Edit tour

Windows Analysis Report
(No subject) (90).eml

Overview

General Information

Sample name:	(No subject) (90).eml
Analysis ID:	1538719
MD5:	71afd3242fc290bf6847beb17263c551
SHA1:	a1f14c40abdce2e4e9b2b27b50c588b05a115ddc
SHA256:	e02650bed86b36ded4713048741d2d52d9ca5aed3096dd30d1ed76116393212f
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected potential phishing Email

Suspicious MSG / EML detected (based on various text indicators)

Detected suspicious crossdomain redirect

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Outlook Security Settings Updated - Registry

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 3112 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\(No subject) (90).eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 544 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "88BA60EF-D248-4381-B63E-717F78FE9EC4" "BD78D5FB-0AC4-4CDF-AC8B-FE207EE80AE5" "3112" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 6452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Favbbr-rb3qaue3c.us22.list-manage.com%2Ftrack%2Fclick%3Fu%3D3cdf2d74abf222c6b4ae493d3%26id%3D7094920e5c%26e%3Dc056d10030%23hgillette%40santaclaraca.gov%23&data=05%7C02%7Chgillette%40santaclaraca.gov%7C7ee52c5c09bf488155e008dcef55275f%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638648396288656756%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=oG3JRRL%2FQQlVv4k9WjUfqnkVh4si7y9AZlV44Gtc10Q%3D&reserved=0 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6640 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1984,i,9039987064207983653,684999351343344289,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

msedge.exe (PID: 3896 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0846ZJPU\email.mht MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7268 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1956,i,17295024196049019224,14762295267959612625,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

chrome.exe (PID: 3472 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Favbbr-rb3qaue3c.us22.list-manage.com%2Ftrack%2Fclick%3Fu%3D3cdf2d74abf222c6b4ae493d3%26id%3D7094920e5c%26e%3Dc056d10030%23hgillette%40santaclaraca.gov%23&data=05%7C02%7Chgillette%40santaclaraca.gov%7C7ee52c5c09bf488155e008dcef55275f%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638648396288656756%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=oG3JRRL%2FQQlVv4k9WjUfqnkVh4si7y9AZlV44Gtc10Q%3D&reserved=0 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 796 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1200 --field-trial-handle=1992,i,17837752971670303683,2202200612718250401,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

msedge.exe (PID: 7296 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0846ZJPU\email.mht MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7552 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1980,i,16275543048844463963,4103199009093388035,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8632 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6540 --field-trial-handle=1980,i,16275543048844463963,4103199009093388035,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8652 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6732 --field-trial-handle=1980,i,16275543048844463963,4103199009093388035,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5464 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5148 --field-trial-handle=1980,i,16275543048844463963,4103199009093388035,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 3112, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Outlook Security Settings Updated - Registry

Source: Registry Key set

Author: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0846ZJPU\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 3112, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Suspicious MSG / EML detected (based on various text indicators)

Source: MSG / EML

OCR Text: DocuSign Pending Contract Agreement Document is ready for hgillette@santaclaraca.gov VIEW COMPLETED DOCUMENT Confidential information intended only for the use of the individual or entity named above. If you have received this as error, please notify the sender immediately and delete from your email. Any unauthorized disclosure, copying, distribution, or use of the information contained in this fax is strictly prohibited. The information in this email is confidential and may be privileged or subject to copyright. It is intended for the exclusive use of the addressee(s). If you are not an addressee and/or not an intended addressee to this email, please do not copy, distribute or othenvise act on the email. If you have received the email in error, please contact the sender immediately and delete the email and any attachment in this email from your system. If you are not the intended recipient you must not copy this message or attachment or disclose the contents to any other person. The unauthorised use of this email may result in liability for breach of confidentiality, privilege or copyright. E-mail transmissions cannot be guaranteed to be secure or error-free as information could be intercepted, conupted, lost, destroyed, anive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message which arise as a result of e-mail transmission

Source: unknown	HTTPS traffic detected: 20.190.160.20:443 -> 192.168.2.17:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.20:443 -> 192.168.2.17:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.101.66:443 -> 192.168.2.17:49771 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: gcc02.safelinks.protection.outlook.com to https://avbbr-rb3qaue3c.us22.list-manage.com/track/click?u=3cdf2d74abf222c6b4ae493d3&id=7094920e5c&e=c056d10030#hgillette@santaclaraca.gov#
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: link.mail.beehiiv.com to https://milesofsmilesfoundation.org/?utm_source=marys-newsletter-e857bc.beehiiv.com&utm_medium=newsletter&utm_campaign=new-post
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: gcc02.safelinks.protection.outlook.com to https://avbbr-rb3qaue3c.us22.list-manage.com/track/click?u=3cdf2d74abf222c6b4ae493d3&id=7094920e5c&e=c056d10030#hgillette@santaclaraca.gov#
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: link.mail.beehiiv.com to https://milesofsmilesfoundation.org/?utm_source=marys-newsletter-e857bc.beehiiv.com&utm_medium=newsletter&utm_campaign=new-post

Source: global traffic

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 13.107.246.38 13.107.246.38
Source: Joe Sandbox View	IP Address: 104.18.68.40 104.18.68.40
Source: Joe Sandbox View	IP Address: 104.47.65.28 104.47.65.28

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=duZveDGKDdT+ygm&MD=4+SAO1DX HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?url=https%3A%2F%2Favbbr-rb3qaue3c.us22.list-manage.com%2Ftrack%2Fclick%3Fu%3D3cdf2d74abf222c6b4ae493d3%26id%3D7094920e5c%26e%3Dc056d10030%23hgillette%40santaclaraca.gov%23&data=05%7C02%7Chgillette%40santaclaraca.gov%7C7ee52c5c09bf488155e008dcef55275f%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638648396288656756%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=oG3JRRL%2FQQlVv4k9WjUfqnkVh4si7y9AZlV44Gtc10Q%3D&reserved=0 HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ls/click?upn=u001.viGU38YukUtIGED3xC-2FGZVVRTa8EQFrXUNq6P7v2HlSzf3J6EESK8xb0jfveQsEBZypXCaKcEhx5bb3L3ICkkhztNbCwiq1sFZKeng-2FI69YJzHKrsERxgWrKmR63SxJZ9KCLXcK4xUcWHfbfu5hevuQVFFNApx-2F8NGHiSPFzqe3-2BMAPnzXLXMjxF0o9e-2FvvW4JBD_2Rm0-2FS-2FJF-2BLH33iip41NYhQwe4HGorVV87kkY-2BZe-2BjYuS-2FBX3aFc1572-2FjYDbqEhZBU-2B1BLjshLrRtnmcIF6JcynI8pDqHRo5m1Xj-2FMj9PxI9xRRWwPvd8896vPxgCp61xoUzIBqcz5TAOihGDphxLBXyw5Eg7-2F5IBWE4VUjhfNJFOa6frl8Zto3ZQToQ3KwMu5aboIEADgZLVkPsSF7m0YRoX47natiyv0BOXToIW471V08sbfTDqhkPUqvTX-2FMZRkws5G-2BYiVkuEyx3pYhK-2Bw17GWDAE36jDfot-2F8UFq1HLsEjDW-2F-2BkGQ4yqCgNTsQSxhyWCxjGKn6teGhDZVl4oqgGFt2YXLiULX-2Fiq4-2Fco1MDzpqxXw-2F4tVWZGPBnNL984rImyAdJhDGx0N-2BNgXqdAACaqqwvVHw4x4J65gwn43gHrJshLRM7DzroSVH1srF HTTP/1.1Host: link.mail.beehiiv.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VywseXPF6DpmaP2KXF4TdJ6uz1pHJdo7SIzf64awZn_DsPwbF0Oii_eW16b6DjZW2yznOTlm_VxQeAWAuOcWr9enBdMY228AFVKEGaLo1DSnWlaxBThs2IAXfaAO1h0AxlKa5Znxy93x0I97CvvQ6KVcNCMVw4_g/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_82_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730128911&P2=404&P3=2&P4=dPAPCeCU4n%2bvMAeY1OGLudYGfgHb%2b4GKjtlYXcqpW9fA2v6SyGlYlYB0rf1SQlgZN%2fC6NbXluDz%2bqLfq33rq9g%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: apwiqwA4KSjHpW6UnW1X/ASec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=duZveDGKDdT+ygm&MD=4+SAO1DX HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?url=https%3A%2F%2Favbbr-rb3qaue3c.us22.list-manage.com%2Ftrack%2Fclick%3Fu%3D3cdf2d74abf222c6b4ae493d3%26id%3D7094920e5c%26e%3Dc056d10030%23hgillette%40santaclaraca.gov%23&data=05%7C02%7Chgillette%40santaclaraca.gov%7C7ee52c5c09bf488155e008dcef55275f%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638648396288656756%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=oG3JRRL%2FQQlVv4k9WjUfqnkVh4si7y9AZlV44Gtc10Q%3D&reserved=0 HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ls/click?upn=u001.viGU38YukUtIGED3xC-2FGZVVRTa8EQFrXUNq6P7v2HlSzf3J6EESK8xb0jfveQsEBZypXCaKcEhx5bb3L3ICkkhztNbCwiq1sFZKeng-2FI69YJzHKrsERxgWrKmR63SxJZ9KCLXcK4xUcWHfbfu5hevuQVFFNApx-2F8NGHiSPFzqe3-2BMAPnzXLXMjxF0o9e-2FvvW4JBD_2Rm0-2FS-2FJF-2BLH33iip41NYhQwe4HGorVV87kkY-2BZe-2BjYuS-2FBX3aFc1572-2FjYDbqEhZBU-2B1BLjshLrRtnmcIF6JcynI8pDqHRo5m1Xj-2FMj9PxI9xRRWwPvd8896vPxgCp61xoUzIBqcz5TAOihGDphxLBXyw5Eg7-2F5IBWE4VUjhfNJFOa6frl8Zto3ZQToQ3KwMu5aboIEADgZLVkPsSF7m0YRoX47natiyv0BOXToIW471V08sbfTDqhkPUqvTX-2FMZRkws5G-2BYiVkuEyx3pYhK-2Bw17GWDAE36jDfot-2F8UFq1HLsEjDW-2F-2BkGQ4yqCgNTsQSxhyWCxjGKn6teGhDZVl4oqgGFt2YXLiULX-2Fiq4-2Fco1MDzpqxXw-2F4tVWZGPBnNL984rImyAdJhDGx0N-2BNgXqdAACaqqwvVHw4x4J65gwn43gHrJshLRM7DzroSVH1srF HTTP/1.1Host: link.mail.beehiiv.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=jqGF.szNHTlWcp2sVDTHR8loDXwuRhaGq_P2rX9XBsg-1729524102-1.0.1.1-23SR8_pMaAEzqaJTKDFHbZDcfyTPXF7CZq8hslTBhiCfuQcX4381zZJ7_WUhDCaGh0Z4XnUf1Gu4XrfYGLYXtQ
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -240X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAYAyRJ4NfJvl7VoKEBus9MYiSdlG9UeNomFvoYVP6pzR5llQfQaWgTsSVdpbYUPsLoSO5mM6vsCFljp0PYD3IQPfsB%2B8lapgE66V3LzTSS1Ja9c0M5T1HdL9BHChlRKeM1lqrO/5wbPVnTZthFi4mx/VygZXObhw%2Bh6joeJ8rGej5dpIIDNlsQDalxynI/YWKM2x7jx7Xb8o7g78Xf97oZmTimXrTyEqIdi3hwQWeYhnX6V9chAVot5Zt01b4nbpkiit0G55%2B1%2BjsBOme7MmSnUbmHPxUegNabV3I374EGSokp1HnMo7O0eJqTVjf87k9PP9WJFB/tdSJo2dWWn%2B/lcQZgAAECuYVYVfpFKqDptQ6Bt0CzywAcV8Rzz00tJ04SFwIGuF7kwjIZnjx00N2e/dYho26N5x%2Bj8sUfrs22pw4vE%2BzK%2B4HA7RqBivpLKTuU7YnBth6NFpjOiLZ05Jhj/DMbJhWK%2BzkcN%2BYX72zjxFvRQG03WxXB8FYwZXQ4ag2Ijm%2BBVmzKgz8ghNxa5eNhPD%2BDnIU5I3wlJKovpubtfmkPeJDO9vAla%2BgcdbBJ9om1YkLInmfSWLEcsB52jIFRsyTCxFLrKvdmevxUc%2B3y6FoUsTa0e9cH4SyN4tZ8cNglMhS8CiEFYz0r1Ipv7/RmbK2iFN5Y6z9oNqGwEKFZOguNU3acYHioP8VIj6yp4HvL1JeL1F8hTNie3hHFolfmyZ4K5Z1/fRemWKDieASg26PcqKT8TeLLW/cfGBi8GmAfnnoYIzwSPQ14XFYOQOfTFew0ojCj2UWw3plYRfUqoPXcd5adrm5kW18UyxcAe1/q72petydanLKz7xO7ifgRNV0o5gjgv2POZ8juNcZmWpu%2B%2BV4N6xwPRpRPS/LFe4yyH9MSslv6ibhgCs6VmxVApFmTiMiTMNS%2B54HbD6DjtnJN6Ck7kQetoB%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1729524160User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 0DA3F1A288B5483EAEBB19D89088830DX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B

Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: email.mht.0.dr	String found in binary or memory: <https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.facebook.com%2Fpages%2FWashington-DC%2FQuality-Trust-for-Individuals-with-Disabilities%2F127197883741&data=05%7C02%7Chgillette%40santaclaraca.gov%7C7ee52c5c09bf488155e008dcef55275f%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638648396288707137%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=zjMS1AdjXZ6lv1Uu%2BOORcv9tnIeOFW3MhtDFcf%2Bqctc%3D&reserved=0> Follow us on facebook equals www.facebook.com (Facebook)
Source: (No subject) (90).eml	String found in binary or memory: /gcc02.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fwww.facebook.co= equals www.facebook.com (Facebook)
Source: email.mht.0.dr	String found in binary or memory: 2Fwww.facebook.com%2Fpages%2FWashington-DC%2FQuality-Trust-for-Individual= equals www.facebook.com (Facebook)
Source: (No subject) (90).eml	String found in binary or memory: Follow us on=A0facebook http://www.facebook.com/pages/Washington-DC/Qu= equals www.facebook.com (Facebook)
Source: ~WRS{9AF887E2-4FD2-4F2B-A752-8DE8B6F713E9}.tmp.0.dr	String found in binary or memory: HYPERLINK "https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.facebook.com%2Fpages%2FWashington-DC%2FQuality-Trust-for-Individuals-with-Disabilities%2F127197883741&data=05%7C02%7Chgillette%40santaclaraca.gov%7C7ee52c5c09bf488155e008dcef55275f%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638648396288707137%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=zjMS1AdjXZ6lv1Uu%2BOORcv9tnIeOFW3MhtDFcf%2Bqctc%3D&reserved=0" \t "_blank" equals www.facebook.com (Facebook)
Source: email.mht.0.dr	String found in binary or memory: originalsrc=3D"http://www.facebook.com/pages/Washington-DC/Quality-Trust-= equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: gcc02.safelinks.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: avbbr-rb3qaue3c.us22.list-manage.com
Source: global traffic	DNS traffic detected: DNS query: link.mail.beehiiv.com
Source: global traffic	DNS traffic detected: DNS query: milesofsmilesfoundation.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: (No subject) (90).eml, email.mht.0.dr	String found in binary or memory: http://www.dcqualitytrust.org/
Source: (No subject) (90).eml	String found in binary or memory: https://Wid1x-h3jsHqopQ.us22.list-manage.com/t=
Source: (No subject) (90).eml, email.mht.0.dr	String found in binary or memory: https://aka.ms/o0ukef
Source: email.mht.0.dr	String found in binary or memory: https://avbbr-rb3qaue3c.us22.list-manage.com/track/click?u=
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://bard.google.com/
Source: Reporting and NEL.13.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.12.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.12.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.12.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.12.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 94accb8f-c467-4130-9c0f-3d047c4277e2.tmp.13.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.12.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 94accb8f-c467-4130-9c0f-3d047c4277e2.tmp.13.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: Reporting and NEL.13.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.12.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.12.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.12.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.12.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log6.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log5.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr, HubApps Icons.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log6.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr, HubApps Icons.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log6.12.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://gaana.com/
Source: (No subject) (90).eml	String found in binary or memory: https://gcc02.safelin=
Source: (No subject) (90).eml	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=
Source: (No subject) (90).eml	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=3Dh=
Source: email.mht.0.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%=
Source: email.mht.0.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F=
Source: (No subject) (90).eml	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=3Dhttps%=
Source: ~WRS{9AF887E2-4FD2-4F2B-A752-8DE8B6F713E9}.tmp.0.dr, email.mht.0.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.dcqualitytrust.org%2F&data=05%7
Source: email.mht.0.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Faka.ms%2Fo0ukef&data=05%7C02%7Chgi
Source: ~WRS{9AF887E2-4FD2-4F2B-A752-8DE8B6F713E9}.tmp.0.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Favbbr-rb3qaue3c.us22.list-manage.c
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://m.kugou.com/
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://m.soundcloud.com/
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://m.vk.com/
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://music.amazon.com
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://music.apple.com
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://music.yandex.com
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://open.spotify.com
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://tidal.com/
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://twitter.com/
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://vibe.naver.com/today
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://web.telegram.org/
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://web.whatsapp.com
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.deezer.com/
Source: content.js.12.dr, content_new.js.12.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.12.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.instagram.com
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.last.fm/
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.messenger.com
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.office.com
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.tiktok.com/
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://www.youtube.com
Source: ea3ea00c-e183-45cb-a61c-d8592bbce8c3.tmp.12.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.190.160.20:443 -> 192.168.2.17:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.20:443 -> 192.168.2.17:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.17:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.101.66:443 -> 192.168.2.17:49771 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.winEML@73/248@20/14