| File name: | 1 (1389) |
| Full analysis: | https://app.any.run/tasks/0dada63a-8a48-4162-be1e-51c037e21547 |
| Verdict: | Malicious activity |
| Analysis date: | March 24, 2025, 15:26:49 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections |
| MD5: | CE388FCB32A8FC94A7AE68005B67D040 |
| SHA1: | C66B1BA1860023185CD5E82FC68DBE9F1FD24A28 |
| SHA256: | 6FF93B179185042611C9D7ABB508E2829937F5A7A401C85E8E6614049C1C94CB |
| SSDEEP: | 6144:FLK0fxTDvDoqA5nIu4hD1ifx/tBKlvJGBH/WyeOdGk/8SwjwpyAvEhCXuPp0sxea:FOi14qA5Iuk4BshaHOyeOdTx4DxmDsR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- Unicorn-3727.exe (PID: 1276)
- 1 (1389).exe (PID: 904)
- Unicorn-21792.exe (PID: 1228)
- Unicorn-59295.exe (PID: 1056)
- Unicorn-63238.exe (PID: 6652)
- Unicorn-28144.exe (PID: 1240)
- Unicorn-11999.exe (PID: 4652)
- Unicorn-25378.exe (PID: 4688)
- Unicorn-28070.exe (PID: 4628)
- Unicorn-37914.exe (PID: 6576)
- Unicorn-53016.exe (PID: 5200)
- Unicorn-14194.exe (PID: 5116)
- Unicorn-302.exe (PID: 6972)
- Unicorn-14407.exe (PID: 4980)
- Unicorn-43166.exe (PID: 208)
- Unicorn-32205.exe (PID: 5964)
- Unicorn-38071.exe (PID: 6388)
- Unicorn-48128.exe (PID: 2984)
- Unicorn-14085.exe (PID: 6964)
- Unicorn-7287.exe (PID: 6752)
- Unicorn-20529.exe (PID: 2656)
- Unicorn-46182.exe (PID: 6192)
- Unicorn-38336.exe (PID: 1660)
- Unicorn-20420.exe (PID: 6228)
- Unicorn-53639.exe (PID: 644)
- Unicorn-38336.exe (PID: 6068)
- Unicorn-8159.exe (PID: 4608)
- Unicorn-40832.exe (PID: 1912)
- Unicorn-28262.exe (PID: 4776)
- Unicorn-55890.exe (PID: 7192)
- Unicorn-54791.exe (PID: 2268)
- Unicorn-54490.exe (PID: 7348)
- Unicorn-47229.exe (PID: 6816)
- Unicorn-21564.exe (PID: 7180)
- Unicorn-46431.exe (PID: 7220)
- Unicorn-759.exe (PID: 7228)
- Unicorn-29239.exe (PID: 7280)
- Unicorn-64141.exe (PID: 7332)
- Unicorn-5803.exe (PID: 7272)
- Unicorn-25948.exe (PID: 7700)
- Unicorn-4469.exe (PID: 7324)
- Unicorn-62410.exe (PID: 7256)
- Unicorn-10442.exe (PID: 7312)
- Unicorn-51475.exe (PID: 7264)
- Unicorn-33432.exe (PID: 7248)
- Unicorn-43951.exe (PID: 7804)
- Unicorn-38916.exe (PID: 7652)
- Unicorn-51142.exe (PID: 7820)
- Unicorn-48889.exe (PID: 7340)
- Unicorn-16026.exe (PID: 7672)
- Unicorn-33240.exe (PID: 7208)
- Unicorn-33131.exe (PID: 7572)
- Unicorn-55392.exe (PID: 4740)
- Unicorn-57390.exe (PID: 7632)
- Unicorn-25922.exe (PID: 7836)
- Unicorn-26551.exe (PID: 5212)
- Unicorn-22680.exe (PID: 7660)
- Unicorn-5663.exe (PID: 6644)
- Unicorn-33728.exe (PID: 8100)
- Unicorn-57117.exe (PID: 4000)
- Unicorn-29239.exe (PID: 7288)
- Unicorn-61335.exe (PID: 7688)
- Unicorn-5803.exe (PID: 7380)
- Unicorn-59301.exe (PID: 8120)
- Unicorn-7578.exe (PID: 7900)
- Unicorn-30857.exe (PID: 8276)
- Unicorn-16987.exe (PID: 7356)
- Unicorn-38833.exe (PID: 3300)
- Unicorn-48756.exe (PID: 8208)
- Unicorn-20389.exe (PID: 8228)
- Unicorn-57805.exe (PID: 8404)
- Unicorn-57313.exe (PID: 7556)
- Unicorn-51128.exe (PID: 8528)
- Unicorn-50339.exe (PID: 2644)
- Unicorn-36084.exe (PID: 7680)
- Unicorn-46063.exe (PID: 8152)
- Unicorn-5632.exe (PID: 7876)
- Unicorn-9799.exe (PID: 8008)
- Unicorn-18304.exe (PID: 8356)
- Unicorn-62923.exe (PID: 8608)
- Unicorn-33951.exe (PID: 6560)
- Unicorn-63254.exe (PID: 8976)
- Unicorn-62491.exe (PID: 8200)
- Unicorn-11376.exe (PID: 7564)
- Unicorn-28544.exe (PID: 9044)
- Unicorn-57863.exe (PID: 7236)
- Unicorn-54179.exe (PID: 8968)
- Unicorn-62368.exe (PID: 9084)
- Unicorn-2503.exe (PID: 8740)
- Unicorn-65108.exe (PID: 8804)
- Unicorn-2076.exe (PID: 9168)
- Unicorn-62679.exe (PID: 6268)
- Unicorn-39238.exe (PID: 8616)
- Unicorn-15139.exe (PID: 8696)
- Unicorn-42576.exe (PID: 8584)
- Unicorn-30656.exe (PID: 7640)
- Unicorn-42201.exe (PID: 720)
- Unicorn-56639.exe (PID: 9460)
- Unicorn-18928.exe (PID: 8300)
- Unicorn-44008.exe (PID: 8260)
- Unicorn-37236.exe (PID: 7892)
- Unicorn-55596.exe (PID: 8704)
- Unicorn-58284.exe (PID: 9076)
- Unicorn-64043.exe (PID: 8392)
- Unicorn-10671.exe (PID: 8764)
- Unicorn-49769.exe (PID: 5164)
- Unicorn-57495.exe (PID: 8836)
- Unicorn-4977.exe (PID: 10096)
- Unicorn-52332.exe (PID: 10128)
- Unicorn-48860.exe (PID: 8316)
- Unicorn-26935.exe (PID: 8664)
- Unicorn-16349.exe (PID: 8508)
- Unicorn-50500.exe (PID: 5936)
- Unicorn-6203.exe (PID: 8552)
- Unicorn-58050.exe (PID: 7852)
- Unicorn-17828.exe (PID: 2332)
- Unicorn-3930.exe (PID: 9412)
- Unicorn-51948.exe (PID: 7936)
- Unicorn-50832.exe (PID: 8040)
- Unicorn-30132.exe (PID: 8576)
- Unicorn-12128.exe (PID: 9444)
- Unicorn-36816.exe (PID: 9512)
- Unicorn-11838.exe (PID: 8324)
- Unicorn-48751.exe (PID: 8844)
- Unicorn-34896.exe (PID: 9320)
- Unicorn-49186.exe (PID: 9300)
- Unicorn-35996.exe (PID: 11372)
- Unicorn-25061.exe (PID: 11400)
- Unicorn-44662.exe (PID: 11420)
- Unicorn-22732.exe (PID: 8724)
- Unicorn-42450.exe (PID: 8788)
- Unicorn-11957.exe (PID: 12692)
- Unicorn-45014.exe (PID: 12720)
- Unicorn-18677.exe (PID: 10372)
- Unicorn-24542.exe (PID: 9396)
- Unicorn-7179.exe (PID: 12820)
- Unicorn-46027.exe (PID: 10452)
- Unicorn-6062.exe (PID: 10088)
- Unicorn-941.exe (PID: 11024)
- Unicorn-32606.exe (PID: 8876)
- Unicorn-61512.exe (PID: 9536)
- Unicorn-35767.exe (PID: 8372)
- Unicorn-3633.exe (PID: 9880)
- Unicorn-41402.exe (PID: 5036)
- Unicorn-62037.exe (PID: 9268)
- Unicorn-17167.exe (PID: 10712)
- Unicorn-65435.exe (PID: 11240)
- Unicorn-45610.exe (PID: 11812)
- Unicorn-38854.exe (PID: 9500)
- Unicorn-5321.exe (PID: 12524)
- Unicorn-58055.exe (PID: 11668)
- Unicorn-32275.exe (PID: 9792)
- Unicorn-3244.exe (PID: 10892)
- Unicorn-57755.exe (PID: 12272)
- Unicorn-63323.exe (PID: 12628)
- Unicorn-12207.exe (PID: 9068)
- Unicorn-27548.exe (PID: 10988)
- Unicorn-27859.exe (PID: 5232)
- Unicorn-37881.exe (PID: 11036)
- Unicorn-56814.exe (PID: 4164)
- Unicorn-23391.exe (PID: 10296)
- Unicorn-13987.exe (PID: 8628)
- Unicorn-33582.exe (PID: 10552)
- Unicorn-54304.exe (PID: 9900)
- Unicorn-61372.exe (PID: 11284)
- Unicorn-51211.exe (PID: 11836)
- Unicorn-46551.exe (PID: 11380)
- Unicorn-18186.exe (PID: 7828)
- Unicorn-25188.exe (PID: 9112)
- Unicorn-4278.exe (PID: 12316)
- Unicorn-29690.exe (PID: 10416)
- Unicorn-11121.exe (PID: 9136)
- Unicorn-13990.exe (PID: 14268)
- Unicorn-17038.exe (PID: 8932)
- Unicorn-54008.exe (PID: 7588)
- Unicorn-21552.exe (PID: 14188)
- Unicorn-41762.exe (PID: 2064)
- Unicorn-25061.exe (PID: 11428)
- Unicorn-22800.exe (PID: 12020)
- Unicorn-61958.exe (PID: 9824)
- Unicorn-23162.exe (PID: 11952)
- Unicorn-50931.exe (PID: 12580)
- Unicorn-36920.exe (PID: 10516)
- Unicorn-26454.exe (PID: 13704)
- Unicorn-20952.exe (PID: 5352)
- Unicorn-11818.exe (PID: 12264)
- Unicorn-41756.exe (PID: 8256)
- Unicorn-31417.exe (PID: 12356)
- Unicorn-35885.exe (PID: 15304)
- Unicorn-22157.exe (PID: 15320)
- Unicorn-19445.exe (PID: 11452)
- Unicorn-11558.exe (PID: 8828)
- Unicorn-53078.exe (PID: 11688)
- Unicorn-25640.exe (PID: 12552)
- Unicorn-53432.exe (PID: 8924)
- Unicorn-25636.exe (PID: 14168)
- Unicorn-18457.exe (PID: 15160)
- Unicorn-29660.exe (PID: 11364)
- Unicorn-5466.exe (PID: 9816)
- Unicorn-34734.exe (PID: 10672)
- Unicorn-31263.exe (PID: 10080)
- Unicorn-20952.exe (PID: 7580)
- Unicorn-54018.exe (PID: 8164)
- Unicorn-51211.exe (PID: 11820)
- Unicorn-2098.exe (PID: 8592)
- Unicorn-48086.exe (PID: 10768)
- Unicorn-24097.exe (PID: 10572)
- Unicorn-15273.exe (PID: 15312)
- Unicorn-13354.exe (PID: 9948)
- Unicorn-13052.exe (PID: 5132)
- Unicorn-31417.exe (PID: 12364)
- Unicorn-42239.exe (PID: 11052)
- Unicorn-32244.exe (PID: 8816)
- Unicorn-4749.exe (PID: 13284)
- Unicorn-24323.exe (PID: 15264)
- Unicorn-47134.exe (PID: 14724)
- Unicorn-39853.exe (PID: 10616)
- Unicorn-13722.exe (PID: 9120)
- Unicorn-31310.exe (PID: 13040)
- Unicorn-61616.exe (PID: 10632)
- Unicorn-45421.exe (PID: 12620)
- Unicorn-29358.exe (PID: 2968)
- Unicorn-56007.exe (PID: 9248)
- Unicorn-4722.exe (PID: 15176)
- Unicorn-41070.exe (PID: 10876)
- Unicorn-21993.exe (PID: 11248)
- Unicorn-43242.exe (PID: 13952)
- Unicorn-5679.exe (PID: 9892)
- Unicorn-13567.exe (PID: 10692)
- Unicorn-60768.exe (PID: 15032)
- Unicorn-56779.exe (PID: 10224)
- Unicorn-35280.exe (PID: 9260)
- Unicorn-4423.exe (PID: 8948)
- Unicorn-45465.exe (PID: 8772)
- Unicorn-35834.exe (PID: 9836)
- Unicorn-19446.exe (PID: 9432)
- Unicorn-45456.exe (PID: 8960)
- Unicorn-37918.exe (PID: 15100)
- Unicorn-27160.exe (PID: 8688)
- Unicorn-14373.exe (PID: 15280)
- Unicorn-32924.exe (PID: 9552)
- Unicorn-31729.exe (PID: 8780)
- Unicorn-43280.exe (PID: 14952)
- Unicorn-50931.exe (PID: 12564)
- Unicorn-57620.exe (PID: 9844)
- Unicorn-60086.exe (PID: 13152)
- Unicorn-6893.exe (PID: 10152)
- Unicorn-8258.exe (PID: 6248)
- Unicorn-55700.exe (PID: 9232)
- Unicorn-12223.exe (PID: 10528)
- Unicorn-22540.exe (PID: 8544)
- Unicorn-23140.exe (PID: 12488)
- Unicorn-44112.exe (PID: 8852)
- Unicorn-3153.exe (PID: 12256)
- Unicorn-6337.exe (PID: 12980)
- Unicorn-29891.exe (PID: 13660)
- Unicorn-16552.exe (PID: 12456)
- Unicorn-38797.exe (PID: 11412)
Starts itself from another location
- Unicorn-3727.exe (PID: 1276)
- 1 (1389).exe (PID: 904)
- Unicorn-63238.exe (PID: 6652)
- Unicorn-59295.exe (PID: 1056)
- Unicorn-28144.exe (PID: 1240)
- Unicorn-302.exe (PID: 6972)
- Unicorn-25378.exe (PID: 4688)
- Unicorn-11999.exe (PID: 4652)
- Unicorn-28070.exe (PID: 4628)
- Unicorn-21792.exe (PID: 1228)
- Unicorn-7287.exe (PID: 6752)
- Unicorn-53016.exe (PID: 5200)
- Unicorn-14194.exe (PID: 5116)
- Unicorn-14407.exe (PID: 4980)
- Unicorn-43166.exe (PID: 208)
- Unicorn-5663.exe (PID: 6644)
- Unicorn-37914.exe (PID: 6576)
- Unicorn-38071.exe (PID: 6388)
- Unicorn-28262.exe (PID: 4776)
- Unicorn-14085.exe (PID: 6964)
- Unicorn-20529.exe (PID: 2656)
- Unicorn-57117.exe (PID: 4000)
- Unicorn-38336.exe (PID: 1660)
- Unicorn-26551.exe (PID: 5212)
- Unicorn-48128.exe (PID: 2984)
- Unicorn-38336.exe (PID: 6068)
- Unicorn-53639.exe (PID: 644)
- Unicorn-8159.exe (PID: 4608)
- Unicorn-40832.exe (PID: 1912)
- Unicorn-55890.exe (PID: 7192)
- Unicorn-32205.exe (PID: 5964)
- Unicorn-54791.exe (PID: 2268)
- Unicorn-57863.exe (PID: 7236)
- Unicorn-54490.exe (PID: 7348)
- Unicorn-47229.exe (PID: 6816)
- Unicorn-64141.exe (PID: 7332)
- Unicorn-20420.exe (PID: 6228)
- Unicorn-46431.exe (PID: 7220)
- Unicorn-759.exe (PID: 7228)
- Unicorn-21564.exe (PID: 7180)
- Unicorn-10442.exe (PID: 7312)
- Unicorn-5803.exe (PID: 7272)
- Unicorn-25948.exe (PID: 7700)
- Unicorn-46182.exe (PID: 6192)
- Unicorn-62410.exe (PID: 7256)
- Unicorn-4469.exe (PID: 7324)
- Unicorn-29239.exe (PID: 7280)
- Unicorn-51475.exe (PID: 7264)
- Unicorn-38916.exe (PID: 7652)
- Unicorn-33432.exe (PID: 7248)
- Unicorn-51142.exe (PID: 7820)
- Unicorn-33240.exe (PID: 7208)
- Unicorn-16026.exe (PID: 7672)
- Unicorn-48889.exe (PID: 7340)
- Unicorn-33131.exe (PID: 7572)
- Unicorn-25922.exe (PID: 7836)
- Unicorn-55392.exe (PID: 4740)
- Unicorn-30656.exe (PID: 7640)
- Unicorn-22680.exe (PID: 7660)
- Unicorn-33728.exe (PID: 8100)
- Unicorn-29239.exe (PID: 7288)
- Unicorn-61335.exe (PID: 7688)
- Unicorn-33951.exe (PID: 6560)
- Unicorn-59301.exe (PID: 8120)
- Unicorn-5803.exe (PID: 7380)
- Unicorn-64043.exe (PID: 8392)
- Unicorn-16987.exe (PID: 7356)
- Unicorn-7578.exe (PID: 7900)
- Unicorn-38833.exe (PID: 3300)
- Unicorn-20389.exe (PID: 8228)
- Unicorn-57313.exe (PID: 7556)
- Unicorn-57390.exe (PID: 7632)
- Unicorn-57805.exe (PID: 8404)
- Unicorn-51128.exe (PID: 8528)
- Unicorn-48756.exe (PID: 8208)
- Unicorn-30857.exe (PID: 8276)
- Unicorn-62923.exe (PID: 8608)
- Unicorn-46063.exe (PID: 8152)
- Unicorn-50832.exe (PID: 8040)
- Unicorn-5632.exe (PID: 7876)
- Unicorn-50339.exe (PID: 2644)
- Unicorn-58050.exe (PID: 7852)
- Unicorn-36084.exe (PID: 7680)
- Unicorn-63254.exe (PID: 8976)
- Unicorn-62491.exe (PID: 8200)
- Unicorn-18186.exe (PID: 7828)
- Unicorn-28544.exe (PID: 9044)
- Unicorn-54179.exe (PID: 8968)
- Unicorn-39238.exe (PID: 8616)
- Unicorn-65108.exe (PID: 8804)
- Unicorn-2076.exe (PID: 9168)
- Unicorn-62679.exe (PID: 6268)
- Unicorn-11376.exe (PID: 7564)
- Unicorn-15139.exe (PID: 8696)
- Unicorn-18304.exe (PID: 8356)
- Unicorn-2503.exe (PID: 8740)
- Unicorn-42201.exe (PID: 720)
- Unicorn-56639.exe (PID: 9460)
- Unicorn-18928.exe (PID: 8300)
- Unicorn-42576.exe (PID: 8584)
- Unicorn-44008.exe (PID: 8260)
- Unicorn-55596.exe (PID: 8704)
- Unicorn-37236.exe (PID: 7892)
- Unicorn-58284.exe (PID: 9076)
- Unicorn-49769.exe (PID: 5164)
- Unicorn-43951.exe (PID: 7804)
- Unicorn-50500.exe (PID: 5936)
- Unicorn-57495.exe (PID: 8836)
- Unicorn-6062.exe (PID: 10088)
- Unicorn-52332.exe (PID: 10128)
- Unicorn-48860.exe (PID: 8316)
- Unicorn-26935.exe (PID: 8664)
- Unicorn-10671.exe (PID: 8764)
- Unicorn-4977.exe (PID: 10096)
- Unicorn-17828.exe (PID: 2332)
- Unicorn-9799.exe (PID: 8008)
- Unicorn-6203.exe (PID: 8552)
- Unicorn-16349.exe (PID: 8508)
- Unicorn-3930.exe (PID: 9412)
- Unicorn-11121.exe (PID: 9136)
- Unicorn-30132.exe (PID: 8576)
- Unicorn-12128.exe (PID: 9444)
- Unicorn-51948.exe (PID: 7936)
- Unicorn-62368.exe (PID: 9084)
- Unicorn-11838.exe (PID: 8324)
- Unicorn-36816.exe (PID: 9512)
- Unicorn-34896.exe (PID: 9320)
- Unicorn-49186.exe (PID: 9300)
- Unicorn-35996.exe (PID: 11372)
- Unicorn-46551.exe (PID: 11380)
- Unicorn-25061.exe (PID: 11400)
- Unicorn-42450.exe (PID: 8788)
- Unicorn-22732.exe (PID: 8724)
- Unicorn-44662.exe (PID: 11420)
- Unicorn-11957.exe (PID: 12692)
- Unicorn-45014.exe (PID: 12720)
- Unicorn-24542.exe (PID: 9396)
- Unicorn-18677.exe (PID: 10372)
- Unicorn-61512.exe (PID: 9536)
- Unicorn-32606.exe (PID: 8876)
- Unicorn-38854.exe (PID: 9500)
- Unicorn-41402.exe (PID: 5036)
- Unicorn-62037.exe (PID: 9268)
- Unicorn-17167.exe (PID: 10712)
- Unicorn-41762.exe (PID: 2064)
- Unicorn-65435.exe (PID: 11240)
- Unicorn-46027.exe (PID: 10452)
- Unicorn-35767.exe (PID: 8372)
- Unicorn-3633.exe (PID: 9880)
- Unicorn-941.exe (PID: 11024)
- Unicorn-3244.exe (PID: 10892)
- Unicorn-58343.exe (PID: 11016)
- Unicorn-58055.exe (PID: 11668)
- Unicorn-32275.exe (PID: 9792)
- Unicorn-37881.exe (PID: 11036)
- Unicorn-56814.exe (PID: 4164)
- Unicorn-63323.exe (PID: 12628)
- Unicorn-27548.exe (PID: 10988)
- Unicorn-12207.exe (PID: 9068)
- Unicorn-27859.exe (PID: 5232)
- Unicorn-19446.exe (PID: 9432)
- Unicorn-13987.exe (PID: 8628)
- Unicorn-23391.exe (PID: 10296)
- Unicorn-33582.exe (PID: 10552)
- Unicorn-54304.exe (PID: 9900)
- Unicorn-32924.exe (PID: 9552)
- Unicorn-61372.exe (PID: 11284)
- Unicorn-57755.exe (PID: 12272)
- Unicorn-51211.exe (PID: 11836)
- Unicorn-45610.exe (PID: 11812)
- Unicorn-5321.exe (PID: 12524)
- Unicorn-25636.exe (PID: 14168)
- Unicorn-45421.exe (PID: 12620)
- Unicorn-25188.exe (PID: 9112)
- Unicorn-4278.exe (PID: 12316)
- Unicorn-29690.exe (PID: 10416)
- Unicorn-25061.exe (PID: 11428)
- Unicorn-13990.exe (PID: 14268)
- Unicorn-17038.exe (PID: 8932)
- Unicorn-54008.exe (PID: 7588)
- Unicorn-21552.exe (PID: 14188)
- Unicorn-22800.exe (PID: 12020)
- Unicorn-19445.exe (PID: 11452)
INFO
Checks supported languages
- Unicorn-21792.exe (PID: 1228)
- 1 (1389).exe (PID: 904)
- Unicorn-3727.exe (PID: 1276)
- Unicorn-59295.exe (PID: 1056)
- Unicorn-53016.exe (PID: 5200)
- Unicorn-48128.exe (PID: 2984)
- Unicorn-302.exe (PID: 6972)
- Unicorn-11999.exe (PID: 4652)
- Unicorn-43166.exe (PID: 208)
- Unicorn-32205.exe (PID: 5964)
- Unicorn-57117.exe (PID: 4000)
- Unicorn-38336.exe (PID: 1660)
- Unicorn-33951.exe (PID: 6560)
- Unicorn-54791.exe (PID: 2268)
- Unicorn-57863.exe (PID: 7236)
- Unicorn-54490.exe (PID: 7348)
- Unicorn-55890.exe (PID: 7192)
- Unicorn-57390.exe (PID: 7632)
- Unicorn-59301.exe (PID: 8120)
- Unicorn-37236.exe (PID: 7892)
- Unicorn-58050.exe (PID: 7852)
- Unicorn-48860.exe (PID: 8316)
- Unicorn-33728.exe (PID: 8100)
- Unicorn-57805.exe (PID: 8404)
- Unicorn-6203.exe (PID: 8552)
- Unicorn-22732.exe (PID: 8724)
- Unicorn-62923.exe (PID: 8608)
- Unicorn-65108.exe (PID: 8804)
- Unicorn-31729.exe (PID: 8780)
- Unicorn-44112.exe (PID: 8852)
- Unicorn-53432.exe (PID: 8924)
- Unicorn-62731.exe (PID: 7868)
- Unicorn-62679.exe (PID: 6268)
- Unicorn-49186.exe (PID: 9300)
- Unicorn-56639.exe (PID: 9460)
- Unicorn-65383.exe (PID: 9424)
- Unicorn-10841.exe (PID: 9808)
- Unicorn-61958.exe (PID: 9824)
- Unicorn-6893.exe (PID: 10152)
- Unicorn-30952.exe (PID: 9976)
- Unicorn-9253.exe (PID: 10176)
- Unicorn-52332.exe (PID: 10128)
- Unicorn-51186.exe (PID: 10232)
- Unicorn-3899.exe (PID: 5416)
- Unicorn-13052.exe (PID: 5132)
- Unicorn-941.exe (PID: 11024)
- Unicorn-16064.exe (PID: 4572)
- Unicorn-14977.exe (PID: 11640)
- Unicorn-29660.exe (PID: 11364)
- Unicorn-17455.exe (PID: 11960)
- Unicorn-35939.exe (PID: 12148)
- Unicorn-9478.exe (PID: 12016)
- Unicorn-1995.exe (PID: 11968)
- Unicorn-32128.exe (PID: 11900)
- Unicorn-19056.exe (PID: 12504)
- Unicorn-58139.exe (PID: 12932)
- Unicorn-20066.exe (PID: 13168)
- Unicorn-3537.exe (PID: 12996)
- Unicorn-26832.exe (PID: 12596)
- Unicorn-61866.exe (PID: 12604)
- Unicorn-6337.exe (PID: 12980)
- Unicorn-18673.exe (PID: 13752)
- Unicorn-13990.exe (PID: 14268)
- Unicorn-28109.exe (PID: 13644)
- Unicorn-16233.exe (PID: 12672)
- Unicorn-37556.exe (PID: 13500)
- Unicorn-33856.exe (PID: 14276)
- Unicorn-22157.exe (PID: 15320)
- Unicorn-49054.exe (PID: 14732)
- Unicorn-1738.exe (PID: 14768)
- Unicorn-39004.exe (PID: 14936)
- Unicorn-18457.exe (PID: 15144)
- Unicorn-18457.exe (PID: 15168)
- Unicorn-27005.exe (PID: 15052)
- Unicorn-37918.exe (PID: 15100)
- Unicorn-10415.exe (PID: 15008)
- Unicorn-24323.exe (PID: 15236)
- Unicorn-60575.exe (PID: 15220)
Reads the computer name
- 1 (1389).exe (PID: 904)
- Unicorn-3727.exe (PID: 1276)
- Unicorn-21792.exe (PID: 1228)
- Unicorn-25378.exe (PID: 4688)
- Unicorn-14085.exe (PID: 6964)
- Unicorn-20420.exe (PID: 6228)
- Unicorn-64141.exe (PID: 7332)
- Unicorn-7578.exe (PID: 7900)
- Unicorn-22680.exe (PID: 7660)
- Unicorn-50339.exe (PID: 2644)
- Unicorn-63254.exe (PID: 8976)
- Unicorn-50500.exe (PID: 5936)
- Unicorn-4977.exe (PID: 10096)
- Unicorn-65435.exe (PID: 11240)
- Unicorn-12207.exe (PID: 9068)
- Unicorn-46027.exe (PID: 10452)
- Unicorn-4278.exe (PID: 12316)
The sample compiled with chinese language support
- 1 (1389).exe (PID: 904)
Create files in a temporary directory
- 1 (1389).exe (PID: 904)
- Unicorn-3727.exe (PID: 1276)
- Unicorn-21792.exe (PID: 1228)
- Unicorn-63238.exe (PID: 6652)
- Unicorn-38071.exe (PID: 6388)
- Unicorn-48128.exe (PID: 2984)
- Unicorn-14085.exe (PID: 6964)
- Unicorn-37914.exe (PID: 6576)
- Unicorn-38336.exe (PID: 1660)
- Unicorn-38336.exe (PID: 6068)
- Unicorn-28070.exe (PID: 4628)
- Unicorn-14407.exe (PID: 4980)
- Unicorn-53639.exe (PID: 644)
- Unicorn-40832.exe (PID: 1912)
- Unicorn-55890.exe (PID: 7192)
- Unicorn-54791.exe (PID: 2268)
- Unicorn-10442.exe (PID: 7312)
- Unicorn-25948.exe (PID: 7700)
- Unicorn-20529.exe (PID: 2656)
- Unicorn-32205.exe (PID: 5964)
- Unicorn-5803.exe (PID: 7272)
- Unicorn-29239.exe (PID: 7280)
- Unicorn-53016.exe (PID: 5200)
- Unicorn-7578.exe (PID: 7900)
- Unicorn-47229.exe (PID: 6816)
- Unicorn-64141.exe (PID: 7332)
- Unicorn-46063.exe (PID: 8152)
- Unicorn-25378.exe (PID: 4688)
- Unicorn-9799.exe (PID: 8008)
- Unicorn-11376.exe (PID: 7564)
- Unicorn-18304.exe (PID: 8356)
- Unicorn-7287.exe (PID: 6752)
- Unicorn-59295.exe (PID: 1056)
- Unicorn-42201.exe (PID: 720)
- Unicorn-28144.exe (PID: 1240)
- Unicorn-33131.exe (PID: 7572)
- Unicorn-5663.exe (PID: 6644)
- Unicorn-20389.exe (PID: 8228)
- Unicorn-59301.exe (PID: 8120)
- Unicorn-11999.exe (PID: 4652)
- Unicorn-57313.exe (PID: 7556)
- Unicorn-2076.exe (PID: 9168)
- Unicorn-43166.exe (PID: 208)
- Unicorn-6062.exe (PID: 10088)
- Unicorn-54179.exe (PID: 8968)
- Unicorn-8159.exe (PID: 4608)
- Unicorn-33951.exe (PID: 6560)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 5452)
- BackgroundTransferHost.exe (PID: 6488)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 6488)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 6488)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 6488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Microsoft Visual Basic 6 (90.6) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (4.9) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:01:19 13:34:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Removable run from swap, Net run from swap, Uniprocessor only, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 176128 |
| InitializedDataSize: | 299008 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13d4 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| CompanyName: | UEFI |
| ProductName: | Kawaii-Unicorn |
| FileVersion: | 1 |
| ProductVersion: | 1 |
| InternalName: | Kawaii-Unicorn |
| OriginalFileName: | Kawaii-Unicorn.exe |
Total processes
643
Monitored processes
512
Malicious processes
78
Suspicious processes
50
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\Users\admin\AppData\Local\Temp\Unicorn-43166.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-43166.exe | Unicorn-63238.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 644 | C:\Users\admin\AppData\Local\Temp\Unicorn-53639.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-53639.exe | Unicorn-28262.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 720 | C:\Users\admin\AppData\Local\Temp\Unicorn-42201.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-42201.exe | Unicorn-57390.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 904 | "C:\Users\admin\AppData\Local\Temp\1 (1389).exe" | C:\Users\admin\AppData\Local\Temp\1 (1389).exe | explorer.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1056 | C:\Users\admin\AppData\Local\Temp\Unicorn-59295.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-59295.exe | 1 (1389).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1116 | C:\Users\admin\AppData\Local\Temp\Unicorn-21993.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-21993.exe | — | Unicorn-57117.exe | |||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1228 | C:\Users\admin\AppData\Local\Temp\Unicorn-21792.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-21792.exe | Unicorn-3727.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1240 | C:\Users\admin\AppData\Local\Temp\Unicorn-28144.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-28144.exe | Unicorn-21792.exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
| 1272 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1276 | C:\Users\admin\AppData\Local\Temp\Unicorn-3727.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3727.exe | 1 (1389).exe | ||||||||||||
User: admin Company: UEFI Integrity Level: MEDIUM Version: 1.00 Modules
| |||||||||||||||
Total events
11 554
Read events
11 539
Write events
15
Delete events
0
Modification events
| (PID) Process: | (5452) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (5452) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (5452) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6488) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6488) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6488) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (5344) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (5344) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (5344) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2384) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
Executable files
758
Suspicious files
5
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6488 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\592b1298-8e7b-4a11-b1d0-ed6edfbd32c6.down_data | — | |
MD5:— | SHA256:— | |||
| 904 | 1 (1389).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-3727.exe | executable | |
MD5:61D804D843D4B5FF0489A5B7D5968B2B | SHA256:D4733AA9E3F3EE44180527B13208A50BFE4B834C2971DBEB40160F7FAB051B79 | |||
| 1276 | Unicorn-3727.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-21792.exe | executable | |
MD5:69A8BFAFF93B9CB89F342D72C87836CE | SHA256:F2439B868FA00DB18B8BA40D48EB6C4DFD1B07A5993EB198DE6DC971F129E7E5 | |||
| 1228 | Unicorn-21792.exe | C:\Users\admin\AppData\Local\Temp\Unicorn-28144.exe | executable | |
MD5:D4444FB933E2A7B6073D7016E88FBA07 | SHA256:41B6EDD734FE521EE1E795406AC74EF33007F9F27E2F382068B7AEE65AF22380 | |||
| 6488 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\4f5a56b0-f478-4400-a978-a76d13a08656.d9891cfd-e7c2-4ea1-a8d0-69da683c628b.down_meta | binary | |
MD5:0EA64F820E2C6A963DEA28ED18C36F66 | SHA256:FB030CC5212C71F78CE8809275141EF57C13E053F1BB0C9A770476F1B59F73C9 | |||
| 904 | 1 (1389).exe | C:\Users\admin\AppData\Local\Temp\Unicorn-59295.exe | executable | |
MD5:1DC0EBDDFC89783323A6AD7ECB3FCACA | SHA256:235E3D46F375AC82A4C5B6E4C992FF8134C94848B3DBC458AEC5076522FE3B37 | |||
| 6488 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\4f5a56b0-f478-4400-a978-a76d13a08656.up_meta_secure | binary | |
MD5:51F7DA4516A3231AE22B13CBE126D6EA | SHA256:FFB1E28D2A67E809373AB7DB12A628E9F5FE79378E2250AAAD692B7DA969A77F | |||
| 6488 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
| 6488 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:9314441F97CD6F7E428A1858A37A49EF | SHA256:4B8F45343C6A06CBE646F750396D833E0EF7327DAD2D25D95AA92A7CD9D25FEB | |||
| 6488 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\592b1298-8e7b-4a11-b1d0-ed6edfbd32c6.d9891cfd-e7c2-4ea1-a8d0-69da683c628b.down_meta | binary | |
MD5:0EA64F820E2C6A963DEA28ED18C36F66 | SHA256:FB030CC5212C71F78CE8809275141EF57C13E053F1BB0C9A770476F1B59F73C9 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
18
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4268 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.16.168.124:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6488 | BackgroundTransferHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7812 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7812 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.16.168.124:80 | crl.microsoft.com | Akamai International B.V. | RU | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.160.67:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
2112 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4268 | backgroundTaskHost.exe | 20.223.35.26:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4268 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |