Windows Analysis Report
d Notice.eml

Phishing

Source: https://link.edgepilot.com/s/120a65cd/92faESPp9EiMtn721vn3cg?u=http://link.adder.com/c/7/eyJhaSI6MzMwMzUyMDMsImUiOiJyc2hlcGhlcmRAaW5kdXN0cmlhbG5ldHdvcmtpbmcuY29tIiwicmkiOiJsZWFkLTQ3YTY2YjE3NzM1NWVmMTFiZmUzNjA0NWJkMTBmMDZiLWY3MGRkYTcyN2NiMzQ0YzA4MDIyYjBhZGU0NDQyYzg5IiwicnEiOiJwMS1iMjQyMjYtOGNjNDhmOGI1YjdkNDIyYTk2ZmFjOGNhMjViMjg1ZjkiLCJwaCI6bnVsbCwibSI6ZmFsc2UsInVpIjoiMiIsInVuIjoiIiwidSI6Imh0dHBzOi8vYWRkZXIuY29tL2VuL2FkZHJlc3MtYXNzaWdubWVudC10aW1lb3V0P3V0bV9zb3VyY2U9ZW5kdXNlci1lbWFpbCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1BTElGQUFUJnV0bV9jb250ZW50PWVtYWlsMiZfY2xkZWU9djZEQ1Q3STc4dDJFOGlIT25icGFLQm5LdDN3M1NqWHNsTUR5UGhlUHRRMHktckRTbEwtMFJxVkJmdTNzVG4zUnI5SUJNam81cVdnd2VrNlU5Tmd3YUEmcmVjaXBpZW50aWQ9bGVhZC00N2E2NmIxNzczNTVlZjExYmZlMzYwNDViZDEwZjA2Yi1mNzBkZGE3MjdjYjM0NGMwODAyMmIwYWRlNDQ0MmM4OSZlc2lkPTYwNzBmNTU4LWMzNTgtZWYxMS1iZmUyLTdjMWU1MjJlMjMwMSJ9/rZBkfKjBfqredTQS-2QacA

HTTP Parser: Base64 decoded: http://link.adder.com/c/7/eyJhaSI6MzMwMzUyMDMsImUiOiJyc2hlcGhlcmRAaW5kdXN0cmlhbG5ldHdvcmtpbmcuY29tIiwicmkiOiJsZWFkLTQ3YTY2YjE3NzM1NWVmMTFiZmUzNjA0NWJkMTBmMDZiLWY3MGRkYTcyN2NiMzQ0YzA4MDIyYjBhZGU0NDQyYzg5IiwicnEiOiJwMS1iMjQyMjYtOGNjNDhmOGI1YjdkNDIyYTk2ZmFjO...

Source: https://link.edgepilot.com/s/120a65cd/92faESPp9EiMtn721vn3cg?u=http://link.adder.com/c/7/eyJhaSI6MzMwMzUyMDMsImUiOiJyc2hlcGhlcmRAaW5kdXN0cmlhbG5ldHdvcmtpbmcuY29tIiwicmkiOiJsZWFkLTQ3YTY2YjE3NzM1NWVmMTFiZmUzNjA0NWJkMTBmMDZiLWY3MGRkYTcyN2NiMzQ0YzA4MDIyYjBhZGU0NDQyYzg5IiwicnEiOiJwMS1iMjQyMjYtOGNjNDhmOGI1YjdkNDIyYTk2ZmFjOGNhMjViMjg1ZjkiLCJwaCI6bnVsbCwibSI6ZmFsc2UsInVpIjoiMiIsInVuIjoiIiwidSI6Imh0dHBzOi8vYWRkZXIuY29tL2VuL2FkZHJlc3MtYXNzaWdubWVudC10aW1lb3V0P3V0bV9zb3VyY2U9ZW5kdXNlci1lbWFpbCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1BTElGQUFUJnV0bV9jb250ZW50PWVtYWlsMiZfY2xkZWU9djZEQ1Q3STc4dDJFOGlIT25icGFLQm5LdDN3M1NqWHNsTUR5UGhlUHRRMHktckRTbEwtMFJxVkJmdTNzVG4zUnI5SUJNam81cVdnd2VrNlU5Tmd3YUEmcmVjaXBpZW50aWQ9bGVhZC00N2E2NmIxNzczNTVlZjExYmZlMzYwNDViZDEwZjA2Yi1mNzBkZGE3MjdjYjM0NGMwODAyMmIwYWRlNDQ0MmM4OSZlc2lkPTYwNzBmNTU4LWMzNTgtZWYxMS1iZmUyLTdjMWU1MjJlMjMwMSJ9/rZBkfKjBfqredTQS-2QacA

HTTP Parser: No favicon

Source: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301

HTTP Parser: No favicon

Compliance

Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.242.39.171:443 -> 192.168.2.16:59289 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:59290 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:59291 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:59293 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.16:59398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:59400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.28:443 -> 192.168.2.16:55930 version: TLS 1.2

Networking

Source: global traffic	TCP traffic: 192.168.2.16:55912 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59288 -> 162.159.36.2:53

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: gcc02.safelinks.protection.outlook.com to https://urldefense.com/v3/__https:/link.edgepilot.com/s/120a65cd/92faespp9eimtn721vn3cg?u=http:**alink.adder.com*c*7*eyjhasi6mzmwmzuymdmsimuioijyc2hlcghlcmraaw5kdxn0cmlhbg5ldhdvcmtpbmcuy29tiiwicmkioijszwfkltq3yty2yje3nzm1nwvmmtfizmuznja0nwjkmtbmmdzilwy3mgrkytcyn2nimzq0yza4mdiyyjbhzgu0ndqyyzg5iiwicneioijwms1imjqymjytognjndhmogi1yjdkndiyytk2zmfjognhmjvimjg1zjkilcjwaci6bnvsbcwibsi6zmfsc2usinvpijoimiisinvuijoiiiwidsi6imh0dhbzoi8vywrkzxiuy29tl2vul2fkzhjlc3mtyxnzawdubwvudc10aw1lb3v0p3v0bv9zb3vyy2u9zw5kdxnlci1lbwfpbcz1dg1fbwvkaxvtpwvtywlsjnv0bv9jyw1wywlnbj1btelgqufujnv0bv9jb250zw50pwvtywlsmizfy2xkzwu9djzeq1q3stc4ddjfoglit25icgflqm5lddn3m1nqwhnstur5ughluhrrmhktckrtbewtmfjxvkjmdtnzvg4zuni5sujnam81cvdnd2vrnlu5tmd3yuemcmvjaxbpzw50awq9bgvhzc00n2e2nmixnzczntvlzjexymzlmzywndvizdewzja2yi1mnzbkzge3mjdjyjm0ngmwodaymmiwywrlndq0mmm4oszlc2lkptywnzbmntu4lwmzntgtzwyxms1izmuyltdjmwu1mjjlmjmwmsj9*rzbkfkjbfqredtqs-2qaca__;ly8vly8v!!okyjeqkqqe9uhnq!yodux79b2ntpenpfehnycfujuuvzfg0fof1atcanpams76bnldmnoaotsaiim92xxm4x4uvdpoz9umgu8mnf0grykyf_n4f_lw0$
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: urldefense.com to https://link.edgepilot.com/s/120a65cd/92faespp9eimtn721vn3cg?u=http://link.adder.com/c/7/eyjhasi6mzmwmzuymdmsimuioijyc2hlcghlcmraaw5kdxn0cmlhbg5ldhdvcmtpbmcuy29tiiwicmkioijszwfkltq3yty2yje3nzm1nwvmmtfizmuznja0nwjkmtbmmdzilwy3mgrkytcyn2nimzq0yza4mdiyyjbhzgu0ndqyyzg5iiwicneioijwms1imjqymjytognjndhmogi1yjdkndiyytk2zmfjognhmjvimjg1zjkilcjwaci6bnvsbcwibsi6zmfsc2usinvpijoimiisinvuijoiiiwidsi6imh0dhbzoi8vywrkzxiuy29tl2vul2fkzhjlc3mtyxnzawdubwvudc10aw1lb3v0p3v0bv9zb3vyy2u9zw5kdxnlci1lbwfpbcz1dg1fbwvkaxvtpwvtywlsjnv0bv9jyw1wywlnbj1btelgqufujnv0bv9jb250zw50pwvtywlsmizfy2xkzwu9djzeq1q3stc4ddjfoglit25icgflqm5lddn3m1nqwhnstur5ughluhrrmhktckrtbewtmfjxvkjmdtnzvg4zuni5sujnam81cvdnd2vrnlu5tmd3yuemcmvjaxbpzw50awq9bgvhzc00n2e2nmixnzczntvlzjexymzlmzywndvizdewzja2yi1mnzbkzge3mjdjyjm0ngmwodaymmiwywrlndq0mmm4oszlc2lkptywnzbmntu4lwmzntgtzwyxms1izmuyltdjmwu1mjjlmjmwmsj9/rzbkfkjbfqredtqs-2qaca
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: link.edgepilot.com to http://link.adder.com/c/7/eyjhasi6mzmwmzuymdmsimuioijyc2hlcghlcmraaw5kdxn0cmlhbg5ldhdvcmtpbmcuy29tiiwicmkioijszwfkltq3yty2yje3nzm1nwvmmtfizmuznja0nwjkmtbmmdzilwy3mgrkytcyn2nimzq0yza4mdiyyjbhzgu0ndqyyzg5iiwicneioijwms1imjqymjytognjndhmogi1yjdkndiyytk2zmfjognhmjvimjg1zjkilcjwaci6bnvsbcwibsi6zmfsc2usinvpijoimiisinvuijoiiiwidsi6imh0dhbzoi8vywrkzxiuy29tl2vul2fkzhjlc3mtyxnzawdubwvudc10aw1lb3v0p3v0bv9zb3vyy2u9zw5kdxnlci1lbwfpbcz1dg1fbwvkaxvtpwvtywlsjnv0bv9jyw1wywlnbj1btelgqufujnv0bv9jb250zw50pwvtywlsmizfy2xkzwu9djzeq1q3stc4ddjfoglit25icgflqm5lddn3m1nqwhnstur5ughluhrrmhktckrtbewtmfjxvkjmdtnzvg4zuni5sujnam81cvdnd2vrnlu5tmd3yuemcmvjaxbpzw50awq9bgvhzc00n2e2nmixnzczntvlzjexymzlmzywndvizdewzja2yi1mnzbkzge3mjdjyjm0ngmwodaymmiwywrlndq0mmm4oszlc2lkptywnzbmntu4lwmzntgtzwyxms1izmuyltdjmwu1mjjlmjmwmsj9/rzbkfkjbfqredtqs-2qaca

Source: global traffic

HTTP traffic detected: GET /ab?clientId=B5786FF8-3453-4616-B94D-5348C714CD0F HTTP/1.1X-OfficeApp-BuildVersion: 16.0.11629.20316Accept-Encoding: gzip, deflateX-OfficeApp-Platform: universalX-OfficeApp-Language: en-CHX-OutlookMobile-Architecture: x64X-OutlookMobile-BuildFlavor: shipX-OutlookMobile-Environment: ProductionX-OfficeApp-MsoVersion: 10.0.19045X-OutlookMobile-HxServiceAccounts: NoneContent-Length: 0Content-Encoding: gzipHost: outlookmobile-office365-tas.msedge.netConnection: Keep-AliveCache-Control: no-cache

Source: global traffic

HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: */*APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAEApwChWQq5lNmBKsEPWGpnTgALtq6cu/9Dlxsars2jaiEPTBfZ1quoJbcAwU8Txaa8q3M1HduY4uLm+fCw8/qqsWP12ZUjUg7jK/RADXyVTCS49Jp/bOkotugNvMLEhFQWKroL6wTlvyng19/rY4p0GnonDOuwK1985i5xy4VbGZmqShzB9JWOn//Nn9jTG8fCy74/dR0vdzR9b3S6M2QnDehkJzz6WScdv103BPiylwOU0KubJRggyyddYCzzL6HvnUNKXvoIX+E4S+NgNS+6vR1WSTXxQJG89QgTb4nWlKoLIU4nqqAwUmlb93DzHEGNgbHQE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1727845180239Host: self.events.data.microsoft.comContent-Length: 8075Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 199.30.234.133 199.30.234.133
Source: Joe Sandbox View	IP Address: 52.71.28.102 52.71.28.102
Source: Joe Sandbox View	IP Address: 151.101.130.137 151.101.130.137
Source: Joe Sandbox View	IP Address: 151.101.130.137 151.101.130.137

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=DSpHTf5TW7M7KmK&MD=vUEYk3Uz HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /clientwebservice/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: fe3cr.delivery.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /sls/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=DSpHTf5TW7M7KmK&MD=vUEYk3Uz HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=DSpHTf5TW7M7KmK&MD=vUEYk3Uz HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Flink.edgepilot.com%2Fs%2F120a65cd%2F92faESPp9EiMtn721vn3cg%3Fu%3Dhttp%3A**Alink.adder.com*c*7*eyJhaSI6MzMwMzUyMDMsImUiOiJyc2hlcGhlcmRAaW5kdXN0cmlhbG5ldHdvcmtpbmcuY29tIiwicmkiOiJsZWFkLTQ3YTY2YjE3NzM1NWVmMTFiZmUzNjA0NWJkMTBmMDZiLWY3MGRkYTcyN2NiMzQ0YzA4MDIyYjBhZGU0NDQyYzg5IiwicnEiOiJwMS1iMjQyMjYtOGNjNDhmOGI1YjdkNDIyYTk2ZmFjOGNhMjViMjg1ZjkiLCJwaCI6bnVsbCwibSI6ZmFsc2UsInVpIjoiMiIsInVuIjoiIiwidSI6Imh0dHBzOi8vYWRkZXIuY29tL2VuL2FkZHJlc3MtYXNzaWdubWVudC10aW1lb3V0P3V0bV9zb3VyY2U9ZW5kdXNlci1lbWFpbCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1BTElGQUFUJnV0bV9jb250ZW50PWVtYWlsMiZfY2xkZWU9djZEQ1Q3STc4dDJFOGlIT25icGFLQm5LdDN3M1NqWHNsTUR5UGhlUHRRMHktckRTbEwtMFJxVkJmdTNzVG4zUnI5SUJNam81cVdnd2VrNlU5Tmd3YUEmcmVjaXBpZW50aWQ9bGVhZC00N2E2NmIxNzczNTVlZjExYmZlMzYwNDViZDEwZjA2Yi1mNzBkZGE3MjdjYjM0NGMwODAyMmIwYWRlNDQ0MmM4OSZlc2lkPTYwNzBmNTU4LWMzNTgtZWYxMS1iZmUyLTdjMWU1MjJlMjMwMSJ9*rZBkfKjBfqredTQS-2QacA__%3BLy8vLy8v!!OkyjEqkqqe9UhNQ!yODuX79B2nTpENPfehnyCFUJuuvzfg0fOf1aTCAnPaMS76bnldMNOaotsAiIm92xxm4x4Uvdpoz9UMGu8MnF0grYKYf_n4F_Lw0%24&data=05%7C02%7CADACoordinator%40santaclaraca.gov%7Cf93995ac148340abe72008dce15903fe%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638633019912809270%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=wjBPzL9yWOp7%2B1aISfeMP49loY2QWPkpt%2FoR6DLGdaI%3D&reserved=0 HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/__https:/link.edgepilot.com/s/120a65cd/92faESPp9EiMtn721vn3cg?u=http:**Alink.adder.com*c*7*eyJhaSI6MzMwMzUyMDMsImUiOiJyc2hlcGhlcmRAaW5kdXN0cmlhbG5ldHdvcmtpbmcuY29tIiwicmkiOiJsZWFkLTQ3YTY2YjE3NzM1NWVmMTFiZmUzNjA0NWJkMTBmMDZiLWY3MGRkYTcyN2NiMzQ0YzA4MDIyYjBhZGU0NDQyYzg5IiwicnEiOiJwMS1iMjQyMjYtOGNjNDhmOGI1YjdkNDIyYTk2ZmFjOGNhMjViMjg1ZjkiLCJwaCI6bnVsbCwibSI6ZmFsc2UsInVpIjoiMiIsInVuIjoiIiwidSI6Imh0dHBzOi8vYWRkZXIuY29tL2VuL2FkZHJlc3MtYXNzaWdubWVudC10aW1lb3V0P3V0bV9zb3VyY2U9ZW5kdXNlci1lbWFpbCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1BTElGQUFUJnV0bV9jb250ZW50PWVtYWlsMiZfY2xkZWU9djZEQ1Q3STc4dDJFOGlIT25icGFLQm5LdDN3M1NqWHNsTUR5UGhlUHRRMHktckRTbEwtMFJxVkJmdTNzVG4zUnI5SUJNam81cVdnd2VrNlU5Tmd3YUEmcmVjaXBpZW50aWQ9bGVhZC00N2E2NmIxNzczNTVlZjExYmZlMzYwNDViZDEwZjA2Yi1mNzBkZGE3MjdjYjM0NGMwODAyMmIwYWRlNDQ0MmM4OSZlc2lkPTYwNzBmNTU4LWMzNTgtZWYxMS1iZmUyLTdjMWU1MjJlMjMwMSJ9*rZBkfKjBfqredTQS-2QacA__;Ly8vLy8v!!OkyjEqkqqe9UhNQ!yODuX79B2nTpENPfehnyCFUJuuvzfg0fOf1aTCAnPaMS76bnldMNOaotsAiIm92xxm4x4Uvdpoz9UMGu8MnF0grYKYf_n4F_Lw0$ HTTP/1.1Host: urldefense.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/120a65cd/92faESPp9EiMtn721vn3cg?u=http://link.adder.com/c/7/eyJhaSI6MzMwMzUyMDMsImUiOiJyc2hlcGhlcmRAaW5kdXN0cmlhbG5ldHdvcmtpbmcuY29tIiwicmkiOiJsZWFkLTQ3YTY2YjE3NzM1NWVmMTFiZmUzNjA0NWJkMTBmMDZiLWY3MGRkYTcyN2NiMzQ0YzA4MDIyYjBhZGU0NDQyYzg5IiwicnEiOiJwMS1iMjQyMjYtOGNjNDhmOGI1YjdkNDIyYTk2ZmFjOGNhMjViMjg1ZjkiLCJwaCI6bnVsbCwibSI6ZmFsc2UsInVpIjoiMiIsInVuIjoiIiwidSI6Imh0dHBzOi8vYWRkZXIuY29tL2VuL2FkZHJlc3MtYXNzaWdubWVudC10aW1lb3V0P3V0bV9zb3VyY2U9ZW5kdXNlci1lbWFpbCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1BTElGQUFUJnV0bV9jb250ZW50PWVtYWlsMiZfY2xkZWU9djZEQ1Q3STc4dDJFOGlIT25icGFLQm5LdDN3M1NqWHNsTUR5UGhlUHRRMHktckRTbEwtMFJxVkJmdTNzVG4zUnI5SUJNam81cVdnd2VrNlU5Tmd3YUEmcmVjaXBpZW50aWQ9bGVhZC00N2E2NmIxNzczNTVlZjExYmZlMzYwNDViZDEwZjA2Yi1mNzBkZGE3MjdjYjM0NGMwODAyMmIwYWRlNDQ0MmM4OSZlc2lkPTYwNzBmNTU4LWMzNTgtZWYxMS1iZmUyLTdjMWU1MjJlMjMwMSJ9/rZBkfKjBfqredTQS-2QacA HTTP/1.1Host: link.edgepilot.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/3.3.7/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://link.edgepilot.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://link.edgepilot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/3.3.7/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://link.edgepilot.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://link.edgepilot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.2.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://link.edgepilot.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://link.edgepilot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/app.css?v=1 HTTP/1.1Host: link.edgepilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://link.edgepilot.com/s/120a65cd/92faESPp9EiMtn721vn3cg?u=http://link.adder.com/c/7/eyJhaSI6MzMwMzUyMDMsImUiOiJyc2hlcGhlcmRAaW5kdXN0cmlhbG5ldHdvcmtpbmcuY29tIiwicmkiOiJsZWFkLTQ3YTY2YjE3NzM1NWVmMTFiZmUzNjA0NWJkMTBmMDZiLWY3MGRkYTcyN2NiMzQ0YzA4MDIyYjBhZGU0NDQyYzg5IiwicnEiOiJwMS1iMjQyMjYtOGNjNDhmOGI1YjdkNDIyYTk2ZmFjOGNhMjViMjg1ZjkiLCJwaCI6bnVsbCwibSI6ZmFsc2UsInVpIjoiMiIsInVuIjoiIiwidSI6Imh0dHBzOi8vYWRkZXIuY29tL2VuL2FkZHJlc3MtYXNzaWdubWVudC10aW1lb3V0P3V0bV9zb3VyY2U9ZW5kdXNlci1lbWFpbCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1BTElGQUFUJnV0bV9jb250ZW50PWVtYWlsMiZfY2xkZWU9djZEQ1Q3STc4dDJFOGlIT25icGFLQm5LdDN3M1NqWHNsTUR5UGhlUHRRMHktckRTbEwtMFJxVkJmdTNzVG4zUnI5SUJNam81cVdnd2VrNlU5Tmd3YUEmcmVjaXBpZW50aWQ9bGVhZC00N2E2NmIxNzczNTVlZjExYmZlMzYwNDViZDEwZjA2Yi1mNzBkZGE3MjdjYjM0NGMwODAyMmIwYWRlNDQ0MmM4OSZlc2lkPTYwNzBmNTU4LWMzNTgtZWYxMS1iZmUyLTdjMWU1MjJlMjMwMSJ9/rZBkfKjBfqredTQS-2QacAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/3.3.7/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.2.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: link.edgepilot.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://link.edgepilot.com/s/120a65cd/92faESPp9EiMtn721vn3cg?u=http://link.adder.com/c/7/eyJhaSI6MzMwMzUyMDMsImUiOiJyc2hlcGhlcmRAaW5kdXN0cmlhbG5ldHdvcmtpbmcuY29tIiwicmkiOiJsZWFkLTQ3YTY2YjE3NzM1NWVmMTFiZmUzNjA0NWJkMTBmMDZiLWY3MGRkYTcyN2NiMzQ0YzA4MDIyYjBhZGU0NDQyYzg5IiwicnEiOiJwMS1iMjQyMjYtOGNjNDhmOGI1YjdkNDIyYTk2ZmFjOGNhMjViMjg1ZjkiLCJwaCI6bnVsbCwibSI6ZmFsc2UsInVpIjoiMiIsInVuIjoiIiwidSI6Imh0dHBzOi8vYWRkZXIuY29tL2VuL2FkZHJlc3MtYXNzaWdubWVudC10aW1lb3V0P3V0bV9zb3VyY2U9ZW5kdXNlci1lbWFpbCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1BTElGQUFUJnV0bV9jb250ZW50PWVtYWlsMiZfY2xkZWU9djZEQ1Q3STc4dDJFOGlIT25icGFLQm5LdDN3M1NqWHNsTUR5UGhlUHRRMHktckRTbEwtMFJxVkJmdTNzVG4zUnI5SUJNam81cVdnd2VrNlU5Tmd3YUEmcmVjaXBpZW50aWQ9bGVhZC00N2E2NmIxNzczNTVlZjExYmZlMzYwNDViZDEwZjA2Yi1mNzBkZGE3MjdjYjM0NGMwODAyMmIwYWRlNDQ0MmM4OSZlc2lkPTYwNzBmNTU4LWMzNTgtZWYxMS1iZmUyLTdjMWU1MjJlMjMwMSJ9/rZBkfKjBfqredTQS-2QacAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: link.edgepilot.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301 HTTP/1.1Host: adder.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301 HTTP/1.1Host: www.adder.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/default/files/css/css_XXfi7PtGEm9OnGaKhfAftbieeXrT_YXAF3qlrZ427gc.css?delta=0&language=en&theme=adder&include=eJxljFEKwzAMQy-UNkca9uKlBicOdrK2t18ZXdnYj5Aeknz3TiUiOAVIiSxmUQSZvO_CNZ9QOC8ddTtjUWShqQMKfTdc-PCfUk3hrkYx2WggczPNRu4_MDGI5rASPtTKDVW7d4MW_0hoYJAPs_j1eJF51DZQ2BdKYUjnQnVE2o6hhyfT6vGtc9E0hF6_AF_d HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/default/files/css/css_zE8Y9G7uIfYn2kD5r3gA3M5QsV9QXcyAgVu2I2MJgA4.css?delta=1&language=en&theme=adder&include=eJxljFEKwzAMQy-UNkca9uKlBicOdrK2t18ZXdnYj5Aeknz3TiUiOAVIiSxmUQSZvO_CNZ9QOC8ddTtjUWShqQMKfTdc-PCfUk3hrkYx2WggczPNRu4_MDGI5rASPtTKDVW7d4MW_0hoYJAPs_j1eJF51DZQ2BdKYUjnQnVE2o6hhyfT6vGtc9E0hF6_AF_d HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/fonts/myriad/myriad-set-pro_bold.woff HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.adder.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/fonts/myriad/myriad-set-pro_medium.woff HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.adder.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/fonts/myriad/myriad-set-pro_text.woff HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.adder.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/fonts/myriad/myriad-set-pro_thin.woff HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.adder.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /j.php?a=862656&u=https%3A%2F%2Fwww.adder.com%2Fen%2Faddress-assignment-timeout%3Futm_source%3Denduser-email%26utm_medium%3Demail%26utm_campaign%3DALIFAAT%26utm_content%3Demail2%26_cldee%3Dv6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA%26recipientid%3Dlead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89%26esid%3D6070f558-c358-ef11-bfe2-7c1e522e2301&vn=2.1&x=true HTTP/1.1Host: dev.visualwebsiteoptimizer.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.adder.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/default/files/js/js_-wTDSkpCpLhOwBJ_CQYGNj8bIb5JtUOhAe430kNjIUM.js?scope=header&delta=0&language=en&theme=adder&include=eJxljmsOgzAMgy9U6JFQSrtQlOKqDRvHH0M8BPsV-1OcmLwPxTpAqxbKTe1LzFoNbVwiD-qw7DbBRQmNkpOwIxY4kma8JarEVR-hyZtPcC-UZPfZ-kgCPnB3vrd_xDDAEjoltqzpbomfvqWRFnPdy8h4r1UuooBozGZ7k4X6MEB-PZ_AzOteCtNsD_EFIVZ1DA HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /modules/contrib/google_tag/js/gtm.js?skdi2m HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /modules/contrib/google_tag/js/gtag.js?skdi2m HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/default/files/js/js_8oVYWeujLTnoEvtIRlm-amqzl6NUxdbcfLsQw_4D12g.js?scope=header&delta=3&language=en&theme=adder&include=eJxljmsOgzAMgy9U6JFQSrtQlOKqDRvHH0M8BPsV-1OcmLwPxTpAqxbKTe1LzFoNbVwiD-qw7DbBRQmNkpOwIxY4kma8JarEVR-hyZtPcC-UZPfZ-kgCPnB3vrd_xDDAEjoltqzpbomfvqWRFnPdy8h4r1UuooBozGZ7k4X6MEB-PZ_AzOteCtNsD_EFIVZ1DA HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/logo.svg HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /j.php?a=862656&u=https%3A%2F%2Fwww.adder.com%2Fen%2Faddress-assignment-timeout%3Futm_source%3Denduser-email%26utm_medium%3Demail%26utm_campaign%3DALIFAAT%26utm_content%3Demail2%26_cldee%3Dv6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA%26recipientid%3Dlead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89%26esid%3D6070f558-c358-ef11-bfe2-7c1e522e2301&vn=2.1&x=true HTTP/1.1Host: dev.visualwebsiteoptimizer.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/images/burger-icon.svg HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /modules/contrib/google_tag/js/gtm.js?skdi2m HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /modules/contrib/google_tag/js/gtag.js?skdi2m HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/logo.svg HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/images/header-search-icon.svg HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /sites/default/files/js/js_8oVYWeujLTnoEvtIRlm-amqzl6NUxdbcfLsQw_4D12g.js?scope=header&delta=3&language=en&theme=adder&include=eJxljmsOgzAMgy9U6JFQSrtQlOKqDRvHH0M8BPsV-1OcmLwPxTpAqxbKTe1LzFoNbVwiD-qw7DbBRQmNkpOwIxY4kma8JarEVR-hyZtPcC-UZPfZ-kgCPnB3vrd_xDDAEjoltqzpbomfvqWRFnPdy8h4r1UuooBozGZ7k4X6MEB-PZ_AzOteCtNsD_EFIVZ1DA HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /eu01/v.gif?cd=0&a=862656&d=adder.com&u=DB718B2A812C7E08E346FE1AB67227EE8&h=35c7ef4c9a210279118ab32b126686d1&t=false HTTP/1.1Host: dev.visualwebsiteoptimizer.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/images/logos/logo_addercrest_queens_award.svg HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /sites/default/files/js/js_nMXzmgn1H9NW1i9vP01FtW8QuhGfY1kNje20harTicI.js?scope=footer&delta=0&language=en&theme=adder&include=eJxljmsOgzAMgy9U6JFQSrtQlOKqDRvHH0M8BPsV-1OcmLwPxTpAqxbKTe1LzFoNbVwiD-qw7DbBRQmNkpOwIxY4kma8JarEVR-hyZtPcC-UZPfZ-kgCPnB3vrd_xDDAEjoltqzpbomfvqWRFnPdy8h4r1UuooBozGZ7k4X6MEB-PZ_AzOteCtNsD_EFIVZ1DA HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/images/adder-tooth.png HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adder.com/sites/default/files/css/css_zE8Y9G7uIfYn2kD5r3gA3M5QsV9QXcyAgVu2I2MJgA4.css?delta=1&language=en&theme=adder&include=eJxljFEKwzAMQy-UNkca9uKlBicOdrK2t18ZXdnYj5Aeknz3TiUiOAVIiSxmUQSZvO_CNZ9QOC8ddTtjUWShqQMKfTdc-PCfUk3hrkYx2WggczPNRu4_MDGI5rASPtTKDVW7d4MW_0hoYJAPs_j1eJF51DZQ2BdKYUjnQnVE2o6hhyfT6vGtc9E0hF6_AF_dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /sites/default/files/js/js_-wTDSkpCpLhOwBJ_CQYGNj8bIb5JtUOhAe430kNjIUM.js?scope=header&delta=0&language=en&theme=adder&include=eJxljmsOgzAMgy9U6JFQSrtQlOKqDRvHH0M8BPsV-1OcmLwPxTpAqxbKTe1LzFoNbVwiD-qw7DbBRQmNkpOwIxY4kma8JarEVR-hyZtPcC-UZPfZ-kgCPnB3vrd_xDDAEjoltqzpbomfvqWRFnPdy8h4r1UuooBozGZ7k4X6MEB-PZ_AzOteCtNsD_EFIVZ1DA HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/images/adder_tooth_navy.svg HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adder.com/sites/default/files/css/css_zE8Y9G7uIfYn2kD5r3gA3M5QsV9QXcyAgVu2I2MJgA4.css?delta=1&language=en&theme=adder&include=eJxljFEKwzAMQy-UNkca9uKlBicOdrK2t18ZXdnYj5Aeknz3TiUiOAVIiSxmUQSZvO_CNZ9QOC8ddTtjUWShqQMKfTdc-PCfUk3hrkYx2WggczPNRu4_MDGI5rASPtTKDVW7d4MW_0hoYJAPs_j1eJF51DZQ2BdKYUjnQnVE2o6hhyfT6vGtc9E0hF6_AF_dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/images/footer-background.svg HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adder.com/sites/default/files/css/css_zE8Y9G7uIfYn2kD5r3gA3M5QsV9QXcyAgVu2I2MJgA4.css?delta=1&language=en&theme=adder&include=eJxljFEKwzAMQy-UNkca9uKlBicOdrK2t18ZXdnYj5Aeknz3TiUiOAVIiSxmUQSZvO_CNZ9QOC8ddTtjUWShqQMKfTdc-PCfUk3hrkYx2WggczPNRu4_MDGI5rASPtTKDVW7d4MW_0hoYJAPs_j1eJF51DZQ2BdKYUjnQnVE2o6hhyfT6vGtc9E0hF6_AF_dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/images/burger-icon.svg HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/images/socials/social-adder-linkedin.svg HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adder.com/sites/default/files/css/css_zE8Y9G7uIfYn2kD5r3gA3M5QsV9QXcyAgVu2I2MJgA4.css?delta=1&language=en&theme=adder&include=eJxljFEKwzAMQy-UNkca9uKlBicOdrK2t18ZXdnYj5Aeknz3TiUiOAVIiSxmUQSZvO_CNZ9QOC8ddTtjUWShqQMKfTdc-PCfUk3hrkYx2WggczPNRu4_MDGI5rASPtTKDVW7d4MW_0hoYJAPs_j1eJF51DZQ2BdKYUjnQnVE2o6hhyfT6vGtc9E0hF6_AF_dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/images/socials/social-adder-facebook.svg HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adder.com/sites/default/files/css/css_zE8Y9G7uIfYn2kD5r3gA3M5QsV9QXcyAgVu2I2MJgA4.css?delta=1&language=en&theme=adder&include=eJxljFEKwzAMQy-UNkca9uKlBicOdrK2t18ZXdnYj5Aeknz3TiUiOAVIiSxmUQSZvO_CNZ9QOC8ddTtjUWShqQMKfTdc-PCfUk3hrkYx2WggczPNRu4_MDGI5rASPtTKDVW7d4MW_0hoYJAPs_j1eJF51DZQ2BdKYUjnQnVE2o6hhyfT6vGtc9E0hF6_AF_dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /eu01/v.gif?cd=0&a=862656&d=adder.com&u=DB718B2A812C7E08E346FE1AB67227EE8&h=35c7ef4c9a210279118ab32b126686d1&t=false HTTP/1.1Host: dev.visualwebsiteoptimizer.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/images/socials/social-adder-vimeo.svg HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adder.com/sites/default/files/css/css_zE8Y9G7uIfYn2kD5r3gA3M5QsV9QXcyAgVu2I2MJgA4.css?delta=1&language=en&theme=adder&include=eJxljFEKwzAMQy-UNkca9uKlBicOdrK2t18ZXdnYj5Aeknz3TiUiOAVIiSxmUQSZvO_CNZ9QOC8ddTtjUWShqQMKfTdc-PCfUk3hrkYx2WggczPNRu4_MDGI5rASPtTKDVW7d4MW_0hoYJAPs_j1eJF51DZQ2BdKYUjnQnVE2o6hhyfT6vGtc9E0hF6_AF_dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/images/header-search-icon.svg HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/images/adder-tooth.png HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/images/adder_tooth_navy.svg HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/images/logos/logo_addercrest_queens_award.svg HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/images/footer-background.svg HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /sites/default/files/js/js_nMXzmgn1H9NW1i9vP01FtW8QuhGfY1kNje20harTicI.js?scope=footer&delta=0&language=en&theme=adder&include=eJxljmsOgzAMgy9U6JFQSrtQlOKqDRvHH0M8BPsV-1OcmLwPxTpAqxbKTe1LzFoNbVwiD-qw7DbBRQmNkpOwIxY4kma8JarEVR-hyZtPcC-UZPfZ-kgCPnB3vrd_xDDAEjoltqzpbomfvqWRFnPdy8h4r1UuooBozGZ7k4X6MEB-PZ_AzOteCtNsD_EFIVZ1DA HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/js/lightbox/images/prev.png HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adder.com/sites/default/files/css/css_zE8Y9G7uIfYn2kD5r3gA3M5QsV9QXcyAgVu2I2MJgA4.css?delta=1&language=en&theme=adder&include=eJxljFEKwzAMQy-UNkca9uKlBicOdrK2t18ZXdnYj5Aeknz3TiUiOAVIiSxmUQSZvO_CNZ9QOC8ddTtjUWShqQMKfTdc-PCfUk3hrkYx2WggczPNRu4_MDGI5rASPtTKDVW7d4MW_0hoYJAPs_j1eJF51DZQ2BdKYUjnQnVE2o6hhyfT6vGtc9E0hF6_AF_dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/js/lightbox/images/next.png HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adder.com/sites/default/files/css/css_zE8Y9G7uIfYn2kD5r3gA3M5QsV9QXcyAgVu2I2MJgA4.css?delta=1&language=en&theme=adder&include=eJxljFEKwzAMQy-UNkca9uKlBicOdrK2t18ZXdnYj5Aeknz3TiUiOAVIiSxmUQSZvO_CNZ9QOC8ddTtjUWShqQMKfTdc-PCfUk3hrkYx2WggczPNRu4_MDGI5rASPtTKDVW7d4MW_0hoYJAPs_j1eJF51DZQ2BdKYUjnQnVE2o6hhyfT6vGtc9E0hF6_AF_dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/js/lightbox/images/loading.gif HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adder.com/sites/default/files/css/css_zE8Y9G7uIfYn2kD5r3gA3M5QsV9QXcyAgVu2I2MJgA4.css?delta=1&language=en&theme=adder&include=eJxljFEKwzAMQy-UNkca9uKlBicOdrK2t18ZXdnYj5Aeknz3TiUiOAVIiSxmUQSZvO_CNZ9QOC8ddTtjUWShqQMKfTdc-PCfUk3hrkYx2WggczPNRu4_MDGI5rASPtTKDVW7d4MW_0hoYJAPs_j1eJF51DZQ2BdKYUjnQnVE2o6hhyfT6vGtc9E0hF6_AF_dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/js/lightbox/images/close.png HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adder.com/sites/default/files/css/css_zE8Y9G7uIfYn2kD5r3gA3M5QsV9QXcyAgVu2I2MJgA4.css?delta=1&language=en&theme=adder&include=eJxljFEKwzAMQy-UNkca9uKlBicOdrK2t18ZXdnYj5Aeknz3TiUiOAVIiSxmUQSZvO_CNZ9QOC8ddTtjUWShqQMKfTdc-PCfUk3hrkYx2WggczPNRu4_MDGI5rASPtTKDVW7d4MW_0hoYJAPs_j1eJF51DZQ2BdKYUjnQnVE2o6hhyfT6vGtc9E0hF6_AF_dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/images/socials/social-adder-linkedin.svg HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/images/socials/social-adder-facebook.svg HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/images/socials/social-adder-vimeo.svg HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/js/lightbox/images/prev.png HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/js/lightbox/images/next.png HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/js/lightbox/images/loading.gif HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/js/lightbox/images/close.png HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/favicon/site.webmanifest HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/favicon.ico HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/favicon.ico HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/favicon/favicon-32x32.png HTTP/1.1Host: www.adder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adder.com/en/address-assignment-timeout?utm_source=enduser-email&utm_medium=email&utm_campaign=ALIFAAT&utm_content=email2&_cldee=v6DCT7I78t2E8iHOnbpaKBnKt3w3SjXslMDyPhePtQ0y-rDSlL-0RqVBfu3sTn3Rr9IBMjo5qWgwek6U9NgwaA&recipientid=lead-47a66b177355ef11bfe36045bd10f06b-f70dda727cb344c08022b0ade4442c89&esid=6070f558-c358-ef11-bfe2-7c1e522e2301Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /themes/custom/adder/favicon/favicon-32x32.png HTTP/1.1Host: www.adder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _vwo_uuid_v2=DB718B2A812C7E08E346FE1AB67227EE8|35c7ef4c9a210279118ab32b126686d1
Source: global traffic	HTTP traffic detected: GET /ab?clientId=B5786FF8-3453-4616-B94D-5348C714CD0F HTTP/1.1X-OfficeApp-BuildVersion: 16.0.11629.20316Accept-Encoding: gzip, deflateX-OfficeApp-Platform: universalX-OfficeApp-Language: en-CHX-OutlookMobile-Architecture: x64X-OutlookMobile-BuildFlavor: shipX-OutlookMobile-Environment: ProductionX-OfficeApp-MsoVersion: 10.0.19045X-OutlookMobile-HxServiceAccounts: NoneContent-Length: 0Content-Encoding: gzipHost: outlookmobile-office365-tas.msedge.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /settings/v2.0/office/olx?app=microsoft.windowscommunicationsapps&appVer=16.0.11629.20316&locale=en-CH&os=WINDOWS&osVer=10.0.19045&deviceClass=Windows.Desktop&deviceId=B5786FF8-3453-4616-B94D-5348C714CD0F&ring=7 HTTP/1.1Accept: */*User-Agent: microsoft.windowscommunicationsappsAccept-Language: en-CHAccept-Encoding: gzip, deflate, brHost: settings.data.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c/7/eyJhaSI6MzMwMzUyMDMsImUiOiJyc2hlcGhlcmRAaW5kdXN0cmlhbG5ldHdvcmtpbmcuY29tIiwicmkiOiJsZWFkLTQ3YTY2YjE3NzM1NWVmMTFiZmUzNjA0NWJkMTBmMDZiLWY3MGRkYTcyN2NiMzQ0YzA4MDIyYjBhZGU0NDQyYzg5IiwicnEiOiJwMS1iMjQyMjYtOGNjNDhmOGI1YjdkNDIyYTk2ZmFjOGNhMjViMjg1ZjkiLCJwaCI6bnVsbCwibSI6ZmFsc2UsInVpIjoiMiIsInVuIjoiIiwidSI6Imh0dHBzOi8vYWRkZXIuY29tL2VuL2FkZHJlc3MtYXNzaWdubWVudC10aW1lb3V0P3V0bV9zb3VyY2U9ZW5kdXNlci1lbWFpbCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1BTElGQUFUJnV0bV9jb250ZW50PWVtYWlsMiZfY2xkZWU9djZEQ1Q3STc4dDJFOGlIT25icGFLQm5LdDN3M1NqWHNsTUR5UGhlUHRRMHktckRTbEwtMFJxVkJmdTNzVG4zUnI5SUJNam81cVdnd2VrNlU5Tmd3YUEmcmVjaXBpZW50aWQ9bGVhZC00N2E2NmIxNzczNTVlZjExYmZlMzYwNDViZDEwZjA2Yi1mNzBkZGE3MjdjYjM0NGMwODAyMmIwYWRlNDQ0MmM4OSZlc2lkPTYwNzBmNTU4LWMzNTgtZWYxMS1iZmUyLTdjMWU1MjJlMjMwMSJ9/rZBkfKjBfqredTQS-2QacA HTTP/1.1Host: link.adder.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: chromecache_252.12.dr	String found in binary or memory: <a href="https://www.facebook.com/AdderTechnology/" class="social-link social-link-facebook" target="_blank">Facebook</a> equals www.facebook.com (Facebook)
Source: chromecache_252.12.dr	String found in binary or memory: <a href="https://www.linkedin.com/company/adder-technology" class="social-link social-link-linkedin" target="_blank">Linkedin</a> equals www.linkedin.com (Linkedin)
Source: chromecache_224.12.dr, chromecache_261.12.dr	String found in binary or memory: CookieConsentDialog.privacyPolicies = [["analytics-eu.clickdimensions.com","ClickDimensions","https://clickdimensions.com/about/privacy-policy/"],["bing.com","Microsoft","https://privacy.microsoft.com/en-US/privacystatement"],["c1.microsoft.com","Microsoft","https://privacy.microsoft.com/en-us/privacystatement"],["cdn.forms.office.net","Microsoft","https://privacy.microsoft.com/en-US/privacystatement"],["consent.cookiebot.com","Cookiebot","https://www.cookiebot.com/goto/privacy-policy/"],["doubleclick.net","Google","https://business.safety.google/privacy/"],["f.vimeocdn.com","Vimeo","https://vimeo.com/privacy"],["forms.microsoft.com","Microsoft","https://privacy.microsoft.com/en-US/privacystatement"],["google.com","Google","https://business.safety.google/privacy/"],["googlesyndication.com","Google","https://business.safety.google/privacy/"],["hotjar.com","Hotjar","https://www.hotjar.com/legal/policies/privacy/"],["imgsct.cookiebot.com","Cookiebot","https://www.cookiebot.com/goto/privacy-policy/"],["linkedin.com","LinkedIn","https://www.linkedin.com/legal/privacy-policy"],["microsoft.com","Microsoft","https://privacy.microsoft.com/en-US/privacystatement"],["script.hotjar.com","Hotjar","https://www.hotjar.com/legal/policies/privacy/"],["vimeo.com","Vimeo","https://vimeo.com/privacy"],["www.google.com","Google","https://business.safety.google/privacy/"],["www.googletagmanager.com","Google","https://business.safety.google/privacy/"],["www.youtube.com","YouTube","https://business.safety.google/privacy/"],["youtube.com","YouTube","https://business.safety.google/privacy/"]]; equals www.linkedin.com (Linkedin)
Source: chromecache_224.12.dr, chromecache_261.12.dr	String found in binary or memory: CookieConsentDialog.privacyPolicies = [["analytics-eu.clickdimensions.com","ClickDimensions","https://clickdimensions.com/about/privacy-policy/"],["bing.com","Microsoft","https://privacy.microsoft.com/en-US/privacystatement"],["c1.microsoft.com","Microsoft","https://privacy.microsoft.com/en-us/privacystatement"],["cdn.forms.office.net","Microsoft","https://privacy.microsoft.com/en-US/privacystatement"],["consent.cookiebot.com","Cookiebot","https://www.cookiebot.com/goto/privacy-policy/"],["doubleclick.net","Google","https://business.safety.google/privacy/"],["f.vimeocdn.com","Vimeo","https://vimeo.com/privacy"],["forms.microsoft.com","Microsoft","https://privacy.microsoft.com/en-US/privacystatement"],["google.com","Google","https://business.safety.google/privacy/"],["googlesyndication.com","Google","https://business.safety.google/privacy/"],["hotjar.com","Hotjar","https://www.hotjar.com/legal/policies/privacy/"],["imgsct.cookiebot.com","Cookiebot","https://www.cookiebot.com/goto/privacy-policy/"],["linkedin.com","LinkedIn","https://www.linkedin.com/legal/privacy-policy"],["microsoft.com","Microsoft","https://privacy.microsoft.com/en-US/privacystatement"],["script.hotjar.com","Hotjar","https://www.hotjar.com/legal/policies/privacy/"],["vimeo.com","Vimeo","https://vimeo.com/privacy"],["www.google.com","Google","https://business.safety.google/privacy/"],["www.googletagmanager.com","Google","https://business.safety.google/privacy/"],["www.youtube.com","YouTube","https://business.safety.google/privacy/"],["youtube.com","YouTube","https://business.safety.google/privacy/"]]; equals www.youtube.com (Youtube)
Source: chromecache_269.12.dr, chromecache_229.12.dr	String found in binary or memory: Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},dk:function(){e=zb()},od:function(){d()}}};var gc=ja(["data-gtm-yt-inspected-"]),KC=["www.youtube.com","www.youtube-nocookie.com"],LC,MC=!1; equals www.youtube.com (Youtube)
Source: chromecache_269.12.dr, chromecache_229.12.dr	String found in binary or memory: if(!(e||f||g||k.length||m.length))return;var p={ih:e,gh:f,hh:g,Sh:k,Th:m,Ie:n,Bb:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var t=E.getElementsByTagName("script"),v=t.length,u=0;u<v;u++){var w=t[u].getAttribute("src");if(VC(w,"iframe_api")||VC(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!MC&&TC(x[A],p.Ie))return wc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_261.12.dr	String found in binary or memory: s interaction with embedded content.","1 day","HTTP Cookie","1","","www.youtube.com","en"],["VISITOR_INFO1_LIVE","youtube.com","Tries to estimate the users' bandwidth on pages with integrated YouTube videos.","180 days","HTTP Cookie","1","","youtube.com","en"],["YSC","youtube.com","Registers a unique ID to keep statistics of what videos from YouTube the user has seen.","Session","HTTP Cookie","1","","youtube.com","en"],["YtIdbMeta#databases","youtube.com","Used to track user equals www.youtube.com (Youtube)
Source: chromecache_261.12.dr	String found in binary or memory: s interaction with embedded content.","Persistent","IndexedDB","6","","www.youtube.com","en"],["remote_sid","youtube.com","Necessary for the implementation and functionality of YouTube video-content on the website. ","Session","HTTP Cookie","1","","www.youtube.com","en"],["ServiceWorkerLogsDatabase#SWHealthLog","youtube.com","Necessary for the implementation and functionality of YouTube video-content on the website. ","Persistent","IndexedDB","6","","www.youtube.com","en"],["TESTCOOKIESENABLED","youtube.com","Used to track user equals www.youtube.com (Youtube)
Source: chromecache_261.12.dr	String found in binary or memory: s interaction with embedded content.","Persistent","IndexedDB","6","","www.youtube.com","en"],["yt-remote-cast-available","youtube.com","Stores the user's video player preferences using embedded YouTube video","Session","HTML Local Storage","2","","www.youtube.com","en"],["yt-remote-cast-installed","youtube.com","Stores the user's video player preferences using embedded YouTube video","Session","HTML Local Storage","2","","www.youtube.com","en"],["yt-remote-connected-devices","youtube.com","Stores the user's video player preferences using embedded YouTube video","Persistent","HTML Local Storage","2","","www.youtube.com","en"],["yt-remote-device-id","youtube.com","Stores the user's video player preferences using embedded YouTube video","Persistent","HTML Local Storage","2","","www.youtube.com","en"],["yt-remote-fast-check-period","youtube.com","Stores the user's video player preferences using embedded YouTube video","Session","HTML Local Storage","2","","www.youtube.com","en"],["yt-remote-session-app","youtube.com","Stores the user's video player preferences using embedded YouTube video","Session","HTML Local Storage","2","","www.youtube.com","en"],["yt-remote-session-name","youtube.com","Stores the user's video player preferences using embedded YouTube video","Session","HTML Local Storage","2","","www.youtube.com","en"]]; equals www.youtube.com (Youtube)
Source: chromecache_261.12.dr	String found in binary or memory: s interaction with embedded content.","Session","HTML Local Storage","2","","www.youtube.com","en"],["iU5q-!O9@$","youtube.com","Registers a unique ID to keep statistics of what videos from YouTube the user has seen.","Session","HTML Local Storage","2","","www.youtube.com","en"],["LAST_RESULT_ENTRY_KEY","youtube.com","Used to track user equals www.youtube.com (Youtube)
Source: chromecache_224.12.dr, chromecache_261.12.dr	String found in binary or memory: s interaction with embedded content.","Session","HTTP Cookie","1","","www.youtube.com","en"],["LogsDatabaseV2:V#||LogsRequestsStore","youtube.com","Used to track user equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: gcc02.safelinks.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: urldefense.com
Source: global traffic	DNS traffic detected: DNS query: link.edgepilot.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: link.adder.com
Source: global traffic	DNS traffic detected: DNS query: adder.com
Source: global traffic	DNS traffic detected: DNS query: www.adder.com
Source: global traffic	DNS traffic detected: DNS query: adder-assets.s3.eu-west-1.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: kit.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: ka-f.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: dev.visualwebsiteoptimizer.com
Source: global traffic	DNS traffic detected: DNS query: cdn.forms.office.net
Source: global traffic	DNS traffic detected: DNS query: consent.cookiebot.com
Source: global traffic	DNS traffic detected: DNS query: consentcdn.cookiebot.com
Source: global traffic	DNS traffic detected: DNS query: imgsct.cookiebot.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: chromecache_227.12.dr, chromecache_234.12.dr, chromecache_212.12.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_244.12.dr, chromecache_263.12.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_244.12.dr, chromecache_263.12.dr	String found in binary or memory: http://jqueryui.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: chromecache_252.12.dr	String found in binary or memory: https://adderportal.adder.com/SignIn?ReturnUrl=/home/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: chromecache_229.12.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_218.12.dr, chromecache_250.12.dr	String found in binary or memory: https://aka.ms/FormsConsumerElite.
Source: d Notice.eml	String found in binary or memory: https://aka.ms/LearnA=
Source: d Notice.eml	String found in binary or memory: https://aka.ms/LearnAboutSenderIdentification
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.aadrm.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.aadrm.com/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.cortana.ai
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.microsoftstream.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.office.net
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.onedrive.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://api.scheduler.
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://app.powerbi.com
Source: chromecache_270.12.dr, chromecache_201.12.dr	String found in binary or memory: https://app.vwo.com/visitor-behavior-analysis/dist/codechecker/cc.min.js?r=
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://augloop.office.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://canary.designerapp.
Source: chromecache_269.12.dr, chromecache_229.12.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://cdn.entity.
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: chromecache_224.12.dr, chromecache_261.12.dr	String found in binary or memory: https://clickdimensions.com/about/privacy-policy/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://clients.config.office.net
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://clients.config.office.net/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://cortana.ai
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://cortana.ai/api
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://cr.office.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://d.docs.live.net
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://designerapp.azurewebsites.net
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://dev.cortana.ai
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: chromecache_270.12.dr, chromecache_201.12.dr	String found in binary or memory: https://dev.visualwebsiteoptimizer.com/apmLib-5ce467525679f340e4eb2c001944d089.js
Source: chromecache_270.12.dr, chromecache_201.12.dr	String found in binary or memory: https://dev.visualwebsiteoptimizer.com/e.gif?a=862656&s=j.php&e=
Source: chromecache_252.12.dr	String found in binary or memory: https://dev.visualwebsiteoptimizer.com/ee.gif?a=
Source: chromecache_270.12.dr, chromecache_201.12.dr	String found in binary or memory: https://dev.visualwebsiteoptimizer.com/ee.gif?s=mode_det&e=
Source: chromecache_270.12.dr, chromecache_201.12.dr	String found in binary or memory: https://dev.visualwebsiteoptimizer.com/eu01/events/
Source: chromecache_270.12.dr, chromecache_201.12.dr	String found in binary or memory: https://dev.visualwebsiteoptimizer.com/eu01/v.gif?cd=
Source: chromecache_252.12.dr	String found in binary or memory: https://dev.visualwebsiteoptimizer.com/j.php?a=
Source: chromecache_270.12.dr, chromecache_201.12.dr	String found in binary or memory: https://dev.visualwebsiteoptimizer.com/j.php?mode=
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://devnull.onenote.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://directory.services.
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://ecs.office.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://edge.skype.com/rps
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: chromecache_242.12.dr, chromecache_254.12.dr, chromecache_236.12.dr, chromecache_217.12.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_242.12.dr, chromecache_254.12.dr, chromecache_236.12.dr, chromecache_217.12.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: d Notice.eml	String found in binary or memory: https://gcc02.safelinks.pro=
Source: chromecache_215.12.dr, chromecache_204.12.dr	String found in binary or memory: https://git.drupalcode.org/project/once/-/raw/v1.0.1/LICENSE.md
Source: chromecache_215.12.dr, chromecache_204.12.dr	String found in binary or memory: https://github.com/focus-trap/tabbable/blob/master/LICENSE
Source: chromecache_234.12.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://graph.windows.net
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://graph.windows.net/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://ic3.teams.office.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://invites.office.com/
Source: chromecache_244.12.dr, chromecache_263.12.dr	String found in binary or memory: https://jquery.org/license
Source: chromecache_244.12.dr, chromecache_263.12.dr	String found in binary or memory: https://jqueryui.com
Source: chromecache_265.12.dr, chromecache_232.12.dr	String found in binary or memory: https://ka-f.fontawesome.com
Source: chromecache_265.12.dr, chromecache_232.12.dr	String found in binary or memory: https://kit.fontawesome.com
Source: chromecache_252.12.dr	String found in binary or memory: https://kit.fontawesome.com/b0f0751e5f.js
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://lifecycle.office.com
Source: d Notice.eml	String found in binary or memory: https://link.edgepilot.com/s/d0dc0c37/ufPd6tHeTUaAXp=
Source: d Notice.eml	String found in binary or memory: https://link.edgepilot.com/s/d0dc0c37/ufPd6tHeTUaAXpVQ4bGCbQ?u=3Dhttps://ww=
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://login.microsoftonline.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://login.microsoftonline.com/organizations
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://login.windows.local
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://make.powerautomate.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://management.azure.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://management.azure.com/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://messaging.action.office.com/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://messaging.office.com/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://mss.office.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://ncus.contentsync.
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://officeapps.live.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://officepyservice.office.net/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://onedrive.live.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://outlook.office.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://outlook.office.com/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://outlook.office365.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://outlook.office365.com/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: chromecache_229.12.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_269.12.dr, chromecache_229.12.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: chromecache_215.12.dr, chromecache_204.12.dr	String found in binary or memory: https://raw.githubusercontent.com/focus-trap/tabbable/v6.2.0/LICENSE
Source: chromecache_244.12.dr, chromecache_263.12.dr	String found in binary or memory: https://raw.githubusercontent.com/jashkenas/underscore/1.13.6/LICENSE
Source: chromecache_244.12.dr, chromecache_263.12.dr, chromecache_266.12.dr	String found in binary or memory: https://raw.githubusercontent.com/jquery/jquery-ui/1.13.2/LICENSE.txt
Source: chromecache_215.12.dr, chromecache_204.12.dr	String found in binary or memory: https://raw.githubusercontent.com/jquery/jquery/3.7.1/LICENSE.txt
Source: chromecache_215.12.dr, chromecache_204.12.dr	String found in binary or memory: https://raw.githubusercontent.com/muicss/loadjs/4.3.0/LICENSE.txt
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://res.cdn.office.net
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://service.powerapps.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://settings.outlook.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://staging.cortana.ai
Source: chromecache_269.12.dr, chromecache_229.12.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://substrate.office.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: chromecache_252.12.dr	String found in binary or memory: https://support.adder.com/tiki/tiki-index.php
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://tasks.office.com
Source: chromecache_269.12.dr, chromecache_229.12.dr	String found in binary or memory: https://td.doubleclick.net
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: chromecache_244.12.dr, chromecache_263.12.dr	String found in binary or memory: https://underscorejs.org
Source: d Notice.eml	String found in binary or memory: https://urldefense.com/v3/__https:/link.edgepilot.c=
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: chromecache_252.12.dr	String found in binary or memory: https://vimeo.com/addertechnology
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://wus2.contentsync.
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: chromecache_224.12.dr, chromecache_261.12.dr	String found in binary or memory: https://www.adder.com
Source: d Notice.eml, chromecache_252.12.dr	String found in binary or memory: https://www.adder.com/en/address-assignment-timeout
Source: chromecache_252.12.dr	String found in binary or memory: https://www.adder.com/en/address-assignment-timeout?utm_source=PANTHEON_STRIPPED&utm_medium=PANT
Source: chromecache_252.12.dr	String found in binary or memory: https://www.adder.com/en/kvm-solutions/secure#paragraph-title-bsecure-accessoriesb
Source: chromecache_252.12.dr	String found in binary or memory: https://www.adder.com/en/kvm-solutions/secure#paragraph-title-bsecure-desktop-kvm-switchesb
Source: chromecache_252.12.dr	String found in binary or memory: https://www.adder.com/en/kvm-solutions/secure#paragraph-title-bsecure-flexi-switchb
Source: chromecache_252.12.dr	String found in binary or memory: https://www.adder.com/en/kvm-solutions/secure#paragraph-title-secure-multi-viewer-switch
Source: chromecache_203.12.dr	String found in binary or memory: https://www.adder.com/en/privacy-cookie-policy)
Source: chromecache_252.12.dr	String found in binary or memory: https://www.adder.com/themes/custom/adder/images/logos/logo_addercrest_queens_award.svg
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: chromecache_224.12.dr, chromecache_261.12.dr	String found in binary or memory: https://www.cookiebot.com
Source: chromecache_252.12.dr	String found in binary or memory: https://www.drupal.org)
Source: chromecache_216.12.dr, chromecache_209.12.dr, chromecache_215.12.dr, chromecache_249.12.dr, chromecache_244.12.dr, chromecache_263.12.dr, chromecache_204.12.dr, chromecache_266.12.dr	String found in binary or memory: https://www.drupal.org/licensing/faq
Source: chromecache_244.12.dr, chromecache_263.12.dr	String found in binary or memory: https://www.drupal.org/node/3183730
Source: chromecache_244.12.dr, chromecache_263.12.dr	String found in binary or memory: https://www.drupal.org/node/3422670
Source: chromecache_229.12.dr	String found in binary or memory: https://www.google.com
Source: chromecache_269.12.dr, chromecache_229.12.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_229.12.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_223.12.dr, chromecache_213.12.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=$
Source: chromecache_219.12.dr, chromecache_271.12.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=$
Source: chromecache_252.12.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-PVBW5R5&gtm_auth=rwGdO7xculQEL_xME-WkIg&gtm_preview=
Source: chromecache_252.12.dr	String found in binary or memory: https://www.linkedin.com/company/adder-technology
Source: chromecache_269.12.dr, chromecache_229.12.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: 50E873D8-1A1A-4576-A238-6DEA6BB49E71.16.dr	String found in binary or memory: https://www.yammer.com
Source: chromecache_269.12.dr, chromecache_229.12.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 59351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59322 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59309
Source: unknown	Network traffic detected: HTTP traffic on port 59316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59305
Source: unknown	Network traffic detected: HTTP traffic on port 59339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59307
Source: unknown	Network traffic detected: HTTP traffic on port 59359 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59311
Source: unknown	Network traffic detected: HTTP traffic on port 59313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59314
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59398
Source: unknown	Network traffic detected: HTTP traffic on port 59380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59391
Source: unknown	Network traffic detected: HTTP traffic on port 59342 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59394
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59393
Source: unknown	Network traffic detected: HTTP traffic on port 59365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59304 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59331 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59319
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59316
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59315
Source: unknown	Network traffic detected: HTTP traffic on port 59377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59318
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59317
Source: unknown	Network traffic detected: HTTP traffic on port 59356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59322
Source: unknown	Network traffic detected: HTTP traffic on port 59299 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59310 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59321
Source: unknown	Network traffic detected: HTTP traffic on port 59307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59330 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59326
Source: unknown	Network traffic detected: HTTP traffic on port 59353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59329
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59328
Source: unknown	Network traffic detected: HTTP traffic on port 55930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59334
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59299
Source: unknown	Network traffic detected: HTTP traffic on port 59311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59332
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59293
Source: unknown	Network traffic detected: HTTP traffic on port 59367 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59344 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59295
Source: unknown	Network traffic detected: HTTP traffic on port 59327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59291
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59290
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 59350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59338
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59337
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59339
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59344
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59343
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59342
Source: unknown	Network traffic detected: HTTP traffic on port 59305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 59347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59355 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59332 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59349
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59348
Source: unknown	Network traffic detected: HTTP traffic on port 59370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59356
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59357
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59351
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59354
Source: unknown	Network traffic detected: HTTP traffic on port 59298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59353
Source: unknown	Network traffic detected: HTTP traffic on port 59306 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59350
Source: unknown	Network traffic detected: HTTP traffic on port 59369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59329 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59321 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59295 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59359
Source: unknown	Network traffic detected: HTTP traffic on port 59338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59367
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59400
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59366
Source: unknown	Network traffic detected: HTTP traffic on port 59314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59369
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59365
Source: unknown	Network traffic detected: HTTP traffic on port 59341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59366 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59318 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59334 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59377
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59379
Source: unknown	Network traffic detected: HTTP traffic on port 59315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59373
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59370
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59371
Source: unknown	Network traffic detected: HTTP traffic on port 59348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59379 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59389
Source: unknown	Network traffic detected: HTTP traffic on port 59337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59302
Source: unknown	Network traffic detected: HTTP traffic on port 59343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59381
Source: unknown	Network traffic detected: HTTP traffic on port 59368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59380
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59382
Source: unknown	Network traffic detected: HTTP traffic on port 59400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59309 -> 443

Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.242.39.171:443 -> 192.168.2.16:59289 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:59290 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:59291 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:59293 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.16:59398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:59400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.28:443 -> 192.168.2.16:55930 version: TLS 1.2

System Summary

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping432_665867553			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping432_665867553\sets.json			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping432_665867553\manifest.json			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping432_665867553\LICENSE			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping432_665867553\_metadata\			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping432_665867553\_metadata\verified_contents.json			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping432_665867553\manifest.fingerprint			Jump to behavior

Source: classification engine

Classification label: sus25.winEML@52/134@20/13

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241002T0054460371-6516.etl

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\d Notice.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "6AC826AD-4BBD-45AD-8D32-0AF1718F9352" "2C6966CE-D238-49AE-AE03-77D6AAD22179" "6516" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" /b /id 400_775915996 /if pdfshell_preva59ba0d7-05eb-4deb-99fe-647e8d5f1433 /CR
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Flink.edgepilot.com%2Fs%2F120a65cd%2F92faESPp9EiMtn721vn3cg%3Fu%3Dhttp%3A**Alink.adder.com*c*7*eyJhaSI6MzMwMzUyMDMsImUiOiJyc2hlcGhlcmRAaW5kdXN0cmlhbG5ldHdvcmtpbmcuY29tIiwicmkiOiJsZWFkLTQ3YTY2YjE3NzM1NWVmMTFiZmUzNjA0NWJkMTBmMDZiLWY3MGRkYTcyN2NiMzQ0YzA4MDIyYjBhZGU0NDQyYzg5IiwicnEiOiJwMS1iMjQyMjYtOGNjNDhmOGI1YjdkNDIyYTk2ZmFjOGNhMjViMjg1ZjkiLCJwaCI6bnVsbCwibSI6ZmFsc2UsInVpIjoiMiIsInVuIjoiIiwidSI6Imh0dHBzOi8vYWRkZXIuY29tL2VuL2FkZHJlc3MtYXNzaWdubWVudC10aW1lb3V0P3V0bV9zb3VyY2U9ZW5kdXNlci1lbWFpbCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1BTElGQUFUJnV0bV9jb250ZW50PWVtYWlsMiZfY2xkZWU9djZEQ1Q3STc4dDJFOGlIT25icGFLQm5LdDN3M1NqWHNsTUR5UGhlUHRRMHktckRTbEwtMFJxVkJmdTNzVG4zUnI5SUJNam81cVdnd2VrNlU5Tmd3YUEmcmVjaXBpZW50aWQ9bGVhZC00N2E2NmIxNzczNTVlZjExYmZlMzYwNDViZDEwZjA2Yi1mNzBkZGE3MjdjYjM0NGMwODAyMmIwYWRlNDQ0MmM4OSZlc2lkPTYwNzBmNTU4LWMzNTgtZWYxMS1iZmUyLTdjMWU1MjJlMjMwMSJ9*rZBkfKjBfqredTQS-2QacA__%3BLy8vLy8v!!OkyjEqkqqe9UhNQ!yODuX79B2nTpENPfehnyCFUJuuvzfg0fOf1aTCAnPaMS76bnldMNOaotsAiIm92xxm4x4Uvdpoz9UMGu8MnF0grYKYf_n4F_Lw0%24&data=05%7C02%7CADACoordinator%40santaclaraca.gov%7Cf93995ac148340abe72008dce15903fe%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638633019912809270%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=wjBPzL9yWOp7%2B1aISfeMP49loY2QWPkpt%2FoR6DLGdaI%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1972,i,13971064303503523449,5076289817585583702,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe" -ServerName:microsoft.windowslive.mail.AppXfbjsbkxvprcgqg6q4c9jfr0pn3kv9x5s.mca
Source: unknown	Process created: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe" -ServerName:microsoft.windowslive.manageaccounts.AppXdbf3yp5apt3t7q877db3gnz5zqpf71zj.mca
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Documents\ALIFAAT_ProductNotice_Aug_2024.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2164 --field-trial-handle=1612,i,1543790139076901750,12852091081081479806,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.adder.com/en/address-assignment-timeout
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "6AC826AD-4BBD-45AD-8D32-0AF1718F9352" "2C6966CE-D238-49AE-AE03-77D6AAD22179" "6516" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Flink.edgepilot.com%2Fs%2F120a65cd%2F92faESPp9EiMtn721vn3cg%3Fu%3Dhttp%3A**Alink.adder.com*c*7*eyJhaSI6MzMwMzUyMDMsImUiOiJyc2hlcGhlcmRAaW5kdXN0cmlhbG5ldHdvcmtpbmcuY29tIiwicmkiOiJsZWFkLTQ3YTY2YjE3NzM1NWVmMTFiZmUzNjA0NWJkMTBmMDZiLWY3MGRkYTcyN2NiMzQ0YzA4MDIyYjBhZGU0NDQyYzg5IiwicnEiOiJwMS1iMjQyMjYtOGNjNDhmOGI1YjdkNDIyYTk2ZmFjOGNhMjViMjg1ZjkiLCJwaCI6bnVsbCwibSI6ZmFsc2UsInVpIjoiMiIsInVuIjoiIiwidSI6Imh0dHBzOi8vYWRkZXIuY29tL2VuL2FkZHJlc3MtYXNzaWdubWVudC10aW1lb3V0P3V0bV9zb3VyY2U9ZW5kdXNlci1lbWFpbCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1BTElGQUFUJnV0bV9jb250ZW50PWVtYWlsMiZfY2xkZWU9djZEQ1Q3STc4dDJFOGlIT25icGFLQm5LdDN3M1NqWHNsTUR5UGhlUHRRMHktckRTbEwtMFJxVkJmdTNzVG4zUnI5SUJNam81cVdnd2VrNlU5Tmd3YUEmcmVjaXBpZW50aWQ9bGVhZC00N2E2NmIxNzczNTVlZjExYmZlMzYwNDViZDEwZjA2Yi1mNzBkZGE3MjdjYjM0NGMwODAyMmIwYWRlNDQ0MmM4OSZlc2lkPTYwNzBmNTU4LWMzNTgtZWYxMS1iZmUyLTdjMWU1MjJlMjMwMSJ9*rZBkfKjBfqredTQS-2QacA__%3BLy8vLy8v!!OkyjEqkqqe9UhNQ!yODuX79B2nTpENPfehnyCFUJuuvzfg0fOf1aTCAnPaMS76bnldMNOaotsAiIm92xxm4x4Uvdpoz9UMGu8MnF0grYKYf_n4F_Lw0%24&data=05%7C02%7CADACoordinator%40santaclaraca.gov%7Cf93995ac148340abe72008dce15903fe%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638633019912809270%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=wjBPzL9yWOp7%2B1aISfeMP49loY2QWPkpt%2FoR6DLGdaI%3D&reserved=0			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1972,i,13971064303503523449,5076289817585583702,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2164 --field-trial-handle=1612,i,1543790139076901750,12852091081081479806,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: microsoft.applications.telemetry.windows.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msoimm.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: mso40uiimm.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: mso30imm.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: mso20imm.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: office.ui.xaml.core.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: office.ui.xaml.word.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: vccorlib140_app.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: vcruntime140_app.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msvcp140_app.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: vccorlib140_app.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msvcp140_app.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: vcruntime140_app.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: vcruntime140_app.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msvcp140_app.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: vcruntime140_app.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msvcp140_app.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: vccorlib140_app.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: vcruntime140_app.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msvcp140_app.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: vcruntime140_app.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msvcp140_app.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: mso98imm.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: mso50imm.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msvcp140_app.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: mso98imm.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: hxoutlook.model.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.storage.applicationdata.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: twinapi.appcore.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: hxcomm.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.applicationmodel.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.globalization.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: bcp47langs.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: bcp47mrm.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: onecorecommonproxystub.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.staterepositorycore.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.networking.connectivity.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.networking.hostname.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.energy.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: rmclient.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: rometadata.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.system.diagnostics.telemetry.platformtelemetryclient.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: hxoutlook.view.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: office.ui.xaml.hxshared.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: hxoutlook.viewmodel.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: clipc.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: hxoutlook.resources.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: logoncli.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.ui.xaml.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: dcomp.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.ui.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windowmanagementapi.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: textinputframework.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: inputhost.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: onecoreuapcommonproxystub.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: dxgi.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: resourcepolicyclient.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: mrmcorer.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: d3d11.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.staterepositoryclient.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: d3d10warp.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: dxcore.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: d2d1.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: dwrite.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: textshaping.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.shell.servicehostbuilder.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: execmodelproxy.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: uiamanager.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.ui.core.textinput.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.ui.immersive.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: dataexchange.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: profext.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: office.ui.xaml.hx.mail.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: threadpoolwinrt.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.graphics.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: twinapi.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: office.ui.xaml.hxcalendar.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.ui.xaml.controls.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.system.remotedesktop.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: winsta.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: directmanipulation.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.system.profile.systemid.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.system.profile.retailinfo.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msxml6.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: winrttracing.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: rasadhlp.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: schannel.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.staterepositoryps.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windowscodecs.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: photometadatahandler.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: ploptin.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: mskeyprotect.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: ntasn1.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: ncryptsslp.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: dwmapi.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: webservices.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: userdataaccountapis.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: userdataplatformhelperutil.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: windows.accountscontrol.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: xmllite.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: accountsrt.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: aphostclient.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Section loaded: execmodelclient.dll			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: apphelp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: hxoutlook.model.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: microsoft.applications.telemetry.windows.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: mso20imm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: vccorlib140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: vccorlib140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: mso30imm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: vccorlib140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.ui.xaml.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: iertutil.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: dcomp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: wintypes.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.ui.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windowmanagementapi.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: inputhost.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: propsys.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: urlmon.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: srvcli.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: netutils.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: dxgi.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: office.ui.xaml.hxaccounts.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: d3d11.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.storage.applicationdata.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: d3d10warp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: dxcore.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: hxcomm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: d2d1.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: dwrite.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.applicationmodel.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: textshaping.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.globalization.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: bcp47mrm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: profapi.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.networking.connectivity.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.networking.hostname.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.energy.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: rmclient.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: wldp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: rometadata.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.system.diagnostics.telemetry.platformtelemetryclient.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: mrmcorer.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.staterepositoryclient.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: execmodelproxy.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: uiamanager.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.ui.core.textinput.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: dataexchange.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.accountscontrol.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: xmllite.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.security.authentication.web.core.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: vaultcli.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.ui.xaml.controls.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: directmanipulation.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: userenv.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: profext.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: winrttracing.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: hxoutlook.resources.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: msftedit.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: globinputhost.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: windows.graphics.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: wuceffects.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Section loaded: threadpoolwinrt.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File opened: C:\Windows\SysWOW64\MsftEdit.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window detected: Number of UI elements: 14

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: d Notice.eml

Static file information: File size 1164149 > 1048576

Persistence and Installation Behavior

Source: Email

LLM: Email contains prominent button: 'click link or copy and paste to a browser'

Boot Survival

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: ALIFAAT_ProductNotice_Aug_2024.pdf.5.dr, ALIFAAT_ProductNotice_Aug_2024 (002).pdf.5.dr, ALIFAAT_ProductNotice_Aug_2024.pdf0.5.dr

Binary or memory string: rGhGFs

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Language, Device and Operating System Detection

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsym.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsym.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsym.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsym.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsb.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsb.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsb.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsb.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsl.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsl.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsl.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsl.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsl.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsl.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsym.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsym.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior