PID: 7652)
- Unicorn-46050.exe (PID: 7700)
- Unicorn-54986.exe (PID: 7468)
- Unicorn-35822.exe (PID: 7564)
- Unicorn-9184.exe (PID: 8092)
- Unicorn-42781.exe (PID: 7808)
- Unicorn-53995.exe (PID: 7996)
- Unicorn-22919.exe (PID: 8100)
- Unicorn-18669.exe (PID: 7624)
- Unicorn-28613.exe (PID: 2084)
- Unicorn-26693.exe (PID: 7864)
- Unicorn-378.exe (PID: 7708)
- Unicorn-15151.exe (PID: 8072)
- Unicorn-18089.exe (PID: 8336)
- Unicorn-58494.exe (PID: 7956)
- Unicorn-48681.exe (PID: 7772)
- Unicorn-34115.exe (PID: 7972)
- Unicorn-28583.exe (PID: 7752)
- Unicorn-55842.exe (PID: 7404)
- Unicorn-29543.exe (PID: 7872)
- Unicorn-23347.exe (PID: 8524)
- Unicorn-10710.exe (PID: 8552)
- Unicorn-12874.exe (PID: 7676)
- Unicorn-10636.exe (PID: 7552)
- Unicorn-14119.exe (PID: 7716)
- Unicorn-16113.exe (PID: 7964)
- Unicorn-57970.exe (PID: 8220)
- Unicorn-56817.exe (PID: 8956)
- Unicorn-38997.exe (PID: 8948)
- Unicorn-52733.exe (PID: 8964)
- Unicorn-32480.exe (PID: 7948)
- Unicorn-11649.exe (PID: 7544)
- Unicorn-56625.exe (PID: 9020)
- Unicorn-41469.exe (PID: 8368)
- Unicorn-52859.exe (PID: 8608)
- Unicorn-37881.exe (PID: 7992)
- Unicorn-38764.exe (PID: 7536)
- Unicorn-35120.exe (PID: 7460)
- Unicorn-40969.exe (PID: 8644)
- Unicorn-19995.exe (PID: 8588)
- Unicorn-35245.exe (PID: 8744)
- Unicorn-16487.exe (PID: 8752)
- Unicorn-31619.exe (PID: 8244)
- Unicorn-49159.exe (PID: 8800)
- Unicorn-54011.exe (PID: 8872)
- Unicorn-56713.exe (PID: 8296)
- Unicorn-77.exe (PID: 5404)
- Unicorn-9034.exe (PID: 3124)
- Unicorn-51167.exe (PID: 8480)
- Unicorn-46.exe (PID: 8232)
- Unicorn-13429.exe (PID: 7572)
- Unicorn-39033.exe (PID: 1748)
- Unicorn-53907.exe (PID: 6080)
- Unicorn-55945.exe (PID: 8008)
- Unicorn-58598.exe (PID: 8940)
- Unicorn-7934.exe (PID: 8816)
- Unicorn-6974.exe (PID: 6044)
- Unicorn-6974.exe (PID: 4424)
- Unicorn-13881.exe (PID: 10248)
- Unicorn-57171.exe (PID: 7820)
- Unicorn-25297.exe (PID: 8004)
- Unicorn-52838.exe (PID: 8692)
- Unicorn-2262.exe (PID: 9100)
- Unicorn-52018.exe (PID: 9092)
- Unicorn-12053.exe (PID: 10064)
- Unicorn-42489.exe (PID: 5936)
- Unicorn-16446.exe (PID: 8724)
- Unicorn-23503.exe (PID: 8684)
- Unicorn-52807.exe (PID: 3020)
- Unicorn-54656.exe (PID: 10552)
- Unicorn-4111.exe (PID: 10624)
- Unicorn-2454.exe (PID: 9060)
- Unicorn-28723.exe (PID: 7932)
- Unicorn-16631.exe (PID: 8928)
- Unicorn-3395.exe (PID: 11536)
- Unicorn-11371.exe (PID: 11592)
- Unicorn-56818.exe (PID: 4268)
- Unicorn-54151.exe (PID: 3968)
- Unicorn-2805.exe (PID: 12720)
- Unicorn-8126.exe (PID: 8788)
- Unicorn-39140.exe (PID: 11832)
- Unicorn-31339.exe (PID: 9432)
- Unicorn-5386.exe (PID: 9012)
- Unicorn-61603.exe (PID: 8772)
- Unicorn-36383.exe (PID: 9552)
- Unicorn-30591.exe (PID: 7380)
- Unicorn-65218.exe (PID: 12816)
- Unicorn-32089.exe (PID: 12776)
- Unicorn-24362.exe (PID: 10896)
- Unicorn-35947.exe (PID: 8660)
- Unicorn-50237.exe (PID: 9028)
- Unicorn-18681.exe (PID: 864)
- Unicorn-64291.exe (PID: 9232)
- Unicorn-19628.exe (PID: 11248)
- Unicorn-32944.exe (PID: 10848)
- Unicorn-31811.exe (PID: 9180)
- Unicorn-32992.exe (PID: 9324)
- Unicorn-38753.exe (PID: 3768)
- Unicorn-27985.exe (PID: 8512)
- Unicorn-40152.exe (PID: 10412)
- Unicorn-4478.exe (PID: 9588)
- Unicorn-23903.exe (PID: 11092)
- Unicorn-36501.exe (PID: 8708)
- Unicorn-21753.exe (PID: 4572)
- Unicorn-19340.exe (PID: 13804)
- Unicorn-60081.exe (PID: 5232)
- Unicorn-25063.exe (PID: 13820)
- Unicorn-7059.exe (PID: 13832)
- Unicorn-53605.exe (PID: 9284)
- Unicorn-54011.exe (PID: 8864)
- Unicorn-41968.exe (PID: 11260)
- Unicorn-10656.exe (PID: 11728)
- Unicorn-34063.exe (PID: 8260)
- Unicorn-48641.exe (PID: 9652)
- Unicorn-41665.exe (PID: 8488)
- Unicorn-38114.exe (PID: 11524)
- Unicorn-22387.exe (PID: 8472)
- Unicorn-34968.exe (PID: 11940)
- Unicorn-42629.exe (PID: 9472)
- Unicorn-46450.exe (PID: 10080)
- Unicorn-21103.exe (PID: 11100)
- Unicorn-40920.exe (PID: 10612)
- Unicorn-28333.exe (PID: 8716)
- Unicorn-54705.exe (PID: 8668)
- Unicorn-51354.exe (PID: 9200)
- Unicorn-11058.exe (PID: 4180)
- Unicorn-10656.exe (PID: 11768)
- Unicorn-36140.exe (PID: 12260)
- Unicorn-778.exe (PID: 10024)
- Unicorn-62718.exe (PID: 12460)
- Unicorn-24391.exe (PID: 11792)
- Unicorn-50430.exe (PID: 3332)
- Unicorn-51905.exe (PID: 8652)
- Unicorn-10046.exe (PID: 8904)
- Unicorn-51441.exe (PID: 9660)
- Unicorn-38163.exe (PID: 9240)
- Unicorn-22019.exe (PID: 5988)
- Unicorn-42914.exe (PID: 10684)
- Unicorn-37927.exe (PID: 11848)
- Unicorn-22963.exe (PID: 8544)
Starts itself from another location
- Unicorn-414.exe (PID: 5328)
- Unicorn-65354.exe (PID: 4188)
- 1 (1303).exe (PID: 5376)
- Unicorn-29365.exe (PID: 4628)
- Unicorn-64534.exe (PID: 2268)
- Unicorn-61841.exe (PID: 1568)
- Unicorn-14778.exe (PID: 6824)
- Unicorn-37119.exe (PID: 5756)
- Unicorn-46595.exe (PID: 2552)
- Unicorn-10568.exe (PID: 6576)
- Unicorn-31206.exe (PID: 5212)
- Unicorn-17815.exe (PID: 6644)
- Unicorn-2225.exe (PID: 1164)
- Unicorn-13465.exe (PID: 744)
- Unicorn-14285.exe (PID: 5640)
- Unicorn-16938.exe (PID: 2108)
- Unicorn-59999.exe (PID: 6572)
- Unicorn-61151.exe (PID: 5304)
- Unicorn-32733.exe (PID: 5428)
- Unicorn-33117.exe (PID: 4284)
- Unicorn-28972.exe (PID: 968)
- Unicorn-24011.exe (PID: 680)
- Unicorn-62111.exe (PID: 7196)
- Unicorn-26816.exe (PID: 7240)
- Unicorn-49070.exe (PID: 7172)
- Unicorn-55597.exe (PID: 7268)
- Unicorn-49283.exe (PID: 7232)
- Unicorn-32947.exe (PID: 7276)
- Unicorn-58390.exe (PID: 7220)
- Unicorn-20695.exe (PID: 7248)
- Unicorn-52797.exe (PID: 7260)
- Unicorn-16183.exe (PID: 7440)
- Unicorn-9163.exe (PID: 7036)
- Unicorn-28753.exe (PID: 7500)
- Unicorn-57617.exe (PID: 7488)
- Unicorn-64571.exe (PID: 7664)
- Unicorn-13673.exe (PID: 8164)
- Unicorn-50627.exe (PID: 7416)
- Unicorn-20149.exe (PID: 7792)
- Unicorn-19787.exe (PID: 7640)
- Unicorn-35718.exe (PID: 7604)
- Unicorn-18770.exe (PID: 7580)
- Unicorn-31551.exe (PID: 7432)
- Unicorn-18339.exe (PID: 7388)
- Unicorn-63626.exe (PID: 7424)
- Unicorn-54986.exe (PID: 7468)
- Unicorn-50565.exe (PID: 7592)
- Unicorn-46050.exe (PID: 7700)
- Unicorn-28692.exe (PID: 7652)
- Unicorn-9184.exe (PID: 8092)
- Unicorn-42781.exe (PID: 7808)
- Unicorn-53995.exe (PID: 7996)
- Unicorn-22919.exe (PID: 8100)
- Unicorn-35822.exe (PID: 7564)
- Unicorn-18669.exe (PID: 7624)
- Unicorn-28613.exe (PID: 2084)
- Unicorn-30591.exe (PID: 7380)
- Unicorn-26693.exe (PID: 7864)
- Unicorn-378.exe (PID: 7708)
- Unicorn-18089.exe (PID: 8336)
- Unicorn-28583.exe (PID: 7752)
- Unicorn-58494.exe (PID: 7956)
- Unicorn-48681.exe (PID: 7772)
- Unicorn-42489.exe (PID: 5936)
- Unicorn-29543.exe (PID: 7872)
- Unicorn-55842.exe (PID: 7404)
- Unicorn-10636.exe (PID: 7552)
- Unicorn-56713.exe (PID: 8296)
- Unicorn-23347.exe (PID: 8524)
- Unicorn-15151.exe (PID: 8072)
- Unicorn-32480.exe (PID: 7948)
- Unicorn-14119.exe (PID: 7716)
- Unicorn-57970.exe (PID: 8220)
- Unicorn-16113.exe (PID: 7964)
- Unicorn-10710.exe (PID: 8552)
- Unicorn-56817.exe (PID: 8956)
- Unicorn-38997.exe (PID: 8948)
- Unicorn-52733.exe (PID: 8964)
- Unicorn-56625.exe (PID: 9020)
- Unicorn-41469.exe (PID: 8368)
- Unicorn-35120.exe (PID: 7460)
- Unicorn-52859.exe (PID: 8608)
- Unicorn-37881.exe (PID: 7992)
- Unicorn-38764.exe (PID: 7536)
- Unicorn-11649.exe (PID: 7544)
- Unicorn-40969.exe (PID: 8644)
- Unicorn-4040.exe (PID: 7396)
- Unicorn-19995.exe (PID: 8588)
- Unicorn-35245.exe (PID: 8744)
- Unicorn-16487.exe (PID: 8752)
- Unicorn-41665.exe (PID: 8488)
- Unicorn-31619.exe (PID: 8244)
- Unicorn-54011.exe (PID: 8872)
- Unicorn-9034.exe (PID: 3124)
- Unicorn-46.exe (PID: 8232)
- Unicorn-49159.exe (PID: 8800)
- Unicorn-13429.exe (PID: 7572)
- Unicorn-58598.exe (PID: 8940)
- Unicorn-53907.exe (PID: 6080)
- Unicorn-39033.exe (PID: 1748)
- Unicorn-7934.exe (PID: 8816)
- Unicorn-6974.exe (PID: 4424)
- Unicorn-6974.exe (PID: 6044)
- Unicorn-13881.exe (PID: 10248)
- Unicorn-57171.exe (PID: 7820)
- Unicorn-55945.exe (PID: 8008)
- Unicorn-34115.exe (PID: 7972)
- Unicorn-12874.exe (PID: 7676)
- Unicorn-52838.exe (PID: 8692)
- Unicorn-52018.exe (PID: 9092)
- Unicorn-2262.exe (PID: 9100)
- Unicorn-12053.exe (PID: 10064)
- Unicorn-51167.exe (PID: 8480)
- Unicorn-25297.exe (PID: 8004)
- Unicorn-54656.exe (PID: 10552)
- Unicorn-4111.exe (PID: 10624)
- Unicorn-2454.exe (PID: 9060)
- Unicorn-16446.exe (PID: 8724)
- Unicorn-23503.exe (PID: 8684)
- Unicorn-52807.exe (PID: 3020)
- Unicorn-38114.exe (PID: 11524)
- Unicorn-11371.exe (PID: 11592)
- Unicorn-3395.exe (PID: 11536)
- Unicorn-77.exe (PID: 5404)
- Unicorn-28723.exe (PID: 7932)
- Unicorn-56818.exe (PID: 4268)
- Unicorn-54151.exe (PID: 3968)
- Unicorn-16631.exe (PID: 8928)
- Unicorn-5386.exe (PID: 9012)
- Unicorn-2805.exe (PID: 12720)
- Unicorn-39140.exe (PID: 11832)
- Unicorn-53605.exe (PID: 9284)
- Unicorn-36383.exe (PID: 9552)
- Unicorn-32089.exe (PID: 12776)
- Unicorn-50237.exe (PID: 9028)
- Unicorn-8126.exe (PID: 8788)
- Unicorn-31339.exe (PID: 9432)
- Unicorn-61603.exe (PID: 8772)
- Unicorn-65218.exe (PID: 12816)
- Unicorn-35947.exe (PID: 8660)
- Unicorn-18681.exe (PID: 864)
- Unicorn-64291.exe (PID: 9232)
- Unicorn-32944.exe (PID: 10848)
- Unicorn-19628.exe (PID: 11248)
- Unicorn-31811.exe (PID: 9180)
- Unicorn-32992.exe (PID: 9324)
- Unicorn-38753.exe (PID: 3768)
- Unicorn-27985.exe (PID: 8512)
- Unicorn-24362.exe (PID: 10896)
- Unicorn-34063.exe (PID: 8260)
Executes application which crashes
- Unicorn-63626.exe (PID: 7424)
INFO
Checks supported languages
- Unicorn-65354.exe (PID: 4188)
- 1 (1303).exe (PID: 5376)
- Unicorn-29365.exe (PID: 4628)
- Unicorn-414.exe (PID: 5328)
- Unicorn-14778.exe (PID: 6824)
- Unicorn-64534.exe (PID: 2268)
- Unicorn-61841.exe (PID: 1568)
- Unicorn-10568.exe (PID: 6576)
- Unicorn-37119.exe (PID: 5756)
- Unicorn-46595.exe (PID: 2552)
- Unicorn-31206.exe (PID: 5212)
- Unicorn-16938.exe (PID: 2108)
- Unicorn-2225.exe (PID: 1164)
- Unicorn-17815.exe (PID: 6644)
- Unicorn-13465.exe (PID: 744)
- Unicorn-33117.exe (PID: 4284)
- Unicorn-61151.exe (PID: 5304)
- Unicorn-28972.exe (PID: 968)
- Unicorn-24011.exe (PID: 680)
- Unicorn-26816.exe (PID: 7240)
- Unicorn-32947.exe (PID: 7276)
- Unicorn-50627.exe (PID: 7416)
- Unicorn-18339.exe (PID: 7388)
- Unicorn-31551.exe (PID: 7432)
- Unicorn-55842.exe (PID: 7404)
- Unicorn-46050.exe (PID: 7700)
- Unicorn-58494.exe (PID: 7956)
- Unicorn-38764.exe (PID: 7536)
- Unicorn-22919.exe (PID: 8100)
- Unicorn-57171.exe (PID: 7820)
- Unicorn-26693.exe (PID: 7864)
- Unicorn-25297.exe (PID: 8004)
- Unicorn-34063.exe (PID: 8260)
- Unicorn-12874.exe (PID: 7676)
- Unicorn-51167.exe (PID: 8480)
- Unicorn-57970.exe (PID: 8220)
- Unicorn-40969.exe (PID: 8644)
- Unicorn-15719.exe (PID: 8624)
- Unicorn-52838.exe (PID: 8692)
- Unicorn-16446.exe (PID: 8724)
- Unicorn-56625.exe (PID: 9020)
- Unicorn-5386.exe (PID: 9012)
- Unicorn-49159.exe (PID: 8800)
- Unicorn-54011.exe (PID: 8864)
- Unicorn-52807.exe (PID: 3020)
- Unicorn-60081.exe (PID: 5232)
- Unicorn-54151.exe (PID: 3968)
- Unicorn-22019.exe (PID: 5988)
- Unicorn-32992.exe (PID: 9324)
- Unicorn-61847.exe (PID: 9604)
- Unicorn-17918.exe (PID: 10072)
- Unicorn-52885.exe (PID: 10188)
- Unicorn-52262.exe (PID: 10320)
- Unicorn-12053.exe (PID: 10064)
- Unicorn-40152.exe (PID: 10420)
- Unicorn-65181.exe (PID: 10380)
- Unicorn-24798.exe (PID: 11080)
- Unicorn-8689.exe (PID: 10448)
- Unicorn-40920.exe (PID: 10580)
- Unicorn-54656.exe (PID: 10552)
- Unicorn-4605.exe (PID: 10808)
- Unicorn-3395.exe (PID: 11536)
- Unicorn-41968.exe (PID: 11260)
- Unicorn-50174.exe (PID: 11636)
- Unicorn-26661.exe (PID: 12556)
- Unicorn-59229.exe (PID: 12492)
- Unicorn-36208.exe (PID: 12420)
- Unicorn-11720.exe (PID: 12692)
The sample compiled with chinese language support
- 1 (1303).exe (PID: 5376)
- Unicorn-19340.exe (PID: 13804)
- Unicorn-35718.exe (PID: 7604)
- Unicorn-64534.exe (PID: 2268)
- Unicorn-18669.exe (PID: 7624)
- Unicorn-2454.exe (PID: 9060)
- Unicorn-64571.exe (PID: 7664)
- Unicorn-34115.exe (PID: 7972)
- Unicorn-51167.exe (PID: 8480)
- Unicorn-49283.exe (PID: 7232)
- Unicorn-9034.exe (PID: 3124)
- Unicorn-11649.exe (PID: 7544)
- Unicorn-28753.exe (PID: 7500)
- Unicorn-55945.exe (PID: 8008)
- Unicorn-22387.exe (PID: 8472)
- Unicorn-42781.exe (PID: 7808)
- Unicorn-52838.exe (PID: 8692)
- Unicorn-11371.exe (PID: 11592)
- Unicorn-20149.exe (PID: 7792)
- Unicorn-24391.exe (PID: 11792)
- Unicorn-25297.exe (PID: 8004)
- Unicorn-24011.exe (PID: 680)
- Unicorn-34063.exe (PID: 8260)
- Unicorn-46.exe (PID: 8232)
Reads the computer name
- 1 (1303).exe (PID: 5376)
- Unicorn-65354.exe (PID: 4188)
- Unicorn-29365.exe (PID: 4628)
- Unicorn-414.exe (PID: 5328)
- Unicorn-64534.exe (PID: 2268)
- Unicorn-14778.exe (PID: 6824)
- Unicorn-31206.exe (PID: 5212)
- Unicorn-17815.exe (PID: 6644)
- Unicorn-16938.exe (PID: 2108)
- Unicorn-2225.exe (PID: 1164)
- Unicorn-14285.exe (PID: 5640)
- Unicorn-46595.exe (PID: 2552)
- Unicorn-10568.exe (PID: 6576)
- Unicorn-24011.exe (PID: 680)
- Unicorn-62111.exe (PID: 7196)
- Unicorn-26816.exe (PID: 7240)
- Unicorn-32947.exe (PID: 7276)
- Unicorn-20695.exe (PID: 7248)
- Unicorn-49283.exe (PID: 7232)
- Unicorn-57617.exe (PID: 7488)
- Unicorn-58494.exe (PID: 7956)
- Unicorn-48681.exe (PID: 7772)
- Unicorn-29543.exe (PID: 7872)
- Unicorn-37881.exe (PID: 7992)
- Unicorn-13429.exe (PID: 7572)
- Unicorn-7934.exe (PID: 8816)
- Unicorn-3395.exe (PID: 11536)
- Unicorn-65218.exe (PID: 12816)
Create files in a temporary directory
- 1 (1303).exe (PID: 5376)
- Unicorn-414.exe (PID: 5328)
- Unicorn-65354.exe (PID: 4188)
- Unicorn-61841.exe (PID: 1568)
- Unicorn-14778.exe (PID: 6824)
- Unicorn-29365.exe (PID: 4628)
- Unicorn-37119.exe (PID: 5756)
- Unicorn-17815.exe (PID: 6644)
- Unicorn-31206.exe (PID: 5212)
- Unicorn-2225.exe (PID: 1164)
- Unicorn-64534.exe (PID: 2268)
- Unicorn-61151.exe (PID: 5304)
- Unicorn-46595.exe (PID: 2552)
- Unicorn-24011.exe (PID: 680)
- Unicorn-26816.exe (PID: 7240)
- Unicorn-55597.exe (PID: 7268)
- Unicorn-9163.exe (PID: 7036)
- Unicorn-52797.exe (PID: 7260)
- Unicorn-13465.exe (PID: 744)
- Unicorn-14285.exe (PID: 5640)
- Unicorn-58390.exe (PID: 7220)
- Unicorn-57617.exe (PID: 7488)
- Unicorn-28972.exe (PID: 968)
- Unicorn-28753.exe (PID: 7500)
- Unicorn-13673.exe (PID: 8164)
- Unicorn-50627.exe (PID: 7416)
- Unicorn-33117.exe (PID: 4284)
- Unicorn-19787.exe (PID: 7640)
- Unicorn-18770.exe (PID: 7580)
- Unicorn-31551.exe (PID: 7432)
- Unicorn-16938.exe (PID: 2108)
- Unicorn-18339.exe (PID: 7388)
- Unicorn-54986.exe (PID: 7468)
- Unicorn-28692.exe (PID: 7652)
- Unicorn-10568.exe (PID: 6576)
- Unicorn-42781.exe (PID: 7808)
- Unicorn-53995.exe (PID: 7996)
- Unicorn-64571.exe (PID: 7664)
- Unicorn-32947.exe (PID: 7276)
- Unicorn-49070.exe (PID: 7172)
- Unicorn-15151.exe (PID: 8072)
- Unicorn-26693.exe (PID: 7864)
- Unicorn-378.exe (PID: 7708)
- Unicorn-18669.exe (PID: 7624)
- Unicorn-28613.exe (PID: 2084)
- Unicorn-12874.exe (PID: 7676)
- Unicorn-20695.exe (PID: 7248)
- Unicorn-34115.exe (PID: 7972)
- Unicorn-28583.exe (PID: 7752)
- Unicorn-29543.exe (PID: 7872)
- Unicorn-10710.exe (PID: 8552)
- Unicorn-16113.exe (PID: 7964)
- Unicorn-38997.exe (PID: 8948)
- Unicorn-52859.exe (PID: 8608)
- Unicorn-58494.exe (PID: 7956)
- Unicorn-39033.exe (PID: 1748)
- Unicorn-55945.exe (PID: 8008)
- Unicorn-55842.exe (PID: 7404)
- Unicorn-52838.exe (PID: 8692)
- Unicorn-25297.exe (PID: 8004)
- Unicorn-4040.exe (PID: 7396)
- Unicorn-32733.exe (PID: 5428)
- Unicorn-2454.exe (PID: 9060)
- Unicorn-37881.exe (PID: 7992)
- Unicorn-6974.exe (PID: 4424)
- Unicorn-9184.exe (PID: 8092)
- Unicorn-35718.exe (PID: 7604)
- Unicorn-28723.exe (PID: 7932)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 7988)
- BackgroundTransferHost.exe (PID: 3024)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 7988)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 7988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
580
Monitored processes
442
Malicious processes
66
Suspicious processes
50
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 616 | C:\Users\admin\AppData\Local\Temp\Unicorn-52737.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-52737.exe | — | Unicorn-52733.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 632 | C:\Users\admin\AppData\Local\Temp\Unicorn-56924.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56924.exe | — | Unicorn-56817.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 668 | C:\Users\admin\AppData\Local\Temp\Unicorn-63054.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63054.exe | — | Unicorn-5386.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 672 | C:\Users\admin\AppData\Local\Temp\Unicorn-18182.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-18182.exe | — | Unicorn-38753.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 | |||||||||||||||
| 680 | C:\Users\admin\AppData\Local\Temp\Unicorn-24011.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24011.exe | Unicorn-10568.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 744 | C:\Users\admin\AppData\Local\Temp\Unicorn-13465.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13465.exe | 1 (1303).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 864 | C:\Users\admin\AppData\Local\Temp\Unicorn-18681.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-18681.exe | Unicorn-50565.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 924 | C:\Users\admin\AppData\Local\Temp\Unicorn-6870.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-6870.exe | — | Unicorn-4040.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 968 | C:\Users\admin\AppData\Local\Temp\Unicorn-28972.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-28972.exe | Unicorn-16938.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1056 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
10 893
Read events
10 878
Write events
15
Delete events
0
Modification events
| (PID) Process: | (7528) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7528) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7528) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7988) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7988) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7988) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (4944) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4944) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4944) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (3024) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
587
Suspicious files
8
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5376 | 1 (1303).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-13465.exe | executable | |
MD5:342C947436C5EEF3E321A7BCB8F6E4C9 | SHA256:341F8EE57B146536C3B8FEA5A5541CC4C2E316F76DD13C601DE28CAEC820CB5B | |||
| 5756 | Unicorn-37119.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-59999.exe | executable | |
MD5:BD5F34C3627E4CF6728F4339912B1399 | SHA256:E7147A89A1A8BF4016633F76F1A48A4AB5ABE28AE9806B158A809DF4243F95AB | |||
| 2268 | Unicorn-64534.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-33117.exe | executable | |
MD5:BA5B5CF58E65E6034C8802C01AD85D54 | SHA256:49586036BC4F9877F7036532B75ECF2E5F44480A5901DAF49906882B8C6D4B97 | |||
| 6576 | Unicorn-10568.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-24011.exe | executable | |
MD5:27F4AB3857F32B1BAA53E68DF7FA0F6D | SHA256:7602906264A710FD0DEF222115902809F7FC7880F6EE092BB945CED58B50975A | |||
| 5376 | 1 (1303).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-31206.exe | executable | |
MD5:347BD135DAE1788E6C2692FC092E6680 | SHA256:7B3E547C0C478C0D684403881D52DDB6DD1444BEC71AB5AAC58E611829536444 | |||
| 5376 | 1 (1303).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-65354.exe | executable | |
MD5:CD308C8940851A81E3A5433CB2EE0639 | SHA256:3938E2336A72D215DC41DA6CA1FE1B789994F23CE9E2BB350CF121D70871991B | |||
| 5376 | 1 (1303).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-29365.exe | executable | |
MD5:8559908F5A44762BD616223CAD6A2DE2 | SHA256:BDEB81F904A22094D253C551C3DA249734B5E46F320EF54DA958589792C3869A | |||
| 4188 | Unicorn-65354.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-414.exe | executable | |
MD5:8570E6FC6B6DFFB5A23DA1197D704AC6 | SHA256:A4E53E81F079D3AAC05FC0D3410558FD22243B73F78DF1273F1F4DC0C868A599 | |||
| 4188 | Unicorn-65354.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-64534.exe | executable | |
MD5:B6A7B7BD0C81AEB5818A8D7235055282 | SHA256:6B3613ADCE4CDC775718AA8BA93BF675E20158C2752B61A010DDEC3F3FF30A62 | |||
| 5328 | Unicorn-414.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-61841.exe | executable | |
MD5:625278DDDEA8BEBF00C233C7501364CB | SHA256:A8DE8A8BB6975E3DE4F8773BB0834C4893B3C0145F553C5DE003AF936FF84162 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
18
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.16.168.114:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7552 | SIHClient.exe | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7988 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
1052 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
7552 | SIHClient.exe | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4756 | svchost.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.16.168.114:80 | crl.microsoft.com | Akamai International B.V. | RU | whitelisted |
5352 | RUXIMICS.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2112 | svchost.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3216 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 40.126.31.129:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |