Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
f1215469392.dll

Overview

General Information

Sample name:f1215469392.dll
Analysis ID:1633362
MD5:e53c5b87d76e669f04174186b262917b
SHA1:18fda7cd620ccd9f908a5e08c5be67511b3b3357
SHA256:53fe93da3c641d0e98684faa64e838a8f6c4e9a9eefdbe31a3ea60ddc595ff4b
Infos:

Detection

Score:52
Range:0 - 100
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Document exploit detected (process start blacklist hit)
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Detected non-DNS traffic on DNS port
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains sections with non-standard names
PE file does not import any functions
Sample execution stops while process was sleeping (likely an evasion)
Stores large binary data to the registry
Uses 32bit PE files

Classification

Process Tree

  • System is w10x64_ra
  • loaddll32.exe (PID: 6920 cmdline: loaddll32.exe "C:\Users\user\Desktop\f1215469392.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)
    • conhost.exe (PID: 6928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 6976 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\f1215469392.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • rundll32.exe (PID: 6996 cmdline: rundll32.exe "C:\Users\user\Desktop\f1215469392.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)
        • WerFault.exe (PID: 7072 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 568 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • chrome.exe (PID: 6724 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --loadload-extension=C:\Windows\crx MD5: E81F54E6C1129887AEA47E7D092680BF)
    • chrome.exe (PID: 6748 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2056,i,6435462050054665223,12314675350512714991,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)
  • Acrobat.exe (PID: 7368 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7616 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7812 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2288 --field-trial-handle=1372,i,5568626499763575672,11755765390696541677,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • rundll32.exe (PID: 4116 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)
  • EXCEL.EXE (PID: 7572 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" MD5: 4A871771235598812032C822E6F68F19)
  • msedge.exe (PID: 2200 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 3400 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1932 --field-trial-handle=1964,i,18245976637816187434,11547063040977359728,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 8752 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6372 --field-trial-handle=1964,i,18245976637816187434,11547063040977359728,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 8784 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6752 --field-trial-handle=1964,i,18245976637816187434,11547063040977359728,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7376 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5760 --field-trial-handle=1964,i,18245976637816187434,11547063040977359728,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • ONENOTE.EXE (PID: 8692 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE" MD5: 0061760D72416BCF5F2D9FA6564F0BEA)
    • DWWIN.EXE (PID: 4716 cmdline: C:\Windows\SysWOW64\DWWIN.EXE -x -s 3676 MD5: 57A4F3E9F6F5AA7AFA57FAACBF578453)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: f1215469392.dllVirustotal: Detection: 6%Perma Link
Source: f1215469392.dllStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
Source: unknownHTTPS traffic detected: 104.214.71.38:443 -> 192.168.2.16:49960 version: TLS 1.2
Source: f1215469392.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT

Software Vulnerabilities

barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess created: C:\Windows\SysWOW64\DWWIN.EXE
Source: global trafficTCP traffic: 192.168.2.16:55822 -> 1.1.1.1:53
Source: Joe Sandbox ViewIP Address: 20.189.173.5 20.189.173.5
Source: Joe Sandbox ViewIP Address: 2.22.242.11 2.22.242.11
Source: Joe Sandbox ViewIP Address: 2.19.106.98 2.19.106.98
Source: Joe Sandbox ViewIP Address: 23.192.243.7 23.192.243.7
Source: Joe Sandbox ViewJA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.195
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.195
Source: unknownTCP traffic detected without corresponding DNS query: 3.167.152.24
Source: unknownTCP traffic detected without corresponding DNS query: 3.167.152.24
Source: unknownTCP traffic detected without corresponding DNS query: 3.167.152.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.72.30
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.72.30
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.72.30
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.72.30
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.72.30
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.72.30
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.72.30
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.72.30
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.72.30
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.72.30
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.72.30
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.72.30
Source: unknownTCP traffic detected without corresponding DNS query: 3.167.152.24
Source: unknownTCP traffic detected without corresponding DNS query: 3.167.152.24
Source: unknownTCP traffic detected without corresponding DNS query: 3.167.152.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.44.201.32
Source: unknownTCP traffic detected without corresponding DNS query: 23.44.201.32
Source: unknownTCP traffic detected without corresponding DNS query: 23.44.201.32
Source: unknownTCP traffic detected without corresponding DNS query: 23.44.201.32
Source: unknownTCP traffic detected without corresponding DNS query: 23.44.201.32
Source: unknownTCP traffic detected without corresponding DNS query: 23.44.201.32
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.5
Source: global trafficHTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /mail/?tab=rm&ogbl HTTP/1.1Host: mail.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=FkgT0r8W3vmIrO3HICJpTguYUdHuqb5U3AbkIriNn2oSeDID-vBRgnRCtzxteQ6d49sSfOjAEG5bMM_BlA4ia_gBeXCJoiIY1RWq9YocuwfjFAzEvqnpJPthYMX78iQYuY6RKoQCOUfAfczyeyGsE3Pm2y9-bSj-anYh-rsU-Msnd4PSOvbQiinbSLO1J3gbUIne1NrZ6A
Source: global trafficHTTP traffic detected: GET /mail/u/0/?tab=rm&ogbl HTTP/1.1Host: mail.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=FkgT0r8W3vmIrO3HICJpTguYUdHuqb5U3AbkIriNn2oSeDID-vBRgnRCtzxteQ6d49sSfOjAEG5bMM_BlA4ia_gBeXCJoiIY1RWq9YocuwfjFAzEvqnpJPthYMX78iQYuY6RKoQCOUfAfczyeyGsE3Pm2y9-bSj-anYh-rsU-Msnd4PSOvbQiinbSLO1J3gbUIne1NrZ6A
Source: global trafficHTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /crx/blobs/Ad_brx23lef_cW590ESOTTAroOhZ9si0XFJIUC52j2ILHW1VLB5ou6c0RgLWwGr1aRJJZ0WPNyiPBYgIpWfykvhKW-6BLzMRsp9ykw5f6ReBQmPpO6WB9pcSJPfykLTHDjYAxlKa5bf72z8tHS5eXuTavTP1h4WZBjSs/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_89_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.867cdfd625d830718faf.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: */*sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=457FEFFAB8114968991F906B3BDDD711.RefC=2025-03-10T08:17:50Z; USRLOC=; MUID=3F7F921E0E686A2D1D8887B50F8F6B10; MUIDB=3F7F921E0E686A2D1D8887B50F8F6B10; _EDGE_S=F=1&SID=0901E925449567A4196EFC8E4594669A; _EDGE_V=1
Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.948ffa5ea2d441a35f55.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: */*sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=457FEFFAB8114968991F906B3BDDD711.RefC=2025-03-10T08:17:50Z; USRLOC=; MUID=3F7F921E0E686A2D1D8887B50F8F6B10; MUIDB=3F7F921E0E686A2D1D8887B50F8F6B10; _EDGE_S=F=1&SID=0901E925449567A4196EFC8E4594669A; _EDGE_V=1
Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.5d0f28115e15fcff20c5.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.4fa8815283fe3d88a934.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.a1e626d952b002612af0.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.c64f021441815c638c7a.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /K7gBWtmhy68WKHPlgviywLLiG6N8Fn6L3QYXTO9z2-6s_MvxJCarKFUMl5cYV7e1m9_3hXuKJMsvdylGv6ejDR19QcykUgCRvwv7=e365-pa-nu-rw-w1416 HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://workspace.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /B-JUuwlvmpEkNNeTdTeQ13avafYuETIqkiz-U7VtPnmEWzE6GPmDbgutVn-9WvHC_YBthyho2gZhi49shb1YeT9riCtm-D5T8O8Pww=e365-pa-nu-s0-rw HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://workspace.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3F7F921E0E686A2D1D8887B50F8F6B10; _EDGE_S=F=1&SID=0901E925449567A4196EFC8E4594669A; _EDGE_V=1
Source: global trafficHTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.35sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 350sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 3gAccept: */*sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=457FEFFAB8114968991F906B3BDDD711.RefC=2025-03-10T08:17:50Z; USRLOC=; MUID=3F7F921E0E686A2D1D8887B50F8F6B10; MUIDB=3F7F921E0E686A2D1D8887B50F8F6B10; _EDGE_S=F=1&SID=0901E925449567A4196EFC8E4594669A; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=660c5ea0-74e2-4604-8104-6822c5f2eb34; ai_session=xZksWZOgmxmRAYzLDBECIs|1741594678511|1741594678511; sptmarket_restored=en-GB||us|en-us|en-us|en||cf=8|RefA=457FEFFAB8114968991F906B3BDDD711.RefC=2025-03-10T08:17:50Z
Source: global trafficHTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: */*Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":26,"imageId":"BB1msOZ4","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false,"wpo_nx":{"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=457FEFFAB8114968991F906B3BDDD711.RefC=2025-03-10T08:17:50Z; USRLOC=; MUID=3F7F921E0E686A2D1D8887B50F8F6B10; MUIDB=3F7F921E0E686A2D1D8887B50F8F6B10; _EDGE_S=F=1&SID=0901E925449567A4196EFC8E4594669A; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=660c5ea0-74e2-4604-8104-6822c5f2eb34; ai_session=xZksWZOgmxmRAYzLDBECIs|1741594678511|1741594678511; sptmarket_restored=en-GB||us|en-us|en-us|en||cf=8|RefA=457FEFFAB8114968991F906B3BDDD711.RefC=2025-03-10T08:17:50Z
Source: global trafficHTTP traffic detected: GET /JRoicK7FUvw3SOlEKLZ1HwWnR2dPKVn0iHL0CdC7lsBxM0L-TrNho8xrUE9Aj4d3SaQMUCeMAUr8dkxck89lc9PGT1yu5f8yjunfGw=e365-pa-nu-s0-rw HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://workspace.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /6Z8m5bsD3e8tEjCe2FhSG5v2CFOmtqBf_ZaXKuan1x9O0HEFIrgTmeU2htAwOUW9ihicsTpgL3EAI1M3DLSWj-rWhWkTtnRt_Lmf=e365-pa-nu-s0-rw HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://workspace.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /BR_gXTPBQrwb4aTeTpBYAMSpl_xOZieCCxX_5Awuir3UOuPsWK1J-zdPZyIEZAxwLO6tnX_Ea_3wKAnqkEYn0Wj9zGnt6m4ZqAI=e365-pa-nu-s0-rw HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://workspace.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /HP1YfjeevslFsDg0wS4rzRNiNXkhLYhW1Sa_0MaFCEsopR1YxAjbegobuqAMscHd93ikHlKQBiTc_WlQWU9qmqp_Dx9qmBPfz6E=e365-pa-nu-s0-rw HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://workspace.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /apc/trans.gif?0cb0e541ca5d8d09aadbaac317f907a3 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: 59290a93187cec89553460d975d13fdc.clo.footprintdns.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /j73UcrFihOUZ-WL-asfh7KViJVGHmWyf8t8qC_PPEXUxpFvBo72oh5IgVUgqpJP7_tbu__rmcvI7QNOy40N7CEs2DraTv6Xl7cY=e365-pa-nu-s0-rw HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://workspace.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /8cHO7WaYQsOObHs3PA0_7Au93UCIvvRzCoYA6XSZMd1W3TGBRQtJgroL6ruN_4TmIuyiCWqgwlhZz4IZaZfcVc3Q9o-Eykla3VLcOA=e365-pa-nu-s0-rw HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://workspace.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /97jr7pwEwgh798nQbvvzK4f8wt6snOzQJZRSsUilwQ3KCAWgVxIf4VhcindgwZR3kodbQkYDtgx2IBR8fiaDf2G5g3d4uPm3P3kv=e365-pa-nu-s0-rw HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://workspace.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=on&oit=1&cp=2&pgcl=4&gs_rn=42&psi=XMYDe_v5wIJmQWDO&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=FkgT0r8W3vmIrO3HICJpTguYUdHuqb5U3AbkIriNn2oSeDID-vBRgnRCtzxteQ6d49sSfOjAEG5bMM_BlA4ia_gBeXCJoiIY1RWq9YocuwfjFAzEvqnpJPthYMX78iQYuY6RKoQCOUfAfczyeyGsE3Pm2y9-bSj-anYh-rsU-Msnd4PSOvbQiinbSLO1J3gbUIne1NrZ6A
Source: global trafficHTTP traffic detected: GET /ZNfku9avhseOyG8BQM4xo-Xrmruq-7jwT212-MiDDhHoDc5ohbGWdFXvvLS5VsZFFzMZPYE7czHtboeNvwvRwdNqEd16W_K56Mav=e365-pa-nu-s0-rw HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://workspace.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /R5STxzbIpvScTy6zXwFT5KT716R579-24F0ZMHsNccGGOOphFjSrp7PCVhvwjua8-OwBATUy0KymKmYKpmxtvJWxY3H1V2hWkibbtA=e365-pa-nu-s0-rw HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://workspace.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /314Y9Xqp426C0uZ2_YyIA4RjFNDpENzU5mz2VAC6Cnm-ODSFqnC3Bf2QBzmzmzKs6exkTTf8KEBPGgc-kg5ZPx8a8s40VFcz4g06Zw=e365-pa-nu-s0-rw HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://workspace.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /GMG_2DCdgywtwJVXgpp1kVNghkDmrw6xjWVWGUEw7OUIoGl7QVgU3zXJU5sJA6WaZxm2dyd2dqLyH5YjZX28EttWJvXKu18tdVgYdQ=e365-pa-nu-s0-rw HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://workspace.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=onedrive&oit=1&cp=8&pgcl=4&gs_rn=42&psi=XMYDe_v5wIJmQWDO&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=FkgT0r8W3vmIrO3HICJpTguYUdHuqb5U3AbkIriNn2oSeDID-vBRgnRCtzxteQ6d49sSfOjAEG5bMM_BlA4ia_gBeXCJoiIY1RWq9YocuwfjFAzEvqnpJPthYMX78iQYuY6RKoQCOUfAfczyeyGsE3Pm2y9-bSj-anYh-rsU-Msnd4PSOvbQiinbSLO1J3gbUIne1NrZ6A
Source: global trafficHTTP traffic detected: GET /search?q=onedrive&oq=onedrive&pf=cs&sourceid=chrome&ie=UTF-8 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Purpose: prefetchSec-Purpose: prefetchAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=FkgT0r8W3vmIrO3HICJpTguYUdHuqb5U3AbkIriNn2oSeDID-vBRgnRCtzxteQ6d49sSfOjAEG5bMM_BlA4ia_gBeXCJoiIY1RWq9YocuwfjFAzEvqnpJPthYMX78iQYuY6RKoQCOUfAfczyeyGsE3Pm2y9-bSj-anYh-rsU-Msnd4PSOvbQiinbSLO1J3gbUIne1NrZ6A
Source: global trafficHTTP traffic detected: GET /search?q=onedrive&oq=onedrive&gs_lcrp=EgZjaHJvbWUyDAgAEEUYORixAxiABDIKCAEQABixAxiABDIKCAIQABixAxiABDIKCAMQABixAxiABDIKCAQQABixAxiABDIKCAUQABixAxiABDIHCAYQABiABDIKCAcQABixAxiABDIHCAgQABiABDIKCAkQABixAxiABKgCALACAQ&sourceid=chrome&ie=UTF-8&sei=VKDOZ9q1GrCL9u8P7o2A0Qk HTTP/1.1Host: www.google.comConnection: keep-alivertt: 550downlink: 1.3sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "134.0.6998.36"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-form-factors: "Desktop"sec-ch-prefers-color-scheme: lightUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Sec-Purpose: prefetch;prerenderPurpose: prefetchAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://www.google.com/search?q=onedrive&oq=onedrive&gs_lcrp=EgZjaHJvbWUyDAgAEEUYORixAxiABDIKCAEQABixAxiABDIKCAIQABixAxiABDIKCAMQABixAxiABDIKCAQQABixAxiABDIKCAUQABixAxiABDIHCAYQABiABDIKCAcQABixAxiABDIHCAgQABiABDIKCAkQABixAxiABKgCALACAQ&sourceid=chrome&ie=UTF-8Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2fLLMIFWE01i2o4Gc7HFl29i1qzAxYUPO2eXbqXsXtQU86Q5vf50A; NID=522=QGapd-seU84dnol3YP8RWOD_ul22fdFIAKbPVJe3weRicRio3usfajkjoGVxEN5CsihQ6ntAVbp51582OrUv9HNdibCPxk3qo-df0zrBh14otC2K_Ah33HwzHNrSA31O8cVB8mYpa-r1ar2r3WQIbJbrykB468ekCk7gQNBCVTkDi8kShy8Q0g6bJ8XQfnbXFyr1FQm2PP-ix4Cxy2yJdbs; SG_SS=*iraatu7yAAaUZktqtGZ9PNUIgUYrME4EADQBEArZ1FeKjuDY077-I6ZvVJxnuwhA_Q5M1UqeAymPy9XIyVVkGI9JWGZ4G7Q3WECNSzyWPQAAAEdtAAAAClcBB0EANfKUY9bQEh_889kHJQFr_mpO4bSKaQ1pbmTB-tMuibi_IX0r13dfFl7pvEcHC-aZv80-VPqPpgJxUup4NvZk_t4SkDhxwjF6SgDlBubJxwaO1Q0jdElZZlEmuzLh1iOJsQexKB3_ld2pJ6Cr8gecM1t3zQjNWPPQIRGmqUtKpE6RU6pk3KrT8m9s9Q9KZmTheNhGZJ2b7k-Xr5RJ2cSZDer-Gx_q4GIXfk-V8UNXpkr3sRcP2HodMx21sQh2-rOq0sCTH1L7PiTy1x66GNRO5o5XUGE1s60yVqxf0SPyLhQa0nOZm0t-hT60SoqyVjcXRmf4xkrtK1ud_hL74yr2C6-TUjn---FReT9bezBvZJxolvkT1fd10JU75jxm_xw1TrIgh3wk0WonpH5HKu_oNNcI1dHF3DqaVgRHSo_10pY7T4Q7CC_qysANVh12KcsXGa7GTEpCFcAha_RnsO0Zo_PmIkZWGo8VLLQ_H6fU6U9Uw2ZVUbB40c1LfY2IU2BgxT17JSJB64qJWBtCA_9KtAwlJWvnYTUmgEftGObXr-AVXubKsqsr56XkfFIKnGPO1uox4wxVv3Cmq5ntuLS8KmneqFuOJrxUl-AwP4iuA_u46b-xkLe7p56IOZ3C_dYc2TVXNJmHhNCvE8-QEPvwRrNWW7YsNYNQNnDnkMPqv-iEdHHPl2XQsrJLC5h2CYFXOLD5gQdmBRHlYm6o_gqqZmmL6UQXO_6M5oFOF2MsIfw3C2Ha
Source: global trafficHTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&url=https%3A%2F%2Fwww.google.com%2Fsearch%3Fq%3Donedrive%26oq%3Donedrive%26gs_lcrp%3DEgZjaHJvbWUyDAgAEEUYORixAxiABDIKCAEQABixAxiABDIKCAIQABixAxiABDIKCAMQABixAxiABDIKCAQQABixAxiABDIKCAUQABixAxiABDIHCAYQABiABDIKCAcQABixAxiABDIHCAgQABiABDIKCAkQABixAxiABKgCALACAQ%26sourceid%3Dchrome%26ie%3DUTF-8%26sei%3DVKDOZ9q1GrCL9u8P7o2A0Qk&pgcl=22&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2fLLMIFWE01i2o4Gc7HFl29i1qzAxYUPO2eXbqXsXtQU86Q5vf50A; NID=522=jyu-2ORYaN0TmHfFmNBxSQR_n9mmN1h_LONYfdTZlOCm87vg1Gqy6Oqr72wkzAwDWavCNFj8p3lmBAj4jOrwbbyU_bRg0lz8zMrh5ED6cqKzrgKRKbg5mKBHVgP9RjdZgSHPOEV81S184BRkNq1Bgq7e5lijNFuu2RJ26hXQin4i5a6kPS2bwBNi6Kz06wmD8OB4G6dvUTpvt3L4rMe9mEDLMGfkc7keHMAZcQJkmo5K6JcDGVVKiz5l
Source: global trafficHTTP traffic detected: GET /images/searchbox/desktop_searchbox_sprites318_hr.webp HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 1.35sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 550sec-ch-ua-platform-version: "10.0.0"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLbgygE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/search?q=onedrive&oq=onedrive&gs_lcrp=EgZjaHJvbWUyDAgAEEUYORixAxiABDIKCAEQABixAxiABDIKCAIQABixAxiABDIKCAMQABixAxiABDIKCAQQABixAxiABDIKCAUQABixAxiABDIHCAYQABiABDIKCAcQABixAxiABDIHCAgQABiABDIKCAkQABixAxiABKgCALACAQ&sourceid=chrome&ie=UTF-8&sei=VKDOZ9q1GrCL9u8P7o2A0QkAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2fLLMIFWE01i2o4Gc7HFl29i1qzAxYUPO2eXbqXsXtQU86Q5vf50A; NID=522=jyu-2ORYaN0TmHfFmNBxSQR_n9mmN1h_LONYfdTZlOCm87vg1Gqy6Oqr72wkzAwDWavCNFj8p3lmBAj4jOrwbbyU_bRg0lz8zMrh5ED6cqKzrgKRKbg5mKBHVgP9RjdZgSHPOEV81S184BRkNq1Bgq7e5lijNFuu2RJ26hXQin4i5a6kPS2bwBNi6Kz06wmD8OB4G6dvUTpvt3L4rMe9mEDLMGfkc7keHMAZcQJkmo5K6JcDGVVKiz5l
Source: global trafficHTTP traffic detected: GET /xjs/_/ss/k=xjs.s.xF7nT1U176s.L.B1.O/am=AMIhQAgAAAAEAACAEAAqAAEAAAAAAAAAAAAAAAAAAAAAAABAAgAAAAIAAAAAAAAAAgAAAIgAAAChTAIAAAAgOCEACjsAAAAAfACBOFUAAQAAAAAAAUACAAAAAAABAAEAJIQAAEAUAAAAAAIQIQQACAAwAQAABQBAIAAAQBgYAEADAAAAIACIRQDiAAAEABgAABwAAUACAAAACIEFIAAAQAkBAAEAAAAoAAAAIAAAgATgIRgGQFABYABHAAAAACACAAIIAAAQABACAIABAAUAgAABANADAALwAQAkgQgAEALAAAQAFAIAAgBAAAAAAAAggQAAAABkAQEuIzZAAAAAAAAAAJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUAAAAAAAAAAAAAAAAAAAAAABA/d=1/ed=1/br=1/rs=ACT90oFCIRlQHS4MPFSzT33wYoCF1PF80w/m=X3N0Bf,attn,cdos,gwc,hsm,jsa,mb4ZUb,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl,YV5bee,d,csi HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 1.35sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 550sec-ch-ua-platform-version: "10.0.0"Accept: text/css,*/*;q=0.1X-Client-Data: CLbgygE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2fLLMIFWE01i2o4Gc7HFl29i1qzAxYUPO2eXbqXsXtQU86Q5vf50A; NID=522=jyu-2ORYaN0TmHfFmNBxSQR_n9mmN1h_LONYfdTZlOCm87vg1Gqy6Oqr72wkzAwDWavCNFj8p3lmBAj4jOrwbbyU_bRg0lz8zMrh5ED6cqKzrgKRKbg5mKBHVgP9RjdZgSHPOEV81S184BRkNq1Bgq7e5lijNFuu2RJ26hXQin4i5a6kPS2bwBNi6Kz06wmD8OB4G6dvUTpvt3L4rMe9mEDLMGfkc7keHMAZcQJkmo5K6JcDGVVKiz5l
Source: global trafficHTTP traffic detected: GET /pagead/1p-conversion/16521530460/?gad_source=1&adview_type=4&adview_query_id=CNXjh_CJ_4sDFWqSgwcdkoYUyQ HTTP/1.1Host: www.google.comConnection: keep-alivedownlink: 1.35sec-ch-ua-full-version-list: "Chromium";v="134.0.6998.36", "Not:A-Brand";v="24.0.0.0", "Google Chrome";v="134.0.6998.36"sec-ch-ua-platform: "Windows"sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-form-factors: "Desktop"sec-ch-ua-wow64: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "134.0.6998.36"sec-ch-prefers-color-scheme: lightUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36rtt: 550sec-ch-ua-platform-version: "10.0.0"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Attribution-Reporting-Eligible: event-source, trigger;navigation-sourceAttribution-Reporting-Support: webX-Client-Data: CLbgygE=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2fLLMIFWE01i2o4Gc7HFl29i1qzAxYUPO2eXbqXsXtQU86Q5vf50A; NID=522=jyu-2ORYaN0TmHfFmNBxSQR_n9mmN1h_LONYfdTZlOCm87vg1Gqy6Oqr72wkzAwDWavCNFj8p3lmBAj4jOrwbbyU_bRg0lz8zMrh5ED6cqKzrgKRKbg5mKBHVgP9RjdZgSHPOEV81S184BRkNq1Bgq7e5lijNFuu2RJ26hXQin4i5a6kPS2bwBNi6Kz06wmD8OB4G6dvUTpvt3L4rMe9mEDLMGfkc7keHMAZcQJkmo5K6JcDGVVKiz5l
Source: global trafficHTTP traffic detected: GET /verify/ABY0gVvhF9RArGafSvlvWgKJ7aKp4_JUSTx09hODOMXo_o9M5fIIkarx7xdQS-m4KC7cFYS0N0KDPwOlKy2avh5WnHhvpOf2pXGkebAWUmTtjAQrQA HTTP/1.1Host: id.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CLbgygE=Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: AEC=AVcja2fLLMIFWE01i2o4Gc7HFl29i1qzAxYUPO2eXbqXsXtQU86Q5vf50A; NID=522=jyu-2ORYaN0TmHfFmNBxSQR_n9mmN1h_LONYfdTZlOCm87vg1Gqy6Oqr72wkzAwDWavCNFj8p3lmBAj4jOrwbbyU_bRg0lz8zMrh5ED6cqKzrgKRKbg5mKBHVgP9RjdZgSHPOEV81S184BRkNq1Bgq7e5lijNFuu2RJ26hXQin4i5a6kPS2bwBNi6Kz06wmD8OB4G6dvUTpvt3L4rMe9mEDLMGfkc7keHMAZcQJkmo5K6JcDGVVKiz5l
Source: global trafficHTTP traffic detected: GET /ajax/jQuery/jquery-1.9.1.min.js HTTP/1.1Host: ajax.aspnetcdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.css HTTP/1.1Host: assets.onestore.msConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cdnfiles/external/mwf/long/v1/v1.25.0/fonts/MWFMDL2.ttf HTTP/1.1Host: assets.onestore.msConnection: keep-aliveOrigin: https://www.microsoft.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /en-us/CMSScripts/script.jsx?k=f65ecb70-094d-0b11-7c9d-7da1bcadfaa7 HTTP/1.1Host: c.s-microsoft.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org
Source: chromecache_1442.17.drString found in binary or memory: <a class="link link--icon" href="https://www.facebook.com/googleworkspace/" data-g-action="footer social links" data-g-event="gmail" data-g-label="facebook"> equals www.facebook.com (Facebook)
Source: chromecache_1442.17.drString found in binary or memory: <a class="link link--icon" href="https://www.linkedin.com/showcase/googleworkspace/" data-g-action="footer social links" data-g-event="gmail" data-g-label="linkedin"> equals www.linkedin.com (Linkedin)
Source: chromecache_1442.17.drString found in binary or memory: <a class="link link--icon" href="https://www.youtube.com/channel/UCBmwzQnSoj9b6HzNmFrg_yw/" data-g-action="footer social links" data-g-event="gmail" data-g-label="youtube"> equals www.youtube.com (Youtube)
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log9.30.drString found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log9.30.drString found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log9.30.drString found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chromecache_1471.17.drString found in binary or memory: OneDrive | by Shlomi Boutnaru, Ph.D. | Mar, 2025",null,"https://medium.com/@boutnaru/the-windows-concept-journey-onedrive-c0ba31de7ead"],null,null,null,null,["https://medium.com/@boutnaru/the-windows-concept-journey-onedrive-c0ba31de7ead",null,null,null,35],2]],"A06Dpo":[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"https://twitter.com/alitajran/status/1898006006199713927",null,null,null,null,[null,null,null,null,null,null,[null,null,null,"/search/about-this-result?origin\u003dwww.google.com\u0026req\u003dCjhodHRwczovL3R3aXR0ZXIuY29tL2FsaXRhanJhbi9zdGF0dXMvMTg5ODAwNjAwNjE5OTcxMzkyNxIICgASABoCCAAaeBIAGgAiACoAMgYIAxICdXM6AEIECAEQAEoAWgByAHoAgkBVCAAQABgAIAAqDwoIb25lZHJpdmUVKqWUPzI4aHR0cHM6Ly90d2l0dGVyLmNvbS9hbGl0YWpyYW4vc3RhdHVzLzE4OTgwMDYwMDYxOTk3MTM5Mjc6ACICEAFIAFgAaAA\u0026hl\u003den-US\u0026gl\u003dUS"],"https://www.google.com"],null,null,null,null,null,null,null,["TWITTER_RESULT",null,"BLUR",0,0,0,null,"https://twitter.com/alitajran/status/1898006006199713927"],["alitajran","OneDrive isn't automatically created when you assign a license to a user in Microsoft 365. So, how do you get OneDrive ready? There are three options. Read more: o365info.com/pre-provision-onedrive-users-microsoft-365/ #OneDrive #Microsoft365 #PowerShell","X (Twitter)","https://pbs.twimg.com/profile_images/1222999690125422593/wG3UKxmO_normal.jpg","https://www.gstatic.com/diner/images/twitter_icon.png"],[null,1,[null,null,5,null,"alitajran",null,"https://twitter.com/alitajran/status/1898006006199713927"],null,null,null,null,["https://twitter.com/alitajran/status/1898006006199713927",null,null,null,35],2]],"A06DpI":[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"https://www.youtube.com/watch?v\u003dq_JmtT_4l3c",null,null,null,null,[null,null,null,null,null,null,[null,null,null,"/search/about-this-result?origin\u003dwww.google.com\u0026req\u003dCitodHRwczovL3d3dy55b3V0dWJlLmNvbS93YXRjaD92PXFfSm10VF80bDNjEggKABIAGgIIABptEgIIABoAIgAqADIGCAMSAnVzOgBCBAgBEABKAFoAcgB6AIJASAgAEAAYACAAKg8KCG9uZWRyaXZlFcVBdkAyK2h0dHBzOi8vd3d3LnlvdXR1YmUuY29tL3dhdGNoP3Y9cV9KbXRUXzRsM2M6ACICEAFIAFgAaAA\u0026hl\u003den-US\u0026gl\u003dUS"],"https://www.google.com"],null,null,null,null,null,null,null,["NEWS_ARTICLE_RESULT",null,"BLUR",0,0,0,null,"https://www.youtube.com/watch?v\u003dq_JmtT_4l3c"],["How Do I Store Files on My Computer and Not OneDrive?","OneDrive complicates an otherwise straightforward situation. equals www.twitter.com (Twitter)
Source: chromecache_1471.17.drString found in binary or memory: OneDrive | by Shlomi Boutnaru, Ph.D. | Mar, 2025",null,"https://medium.com/@boutnaru/the-windows-concept-journey-onedrive-c0ba31de7ead"],null,null,null,null,["https://medium.com/@boutnaru/the-windows-concept-journey-onedrive-c0ba31de7ead",null,null,null,35],2]],"A06Dpo":[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"https://twitter.com/alitajran/status/1898006006199713927",null,null,null,null,[null,null,null,null,null,null,[null,null,null,"/search/about-this-result?origin\u003dwww.google.com\u0026req\u003dCjhodHRwczovL3R3aXR0ZXIuY29tL2FsaXRhanJhbi9zdGF0dXMvMTg5ODAwNjAwNjE5OTcxMzkyNxIICgASABoCCAAaeBIAGgAiACoAMgYIAxICdXM6AEIECAEQAEoAWgByAHoAgkBVCAAQABgAIAAqDwoIb25lZHJpdmUVKqWUPzI4aHR0cHM6Ly90d2l0dGVyLmNvbS9hbGl0YWpyYW4vc3RhdHVzLzE4OTgwMDYwMDYxOTk3MTM5Mjc6ACICEAFIAFgAaAA\u0026hl\u003den-US\u0026gl\u003dUS"],"https://www.google.com"],null,null,null,null,null,null,null,["TWITTER_RESULT",null,"BLUR",0,0,0,null,"https://twitter.com/alitajran/status/1898006006199713927"],["alitajran","OneDrive isn't automatically created when you assign a license to a user in Microsoft 365. So, how do you get OneDrive ready? There are three options. Read more: o365info.com/pre-provision-onedrive-users-microsoft-365/ #OneDrive #Microsoft365 #PowerShell","X (Twitter)","https://pbs.twimg.com/profile_images/1222999690125422593/wG3UKxmO_normal.jpg","https://www.gstatic.com/diner/images/twitter_icon.png"],[null,1,[null,null,5,null,"alitajran",null,"https://twitter.com/alitajran/status/1898006006199713927"],null,null,null,null,["https://twitter.com/alitajran/status/1898006006199713927",null,null,null,35],2]],"A06DpI":[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"https://www.youtube.com/watch?v\u003dq_JmtT_4l3c",null,null,null,null,[null,null,null,null,null,null,[null,null,null,"/search/about-this-result?origin\u003dwww.google.com\u0026req\u003dCitodHRwczovL3d3dy55b3V0dWJlLmNvbS93YXRjaD92PXFfSm10VF80bDNjEggKABIAGgIIABptEgIIABoAIgAqADIGCAMSAnVzOgBCBAgBEABKAFoAcgB6AIJASAgAEAAYACAAKg8KCG9uZWRyaXZlFcVBdkAyK2h0dHBzOi8vd3d3LnlvdXR1YmUuY29tL3dhdGNoP3Y9cV9KbXRUXzRsM2M6ACICEAFIAFgAaAA\u0026hl\u003den-US\u0026gl\u003dUS"],"https://www.google.com"],null,null,null,null,null,null,null,["NEWS_ARTICLE_RESULT",null,"BLUR",0,0,0,null,"https://www.youtube.com/watch?v\u003dq_JmtT_4l3c"],["How Do I Store Files on My Computer and Not OneDrive?","OneDrive complicates an otherwise straightforward situation. equals www.youtube.com (Youtube)
Source: chromecache_1471.17.drString found in binary or memory: X</h3><div class="p4InSe iUh30" style="z-index:1"><span class="DDKf1c"><div class="eqA2re UnOTSe Vwoesf" aria-hidden="true"><img class="XNo5Ab" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAAAAABWESUoAAAA3ElEQVR4Ac2SGQDFMBBE1ylOcYpTner0neK0TnGpU53iFKc6xWl+p+f25D7InZ295Cv0mGjFUOzWDVVVa/WykaBiaBBFfsiyory3JASRjs8mInqxUGRw47CIBIy7Ew0Sh0nED4OXCwkNh8h7GrrgCkVK9a7w6Q2BjoVa6Oo9EZEDVJ7I1M4UeMDXzIEhvoukFxNMaP8o4gpon1l9qnqc7DcPIgpd7Ce0t/fJVO0q0qIsVeuY1XwNYK1gwm8J2GAqvHRF5mD7BcG0Rl6yegjw0BqdakE8Bni0RyjyDf4Y1Y0n0wNT4wAAAABJRU5ErkJggg==" style="height:26px;width:26px" alt=""></div></span><div class="CA5RN"><div><span class="VuuXrf">X (Twitter)</span></div><div class="byrV5b"><cite class="ellip iUh30 HmBl6" style="overflow:initial">https://twitter.com/onedrive</cite></div></div></div></a></g-link></div><div class="p4InSe znvUFb"><span class="H9lube"><div class="eqA2re NjwKYd Vwoesf" aria-hidden="true"><img class="XNo5Ab" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAAAAABWESUoAAAA3ElEQVR4Ac2SGQDFMBBE1ylOcYpTner0neK0TnGpU53iFKc6xWl+p+f25D7InZ295Cv0mGjFUOzWDVVVa/WykaBiaBBFfsiyory3JASRjs8mInqxUGRw47CIBIy7Ew0Sh0nED4OXCwkNh8h7GrrgCkVK9a7w6Q2BjoVa6Oo9EZEDVJ7I1M4UeMDXzIEhvoukFxNMaP8o4gpon1l9qnqc7DcPIgpd7Ce0t/fJVO0q0qIsVeuY1XwNYK1gwm8J2GAqvHRF5mD7BcG0Rl6yegjw0BqdakE8Bni0RyjyDf4Y1Y0n0wNT4wAAAABJRU5ErkJggg==" style="height:16px;width:16px" alt=""></div></span><div class="CA5RN"><div><span class="VuuXrf">X (Twitter)</span></div><div class="byrV5b"><cite class="ellip iUh30 HmBl6" style="overflow:initial">https://twitter.com/onedrive<span class="TRQZRb"><div jscontroller="gOTY1" data-id="atritem-" jsdata="PFrTzf;_;A06DoI" data-viewer-group="1" jsaction="rcuQ6b:npT2md;aevozb:T2P31d;vcOT6c:C6KsF;k7WJpc:beCLof;jH1Skf:sCDZjb"><div><div jsdata="l7Bhpb;_;A06Dog" jscontroller="PbHo4e" jsshadow="" jsaction="rcuQ6b:npT2md;h5M12e;jGQF0b:kNqZ1c;" data-viewer-entrypoint="1" data-ved="2ahUKEwjugIPwif-LAxX2g_0HHWa6EjgQ2esEegQIIBAI"><div jsslot=""><div jsname="I3kE2c" class="iTPLzd rNSxBe eY4mx lUn2nc" style="position:absolute" aria-label="About this result" role="button" tabindex="0"><span jsname="czHhOd" class="D6lY4c mBswFe"><span jsname="Bil8Ae" class="xTFaxe z1asCe" style="height:18px;line-height:18px;width:18px"><svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 8c1.1 0 2-.9 2-2s-.9-2-2-2-2 .9-2 2 .9 2 2 2zm0 2c-1.1 0-2 .9-2 2s.9 2 2 2 2-.9 2-2-.9-2-2-2zm0 6c-1.1 0-2 .9-2 2s.9 2 2 2 2-.9 2-2-.9-2-2-2z"></path></svg></span></span></div></div></div></div></div></span></cite></div></div></div></div><div><div class="dHOsHb RWOyub" data-hveid="CBYQAA" data-ved="2ahUKEwjugIPwif-LAxX2g_0HHWa6EjgQ-YgBKAB6BAgWEAA"><g-inner-card class="zf84ud"><div class="bwBN6e tw-res" data-ved="2ahUKEwjugIPwif-LAxX2g_0HHWa6EjgQ_VMoAHoECBYQAQ"><div class="xcQxib eadHV es80kd Ses7yd wHYlTd" aria-level="3" role="heading"> equals www.twitter.com (Twitter)
Source: chromecache_1501.17.drString found in binary or memory: return f}rG.K="internal.enableAutoEventOnTimer";var cc=wa(["data-gtm-yt-inspected-"]),tG=["www.youtube.com","www.youtube-nocookie.com"],uG,vG=!1; equals www.youtube.com (Youtube)
Source: chromecache_1501.17.drString found in binary or memory: var GF=function(a,b,c,d,e){var f=DC("fsl",c?"nv.mwt":"mwt",0),g;g=c?DC("fsl","nv.ids",[]):DC("fsl","ids",[]);if(!g.length)return!0;var k=IC(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);R(121);if(m==="https://www.facebook.com/tr/")return R(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!qB(k,sB(b, equals www.facebook.com (Facebook)
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: apis.google.com
Source: global trafficDNS traffic detected: DNS query: play.google.com
Source: global trafficDNS traffic detected: DNS query: x1.i.lencr.org
Source: global trafficDNS traffic detected: DNS query: mail.google.com
Source: global trafficDNS traffic detected: DNS query: workspace.google.com
Source: global trafficDNS traffic detected: DNS query: ntp.msn.com
Source: global trafficDNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global trafficDNS traffic detected: DNS query: bzib.nelreports.net
Source: global trafficDNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global trafficDNS traffic detected: DNS query: assets.msn.com
Source: global trafficDNS traffic detected: DNS query: c.msn.com
Source: global trafficDNS traffic detected: DNS query: api.msn.com
Source: global trafficDNS traffic detected: DNS query: lh3.googleusercontent.com
Source: global trafficDNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global trafficDNS traffic detected: DNS query: google.com
Source: global trafficDNS traffic detected: DNS query: beacons.gvt2.com
Source: global trafficDNS traffic detected: DNS query: id.google.com
Source: global trafficDNS traffic detected: DNS query: assets.onestore.ms
Source: global trafficDNS traffic detected: DNS query: ajax.aspnetcdn.com
Source: global trafficDNS traffic detected: DNS query: otelrules.svc.static.microsoft
Source: global trafficDNS traffic detected: DNS query: c.s-microsoft.com
Source: global trafficDNS traffic detected: DNS query: beacons2.gvt2.com
Source: unknownHTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 907sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/x-www-form-urlencoded;charset=UTF-8sec-ch-ua-mobile: ?0Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CLbgygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: chromecache_1437.17.drString found in binary or memory: http://schema.org/Organization
Source: chromecache_1471.17.drString found in binary or memory: http://schema.org/SearchResultsPage
Source: Amcache.hve.6.drString found in binary or memory: http://upx.sf.net
Source: 2D85F72862B55C4EADD9E66E06947F3D0.21.drString found in binary or memory: http://x1.i.lencr.org/
Source: chromecache_1446.17.drString found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_1446.17.drString found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_1501.17.drString found in binary or memory: https://ad.doubleclick.net
Source: chromecache_1501.17.drString found in binary or memory: https://ade.googlesyndication.com
Source: chromecache_1501.17.drString found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_1437.17.drString found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
Source: chromecache_1471.17.drString found in binary or memory: https://aka.ms/OneDriveOfficeHours
Source: chromecache_1471.17.drString found in binary or memory: https://aka.ms/OneDriveOfficeHours&amp;ved=2ahUKEwjugIPwif-LAxX2g_0HHWa6EjgQhlR6BAgWEAI
Source: chromecache_1446.17.dr, chromecache_1467.17.drString found in binary or memory: https://apis.google.com
Source: chromecache_1471.17.drString found in binary or memory: https://apps.apple.com
Source: chromecache_1471.17.drString found in binary or memory: https://apps.apple.com/us/app/microsoft-onedrive/id477537958
Source: chromecache_1453.17.drString found in binary or memory: https://apps.google.com/
Source: 2cc80dabc69f58b6_1.30.drString found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.30.drString found in binary or memory: https://assets.msn.com/resolver/
Source: chromecache_1437.17.drString found in binary or memory: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.c
Source: chromecache_1437.17.drString found in binary or memory: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.30.drString found in binary or memory: https://bit.ly/wb-precache
Source: 2cc80dabc69f58b6_1.30.drString found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.30.drString found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.30.drString found in binary or memory: https://c.msn.com/
Source: chromecache_1453.17.drString found in binary or memory: https://calendar.google.com/calendar/u/0/r/appointment?appttour
Source: chromecache_1453.17.drString found in binary or memory: https://calendar.google.com/u/0/r/appointment?appttour
Source: chromecache_1501.17.drString found in binary or memory: https://cct.google/taggy/agent.js
Source: offscreendocument_main.js.30.dr, service_worker_bin_prod.js.30.drString found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/mathjax/
Source: Web Data.30.drString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.30.drString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 1df44329-127b-407a-bd4c-4805dc26f2e7.tmp.22.drString found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.30.drString found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.30.drString found in binary or memory: https://chromewebstore.google.com/
Source: manifest.json0.30.drString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chromecache_1446.17.drString found in binary or memory: https://clients6.google.com
Source: chromecache_1453.17.drString found in binary or memory: https://cloud.google.com/
Source: chromecache_1446.17.drString found in binary or memory: https://content.googleapis.com
Source: 2cc80dabc69f58b6_0.30.dr, Reporting and NEL.31.drString found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: chromecache_1453.17.drString found in binary or memory: https://developers.google.com/
Source: manifest.json0.30.drString found in binary or memory: https://docs.google.com/
Source: chromecache_1446.17.drString found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.30.drString found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.30.drString found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.30.drString found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.30.drString found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.30.drString found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.30.drString found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.30.drString found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.30.drString found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.30.drString found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.30.drString found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.30.drString found in binary or memory: https://drive.google.com/
Source: Web Data.30.drString found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.30.drString found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.30.drString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log9.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log9.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log9.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log10.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.30.dr, 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.30.dr, 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.30.dr, 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log9.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.30.dr, 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.30.dr, 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.30.dr, 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.30.dr, 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log9.30.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: chromecache_1471.17.drString found in binary or memory: https://encrypted-tbn2.gstatic.com/faviconV2?url
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_1442.17.drString found in binary or memory: https://fonts.googleapis.com
Source: chromecache_1442.17.drString found in binary or memory: https://fonts.googleapis.com/css?family=Material
Source: chromecache_1442.17.drString found in binary or memory: https://fonts.gstatic.com
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesans/v62/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RP
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv39oS_a.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDvD9oS_a.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDvH9oS_a.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDvr9oS_a.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8IacM9Wef3EJPWRrHjgE4B6CnlZxHVBg3etB77TKx9.woff2
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8IacM9Wef3EJPWRrHjgE4B6CnlZxHVBg3etBD7TA.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8IacM9Wef3EJPWRrHjgE4B6CnlZxHVBg3etBP7TKx9.woff2
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8IacM9Wef3EJPWRrHjgE4B6CnlZxHVBg3etBT7TKx9.woff2
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8IacM9Wef3EJPWRrHjgE4B6CnlZxHVBg3etB_7TKx9.woff2
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8IacM9Wef3EJPWRrHjgE4B6CnlZxHVBkXYtB77TKx9.woff2
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8IacM9Wef3EJPWRrHjgE4B6CnlZxHVBkXYtBD7TA.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8IacM9Wef3EJPWRrHjgE4B6CnlZxHVBkXYtBP7TKx9.woff2
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8IacM9Wef3EJPWRrHjgE4B6CnlZxHVBkXYtBT7TKx9.woff2
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8IacM9Wef3EJPWRrHjgE4B6CnlZxHVBkXYtB_7TKx9.woff2
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVngZjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnkdjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnktjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnmFjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnmNjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnmRjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnmVjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnmZjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnmdjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnmhjtg.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnmljtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnmpjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnmtjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnmxjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnn5jtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnnBjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnnFjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnnJjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnnNjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnnRjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnnVjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnndjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnnhjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnnljtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnnpjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnnxjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTngZjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnkdjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnktjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnmFjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnmNjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnmRjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnmVjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnmZjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnmdjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnmhjtg.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnmljtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnmpjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnmtjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnmxjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnn5jtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnnBjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnnFjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnnJjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnnNjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnnRjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnnVjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnndjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnnhjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnnljtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnnpjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnnxjtiu7.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qCR2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qE52i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEF2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEN2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qER2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEV2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEZ2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEd2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEh2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEl2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEp2iw.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEt2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qF52i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qFB2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qFF2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qFJ2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qFN2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qFV2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qFZ2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qFd2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qFh2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qFp2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qFt2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qFx2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qGV2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/googlesanstext/v23/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qGl2i1dC.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/materialicons/v143/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/materialiconsoutlined/v109/gok-H7zzDkdnRel8-DQ6KAXJ69wP1tGnf4ZGhUce.woff
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3-UBGEe.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3CUBGEe.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3GUBGEe.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3KUBGEe.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3OUBGEe.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3iUBGEe.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMawCUBGEe.woff2)
Source: chromecache_1456.17.drString found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMaxKUBGEe.woff2)
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://gaana.com/
Source: chromecache_1501.17.drString found in binary or memory: https://google.com
Source: chromecache_1501.17.drString found in binary or memory: https://googleads.g.doubleclick.net
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: chromecache_1437.17.drString found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: 2cc80dabc69f58b6_1.30.drString found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.30.drString found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/1kav9iVRBiyJ1_1VwMDeiYHGP9X3Dw5tVIj28ivFM1MyFxw76oF6I644_i66ucbEBP
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/4hZxVldyR8cl8b4OuQa9kOtPC_WhtyNdXTWA7876G4c8z7OulLxqIyT5UB80eOG2pl
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/6Z8m5bsD3e8tEjCe2FhSG5v2CFOmtqBf_ZaXKuan1x9O0HEFIrgTmeU2htAwOUW9ih
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/6nbzCZNiZVLtoOTzbAZ1d_BHxKtzyqTHC_l_kqxABxK5bAqWZ2Crhn0sp_3hkBzpt7
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/8cHO7WaYQsOObHs3PA0_7Au93UCIvvRzCoYA6XSZMd1W3TGBRQtJgroL6ruN_4TmIu
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/97jr7pwEwgh798nQbvvzK4f8wt6snOzQJZRSsUilwQ3KCAWgVxIf4VhcindgwZR3ko
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/B-JUuwlvmpEkNNeTdTeQ13avafYuETIqkiz-U7VtPnmEWzE6GPmDbgutVn-9WvHC_Y
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/BR_gXTPBQrwb4aTeTpBYAMSpl_xOZieCCxX_5Awuir3UOuPsWK1J-zdPZyIEZAxwLO
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/E2B-If-44mKRaB-EuLhzCmMlmAOgzKYDSBYlDNJx39Ft-KCtVt5eDR9Yn8F_4HlFqR
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/Fk-v24P1qAjGavgvgOkh6ttG5cGhkMEATKoBA33pXK5LGmzSOhTjWHu5ogUiiAIBJz
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/GYB1duIsvf5pEkcppH7SArKPxs-VEe6iddpvMMoA53pCPeljo3dzOEYpFsyl16rBDL
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/HP1YfjeevslFsDg0wS4rzRNiNXkhLYhW1Sa_0MaFCEsopR1YxAjbegobuqAMscHd93
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/JRoicK7FUvw3SOlEKLZ1HwWnR2dPKVn0iHL0CdC7lsBxM0L-TrNho8xrUE9Aj4d3Sa
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/Jf0IFQYNhGIcL1csBV5CKORNe5RU6QrYwdo9ipBDR1x3UdvH5_TcHj1dtSiVlxuShj
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/K7gBWtmhy68WKHPlgviywLLiG6N8Fn6L3QYXTO9z2-6s_MvxJCarKFUMl5cYV7e1m9
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/OJ4EfHYcL2U4vOUDwPYHdOWJIapcDvUsJpf6Pw6K4vJ-xaElcOopNNLqy5dc7a7rQZ
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/R5STxzbIpvScTy6zXwFT5KT716R579-24F0ZMHsNccGGOOphFjSrp7PCVhvwjua8-O
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/RbClFf663t2-x5CoRLt_MAvt6nK6hy27j-I389v9JLO7ZCNMok9dk94Lj1xwLx9A3w
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/RidYo95T8UR15jRW0eYmkGy3NTWJH6-5Ah1gQiY-1L6dmS0IjMqE7VUHaEQiREFUmZ
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/TGIWw3Mf1gLXkS7pMdY8SAvsaKhs3Atd9swXXP0DbLDCEynRgs6CEJm5pVCpqJoG08
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/TjTAVBYWc7dFWaZh5G9wXNVeznp7bm6DvJ-XNcC05YNYgfu1FHHE9TjksiYtG1nkT7
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/ZNfku9avhseOyG8BQM4xo-Xrmruq-7jwT212-MiDDhHoDc5ohbGWdFXvvLS5VsZFFz
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/dzHrYeZICfncgMRajd9e6fS0t_9dkc80qzJ2F6Wr1XAQAzJgG-jvK1vhOvHNNIBkyP
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/f1FCowp2z17NBacYzg905JXHLqg1dyuxVMGhbkvBmwWOtcesAP5hC7b-yf_7rxgBB0
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/j4KrlViisxT0AYAJfJ9pNhiegonco1_OJS6fi7gjU7b4hQicbwuKHWjpG774zVGSyP
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/j73UcrFihOUZ-WL-asfh7KViJVGHmWyf8t8qC_PPEXUxpFvBo72oh5IgVUgqpJP7_t
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/jA31lqwRtxtKK6K1gSw6vZfECA-ACyB91DrCzpcLab0jWsy4uG1DzjiTGLQwV43K4a
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/kpWr95tuV8tFDQ3zN4e02OPtjqoS_OFDBMNFEhrWtOfzeouoJylllG55i_4FNi7tDe
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/qfeCWLvhnJrPY77Z21vMTvLBtAKekA_1w_Ml3vOMSOMJoDCVJOIPL-4o4FXg5-npkE
Source: chromecache_1442.17.drString found in binary or memory: https://lh3.googleusercontent.com/vrVNbYmyZF8zPQgzhUjRDnAMI5qEJhgtzz-K6L7gnUoGyFbtabtPTXUmgIMAghzp3e
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://m.kugou.com/
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://m.soundcloud.com/
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://m.vk.com/
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: chromecache_1471.17.drString found in binary or memory: https://medium.com
Source: chromecache_1471.17.drString found in binary or memory: https://medium.com/
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://music.amazon.com
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://music.apple.com
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.30.drString found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log6.30.drString found in binary or memory: https://ntp.msn.com
Source: 000003.log0.30.dr, 000003.log2.30.drString found in binary or memory: https://ntp.msn.com/
Source: 000003.log0.30.drString found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.30.drString found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log0.30.dr, 2cc80dabc69f58b6_1.30.drString found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.30.drString found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: QuotaManager.30.drString found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.30.drString found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chromecache_1453.17.drString found in binary or memory: https://one.google.com/
Source: chromecache_1471.17.drString found in binary or memory: https://onedrive.live.com
Source: chromecache_1437.17.drString found in binary or memory: https://onedrive.live.com/about/en-us/
Source: chromecache_1471.17.drString found in binary or memory: https://onedrive.live.com/login
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://open.spotify.com
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://outlook.live.com/mail/0/
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: chromecache_1437.17.drString found in binary or memory: https://outlook.live.com/owa/
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://outlook.office.com/mail/0/
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_1501.17.drString found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_1501.17.drString found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_1471.17.drString found in binary or memory: https://pbs.twimg.com/profile_images/1222999690125422593/wG3UKxmO_normal.jpg
Source: chromecache_1471.17.drString found in binary or memory: https://play.google.com
Source: chromecache_1471.17.drString found in binary or memory: https://play.google.com/store/apps/details%3Fid%3Dcom.microsoft.skydrive%26hl%3Den_US&amp;ved=2ahUKE
Source: chromecache_1471.17.drString found in binary or memory: https://play.google.com/store/apps/details?id=com.microsoft.skydrive&amp;hl=en_US
Source: chromecache_1446.17.drString found in binary or memory: https://plus.google.com
Source: chromecache_1446.17.drString found in binary or memory: https://plus.googleapis.com
Source: chromecache_1453.17.drString found in binary or memory: https://policies.google.com/
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: chromecache_1437.17.drString found in binary or memory: https://products.office.com/en-us/home
Source: chromecache_1437.17.drString found in binary or memory: https://products.office.com/en-us/microsoft-teams/free?icid=SSM_AS_Promo_Apps_MicrosoftTeams
Source: 2cc80dabc69f58b6_1.30.drString found in binary or memory: https://sb.scorecardresearch.com/
Source: chromecache_1442.17.drString found in binary or memory: https://schema.org/WebPage
Source: 2cc80dabc69f58b6_1.30.drString found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.30.drString found in binary or memory: https://srtb.msn.com/
Source: chromecache_1437.17.drString found in binary or memory: https://statics-marketingsites-wcus-ms-com.akamaized.net/statics/override.css?c=7
Source: chromecache_1453.17.drString found in binary or memory: https://support.google.com/
Source: chromecache_1428.17.drString found in binary or memory: https://support.google.com/websearch
Source: chromecache_1501.17.drString found in binary or memory: https://survey.g.doubleclick.net/async_survey?site=
Source: chromecache_1501.17.drString found in binary or memory: https://td.doubleclick.net
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://tidal.com/
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://twitter.com/
Source: chromecache_1471.17.drString found in binary or memory: https://twitter.com/alitajran/status/1898006006199713927
Source: chromecache_1471.17.drString found in binary or memory: https://twitter.com/onedrive
Source: chromecache_1471.17.drString found in binary or memory: https://twitter.com/onedrive%3Fref_src%3Dtwsrc%255Egoogle%257Ctwcamp%255Eserp%257Ctwgr%255Eauthor&am
Source: chromecache_1471.17.drString found in binary or memory: https://twitter.com/onedrive/status/1897731626219848168?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwg
Source: chromecache_1471.17.drString found in binary or memory: https://twitter.com/onedrive?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://vibe.naver.com/today
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://web.telegram.org/
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://web.whatsapp.com
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_1453.17.drString found in binary or memory: https://workspace.google.com
Source: chromecache_1453.17.dr, chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/
Source: chromecache_1446.17.drString found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: chromecache_1453.17.dr, chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/blog/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/ar/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/ar_eg/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/cs/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/da/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/de/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/de_ch/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/en_au/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/en_ca/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/en_id/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/en_ie/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/en_in/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/en_my/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/en_nz/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/en_ph/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/en_sg/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/en_uk/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/en_za/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/es-419/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/es-419_ar/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/es-419_mx/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/es-419_us/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/es/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/fa/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/fi/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/fr/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/fr_ca/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/fr_ch/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/hu/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/id/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/it/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/iw/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/ja/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/ko/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/nl/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/no/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/pl/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/pt-BR/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/pt-PT/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/ru/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/sv/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/th/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/tr/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/uk/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/vi/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/zh-CN/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/zh-HK/gmail/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/intl/zh-TW/gmail/
Source: chromecache_1453.17.drString found in binary or memory: https://workspace.google.com/learning/
Source: chromecache_1442.17.drString found in binary or memory: https://workspace.google.com/static/favicon.ico?cache=4926369
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.deezer.com/
Source: chromecache_1501.17.drString found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_1501.17.drString found in binary or memory: https://www.google.com
Source: content.js.30.dr, content_new.js.30.drString found in binary or memory: https://www.google.com/chrome
Source: chromecache_1501.17.drString found in binary or memory: https://www.google.com/gmp/conversion;
Source: Web Data.30.drString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_1471.17.drString found in binary or memory: https://www.google.com/pagead/1p-conversion/16521530460/?gad_source=1&adview_type=5
Source: chromecache_1422.17.drString found in binary or memory: https://www.google.com/recaptcha/enterprise.js?render=$
Source: chromecache_1501.17.drString found in binary or memory: https://www.googleadservices.com
Source: chromecache_1471.17.drString found in binary or memory: https://www.googleadservices.com/pagead/aclk
Source: chromecache_1471.17.drString found in binary or memory: https://www.googleadservices.com/pagead/conversion/16521530460/?gad_source=1&adview_type=3
Source: chromecache_1446.17.drString found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_1446.17.drString found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_1501.17.drString found in binary or memory: https://www.googletagmanager.com
Source: chromecache_1501.17.drString found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_1501.17.drString found in binary or memory: https://www.googletagmanager.com/dclk/ns/v1.js
Source: chromecache_1442.17.drString found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: chromecache_1501.17.drString found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_1509.17.drString found in binary or memory: https://www.gstatic.com
Source: chromecache_1471.17.drString found in binary or memory: https://www.gstatic.com/diner/images/twitter_icon.png
Source: chromecache_1431.17.drString found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chromecache_1442.17.drString found in binary or memory: https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.css
Source: chromecache_1442.17.drString found in binary or memory: https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.js
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.iheart.com/podcast/
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.instagram.com
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.last.fm/
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.messenger.com
Source: 2cc80dabc69f58b6_1.30.drString found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.office.com
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: chromecache_1437.17.drString found in binary or memory: https://www.onenote.com/
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: chromecache_1471.17.drString found in binary or memory: https://www.reddit.com/r/linuxquestions/comments/1j3ldck/cloud_service_like_onedrive/
Source: chromecache_1471.17.drString found in binary or memory: https://www.reddit.com/r/microsoft/comments/1j5rp2q/is_it_safe_to_use_onedrive_as_the_master_storage
Source: chromecache_1471.17.drString found in binary or memory: https://www.reddit.com/r/msp/comments/1j4hklj/sharepoint_onedrive/
Source: chromecache_1437.17.drString found in binary or memory: https://www.skype.com/en/
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.tiktok.com/
Source: chromecache_1437.17.drString found in binary or memory: https://www.xbox.com/
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://www.youtube.com
Source: chromecache_1471.17.drString found in binary or memory: https://www.youtube.com/watch?v
Source: chromecache_1471.17.drString found in binary or memory: https://x.com/onedrive/status/1897731626219848168/photo/1
Source: chromecache_1471.17.drString found in binary or memory: https://x.com/onedrive/status/1897731626219848168/photo/1&amp;ved=2ahUKEwjugIPwif-LAxX2g_0HHWa6EjgQh
Source: 73eadcde-87a1-49ce-b761-4cc7a50d2882.tmp.30.drString found in binary or memory: https://y.music.163.com/m/
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49865
Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49864
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49982
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55865
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55866
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55861
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55863
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55864
Source: unknownNetwork traffic detected: HTTP traffic on port 49961 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49852 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55865 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 49881 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49979
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49978
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49855
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49975
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49852
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49973
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49851
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49972
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55824 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49967 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55882
Source: unknownNetwork traffic detected: HTTP traffic on port 49909 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49978 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
Source: unknownNetwork traffic detected: HTTP traffic on port 49886 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49967
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49966
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49965
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49962
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49961
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49960
Source: unknownNetwork traffic detected: HTTP traffic on port 55883 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49972 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49966 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55883
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55884
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49904 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49952
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49951
Source: unknownNetwork traffic detected: HTTP traffic on port 49864 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55853 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55898
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55899
Source: unknownNetwork traffic detected: HTTP traffic on port 49910 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55897
Source: unknownNetwork traffic detected: HTTP traffic on port 55864 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55852 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49951 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55826
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55827
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55828
Source: unknownNetwork traffic detected: HTTP traffic on port 49916 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55823 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55823
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55824
Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55884 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49899
Source: unknownNetwork traffic detected: HTTP traffic on port 55828 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49671 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49879 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49911 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49851 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49886
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55848
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49881
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55849
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49880
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55844
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55863 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49979 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49879
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 49973 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49923 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49872
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55855
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55856
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55850
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55852
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55853
Source: unknownNetwork traffic detected: HTTP traffic on port 49880 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49962 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55900 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55827 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55856 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55900
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 55901
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49900 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49975 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55897 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49872 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49855 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49901 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49924 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49844 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55901 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55844 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49952 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55861 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49913 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55850 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49865 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55898 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49965 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
Source: unknownNetwork traffic detected: HTTP traffic on port 49902 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
Source: unknownNetwork traffic detected: HTTP traffic on port 55855 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49925 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49679 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49960 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55866 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55849 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49925
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49924
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49923
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49920
Source: unknownNetwork traffic detected: HTTP traffic on port 49854 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49982 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49916
Source: unknownNetwork traffic detected: HTTP traffic on port 55848 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49913
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49911
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49910
Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55882 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55826 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49899 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 55899 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49909
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49904
Source: unknownNetwork traffic detected: HTTP traffic on port 49920 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49903
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49902
Source: unknownNetwork traffic detected: HTTP traffic on port 49903 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49901
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49900
Source: unknownHTTPS traffic detected: 104.214.71.38:443 -> 192.168.2.16:49960 version: TLS 1.2
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 568
Source: f1215469392.dllStatic PE information: No import functions for PE file found
Source: f1215469392.dllStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
Source: classification engineClassification label: mal52.expl.winDLL@103/499@64/26
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Windows\SysWOW64\DWWIN.EXEMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8692
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6928:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6996
Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\0d2acd68-92d1-4d7e-85f8-67c4950e5fd2Jump to behavior
Source: f1215469392.dllStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\f1215469392.dll",#1
Source: f1215469392.dllVirustotal: Detection: 6%
Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\f1215469392.dll"
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\f1215469392.dll",#1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\f1215469392.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 568
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --loadload-extension=C:\Windows\crx
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2056,i,6435462050054665223,12314675350512714991,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2288 --field-trial-handle=1372,i,5568626499763575672,11755765390696541677,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknownProcess created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE"
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1932 --field-trial-handle=1964,i,18245976637816187434,11547063040977359728,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6372 --field-trial-handle=1964,i,18245976637816187434,11547063040977359728,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6752 --field-trial-handle=1964,i,18245976637816187434,11547063040977359728,262144 /prefetch:8
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess created: C:\Windows\SysWOW64\DWWIN.EXE C:\Windows\SysWOW64\DWWIN.EXE -x -s 3676
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5760 --field-trial-handle=1964,i,18245976637816187434,11547063040977359728,262144 /prefetch:8
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\f1215469392.dll",#1Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\f1215469392.dll",#1Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2056,i,6435462050054665223,12314675350512714991,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2288 --field-trial-handle=1372,i,5568626499763575672,11755765390696541677,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1932 --field-trial-handle=1964,i,18245976637816187434,11547063040977359728,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6372 --field-trial-handle=1964,i,18245976637816187434,11547063040977359728,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6752 --field-trial-handle=1964,i,18245976637816187434,11547063040977359728,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5760 --field-trial-handle=1964,i,18245976637816187434,11547063040977359728,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess created: C:\Windows\SysWOW64\DWWIN.EXE C:\Windows\SysWOW64\DWWIN.EXE -x -s 3676
Source: C:\Windows\System32\loaddll32.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: wer.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: version.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: c2r64.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: c2r32.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: msvcp140.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: aepic.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: sfc.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: wldp.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: phoneinfo.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: netapi32.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: dsreg.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: profapi.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: xmllite.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: netprofm.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: npmproxy.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: netprofm.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: npmproxy.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: umpdc.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: rmclient.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: windows.security.authentication.onlineid.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: dpapi.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: winhttp.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: mswsock.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: winnsi.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: webio.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: schannel.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: msasn1.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: gpapi.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: cryptnet.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: policymanager.dll
Source: C:\Windows\SysWOW64\DWWIN.EXESection loaded: twinapi.appcore.dll
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office
Source: f1215469392.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: f1215469392.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: f1215469392.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: f1215469392.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: f1215469392.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: f1215469392.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: f1215469392.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
Source: f1215469392.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: f1215469392.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: f1215469392.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: f1215469392.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: f1215469392.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: f1215469392.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: f1215469392.dllStatic PE information: section name: .qtmetad
Source: C:\Windows\SysWOW64\DWWIN.EXEKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363} DeviceTicket
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\DWWIN.EXE TID: 4932Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: Web Data.30.drBinary or memory string: outlook.office365.comVMware20,11696584680t
Source: Amcache.hve.6.drBinary or memory string: VMware
Source: Web Data.30.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696584680
Source: Web Data.30.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696584680^
Source: Web Data.30.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696584680n
Source: Web Data.30.drBinary or memory string: microsoft.visualstudio.comVMware20,11696584680x
Source: Amcache.hve.6.drBinary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Web Data.30.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696584680
Source: DWWIN.EXE, 0000002A.00000003.2137880778.0000000003037000.00000004.00000020.00020000.00000000.sdmp, DWWIN.EXE, 0000002A.00000002.2141033650.0000000002FDA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: Web Data.30.drBinary or memory string: outlook.office.comVMware20,11696584680s
Source: Web Data.30.drBinary or memory string: secure.bankofamerica.comVMware20,11696584680|UE
Source: Web Data.30.drBinary or memory string: Canara Transaction PasswordVMware20,11696584680x
Source: Amcache.hve.6.drBinary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Web Data.30.drBinary or memory string: Canara Transaction PasswordVMware20,11696584680}
Source: Web Data.30.drBinary or memory string: bankofamerica.comVMware20,11696584680x
Source: Amcache.hve.6.drBinary or memory string: vmci.sys
Source: Web Data.30.drBinary or memory string: turbotax.intuit.comVMware20,11696584680t
Source: Web Data.30.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696584680
Source: Web Data.30.drBinary or memory string: www.interactivebrokers.comVMware20,11696584680}
Source: Web Data.30.drBinary or memory string: AMC password management pageVMware20,11696584680
Source: Amcache.hve.6.drBinary or memory string: VMware20,1
Source: Amcache.hve.6.drBinary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.drBinary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.drBinary or memory string: VMware Virtual disk SCSI Disk Device
Source: Web Data.30.drBinary or memory string: interactivebrokers.comVMware20,11696584680
Source: Amcache.hve.6.drBinary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Web Data.30.drBinary or memory string: tasks.office.comVMware20,11696584680o
Source: Amcache.hve.6.drBinary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.drBinary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.drBinary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.drBinary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.drBinary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.drBinary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.drBinary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.drBinary or memory string: vmci.syshbin
Source: Amcache.hve.6.drBinary or memory string: VMware, Inc.
Source: Web Data.30.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696584680p
Source: Web Data.30.drBinary or memory string: Interactive Brokers - HKVMware20,11696584680]
Source: Amcache.hve.6.drBinary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.drBinary or memory string: VMware-42 27 c8 0c e4 52 1d cc-a0 8f d3 a4 82 3e 8f 04
Source: Amcache.hve.6.drBinary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.drBinary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.drBinary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Web Data.30.drBinary or memory string: account.microsoft.com/profileVMware20,11696584680u
Source: Web Data.30.drBinary or memory string: ms.portal.azure.comVMware20,11696584680
Source: Web Data.30.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696584680
Source: Amcache.hve.6.drBinary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.drBinary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.drBinary or memory string: vmci.syshbin`
Source: Web Data.30.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696584680
Source: Amcache.hve.6.drBinary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.drBinary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Web Data.30.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696584680~
Source: Web Data.30.drBinary or memory string: trackpan.utiitsl.comVMware20,11696584680h
Source: Web Data.30.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696584680z
Source: Amcache.hve.6.drBinary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Web Data.30.drBinary or memory string: discord.comVMware20,11696584680f
Source: Web Data.30.drBinary or memory string: netportal.hdfcbank.comVMware20,11696584680
Source: Web Data.30.drBinary or memory string: global block list test formVMware20,11696584680
Source: DWWIN.EXE, 0000002A.00000003.2138005632.0000000003002000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWzA6&
Source: Web Data.30.drBinary or memory string: dev.azure.comVMware20,11696584680j
Source: Web Data.30.drBinary or memory string: interactivebrokers.co.inVMware20,11696584680d
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\f1215469392.dll",#1Jump to behavior
Source: C:\Windows\SysWOW64\DWWIN.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Source: Amcache.hve.6.drBinary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.drBinary or memory string: msmpeng.exe
Source: Amcache.hve.6.drBinary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.drBinary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Exploitation for Client Execution		1
DLL Side-Loading		11
Process Injection		1
Masquerading		OS Credential Dumping21
Security Software Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Modify Registry		LSASS Memory2
Virtualization/Sandbox Evasion		Remote Desktop ProtocolData from Removable Media1
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)2
Virtualization/Sandbox Evasion		Security Account Manager1
Process Discovery		SMB/Windows Admin SharesData from Network Shared Drive3
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
Process Injection		NTDS3
System Information Discovery		Distributed Component Object ModelInput Capture4
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Rundll32		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1633362 Sample: f1215469392.dll Startdate: 10/03/2025 Architecture: WINDOWS Score: 52 43 x1.i.lencr.org 2->43 45 star-azurefd-prod.trafficmanager.net 2->45 47 20 other IPs or domains 2->47 67 Multi AV Scanner detection for submitted file 2->67 69 Document exploit detected (process start blacklist hit) 2->69 9 msedge.exe 2->9         started        12 chrome.exe 2->12         started        14 loaddll32.exe 1 2->14         started        16 4 other processes 2->16 signatures3 process4 dnsIp5 63 239.255.255.250 unknown Reserved 9->63 18 msedge.exe 9->18         started        21 msedge.exe 9->21         started        23 msedge.exe 9->23         started        25 msedge.exe 9->25         started        65 192.168.2.16, 138, 443, 49216 unknown unknown 12->65 27 chrome.exe 12->27         started        29 cmd.exe 1 14->29         started        31 conhost.exe 14->31         started        33 AcroCEF.exe 102 16->33         started        35 DWWIN.EXE 16->35         started        process6 dnsIp7 49 c-msn-pme.trafficmanager.net 13.74.129.1, 443, 49852 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 18->49 51 ax-0001.ax-msedge.net 150.171.28.10, 443, 49851 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 18->51 59 29 other IPs or domains 18->59 53 mail.google.com 142.250.184.229, 443, 49756, 49757 GOOGLEUS United States 27->53 55 play.google.com 142.250.185.110, 443, 49731, 49737 GOOGLEUS United States 27->55 61 24 other IPs or domains 27->61 37 rundll32.exe 29->37         started        57 e8652.dscx.akamaiedge.net 23.209.209.135, 49747, 80 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID United States 33->57 39 AcroCEF.exe 33->39         started        process8 process9 41 WerFault.exe 20 16 37->41         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.