| File name: | 1 (545) |
| Full analysis: | https://app.any.run/tasks/cfb05720-097a-4193-99e6-0e5c6d513456 |
| Verdict: | Malicious activity |
| Analysis date: | March 25, 2025, 00:06:08 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | 34F8614F46D03B196560144EF35B26B0 |
| SHA1: | 03D4EFDBAD47D971AA5B34B9AB72D495D9295F0F |
| SHA256: | A92CDB13B6D4C7DDD8511F8883F86CB11AA045D82F07A9894CB581130D675F87 |
| SSDEEP: | 6144:p7K0NdIDvDFqA5BYEShDS+fx/tBKePJGBH/WyeOork/8SwjwpyAvEhX1u7un3rfB:p+UOVqA5eESBBnBaHOyeOoNx4DxmDfR |
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\Users\admin\AppData\Local\Temp\Unicorn-46731.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46731.exe | Unicorn-12177.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 536 | C:\Users\admin\AppData\Local\Temp\Unicorn-63284.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63284.exe | — | Unicorn-7546.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 632 | C:\Users\admin\AppData\Local\Temp\Unicorn-9692.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9692.exe | Unicorn-21851.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 680 | C:\Users\admin\AppData\Local\Temp\Unicorn-23346.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-23346.exe | Unicorn-21851.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 720 | C:\Users\admin\AppData\Local\Temp\Unicorn-3924.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3924.exe | Unicorn-20621.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 728 | C:\Users\admin\AppData\Local\Temp\Unicorn-45153.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-45153.exe | Unicorn-43846.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 736 | C:\Users\admin\AppData\Local\Temp\Unicorn-42286.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-42286.exe | — | Unicorn-32061.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 | |||||||||||||||
| 856 | C:\Users\admin\AppData\Local\Temp\Unicorn-9855.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-9855.exe | — | Unicorn-8838.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 | |||||||||||||||
| 920 | C:\Users\admin\AppData\Local\Temp\Unicorn-25912.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-25912.exe | 1 (545).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1012 | C:\Users\admin\AppData\Local\Temp\Unicorn-37716.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-37716.exe | Unicorn-64605.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| (PID) Process: | (2240) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2240) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2240) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7396) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7396) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7396) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7584) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7584) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7584) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7944) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 920 | Unicorn-25912.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-58188.exe | executable | |
MD5:E34D0BA762519A4F1879B6970EE1FE99 | SHA256:869EAB7D41CA5EC8EEE47D48ED44AEA2FD9B564618DB0D49CA6E515845EB6E65 | |||
| 5344 | Unicorn-21851.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-46948.exe | executable | |
MD5:D6D8FFE5F3D88D5DC6C1D5EFBD8FA1EF | SHA256:CD185FA392FA64DB4378EBD27F52994A2D566D138F4DA4B5A982D212D76B03FD | |||
| 6564 | Unicorn-49836.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-63920.exe | executable | |
MD5:C27E87B4AB45574BC274ED27E832FD79 | SHA256:B7F7C674138FA07BEC68B2EB1A79C849A229DF3D839B5035B65C0A029C95C2AE | |||
| 1676 | 1 (545).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-45635.exe | executable | |
MD5:EC55CF42A5081553D15DB03C5F1F154E | SHA256:F13ADD74874D28DAEE3A7865769923C26DE5160C2358316B4273471EEA9BA858 | |||
| 5504 | Unicorn-35639.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-42304.exe | executable | |
MD5:B26810BF88ED39AFD6243A3B19E8DF97 | SHA256:81F238351A5D45B74D44BBBE98E3B402793B652836169FD88941D11B48327206 | |||
| 2616 | Unicorn-46948.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-59682.exe | executable | |
MD5:1A88DF1350AC0C585C4B3362E7B6AAA3 | SHA256:DDC948B53B36D1A0159F5F9B062ACE9B6D69810CBB0B6C43047104E893071756 | |||
| 6032 | Unicorn-8838.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-11070.exe | executable | |
MD5:FC43305AA9BB945E4B6DD139507E6749 | SHA256:0791B0E820764261A187F791447C81F5FC27F4083EBFCC50D6D9F66C1CA2ABC9 | |||
| 920 | Unicorn-25912.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-11692.exe | executable | |
MD5:78EF5F94EEEEFF34835C48287E830D16 | SHA256:6FB0BB3480617767A5B24020DAD686AAE35871F29D50565CD99200269C0CDA8E | |||
| 5548 | Unicorn-64605.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-37716.exe | executable | |
MD5:B874BBFF6F23D67B997B4A7D7FF41BC4 | SHA256:6886A398D2597EABDEF6ECA36CDF64F4F9498619A8AB29740483493FF96FDC79 | |||
| 5548 | Unicorn-64605.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-31493.exe | executable | |
MD5:BF4BFB8DA4ED03DBB5BDCDBF2C848E8E | SHA256:285A4D38A34CA06913603F1D0E9C4F0DE9C1D9F059422A669FE64C461AAED0C4 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.143:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6040 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
2268 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7396 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
2268 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2104 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.48.23.143:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
3216 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.160.64:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
2112 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6040 | backgroundTaskHost.exe | 20.223.35.26:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |