| File name: | 1 (1142) |
| Full analysis: | https://app.any.run/tasks/e1d21388-3e11-4656-9d4a-a54e5e979fcf |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 08:37:54 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | 8029651E803DF12A85A93141813AF2D0 |
| SHA1: | CA598F86093064BF08BFF153DF15DC169F9C7D0C |
| SHA256: | 31A72923E9FCE984772D38AA29DDFA11E0E69316761A676C9A62812C517F4239 |
| SSDEEP: | 6144:2NEybXIJCDLLA5BSWZSEiDSx5trqlp8GBV/2yeXdSk/8SwjwpyAvEhUXS3fns6TS:2ycYSLA5YWAyrM+aVuyeXdQx4nxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts itself from another location
- 1 (1142).exe (PID: 6036)
- Unicorn-27170.exe (PID: 6244)
- Unicorn-60165.exe (PID: 1324)
- Unicorn-36460.exe (PID: 6620)
- Unicorn-28173.exe (PID: 7560)
- Unicorn-139.exe (PID: 7580)
- Unicorn-61717.exe (PID: 7684)
- Unicorn-15043.exe (PID: 7612)
- Unicorn-8913.exe (PID: 7604)
- Unicorn-48676.exe (PID: 7704)
- Unicorn-44037.exe (PID: 7720)
- Unicorn-57450.exe (PID: 7728)
- Unicorn-14571.exe (PID: 7764)
- Unicorn-6138.exe (PID: 7788)
- Unicorn-52075.exe (PID: 7796)
- Unicorn-64981.exe (PID: 7848)
- Unicorn-56491.exe (PID: 7868)
- Unicorn-35708.exe (PID: 7884)
- Unicorn-62442.exe (PID: 7900)
- Unicorn-54997.exe (PID: 7916)
- Unicorn-46507.exe (PID: 7948)
- Unicorn-38661.exe (PID: 7932)
- Unicorn-14571.exe (PID: 7756)
- Unicorn-63549.exe (PID: 7984)
- Unicorn-63092.exe (PID: 7956)
- Unicorn-5858.exe (PID: 8012)
- Unicorn-55059.exe (PID: 8028)
- Unicorn-25724.exe (PID: 8036)
- Unicorn-25724.exe (PID: 8056)
- Unicorn-3257.exe (PID: 8020)
- Unicorn-316.exe (PID: 8152)
- Unicorn-508.exe (PID: 8188)
- Unicorn-51747.exe (PID: 3192)
- Unicorn-57363.exe (PID: 8172)
- Unicorn-42946.exe (PID: 5608)
- Unicorn-13611.exe (PID: 7316)
- Unicorn-54379.exe (PID: 7192)
- Unicorn-43269.exe (PID: 7284)
- Unicorn-51691.exe (PID: 7292)
- Unicorn-60181.exe (PID: 6112)
- Unicorn-62044.exe (PID: 5512)
- Unicorn-62044.exe (PID: 3304)
- Unicorn-22827.exe (PID: 6388)
- Unicorn-47332.exe (PID: 7208)
- Unicorn-45138.exe (PID: 7428)
- Unicorn-47938.exe (PID: 7468)
- Unicorn-34202.exe (PID: 7464)
- Unicorn-1660.exe (PID: 7212)
- Unicorn-59029.exe (PID: 4380)
- Unicorn-36.exe (PID: 7476)
- Unicorn-36.exe (PID: 904)
- Unicorn-54482.exe (PID: 7264)
- Unicorn-57332.exe (PID: 7348)
- Unicorn-37731.exe (PID: 7288)
- Unicorn-32901.exe (PID: 7504)
- Unicorn-35146.exe (PID: 7176)
- Unicorn-40746.exe (PID: 7516)
- Unicorn-32901.exe (PID: 496)
- Unicorn-457.exe (PID: 8048)
- Unicorn-54482.exe (PID: 7280)
- Unicorn-33861.exe (PID: 7148)
- Unicorn-29842.exe (PID: 2908)
- Unicorn-10570.exe (PID: 4112)
- Unicorn-22652.exe (PID: 4208)
- Unicorn-59325.exe (PID: 5384)
- Unicorn-31291.exe (PID: 1128)
- Unicorn-46196.exe (PID: 2772)
- Unicorn-32901.exe (PID: 7508)
- Unicorn-29787.exe (PID: 5984)
- Unicorn-33979.exe (PID: 736)
- Unicorn-37125.exe (PID: 5756)
- Unicorn-55691.exe (PID: 4188)
- Unicorn-48308.exe (PID: 5400)
- Unicorn-4452.exe (PID: 6752)
- Unicorn-65028.exe (PID: 2984)
- Unicorn-56482.exe (PID: 5212)
- Unicorn-52919.exe (PID: 2088)
- Unicorn-7672.exe (PID: 4740)
- Unicorn-22860.exe (PID: 7656)
- Unicorn-36967.exe (PID: 7352)
- Unicorn-27922.exe (PID: 1056)
- Unicorn-56982.exe (PID: 1020)
- Unicorn-11502.exe (PID: 8212)
- Unicorn-11886.exe (PID: 8268)
- Unicorn-12737.exe (PID: 8324)
- Unicorn-37349.exe (PID: 8300)
- Unicorn-7868.exe (PID: 8388)
- Unicorn-56297.exe (PID: 8228)
- Unicorn-12737.exe (PID: 8332)
- Unicorn-33821.exe (PID: 8444)
- Unicorn-30151.exe (PID: 8428)
- Unicorn-37242.exe (PID: 8308)
- Unicorn-47640.exe (PID: 8340)
Executable content was dropped or overwritten
- 1 (1142).exe (PID: 6036)
- Unicorn-27170.exe (PID: 6244)
- Unicorn-60165.exe (PID: 1324)
- Unicorn-36460.exe (PID: 6620)
- Unicorn-139.exe (PID: 7580)
- Unicorn-15043.exe (PID: 7612)
- Unicorn-28173.exe (PID: 7560)
- Unicorn-61717.exe (PID: 7684)
- Unicorn-48676.exe (PID: 7704)
- Unicorn-44037.exe (PID: 7720)
- Unicorn-57450.exe (PID: 7728)
- Unicorn-14571.exe (PID: 7764)
- Unicorn-8913.exe (PID: 7604)
- Unicorn-14571.exe (PID: 7756)
- Unicorn-64981.exe (PID: 7848)
- Unicorn-56491.exe (PID: 7868)
- Unicorn-35708.exe (PID: 7884)
- Unicorn-62442.exe (PID: 7900)
- Unicorn-54997.exe (PID: 7916)
- Unicorn-38661.exe (PID: 7932)
- Unicorn-63092.exe (PID: 7956)
- Unicorn-63549.exe (PID: 7984)
- Unicorn-55059.exe (PID: 8028)
- Unicorn-25724.exe (PID: 8036)
- Unicorn-6138.exe (PID: 7788)
- Unicorn-52075.exe (PID: 7796)
- Unicorn-57363.exe (PID: 8172)
- Unicorn-316.exe (PID: 8152)
- Unicorn-508.exe (PID: 8188)
- Unicorn-51747.exe (PID: 3192)
- Unicorn-42946.exe (PID: 5608)
- Unicorn-13611.exe (PID: 7316)
- Unicorn-43269.exe (PID: 7284)
- Unicorn-54379.exe (PID: 7192)
- Unicorn-51691.exe (PID: 7292)
- Unicorn-62044.exe (PID: 3304)
- Unicorn-60181.exe (PID: 6112)
- Unicorn-46507.exe (PID: 7948)
- Unicorn-62044.exe (PID: 5512)
- Unicorn-22827.exe (PID: 6388)
- Unicorn-47332.exe (PID: 7208)
- Unicorn-47938.exe (PID: 7468)
- Unicorn-45138.exe (PID: 7428)
- Unicorn-1660.exe (PID: 7212)
- Unicorn-59029.exe (PID: 4380)
- Unicorn-36.exe (PID: 7476)
- Unicorn-57332.exe (PID: 7348)
- Unicorn-32901.exe (PID: 7504)
- Unicorn-35146.exe (PID: 7176)
- Unicorn-36.exe (PID: 904)
- Unicorn-36.exe (PID: 7484)
- Unicorn-40746.exe (PID: 7516)
- Unicorn-32901.exe (PID: 496)
- Unicorn-54482.exe (PID: 7280)
- Unicorn-5858.exe (PID: 8012)
- Unicorn-33861.exe (PID: 7148)
- Unicorn-10570.exe (PID: 4112)
- Unicorn-29842.exe (PID: 2908)
- Unicorn-31291.exe (PID: 1128)
- Unicorn-46196.exe (PID: 2772)
- Unicorn-22652.exe (PID: 4208)
- Unicorn-29787.exe (PID: 5984)
- Unicorn-48308.exe (PID: 5400)
- Unicorn-32901.exe (PID: 7508)
- Unicorn-37125.exe (PID: 5756)
- Unicorn-55691.exe (PID: 4188)
- Unicorn-45163.exe (PID: 2552)
- Unicorn-4452.exe (PID: 6752)
- Unicorn-65028.exe (PID: 2984)
- Unicorn-56482.exe (PID: 5212)
- Unicorn-7672.exe (PID: 4740)
- Unicorn-52919.exe (PID: 2088)
- Unicorn-22860.exe (PID: 7656)
- Unicorn-36967.exe (PID: 7352)
- Unicorn-27922.exe (PID: 1056)
- Unicorn-11502.exe (PID: 8212)
- Unicorn-56982.exe (PID: 1020)
- Unicorn-11886.exe (PID: 8268)
- Unicorn-12737.exe (PID: 8324)
- Unicorn-33821.exe (PID: 8444)
- Unicorn-56297.exe (PID: 8228)
- Unicorn-37349.exe (PID: 8300)
- Unicorn-12737.exe (PID: 8332)
- Unicorn-30151.exe (PID: 8428)
- Unicorn-47640.exe (PID: 8340)
- Unicorn-37242.exe (PID: 8308)
- Unicorn-34202.exe (PID: 7464)
- Unicorn-45602.exe (PID: 8348)
- Unicorn-13998.exe (PID: 8396)
Executes application which crashes
- Unicorn-34868.exe (PID: 9096)
INFO
Checks supported languages
- Unicorn-27170.exe (PID: 6244)
- Unicorn-36460.exe (PID: 6620)
- 1 (1142).exe (PID: 6036)
- Unicorn-60165.exe (PID: 1324)
- Unicorn-139.exe (PID: 7580)
- Unicorn-15043.exe (PID: 7612)
- Unicorn-8913.exe (PID: 7604)
- Unicorn-28173.exe (PID: 7560)
- Unicorn-61717.exe (PID: 7684)
- Unicorn-48676.exe (PID: 7704)
- Unicorn-44037.exe (PID: 7720)
- Unicorn-57450.exe (PID: 7728)
- Unicorn-14571.exe (PID: 7764)
- Unicorn-52075.exe (PID: 7796)
- Unicorn-64981.exe (PID: 7848)
- Unicorn-14571.exe (PID: 7756)
- Unicorn-6138.exe (PID: 7788)
- Unicorn-35708.exe (PID: 7884)
- Unicorn-62442.exe (PID: 7900)
- Unicorn-54997.exe (PID: 7916)
- Unicorn-56491.exe (PID: 7868)
- Unicorn-46507.exe (PID: 7948)
- Unicorn-63092.exe (PID: 7956)
- Unicorn-63549.exe (PID: 7984)
- Unicorn-38661.exe (PID: 7932)
- Unicorn-25724.exe (PID: 8056)
- Unicorn-55059.exe (PID: 8028)
- Unicorn-3257.exe (PID: 8020)
- Unicorn-5858.exe (PID: 8012)
- Unicorn-457.exe (PID: 8048)
- Unicorn-25724.exe (PID: 8036)
- Unicorn-316.exe (PID: 8152)
- Unicorn-57363.exe (PID: 8172)
- Unicorn-508.exe (PID: 8188)
- Unicorn-42946.exe (PID: 5608)
- Unicorn-51747.exe (PID: 3192)
- Unicorn-43269.exe (PID: 7284)
- Unicorn-54379.exe (PID: 7192)
- Unicorn-51691.exe (PID: 7292)
- Unicorn-62044.exe (PID: 3304)
- Unicorn-62044.exe (PID: 5512)
- Unicorn-13611.exe (PID: 7316)
- Unicorn-60181.exe (PID: 6112)
- Unicorn-47332.exe (PID: 7208)
- Unicorn-1660.exe (PID: 7212)
- Unicorn-59029.exe (PID: 4380)
- Unicorn-45138.exe (PID: 7428)
- Unicorn-22827.exe (PID: 6388)
- Unicorn-47938.exe (PID: 7468)
- Unicorn-36.exe (PID: 7476)
- Unicorn-36.exe (PID: 7484)
- Unicorn-34202.exe (PID: 7464)
- Unicorn-32901.exe (PID: 496)
- Unicorn-40746.exe (PID: 7516)
- Unicorn-54482.exe (PID: 7264)
- Unicorn-37731.exe (PID: 7288)
- Unicorn-54482.exe (PID: 7280)
- Unicorn-32901.exe (PID: 7504)
- Unicorn-35146.exe (PID: 7176)
- Unicorn-57332.exe (PID: 7348)
- Unicorn-36.exe (PID: 904)
- Unicorn-32901.exe (PID: 7508)
- Unicorn-33861.exe (PID: 7148)
- Unicorn-10570.exe (PID: 4112)
- Unicorn-29842.exe (PID: 2908)
- Unicorn-22652.exe (PID: 4208)
- Unicorn-59325.exe (PID: 5384)
- Unicorn-46196.exe (PID: 2772)
- Unicorn-29787.exe (PID: 5984)
- Unicorn-31291.exe (PID: 1128)
- Unicorn-48308.exe (PID: 5400)
- Unicorn-37125.exe (PID: 5756)
- Unicorn-4452.exe (PID: 6752)
- Unicorn-55691.exe (PID: 4188)
- Unicorn-45163.exe (PID: 2552)
- Unicorn-33979.exe (PID: 736)
- Unicorn-65028.exe (PID: 2984)
- Unicorn-52919.exe (PID: 2088)
- Unicorn-7672.exe (PID: 4740)
- Unicorn-36967.exe (PID: 7352)
- Unicorn-56482.exe (PID: 5212)
- Unicorn-56982.exe (PID: 1020)
- Unicorn-56297.exe (PID: 8228)
- Unicorn-11502.exe (PID: 8212)
- Unicorn-22860.exe (PID: 7656)
- Unicorn-27922.exe (PID: 1056)
- Unicorn-11886.exe (PID: 8268)
- Unicorn-45218.exe (PID: 8276)
- Unicorn-12737.exe (PID: 8324)
- Unicorn-12737.exe (PID: 8332)
- Unicorn-47640.exe (PID: 8340)
- Unicorn-37349.exe (PID: 8300)
- Unicorn-13998.exe (PID: 8396)
- Unicorn-36017.exe (PID: 8436)
- Unicorn-33821.exe (PID: 8444)
- Unicorn-30151.exe (PID: 8428)
- Unicorn-33821.exe (PID: 8448)
- Unicorn-13422.exe (PID: 8504)
- Unicorn-37242.exe (PID: 8308)
- Unicorn-45602.exe (PID: 8348)
- Unicorn-7868.exe (PID: 8388)
- Unicorn-38586.exe (PID: 8524)
- Unicorn-14081.exe (PID: 8584)
- Unicorn-38586.exe (PID: 8532)
- Unicorn-15150.exe (PID: 8572)
- Unicorn-11813.exe (PID: 8620)
- Unicorn-30418.exe (PID: 8560)
- Unicorn-56183.exe (PID: 8612)
- Unicorn-55991.exe (PID: 8540)
- Unicorn-38586.exe (PID: 8552)
- Unicorn-48491.exe (PID: 8720)
- Unicorn-56567.exe (PID: 8704)
- Unicorn-58985.exe (PID: 8756)
- Unicorn-19650.exe (PID: 8740)
- Unicorn-58985.exe (PID: 8780)
- Unicorn-58985.exe (PID: 8772)
- Unicorn-7174.exe (PID: 8680)
- Unicorn-54356.exe (PID: 8728)
- Unicorn-58985.exe (PID: 8748)
- Unicorn-13240.exe (PID: 8860)
- Unicorn-16002.exe (PID: 8936)
- Unicorn-4913.exe (PID: 8804)
- Unicorn-58985.exe (PID: 8796)
- Unicorn-7183.exe (PID: 8764)
- Unicorn-39930.exe (PID: 9076)
- Unicorn-14776.exe (PID: 9012)
- Unicorn-15919.exe (PID: 8992)
- Unicorn-56074.exe (PID: 9020)
- Unicorn-37360.exe (PID: 8964)
- Unicorn-22271.exe (PID: 9112)
- Unicorn-35653.exe (PID: 9188)
- Unicorn-22271.exe (PID: 9120)
- Unicorn-51798.exe (PID: 9136)
- Unicorn-34868.exe (PID: 9096)
- Unicorn-41221.exe (PID: 9196)
- Unicorn-21887.exe (PID: 9252)
- Unicorn-43053.exe (PID: 9264)
- Unicorn-22167.exe (PID: 9336)
- Unicorn-45166.exe (PID: 9372)
- Unicorn-45130.exe (PID: 4172)
- Unicorn-47735.exe (PID: 9448)
- Unicorn-23231.exe (PID: 9456)
- Unicorn-6977.exe (PID: 9404)
- Unicorn-7278.exe (PID: 9536)
- Unicorn-51881.exe (PID: 9544)
- Unicorn-30365.exe (PID: 9576)
- Unicorn-44293.exe (PID: 9644)
- Unicorn-32753.exe (PID: 9636)
- Unicorn-47735.exe (PID: 9440)
- Unicorn-46858.exe (PID: 9512)
- Unicorn-49463.exe (PID: 9764)
- Unicorn-25151.exe (PID: 9808)
- Unicorn-30640.exe (PID: 9860)
- Unicorn-25543.exe (PID: 9684)
- Unicorn-4709.exe (PID: 9708)
- Unicorn-33210.exe (PID: 9916)
- Unicorn-47662.exe (PID: 9968)
- Unicorn-49929.exe (PID: 9896)
- Unicorn-33122.exe (PID: 10052)
- Unicorn-10956.exe (PID: 10112)
- Unicorn-27751.exe (PID: 10160)
- Unicorn-2177.exe (PID: 10168)
- Unicorn-33625.exe (PID: 10216)
- Unicorn-46889.exe (PID: 10232)
- Unicorn-3521.exe (PID: 9804)
- Unicorn-42177.exe (PID: 9284)
- Unicorn-60039.exe (PID: 8248)
- Unicorn-15180.exe (PID: 9836)
- Unicorn-28218.exe (PID: 8236)
- Unicorn-60999.exe (PID: 9960)
- Unicorn-33157.exe (PID: 9048)
- Unicorn-44938.exe (PID: 9104)
- Unicorn-15560.exe (PID: 9964)
- Unicorn-28711.exe (PID: 9388)
- Unicorn-14621.exe (PID: 10256)
- Unicorn-58114.exe (PID: 10272)
- Unicorn-48809.exe (PID: 8928)
- Unicorn-17082.exe (PID: 5776)
- Unicorn-59375.exe (PID: 10328)
- Unicorn-59567.exe (PID: 10368)
- Unicorn-45269.exe (PID: 10384)
- Unicorn-8913.exe (PID: 4152)
- Unicorn-17274.exe (PID: 10292)
- Unicorn-2015.exe (PID: 10452)
- Unicorn-12976.exe (PID: 10516)
- Unicorn-33454.exe (PID: 10436)
- Unicorn-43191.exe (PID: 10420)
- Unicorn-32842.exe (PID: 10492)
Reads the computer name
- Unicorn-36460.exe (PID: 6620)
- 1 (1142).exe (PID: 6036)
- Unicorn-27170.exe (PID: 6244)
- Unicorn-60165.exe (PID: 1324)
- Unicorn-28173.exe (PID: 7560)
- Unicorn-61717.exe (PID: 7684)
- Unicorn-8913.exe (PID: 7604)
- Unicorn-139.exe (PID: 7580)
- Unicorn-15043.exe (PID: 7612)
- Unicorn-48676.exe (PID: 7704)
- Unicorn-57450.exe (PID: 7728)
- Unicorn-44037.exe (PID: 7720)
- Unicorn-14571.exe (PID: 7756)
- Unicorn-6138.exe (PID: 7788)
- Unicorn-52075.exe (PID: 7796)
- Unicorn-14571.exe (PID: 7764)
- Unicorn-64981.exe (PID: 7848)
- Unicorn-35708.exe (PID: 7884)
- Unicorn-56491.exe (PID: 7868)
- Unicorn-63092.exe (PID: 7956)
- Unicorn-46507.exe (PID: 7948)
- Unicorn-54997.exe (PID: 7916)
- Unicorn-38661.exe (PID: 7932)
- Unicorn-62442.exe (PID: 7900)
- Unicorn-63549.exe (PID: 7984)
- Unicorn-457.exe (PID: 8048)
- Unicorn-5858.exe (PID: 8012)
- Unicorn-25724.exe (PID: 8056)
- Unicorn-55059.exe (PID: 8028)
- Unicorn-3257.exe (PID: 8020)
- Unicorn-25724.exe (PID: 8036)
- Unicorn-316.exe (PID: 8152)
- Unicorn-508.exe (PID: 8188)
- Unicorn-51747.exe (PID: 3192)
- Unicorn-57363.exe (PID: 8172)
- Unicorn-13611.exe (PID: 7316)
- Unicorn-43269.exe (PID: 7284)
- Unicorn-54379.exe (PID: 7192)
- Unicorn-60181.exe (PID: 6112)
- Unicorn-51691.exe (PID: 7292)
- Unicorn-62044.exe (PID: 5512)
- Unicorn-45138.exe (PID: 7428)
- Unicorn-22827.exe (PID: 6388)
- Unicorn-47332.exe (PID: 7208)
- Unicorn-47938.exe (PID: 7468)
- Unicorn-34202.exe (PID: 7464)
- Unicorn-62044.exe (PID: 3304)
- Unicorn-36.exe (PID: 7476)
- Unicorn-1660.exe (PID: 7212)
- Unicorn-59029.exe (PID: 4380)
- Unicorn-37731.exe (PID: 7288)
- Unicorn-54482.exe (PID: 7264)
- Unicorn-36.exe (PID: 904)
- Unicorn-57332.exe (PID: 7348)
- Unicorn-32901.exe (PID: 7504)
- Unicorn-35146.exe (PID: 7176)
- Unicorn-32901.exe (PID: 496)
- Unicorn-32901.exe (PID: 7508)
- Unicorn-36.exe (PID: 7484)
- Unicorn-54482.exe (PID: 7280)
- Unicorn-40746.exe (PID: 7516)
- Unicorn-33861.exe (PID: 7148)
- Unicorn-29842.exe (PID: 2908)
- Unicorn-10570.exe (PID: 4112)
- Unicorn-22652.exe (PID: 4208)
- Unicorn-31291.exe (PID: 1128)
- Unicorn-59325.exe (PID: 5384)
- Unicorn-46196.exe (PID: 2772)
- Unicorn-29787.exe (PID: 5984)
- Unicorn-48308.exe (PID: 5400)
- Unicorn-45163.exe (PID: 2552)
- Unicorn-4452.exe (PID: 6752)
- Unicorn-33979.exe (PID: 736)
- Unicorn-55691.exe (PID: 4188)
- Unicorn-37125.exe (PID: 5756)
- Unicorn-65028.exe (PID: 2984)
- Unicorn-52919.exe (PID: 2088)
- Unicorn-56482.exe (PID: 5212)
- Unicorn-7672.exe (PID: 4740)
- Unicorn-22860.exe (PID: 7656)
- Unicorn-27922.exe (PID: 1056)
- Unicorn-56982.exe (PID: 1020)
- Unicorn-11502.exe (PID: 8212)
- Unicorn-12737.exe (PID: 8324)
- Unicorn-56297.exe (PID: 8228)
- Unicorn-11886.exe (PID: 8268)
- Unicorn-30151.exe (PID: 8428)
- Unicorn-33821.exe (PID: 8444)
- Unicorn-12737.exe (PID: 8332)
- Unicorn-37242.exe (PID: 8308)
- Unicorn-45602.exe (PID: 8348)
- Unicorn-36017.exe (PID: 8436)
- Unicorn-45218.exe (PID: 8276)
- Unicorn-37349.exe (PID: 8300)
- Unicorn-7868.exe (PID: 8388)
- Unicorn-47640.exe (PID: 8340)
- Unicorn-13998.exe (PID: 8396)
- Unicorn-13422.exe (PID: 8504)
- Unicorn-33821.exe (PID: 8448)
- Unicorn-30418.exe (PID: 8560)
- Unicorn-55991.exe (PID: 8540)
- Unicorn-56183.exe (PID: 8612)
- Unicorn-14081.exe (PID: 8584)
- Unicorn-7174.exe (PID: 8680)
- Unicorn-38586.exe (PID: 8524)
- Unicorn-11813.exe (PID: 8620)
- Unicorn-38586.exe (PID: 8532)
- Unicorn-38586.exe (PID: 8552)
- Unicorn-58985.exe (PID: 8756)
- Unicorn-15150.exe (PID: 8572)
- Unicorn-48491.exe (PID: 8720)
- Unicorn-4913.exe (PID: 8804)
- Unicorn-42946.exe (PID: 5608)
- Unicorn-36967.exe (PID: 7352)
The sample compiled with chinese language support
- 1 (1142).exe (PID: 6036)
- Unicorn-36460.exe (PID: 6620)
- Unicorn-27170.exe (PID: 6244)
- Unicorn-60165.exe (PID: 1324)
- Unicorn-28173.exe (PID: 7560)
- Unicorn-139.exe (PID: 7580)
- Unicorn-15043.exe (PID: 7612)
- Unicorn-61717.exe (PID: 7684)
- Unicorn-48676.exe (PID: 7704)
- Unicorn-44037.exe (PID: 7720)
- Unicorn-57450.exe (PID: 7728)
- Unicorn-14571.exe (PID: 7764)
- Unicorn-8913.exe (PID: 7604)
- Unicorn-14571.exe (PID: 7756)
- Unicorn-64981.exe (PID: 7848)
- Unicorn-56491.exe (PID: 7868)
- Unicorn-35708.exe (PID: 7884)
- Unicorn-62442.exe (PID: 7900)
- Unicorn-54997.exe (PID: 7916)
- Unicorn-38661.exe (PID: 7932)
- Unicorn-63092.exe (PID: 7956)
- Unicorn-63549.exe (PID: 7984)
- Unicorn-55059.exe (PID: 8028)
- Unicorn-25724.exe (PID: 8036)
- Unicorn-52075.exe (PID: 7796)
- Unicorn-6138.exe (PID: 7788)
- Unicorn-316.exe (PID: 8152)
- Unicorn-57363.exe (PID: 8172)
- Unicorn-508.exe (PID: 8188)
- Unicorn-51747.exe (PID: 3192)
- Unicorn-13611.exe (PID: 7316)
- Unicorn-42946.exe (PID: 5608)
- Unicorn-54379.exe (PID: 7192)
- Unicorn-43269.exe (PID: 7284)
- Unicorn-60181.exe (PID: 6112)
- Unicorn-51691.exe (PID: 7292)
- Unicorn-46507.exe (PID: 7948)
- Unicorn-62044.exe (PID: 5512)
- Unicorn-62044.exe (PID: 3304)
- Unicorn-22827.exe (PID: 6388)
- Unicorn-47332.exe (PID: 7208)
- Unicorn-45138.exe (PID: 7428)
- Unicorn-1660.exe (PID: 7212)
- Unicorn-59029.exe (PID: 4380)
- Unicorn-47938.exe (PID: 7468)
- Unicorn-36.exe (PID: 7476)
- Unicorn-32901.exe (PID: 7504)
- Unicorn-57332.exe (PID: 7348)
- Unicorn-36.exe (PID: 904)
- Unicorn-35146.exe (PID: 7176)
- Unicorn-32901.exe (PID: 496)
- Unicorn-36.exe (PID: 7484)
- Unicorn-40746.exe (PID: 7516)
- Unicorn-54482.exe (PID: 7280)
- Unicorn-5858.exe (PID: 8012)
- Unicorn-33861.exe (PID: 7148)
- Unicorn-29842.exe (PID: 2908)
- Unicorn-10570.exe (PID: 4112)
- Unicorn-22652.exe (PID: 4208)
- Unicorn-31291.exe (PID: 1128)
- Unicorn-46196.exe (PID: 2772)
- Unicorn-32901.exe (PID: 7508)
- Unicorn-29787.exe (PID: 5984)
- Unicorn-37125.exe (PID: 5756)
- Unicorn-55691.exe (PID: 4188)
- Unicorn-48308.exe (PID: 5400)
- Unicorn-45163.exe (PID: 2552)
- Unicorn-4452.exe (PID: 6752)
- Unicorn-56482.exe (PID: 5212)
- Unicorn-65028.exe (PID: 2984)
- Unicorn-52919.exe (PID: 2088)
- Unicorn-7672.exe (PID: 4740)
- Unicorn-36967.exe (PID: 7352)
- Unicorn-22860.exe (PID: 7656)
- Unicorn-27922.exe (PID: 1056)
- Unicorn-56982.exe (PID: 1020)
- Unicorn-11502.exe (PID: 8212)
- Unicorn-12737.exe (PID: 8324)
- Unicorn-11886.exe (PID: 8268)
- Unicorn-37349.exe (PID: 8300)
- Unicorn-56297.exe (PID: 8228)
- Unicorn-30151.exe (PID: 8428)
- Unicorn-33821.exe (PID: 8444)
- Unicorn-12737.exe (PID: 8332)
- Unicorn-37242.exe (PID: 8308)
- Unicorn-47640.exe (PID: 8340)
- Unicorn-34202.exe (PID: 7464)
- Unicorn-45602.exe (PID: 8348)
- Unicorn-13998.exe (PID: 8396)
Create files in a temporary directory
- Unicorn-27170.exe (PID: 6244)
- Unicorn-60165.exe (PID: 1324)
- 1 (1142).exe (PID: 6036)
- Unicorn-15043.exe (PID: 7612)
- Unicorn-61717.exe (PID: 7684)
- Unicorn-28173.exe (PID: 7560)
- Unicorn-48676.exe (PID: 7704)
- Unicorn-57450.exe (PID: 7728)
- Unicorn-139.exe (PID: 7580)
- Unicorn-8913.exe (PID: 7604)
- Unicorn-56491.exe (PID: 7868)
- Unicorn-62442.exe (PID: 7900)
- Unicorn-14571.exe (PID: 7756)
- Unicorn-63092.exe (PID: 7956)
- Unicorn-54997.exe (PID: 7916)
- Unicorn-63549.exe (PID: 7984)
- Unicorn-14571.exe (PID: 7764)
- Unicorn-36460.exe (PID: 6620)
- Unicorn-25724.exe (PID: 8036)
- Unicorn-55059.exe (PID: 8028)
- Unicorn-6138.exe (PID: 7788)
- Unicorn-52075.exe (PID: 7796)
- Unicorn-316.exe (PID: 8152)
- Unicorn-64981.exe (PID: 7848)
- Unicorn-51747.exe (PID: 3192)
- Unicorn-13611.exe (PID: 7316)
- Unicorn-43269.exe (PID: 7284)
- Unicorn-54379.exe (PID: 7192)
- Unicorn-35708.exe (PID: 7884)
- Unicorn-51691.exe (PID: 7292)
- Unicorn-44037.exe (PID: 7720)
- Unicorn-62044.exe (PID: 3304)
- Unicorn-60181.exe (PID: 6112)
- Unicorn-46507.exe (PID: 7948)
- Unicorn-38661.exe (PID: 7932)
- Unicorn-22827.exe (PID: 6388)
- Unicorn-47332.exe (PID: 7208)
- Unicorn-45138.exe (PID: 7428)
- Unicorn-47938.exe (PID: 7468)
- Unicorn-1660.exe (PID: 7212)
- Unicorn-59029.exe (PID: 4380)
- Unicorn-36.exe (PID: 7476)
- Unicorn-36.exe (PID: 904)
- Unicorn-32901.exe (PID: 7504)
- Unicorn-35146.exe (PID: 7176)
- Unicorn-40746.exe (PID: 7516)
- Unicorn-57332.exe (PID: 7348)
- Unicorn-32901.exe (PID: 496)
- Unicorn-36.exe (PID: 7484)
- Unicorn-5858.exe (PID: 8012)
- Unicorn-54482.exe (PID: 7280)
- Unicorn-33861.exe (PID: 7148)
- Unicorn-10570.exe (PID: 4112)
- Unicorn-22652.exe (PID: 4208)
- Unicorn-29842.exe (PID: 2908)
- Unicorn-31291.exe (PID: 1128)
- Unicorn-57363.exe (PID: 8172)
- Unicorn-508.exe (PID: 8188)
- Unicorn-46196.exe (PID: 2772)
- Unicorn-29787.exe (PID: 5984)
- Unicorn-32901.exe (PID: 7508)
- Unicorn-55691.exe (PID: 4188)
- Unicorn-4452.exe (PID: 6752)
- Unicorn-48308.exe (PID: 5400)
- Unicorn-37125.exe (PID: 5756)
- Unicorn-45163.exe (PID: 2552)
- Unicorn-42946.exe (PID: 5608)
- Unicorn-56482.exe (PID: 5212)
- Unicorn-65028.exe (PID: 2984)
- Unicorn-52919.exe (PID: 2088)
- Unicorn-22860.exe (PID: 7656)
- Unicorn-7672.exe (PID: 4740)
- Unicorn-36967.exe (PID: 7352)
- Unicorn-27922.exe (PID: 1056)
- Unicorn-56982.exe (PID: 1020)
- Unicorn-11886.exe (PID: 8268)
- Unicorn-11502.exe (PID: 8212)
- Unicorn-12737.exe (PID: 8324)
- Unicorn-62044.exe (PID: 5512)
- Unicorn-56297.exe (PID: 8228)
- Unicorn-37349.exe (PID: 8300)
- Unicorn-33821.exe (PID: 8444)
- Unicorn-12737.exe (PID: 8332)
- Unicorn-30151.exe (PID: 8428)
- Unicorn-37242.exe (PID: 8308)
- Unicorn-47640.exe (PID: 8340)
- Unicorn-34202.exe (PID: 7464)
Creates files or folders in the user directory
- WerFault.exe (PID: 9300)
- WerFault.exe (PID: 9840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | DOS Executable Generic (100) |
|---|
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
331
Monitored processes
193
Malicious processes
24
Suspicious processes
19
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 496 | C:\Users\admin\AppData\Local\Temp\Unicorn-32901.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-32901.exe | Unicorn-3257.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 736 | C:\Users\admin\AppData\Local\Temp\Unicorn-33979.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-33979.exe | — | Unicorn-62442.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 904 | C:\Users\admin\AppData\Local\Temp\Unicorn-36.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-36.exe | Unicorn-457.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1020 | C:\Users\admin\AppData\Local\Temp\Unicorn-56982.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56982.exe | Unicorn-46507.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1056 | C:\Users\admin\AppData\Local\Temp\Unicorn-27922.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-27922.exe | Unicorn-62044.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1128 | C:\Users\admin\AppData\Local\Temp\Unicorn-31291.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-31291.exe | Unicorn-56491.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1324 | C:\Users\admin\AppData\Local\Temp\Unicorn-60165.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-60165.exe | Unicorn-36460.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2088 | C:\Users\admin\AppData\Local\Temp\Unicorn-52919.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-52919.exe | Unicorn-60181.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2552 | C:\Users\admin\AppData\Local\Temp\Unicorn-45163.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-45163.exe | Unicorn-35708.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 2772 | C:\Users\admin\AppData\Local\Temp\Unicorn-46196.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46196.exe | Unicorn-51747.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
7 441
Read events
7 441
Write events
0
Delete events
0
Modification events
Executable files
173
Suspicious files
4
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1324 | Unicorn-60165.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-28173.exe | executable | |
MD5:53C28EC7C1C165F74522858763B61FDC | SHA256:96A66D1BEBD2561F2D3EECFA1C9245920F60A9EDB18064BA42A24A47D34BEDD3 | |||
| 1324 | Unicorn-60165.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-48676.exe | executable | |
MD5:C084E4547588552242EC46740F56AC01 | SHA256:620CA9C0E8E581A59DD7CF4D2734540A3D845B546545D0B721CA6D66E08296BA | |||
| 6620 | Unicorn-36460.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-57450.exe | executable | |
MD5:C32E4AFADDA42A2AB52B2F7D01F77CB0 | SHA256:3CB1241CC2FA15D157B66623BF1DB68B5943D82688214247714B8E6B8237D5A3 | |||
| 6036 | 1 (1142).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-6138.exe | executable | |
MD5:94170CF34D73F32ACE5FF9EB946734BE | SHA256:55FD85B1C18CF211053E254638828DC4FB686D7EB9B0AE62D5684492850EAE7A | |||
| 6620 | Unicorn-36460.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-139.exe | executable | |
MD5:3F14F1E839AB9221B91AC93619E4CE0B | SHA256:2D4760F60CF09EF46892BB2BC014C871BCDF6D674E196557ABC9F78D8682FCED | |||
| 7560 | Unicorn-28173.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-61717.exe | executable | |
MD5:C45E7FA0AB77E7BA2BE918C431A093E3 | SHA256:7A0BBE59F75A425BFC9BA847ABA8242D4E8759496938DF8C8B29827F4F8BF1A7 | |||
| 6036 | 1 (1142).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-27170.exe | executable | |
MD5:E145B5E734302DFC41E48825218C5CFE | SHA256:ACC8916C8AA2372DD0894CFA5A2ECA888A65333B432A80F3BDD00E057FE4A720 | |||
| 6244 | Unicorn-27170.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-15043.exe | executable | |
MD5:6ADC99B190AA0A25EE59E95E1514481A | SHA256:B42912A65CA12BF3C006AD3F948D79ED566EF1DEBD2C55C6389A9CDCF14BC9E5 | |||
| 7704 | Unicorn-48676.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-35708.exe | executable | |
MD5:57B1DB8EE1BDCE5AC95FB4F10EF36957 | SHA256:D79013CE6EC89F1B64C8B5F75E57C4E6A260E95AF538F4657DCA9227568C8161 | |||
| 7560 | Unicorn-28173.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-56491.exe | executable | |
MD5:9F4191CAE8051978126E54921754A5F7 | SHA256:9BF408BD2A97DAB6555AEAD635C46B2B96A9F8EA769B5D6D758F2536C62DDE4C | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
15
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.173:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
8924 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | unknown |
8924 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | unknown |
1228 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | unknown |
5496 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5496 | MoUsoCoreWorker.exe | 23.48.23.173:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
2104 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
3216 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
6544 | svchost.exe | 20.190.160.4:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | unknown |
5364 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
1228 | backgroundTaskHost.exe | 20.31.169.57:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| unknown |
settings-win.data.microsoft.com |
| unknown |
crl.microsoft.com |
| unknown |
client.wns.windows.com |
| unknown |
login.live.com |
| unknown |
ocsp.digicert.com |
| unknown |
arc.msn.com |
| unknown |
slscr.update.microsoft.com |
| unknown |
www.microsoft.com |
| unknown |
fe3cr.delivery.mp.microsoft.com |
| unknown |