Windows Analysis Report http://Conades.org/aut/minusite-6199055

Compliance:

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Uses new MSVCR Dlls

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 23.35.236.56:443 -> 192.168.2.7:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.179.253.213:443 -> 192.168.2.7:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.179.253.213:443 -> 192.168.2.7:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.82.209.183:443 -> 192.168.2.7:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.82.209.183:443 -> 192.168.2.7:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.161.44.139:443 -> 192.168.2.7:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.7:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.235:443 -> 192.168.2.7:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.112.88.60:443 -> 192.168.2.7:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.7:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.7:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.7:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.7:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.7:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.7:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.7:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.112.88.60:443 -> 192.168.2.7:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.7:49874 version: TLS 1.2

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\regsvr32.exe

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 02CD09B7h		7_2_02CD02A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 02CD09B6h		7_2_02CD02A8

Networking:

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49676
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183

URLs found in memory or binary data

Source: angular.js.1.dr	String found in binary or memory: http://angularjs.org
Source: data_1.4.dr, 000003.log2.1.dr, History.1.dr	String found in binary or memory: http://conades.org/aut/contemporary-236025701.zip
Source: Current Session.1.dr	String found in binary or memory: http://conades.org/aut/minusite-6199055
Source: History.1.dr	String found in binary or memory: http://conades.org/aut/minusite-6199055/0(S
Source: History Provider Cache.1.dr	String found in binary or memory: http://conades.org/aut/minusite-61990552
Source: History Provider Cache.1.dr	String found in binary or memory: http://conades.org/aut/minusite-61990552:
Source: History.1.dr	String found in binary or memory: http://conades.org/aut/minusite-6199055http://conades.org/aut/minusite-6199055application/octet-stre
Source: angular.js.1.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: pnacl_public_x86_64_pnacl_sz_nexe.1.dr	String found in binary or memory: http://llvm.org/):
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: 71493052-21d6-4b51-8d0a-ba28f6348003.tmp.4.dr, manifest.json1.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.1.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://api.aadrm.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://api.aadrm.com/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://api.cortana.ai
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://api.office.net
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://api.onedrive.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 71493052-21d6-4b51-8d0a-ba28f6348003.tmp.4.dr, manifest.json1.1.dr	String found in binary or memory: https://apis.google.com
Source: mirroring_common.js.1.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://augloop.office.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://augloop.office.com/v2
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: mirroring_common.js.1.dr	String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://cdn.entity.
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: pnacl_public_x86_64_libcrt_platform_a.1.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libcrt_platform_a.1.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://clients.config.office.net/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 71493052-21d6-4b51-8d0a-ba28f6348003.tmp.4.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json0.1.dr, manifest.json.1.dr, manifest.json1.1.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 71493052-21d6-4b51-8d0a-ba28f6348003.tmp.4.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://clients6.google.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: pnacl_public_x86_64_ld_nexe.1.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.1.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://config.edge.skype.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: manifest.json1.1.dr	String found in binary or memory: https://content.googleapis.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://cortana.ai
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://cortana.ai/api
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://cr.office.com
Source: common.js.1.dr, mirroring_cast_streaming.js.1.dr	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://dev.cortana.ai
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://devnull.onenote.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://directory.services.
Source: 76b0f4c2-0bb6-4255-a82f-4cc26f73710e.tmp.4.dr, 71493052-21d6-4b51-8d0a-ba28f6348003.tmp.4.dr, 58a2d35b-15a6-4eb8-b267-71b53b43ab2d.tmp.4.dr	String found in binary or memory: https://dns.google
Source: mirroring_common.js.1.dr	String found in binary or memory: https://docs.google.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: manifest.json1.1.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: 71493052-21d6-4b51-8d0a-ba28f6348003.tmp.4.dr	String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json1.1.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: 71493052-21d6-4b51-8d0a-ba28f6348003.tmp.4.dr	String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json1.1.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: angular.js.1.dr, material_css_min.css.1.dr	String found in binary or memory: https://github.com/angular/material
Source: craw_background.js.1.dr, craw_window.js.1.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://graph.windows.net
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://graph.windows.net/
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json1.1.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://lifecycle.office.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://login.windows.local
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://management.azure.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://management.azure.com/
Source: mirroring_common.js.1.dr	String found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://messaging.office.com/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://ncus.contentsync.
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: mirroring_common.js.1.dr	String found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://officeapps.live.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 71493052-21d6-4b51-8d0a-ba28f6348003.tmp.4.dr	String found in binary or memory: https://ogs.google.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://onedrive.live.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://osi.office.net
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://outlook.office.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://outlook.office.com/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://outlook.office365.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://outlook.office365.com/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: manifest.json.1.dr, craw_window.js.1.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://powerlift-user.acompli.net
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://powerlift.acompli.net
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: data_3.4.dr	String found in binary or memory: https://r2---sn-1gi7znek.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic?cms_redirect=yes&mh=I2&mip=84.17
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: data_1.4.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic
Source: data_1.4.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdicawb
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://roaming.edog.
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: manifest.json.1.dr, craw_window.js.1.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://settings.outlook.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 71493052-21d6-4b51-8d0a-ba28f6348003.tmp.4.dr	String found in binary or memory: https://ssl.gstatic.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://staging.cortana.ai
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: messages.json27.1.dr, messages.json83.1.dr, feedback.html.1.dr, messages.json80.1.dr, messages.json28.1.dr, messages.json22.1.dr, messages.json77.1.dr, messages.json34.1.dr, messages.json10.1.dr, messages.json21.1.dr, messages.json3.1.dr, messages.json74.1.dr, messages.json9.1.dr, messages.json75.1.dr, messages.json85.1.dr, messages.json20.1.dr, messages.json24.1.dr, messages.json8.1.dr, messages.json87.1.dr, messages.json86.1.dr, messages.json76.1.dr, messages.json1.1.dr, messages.json33.1.dr, messages.json7.1.dr, messages.json84.1.dr, messages.json70.1.dr, messages.json35.1.dr, messages.json23.1.dr, messages.json26.1.dr, messages.json25.1.dr, messages.json6.1.dr, messages.json12.1.dr, messages.json79.1.dr, messages.json2.1.dr, messages.json71.1.dr, messages.json82.1.dr, messages.json81.1.dr, messages.json5.1.dr, messages.json78.1.dr, messages.json0.1.dr, messages.json11.1.dr, messages.json.1.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json27.1.dr, messages.json83.1.dr, feedback.html.1.dr, messages.json80.1.dr, messages.json28.1.dr, messages.json22.1.dr, messages.json77.1.dr, messages.json34.1.dr, messages.json10.1.dr, messages.json21.1.dr, messages.json3.1.dr, messages.json74.1.dr, messages.json9.1.dr, messages.json75.1.dr, messages.json85.1.dr, messages.json20.1.dr, messages.json24.1.dr, messages.json8.1.dr, messages.json87.1.dr, messages.json86.1.dr, messages.json76.1.dr, messages.json1.1.dr, messages.json33.1.dr, messages.json7.1.dr, messages.json84.1.dr, messages.json70.1.dr, messages.json35.1.dr, messages.json23.1.dr, messages.json26.1.dr, messages.json25.1.dr, messages.json6.1.dr, messages.json12.1.dr, messages.json79.1.dr, messages.json2.1.dr, messages.json71.1.dr, messages.json82.1.dr, messages.json81.1.dr, messages.json5.1.dr, messages.json78.1.dr, messages.json0.1.dr, messages.json11.1.dr, messages.json.1.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://tasks.office.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://webshell.suite.office.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://wus2.contentsync.
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: craw_background.js.1.dr, craw_window.js.1.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 71493052-21d6-4b51-8d0a-ba28f6348003.tmp.4.dr, manifest.json1.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.1.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.1.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: feedback_script.js.1.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json1.1.dr	String found in binary or memory: https://www.google.com;
Source: 71493052-21d6-4b51-8d0a-ba28f6348003.tmp.4.dr, craw_background.js.1.dr, craw_window.js.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json1.1.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json1.1.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json1.1.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json1.1.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json1.1.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json1.1.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json1.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json1.1.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: mirroring_common.js.1.dr	String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: mirroring_common.js.1.dr	String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: 71493052-21d6-4b51-8d0a-ba28f6348003.tmp.4.dr	String found in binary or memory: https://www.gstatic.com
Source: common.js.1.dr	String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: manifest.json1.1.dr	String found in binary or memory: https://www.gstatic.com;
Source: E4D27F66-2E94-4931-B210-887418C1BE9B.19.dr	String found in binary or memory: https://www.odwebp.svc.ms

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4740Host: login.live.com

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: accounts.google.com

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /client/config?cc=US&setlang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -480X-BM-FirstEnabledTime: 132061395240662859X-DeviceID: 0100748C0900F661X-Search-TimeZone: Bias=480; StandardBias=0; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDgAkR8BAAUW3WS0TDKGu2jEbBhB%2BXls4oNzBQAAXNgT%2BvyMGh3UWAYzPpXd1DEKD3o93ntd%2BmE7yuGcyd2SUaLrph6gFb3hQAWei2yWiErzIG7CQ0AVtZHFj3Lec%2B%2Bq00q9ArOitLDFYuutQ8olqyHKofbXyNLCilwTShP21orgPlaQvsQi1WdupNKraE%2BowVuRsq86u6f6Ek62Z5Ct%2BtQKuKe7ONrCIQTWofkIGS1M384mLHHFbuf6dpxE4C9IV3tdr53fyF6IUFv%2BGBy36kYTrv9k3hnpj%2BdYhyBzufSKzyPZFt6EBWzTeCq14WoijemOLLaXyEI4S%2B19ZSmIGoiN7isOwwos8sYBmFkJODfSBTrAE6lGB8rut1YJTMDZgAACJ9nCj7cipdMsAGJqFyMpkIuVN3y6g9Rlmf6jChW%2BDJzpQTwA6sjLMsq7RCiUVyRMHNfDjPc2J1ur766UawqXYrraS2Fybv/boRv4it0Fzs%2B8PlKA87Sphm%2BhuNSxqIJoDXFP1bIDi8h/vZGib%2Bpcd7%2BpFj9rcMEu7Si5Jag6IGVXJF2GJMd4%2BSAhwO9KgJjvsoL15Pg3EkYVUejHuautpTa9IRKKFZR9UF6KMtSm5CMyrFPpKDW5l9PszDPgcv3F/Lz%2BL0YbE8oh28oqId5Ze2rPyj7wbI6DRn40ifakH5NVvl5VYG%2BsDBaHe1OHRAHUYBHGkHKnOXyvwr1M5T1ozcYt2PCOjfUfm/o%2ByNKnDDFkmd54vioI9yG1MJgFDKmfjB/MfMFt6ypaBtTLxEsrAMX4VB%2BRNAmsnUg/jpzmF8f0X/IXcEkfupTfxK6ken9%2BELijfuMO9swr/HCI37U0MQvIMYsLG3bljRZTczIRKghltQ1kaP6mJ4p%2BnQd/RzrgrvZx0H9WPkDn22O7MFheLqVYftAUTtrQFcEkfe2egG8sTUoB9ogZLz5W93Rq4SSJ%2BOo0%2BcedJmQk6rVAQ%3D%3D%26p%3DX-Agent-DeviceId: 0100748C0900F661X-BM-CBT: 1637800047User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-Touch: falseX-Device-ClientSession: E9D404B4CE0B4258B031F9C4ED83DC35X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
Source: global traffic	HTTP traffic detected: GET /proactive/v2/spark?cc=US&setLang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-Device-IsBatteryCertified: falseX-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-Device-IsBatteryEnabled: falseX-Device-NetworkType: ethernetX-BM-DTZ: -480X-BM-FirstEnabledTime: 132061395240662859X-DeviceID: 0100748C0900F661X-VoiceActivationOn: falseX-Device-AudioCapture: Microphone (High Definition Audio Device)X-Search-TimeZone: Bias=480; StandardBias=0; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDgAkR8BAAUW3WS0TDKGu2jEbBhB%2BXls4oNzBQAAXNgT%2BvyMGh3UWAYzPpXd1DEKD3o93ntd%2BmE7yuGcyd2SUaLrph6gFb3hQAWei2yWiErzIG7CQ0AVtZHFj3Lec%2B%2Bq00q9ArOitLDFYuutQ8olqyHKofbXyNLCilwTShP21orgPlaQvsQi1WdupNKraE%2BowVuRsq86u6f6Ek62Z5Ct%2BtQKuKe7ONrCIQTWofkIGS1M384mLHHFbuf6dpxE4C9IV3tdr53fyF6IUFv%2BGBy36kYTrv9k3hnpj%2BdYhyBzufSKzyPZFt6EBWzTeCq14WoijemOLLaXyEI4S%2B19ZSmIGoiN7isOwwos8sYBmFkJODfSBTrAE6lGB8rut1YJTMDZgAACJ9nCj7cipdMsAGJqFyMpkIuVN3y6g9Rlmf6jChW%2BDJzpQTwA6sjLMsq7RCiUVyRMHNfDjPc2J1ur766UawqXYrraS2Fybv/boRv4it0Fzs%2B8PlKA87Sphm%2BhuNSxqIJoDXFP1bIDi8h/vZGib%2Bpcd7%2BpFj9rcMEu7Si5Jag6IGVXJF2GJMd4%2BSAhwO9KgJjvsoL15Pg3EkYVUejHuautpTa9IRKKFZR9UF6KMtSm5CMyrFPpKDW5l9PszDPgcv3F/Lz%2BL0YbE8oh28oqId5Ze2rPyj7wbI6DRn40ifakH5NVvl5VYG%2BsDBaHe1OHRAHUYBHGkHKnOXyvwr1M5T1ozcYt2PCOjfUfm/o%2ByNKnDDFkmd54vioI9yG1MJgFDKmfjB/MfMFt6ypaBtTLxEsrAMX4VB%2BRNAmsnUg/jpzmF8f0X/IXcEkfupTfxK6ken9%2BELijfuMO9swr/HCI37U0MQvIMYsLG3bljRZTczIRKghltQ1kaP6mJ4p%2BnQd/RzrgrvZx0H9WPkDn22O7MFheLqVYftAUTtrQFcEkfe2egG8sTUoB9ogZLz5W93Rq4SSJ%2BOo0%2BcedJmQk6rVAQ%3D%3D%26p%3DX-Agent-DeviceId: 0100748C0900F661X-BM-CBT: 1637800047User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-IsEnergyHero: falseX-Device-Touch: falseX-Device-ClientSession: E9D404B4CE0B4258B031F9C4ED83DC35X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20211125T002728Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=8dea6b60a8bb46d3a0da8d5af1b9f0b3&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1268902&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=VMware7%2C1&tl=2&tsu=1268902&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32314&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAfloyULdvCVq9dG5QCHN8znW+eBQZRkpYLyZsRbyxs8lN8BLEsz/Bq4JHpG2gXMhJWH6vVfo3zDhQph+Qtmnz5KCZst5302Wt1elN0mHItb3PxEUQkyfJSZsYEIU34WyMriHCFCc0EK885aXegMH4BYtTI+4XUJGjcZ1/vfw2VOlk0tG4Smq0AJFovYM+rIXWH+YrMnx1o/99zKeAKfljhlUUgRd2VZvRbPIF2WTJ8XKmZZo8Q4aRuJICTmHhiq10L303Ul4hJp1iJum39LEAcNkGK28J91vP+iDjOgdxjoVS6blhvcXCEWveUJbAjBTeaYWTVMcf+Mb5Xr91nk+vCgDZgAACK1SnSTucJPBsAHR8OQ4Ft7b56/h6rcQOQ8w1Q5QJ8wDmRdfr7/3jeZgQKMgkz/3wkoU30cUFwy1lA27hr0IevqUJNcHL+xi4A8gkkZqOGZzbn+kXOms5Su+F7gILFkSeua0uzsT1HZPwcZmq4TFRLK2bDWo9+B3CLFul17HJszCSbYpyo4YSXe1+R6yjhmPkUtVK1/hMb7NuLf0w1zqV7KXJx/UwtoaHOSl6kAyISo3M3j/pfUbDanTBpvGRiakiDB7SIYZtgdp0UbyXqdcstQRZW9v6GiUDBqcloBCUaV/oHvdb3j1Og37KA0pIq2nTNx8pOg8WZeuCcE08qbhKAG5NviF4ikpp+m6zhVIvKRlJ840VHLuIjMDtUwzegeV3P38rcd1y5Kl9kRp+b3mD6V2Cl/3WjLUNAisr3ZqSzSm8/sTjy6p9PEuaKZI+aeS0L2p7Ng3UatMaMGP86itOI8ZtdL68MA9/7Fp3Qo6pxUYLgclRiSyIUj2WMyuAWLoGD9Vr2nJRrBwZ5osEUrbwPBoBHsXbqo3tuCAdmZfyJkwoOzhWD6oSEkbVEON2v/yLpjfr2kbPbkpgMPVAQ==&p=Cache-Control: no-cacheMS-CV: XcQVAcpAik+c6zhM.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20211125T002728Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=c1d41bcf1869444593568226e1e20cf1&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1268902&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=1268902&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32314&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAayxKqE8Za/HRZeiToySTtPfg+q3Q9CgUXJBmcu97lY1A/b/brIzvqqwSJPOTO4t7kVD9tSdEFer+clIDPnUg9OIBmeJ+aY3kKGDZOJ0Csa1AxshQcPUPTU40Lc61JRvulBFQoEVXgNwiP51qc5ddat4Bg29/YyuOB7NzWbSpUVZdrVB+IJIMJPkEwdQFgnsLL6mw8mwR9Lfo6VZjMVXU4fM7zHfDl/TVOzLC+JUC4MBNS4+mNSnM1wEmCkjUaPE26m4LxdYpCYX42S9AuSjCcxgURlr5PuOdodWS26LSNY4kSZw7ZLpICtYXwu19JxJ3s491EW88OdF3LW+N9ZbHoADZgAACDT9aVj8DYOZqAFgaUS/Y6VnVMEHJ8hERixbnUhtn59yjm+jtfUL13G121UofBnMamXklZ8kgud4TgV0xxa4YPdy3iLXuQ5tpXG9H1yGzBvyO91ip6yBp66M31BBqUWNMC/ubxdcIo+ascqR7RizJMDC//ZPoKMLLYrMqxTh8gZv5OlTjwtdol+hseRRhWTgzBl4Y0Hzv6MwTyjDi3cCyt/3zruJhEsM5DHGbo9YRwW9hxape/r6Swih6zHB7dcaAl7Z33LjYjwZeytrjspfKojfFH1CO5PIkk6xTymxgcvpryr1tFqbKV3LxeUbNaU6gJ0C2THm66nVF5Z+NCsV9i5HweOIe9DnH85UjCAdQ5ApLDiYZDe/pZAAFdL2QrO3KLSF8XMyB4CPcK8yqrujydpP8YBesSfGbz7ENaKCu8obX0yvk+LfiSz4AFm/NxT+lMmik5UVNJpHBz+g7btn3APx650aaCNxxOIwo64a9JKtcNqWB4hdmyFVHgCqhcBI2Ux+IwNJXTC9rclgzlNqYdtyZgt/t+OUT8x+IukumuWrZxlL8tdchq3Il8glo4yxn6MS1QE=&p=Cache-Control: no-cacheMS-CV: XcQVAcpAik+c6zhM.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Thu, 20 Apr 2017 16:10:39 GMTUser-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /GD7A3PSD4zc/tw.html HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: orthomay.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ag2DVqIM/w.html HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: quebradadigital.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20211125T002814Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=19f76fb2f26b4f439451fe89ca407e41&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1268902&metered=false&nettype=ethernet&npid=sc-280815&oemName=pxccts%2C%20Inc.&oemid=pxccts%2C%20Inc.&ossku=Professional&smBiosDm=pxccts7%2C1&tl=2&tsu=1268902&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32314&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAfloyULdvCVq9dG5QCHN8znW+eBQZRkpYLyZsRbyxs8lN8BLEsz/Bq4JHpG2gXMhJWH6vVfo3zDhQph+Qtmnz5KCZst5302Wt1elN0mHItb3PxEUQkyfJSZsYEIU34WyMriHCFCc0EK885aXegMH4BYtTI+4XUJGjcZ1/vfw2VOlk0tG4Smq0AJFovYM+rIXWH+YrMnx1o/99zKeAKfljhlUUgRd2VZvRbPIF2WTJ8XKmZZo8Q4aRuJICTmHhiq10L303Ul4hJp1iJum39LEAcNkGK28J91vP+iDjOgdxjoVS6blhvcXCEWveUJbAjBTeaYWTVMcf+Mb5Xr91nk+vCgDZgAACK1SnSTucJPBsAHR8OQ4Ft7b56/h6rcQOQ8w1Q5QJ8wDmRdfr7/3jeZgQKMgkz/3wkoU30cUFwy1lA27hr0IevqUJNcHL+xi4A8gkkZqOGZzbn+kXOms5Su+F7gILFkSeua0uzsT1HZPwcZmq4TFRLK2bDWo9+B3CLFul17HJszCSbYpyo4YSXe1+R6yjhmPkUtVK1/hMb7NuLf0w1zqV7KXJx/UwtoaHOSl6kAyISo3M3j/pfUbDanTBpvGRiakiDB7SIYZtgdp0UbyXqdcstQRZW9v6GiUDBqcloBCUaV/oHvdb3j1Og37KA0pIq2nTNx8pOg8WZeuCcE08qbhKAG5NviF4ikpp+m6zhVIvKRlJ840VHLuIjMDtUwzegeV3P38rcd1y5Kl9kRp+b3mD6V2Cl/3WjLUNAisr3ZqSzSm8/sTjy6p9PEuaKZI+aeS0L2p7Ng3UatMaMGP86itOI8ZtdL68MA9/7Fp3Qo6pxUYLgclRiSyIUj2WMyuAWLoGD9Vr2nJRrBwZ5osEUrbwPBoBHsXbqo3tuCAdmZfyJkwoOzhWD6oSEkbVEON2v/yLpjfr2kbPbkpgMPVAQ==&p=Cache-Control: no-cacheMS-CV: MQurgrzSZk+OYgcZ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20211125T002813Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=e4aa4025ddbb4244a1e8393bfd312c93&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1268902&metered=false&nettype=ethernet&npid=sc-338389&oemName=pxccts%2C%20Inc.&oemid=pxccts%2C%20Inc.&ossku=Professional&smBiosDm=pxccts7%2C1&tl=2&tsu=1268902&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32314&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAfloyULdvCVq9dG5QCHN8znW+eBQZRkpYLyZsRbyxs8lN8BLEsz/Bq4JHpG2gXMhJWH6vVfo3zDhQph+Qtmnz5KCZst5302Wt1elN0mHItb3PxEUQkyfJSZsYEIU34WyMriHCFCc0EK885aXegMH4BYtTI+4XUJGjcZ1/vfw2VOlk0tG4Smq0AJFovYM+rIXWH+YrMnx1o/99zKeAKfljhlUUgRd2VZvRbPIF2WTJ8XKmZZo8Q4aRuJICTmHhiq10L303Ul4hJp1iJum39LEAcNkGK28J91vP+iDjOgdxjoVS6blhvcXCEWveUJbAjBTeaYWTVMcf+Mb5Xr91nk+vCgDZgAACK1SnSTucJPBsAHR8OQ4Ft7b56/h6rcQOQ8w1Q5QJ8wDmRdfr7/3jeZgQKMgkz/3wkoU30cUFwy1lA27hr0IevqUJNcHL+xi4A8gkkZqOGZzbn+kXOms5Su+F7gILFkSeua0uzsT1HZPwcZmq4TFRLK2bDWo9+B3CLFul17HJszCSbYpyo4YSXe1+R6yjhmPkUtVK1/hMb7NuLf0w1zqV7KXJx/UwtoaHOSl6kAyISo3M3j/pfUbDanTBpvGRiakiDB7SIYZtgdp0UbyXqdcstQRZW9v6GiUDBqcloBCUaV/oHvdb3j1Og37KA0pIq2nTNx8pOg8WZeuCcE08qbhKAG5NviF4ikpp+m6zhVIvKRlJ840VHLuIjMDtUwzegeV3P38rcd1y5Kl9kRp+b3mD6V2Cl/3WjLUNAisr3ZqSzSm8/sTjy6p9PEuaKZI+aeS0L2p7Ng3UatMaMGP86itOI8ZtdL68MA9/7Fp3Qo6pxUYLgclRiSyIUj2WMyuAWLoGD9Vr2nJRrBwZ5osEUrbwPBoBHsXbqo3tuCAdmZfyJkwoOzhWD6oSEkbVEON2v/yLpjfr2kbPbkpgMPVAQ==&p=Cache-Control: no-cacheMS-CV: MQurgrzSZk+OYgcZ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /UnE5kOnX/tw.html HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mustafakhafimsp.afConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20211125T002831Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=139a7801789f4317ae48454fca227751&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1268902&metered=false&nettype=ethernet&npid=sc-338387&oemName=pxccts%2C%20Inc.&oemid=pxccts%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=pxccts7%2C1&tl=2&tsu=1268902&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32314&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAfloyULdvCVq9dG5QCHN8znW+eBQZRkpYLyZsRbyxs8lN8BLEsz/Bq4JHpG2gXMhJWH6vVfo3zDhQph+Qtmnz5KCZst5302Wt1elN0mHItb3PxEUQkyfJSZsYEIU34WyMriHCFCc0EK885aXegMH4BYtTI+4XUJGjcZ1/vfw2VOlk0tG4Smq0AJFovYM+rIXWH+YrMnx1o/99zKeAKfljhlUUgRd2VZvRbPIF2WTJ8XKmZZo8Q4aRuJICTmHhiq10L303Ul4hJp1iJum39LEAcNkGK28J91vP+iDjOgdxjoVS6blhvcXCEWveUJbAjBTeaYWTVMcf+Mb5Xr91nk+vCgDZgAACK1SnSTucJPBsAHR8OQ4Ft7b56/h6rcQOQ8w1Q5QJ8wDmRdfr7/3jeZgQKMgkz/3wkoU30cUFwy1lA27hr0IevqUJNcHL+xi4A8gkkZqOGZzbn+kXOms5Su+F7gILFkSeua0uzsT1HZPwcZmq4TFRLK2bDWo9+B3CLFul17HJszCSbYpyo4YSXe1+R6yjhmPkUtVK1/hMb7NuLf0w1zqV7KXJx/UwtoaHOSl6kAyISo3M3j/pfUbDanTBpvGRiakiDB7SIYZtgdp0UbyXqdcstQRZW9v6GiUDBqcloBCUaV/oHvdb3j1Og37KA0pIq2nTNx8pOg8WZeuCcE08qbhKAG5NviF4ikpp+m6zhVIvKRlJ840VHLuIjMDtUwzegeV3P38rcd1y5Kl9kRp+b3mD6V2Cl/3WjLUNAisr3ZqSzSm8/sTjy6p9PEuaKZI+aeS0L2p7Ng3UatMaMGP86itOI8ZtdL68MA9/7Fp3Qo6pxUYLgclRiSyIUj2WMyuAWLoGD9Vr2nJRrBwZ5osEUrbwPBoBHsXbqo3tuCAdmZfyJkwoOzhWD6oSEkbVEON2v/yLpjfr2kbPbkpgMPVAQ==&p=Cache-Control: no-cacheMS-CV: MQurgrzSZk+OYgcZ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20211125T002831Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=f57c03a4b86547aba6d74cca112cd5dd&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1268902&metered=false&nettype=ethernet&npid=sc-338388&oemName=pxccts%2C%20Inc.&oemid=pxccts%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=pxccts7%2C1&tl=2&tsu=1268902&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32314&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAfloyULdvCVq9dG5QCHN8znW+eBQZRkpYLyZsRbyxs8lN8BLEsz/Bq4JHpG2gXMhJWH6vVfo3zDhQph+Qtmnz5KCZst5302Wt1elN0mHItb3PxEUQkyfJSZsYEIU34WyMriHCFCc0EK885aXegMH4BYtTI+4XUJGjcZ1/vfw2VOlk0tG4Smq0AJFovYM+rIXWH+YrMnx1o/99zKeAKfljhlUUgRd2VZvRbPIF2WTJ8XKmZZo8Q4aRuJICTmHhiq10L303Ul4hJp1iJum39LEAcNkGK28J91vP+iDjOgdxjoVS6blhvcXCEWveUJbAjBTeaYWTVMcf+Mb5Xr91nk+vCgDZgAACK1SnSTucJPBsAHR8OQ4Ft7b56/h6rcQOQ8w1Q5QJ8wDmRdfr7/3jeZgQKMgkz/3wkoU30cUFwy1lA27hr0IevqUJNcHL+xi4A8gkkZqOGZzbn+kXOms5Su+F7gILFkSeua0uzsT1HZPwcZmq4TFRLK2bDWo9+B3CLFul17HJszCSbYpyo4YSXe1+R6yjhmPkUtVK1/hMb7NuLf0w1zqV7KXJx/UwtoaHOSl6kAyISo3M3j/pfUbDanTBpvGRiakiDB7SIYZtgdp0UbyXqdcstQRZW9v6GiUDBqcloBCUaV/oHvdb3j1Og37KA0pIq2nTNx8pOg8WZeuCcE08qbhKAG5NviF4ikpp+m6zhVIvKRlJ840VHLuIjMDtUwzegeV3P38rcd1y5Kl9kRp+b3mD6V2Cl/3WjLUNAisr3ZqSzSm8/sTjy6p9PEuaKZI+aeS0L2p7Ng3UatMaMGP86itOI8ZtdL68MA9/7Fp3Qo6pxUYLgclRiSyIUj2WMyuAWLoGD9Vr2nJRrBwZ5osEUrbwPBoBHsXbqo3tuCAdmZfyJkwoOzhWD6oSEkbVEON2v/yLpjfr2kbPbkpgMPVAQ==&p=Cache-Control: no-cacheMS-CV: MQurgrzSZk+OYgcZ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWLGIB?ver=d036 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20211125T002846Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=83038ba140ed4ec8ba086a0b705df136&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1268902&metered=false&nettype=ethernet&npid=sc-338388&oemName=pxccts%2C%20Inc.&oemid=pxccts%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=pxccts7%2C1&tl=2&tsu=1268902&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=WW_128000000002987389_EN-US&chs=0&imp=0&chf=0&ds=50583&fs=32314&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAfloyULdvCVq9dG5QCHN8znW+eBQZRkpYLyZsRbyxs8lN8BLEsz/Bq4JHpG2gXMhJWH6vVfo3zDhQph+Qtmnz5KCZst5302Wt1elN0mHItb3PxEUQkyfJSZsYEIU34WyMriHCFCc0EK885aXegMH4BYtTI+4XUJGjcZ1/vfw2VOlk0tG4Smq0AJFovYM+rIXWH+YrMnx1o/99zKeAKfljhlUUgRd2VZvRbPIF2WTJ8XKmZZo8Q4aRuJICTmHhiq10L303Ul4hJp1iJum39LEAcNkGK28J91vP+iDjOgdxjoVS6blhvcXCEWveUJbAjBTeaYWTVMcf+Mb5Xr91nk+vCgDZgAACK1SnSTucJPBsAHR8OQ4Ft7b56/h6rcQOQ8w1Q5QJ8wDmRdfr7/3jeZgQKMgkz/3wkoU30cUFwy1lA27hr0IevqUJNcHL+xi4A8gkkZqOGZzbn+kXOms5Su+F7gILFkSeua0uzsT1HZPwcZmq4TFRLK2bDWo9+B3CLFul17HJszCSbYpyo4YSXe1+R6yjhmPkUtVK1/hMb7NuLf0w1zqV7KXJx/UwtoaHOSl6kAyISo3M3j/pfUbDanTBpvGRiakiDB7SIYZtgdp0UbyXqdcstQRZW9v6GiUDBqcloBCUaV/oHvdb3j1Og37KA0pIq2nTNx8pOg8WZeuCcE08qbhKAG5NviF4ikpp+m6zhVIvKRlJ840VHLuIjMDtUwzegeV3P38rcd1y5Kl9kRp+b3mD6V2Cl/3WjLUNAisr3ZqSzSm8/sTjy6p9PEuaKZI+aeS0L2p7Ng3UatMaMGP86itOI8ZtdL68MA9/7Fp3Qo6pxUYLgclRiSyIUj2WMyuAWLoGD9Vr2nJRrBwZ5osEUrbwPBoBHsXbqo3tuCAdmZfyJkwoOzhWD6oSEkbVEON2v/yLpjfr2kbPbkpgMPVAQ==&p=Cache-Control: no-cacheMS-CV: MQurgrzSZk+OYgcZ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWyWLa?ver=5289 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWz7WV?ver=7404 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWLCO4?ver=1ee7 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWLSu2?ver=3307 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20211125T002851Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=470340905e9a4c3bbd9871fa522d7f02&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1268902&metered=false&nettype=ethernet&npid=sc-338387&oemName=pxccts%2C%20Inc.&oemid=pxccts%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=pxccts7%2C1&tl=2&tsu=1268902&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=WW_128000000002624389_EN-US,WW_128000000002971149_EN-US,WW_128000000002729749_EN-US&chs=0&imp=0&chf=0&ds=50583&fs=32314&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAfloyULdvCVq9dG5QCHN8znW+eBQZRkpYLyZsRbyxs8lN8BLEsz/Bq4JHpG2gXMhJWH6vVfo3zDhQph+Qtmnz5KCZst5302Wt1elN0mHItb3PxEUQkyfJSZsYEIU34WyMriHCFCc0EK885aXegMH4BYtTI+4XUJGjcZ1/vfw2VOlk0tG4Smq0AJFovYM+rIXWH+YrMnx1o/99zKeAKfljhlUUgRd2VZvRbPIF2WTJ8XKmZZo8Q4aRuJICTmHhiq10L303Ul4hJp1iJum39LEAcNkGK28J91vP+iDjOgdxjoVS6blhvcXCEWveUJbAjBTeaYWTVMcf+Mb5Xr91nk+vCgDZgAACK1SnSTucJPBsAHR8OQ4Ft7b56/h6rcQOQ8w1Q5QJ8wDmRdfr7/3jeZgQKMgkz/3wkoU30cUFwy1lA27hr0IevqUJNcHL+xi4A8gkkZqOGZzbn+kXOms5Su+F7gILFkSeua0uzsT1HZPwcZmq4TFRLK2bDWo9+B3CLFul17HJszCSbYpyo4YSXe1+R6yjhmPkUtVK1/hMb7NuLf0w1zqV7KXJx/UwtoaHOSl6kAyISo3M3j/pfUbDanTBpvGRiakiDB7SIYZtgdp0UbyXqdcstQRZW9v6GiUDBqcloBCUaV/oHvdb3j1Og37KA0pIq2nTNx8pOg8WZeuCcE08qbhKAG5NviF4ikpp+m6zhVIvKRlJ840VHLuIjMDtUwzegeV3P38rcd1y5Kl9kRp+b3mD6V2Cl/3WjLUNAisr3ZqSzSm8/sTjy6p9PEuaKZI+aeS0L2p7Ng3UatMaMGP86itOI8ZtdL68MA9/7Fp3Qo6pxUYLgclRiSyIUj2WMyuAWLoGD9Vr2nJRrBwZ5osEUrbwPBoBHsXbqo3tuCAdmZfyJkwoOzhWD6oSEkbVEON2v/yLpjfr2kbPbkpgMPVAQ==&p=Cache-Control: no-cacheMS-CV: MQurgrzSZk+OYgcZ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4O5f3?ver=c46b HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWyRoW?ver=921a HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4O87L?ver=f1f1 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWyZrX?ver=8770 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWHdwf?ver=2631 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWHt7H?ver=fcc3 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20211125T002926Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=3e3f7348450d4967908131dd748eb928&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1268902&metered=false&nettype=ethernet&npid=sc-310091&oemName=pxccts%2C%20Inc.&oemid=pxccts%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=pxccts7%2C1&tl=2&tsu=1268902&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32314&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAfloyULdvCVq9dG5QCHN8znW+eBQZRkpYLyZsRbyxs8lN8BLEsz/Bq4JHpG2gXMhJWH6vVfo3zDhQph+Qtmnz5KCZst5302Wt1elN0mHItb3PxEUQkyfJSZsYEIU34WyMriHCFCc0EK885aXegMH4BYtTI+4XUJGjcZ1/vfw2VOlk0tG4Smq0AJFovYM+rIXWH+YrMnx1o/99zKeAKfljhlUUgRd2VZvRbPIF2WTJ8XKmZZo8Q4aRuJICTmHhiq10L303Ul4hJp1iJum39LEAcNkGK28J91vP+iDjOgdxjoVS6blhvcXCEWveUJbAjBTeaYWTVMcf+Mb5Xr91nk+vCgDZgAACK1SnSTucJPBsAHR8OQ4Ft7b56/h6rcQOQ8w1Q5QJ8wDmRdfr7/3jeZgQKMgkz/3wkoU30cUFwy1lA27hr0IevqUJNcHL+xi4A8gkkZqOGZzbn+kXOms5Su+F7gILFkSeua0uzsT1HZPwcZmq4TFRLK2bDWo9+B3CLFul17HJszCSbYpyo4YSXe1+R6yjhmPkUtVK1/hMb7NuLf0w1zqV7KXJx/UwtoaHOSl6kAyISo3M3j/pfUbDanTBpvGRiakiDB7SIYZtgdp0UbyXqdcstQRZW9v6GiUDBqcloBCUaV/oHvdb3j1Og37KA0pIq2nTNx8pOg8WZeuCcE08qbhKAG5NviF4ikpp+m6zhVIvKRlJ840VHLuIjMDtUwzegeV3P38rcd1y5Kl9kRp+b3mD6V2Cl/3WjLUNAisr3ZqSzSm8/sTjy6p9PEuaKZI+aeS0L2p7Ng3UatMaMGP86itOI8ZtdL68MA9/7Fp3Qo6pxUYLgclRiSyIUj2WMyuAWLoGD9Vr2nJRrBwZ5osEUrbwPBoBHsXbqo3tuCAdmZfyJkwoOzhWD6oSEkbVEON2v/yLpjfr2kbPbkpgMPVAQ==&p=Cache-Control: no-cacheMS-CV: z/iNLv3IakqqbUF6.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T002825Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T002827Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20211125T002941Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=12551fde4b8544f482ef89f703afef20&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1268902&metered=false&nettype=ethernet&npid=sc-310091&oemName=pxccts%2C%20Inc.&oemid=pxccts%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=pxccts7%2C1&tl=2&tsu=1268902&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: pod=1&chs=0&imp=0&chf=0&ds=50583&fs=32314&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAfloyULdvCVq9dG5QCHN8znW+eBQZRkpYLyZsRbyxs8lN8BLEsz/Bq4JHpG2gXMhJWH6vVfo3zDhQph+Qtmnz5KCZst5302Wt1elN0mHItb3PxEUQkyfJSZsYEIU34WyMriHCFCc0EK885aXegMH4BYtTI+4XUJGjcZ1/vfw2VOlk0tG4Smq0AJFovYM+rIXWH+YrMnx1o/99zKeAKfljhlUUgRd2VZvRbPIF2WTJ8XKmZZo8Q4aRuJICTmHhiq10L303Ul4hJp1iJum39LEAcNkGK28J91vP+iDjOgdxjoVS6blhvcXCEWveUJbAjBTeaYWTVMcf+Mb5Xr91nk+vCgDZgAACK1SnSTucJPBsAHR8OQ4Ft7b56/h6rcQOQ8w1Q5QJ8wDmRdfr7/3jeZgQKMgkz/3wkoU30cUFwy1lA27hr0IevqUJNcHL+xi4A8gkkZqOGZzbn+kXOms5Su+F7gILFkSeua0uzsT1HZPwcZmq4TFRLK2bDWo9+B3CLFul17HJszCSbYpyo4YSXe1+R6yjhmPkUtVK1/hMb7NuLf0w1zqV7KXJx/UwtoaHOSl6kAyISo3M3j/pfUbDanTBpvGRiakiDB7SIYZtgdp0UbyXqdcstQRZW9v6GiUDBqcloBCUaV/oHvdb3j1Og37KA0pIq2nTNx8pOg8WZeuCcE08qbhKAG5NviF4ikpp+m6zhVIvKRlJ840VHLuIjMDtUwzegeV3P38rcd1y5Kl9kRp+b3mD6V2Cl/3WjLUNAisr3ZqSzSm8/sTjy6p9PEuaKZI+aeS0L2p7Ng3UatMaMGP86itOI8ZtdL68MA9/7Fp3Qo6pxUYLgclRiSyIUj2WMyuAWLoGD9Vr2nJRrBwZ5osEUrbwPBoBHsXbqo3tuCAdmZfyJkwoOzhWD6oSEkbVEON2v/yLpjfr2kbPbkpgMPVAQ==&p=Cache-Control: no-cacheMS-CV: z/iNLv3IakqqbUF6.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T002829Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T002830Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T002832Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=Disney.37853FC22B2CE_6rarf9sa4v8jt&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: lDvr+9wjE0SIf84D.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T002834Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T002842Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=BytedancePte.Ltd.TikTok_6yccndn6064se&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: Cp5NLik58kqNNlwx.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9N0866FS04W8&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T002844Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9WZDNCRFJ10M&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T002845Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9WZDNCRFJ140&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T002847Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=AdobeSystemsIncorporated.AdobePhotoshopExpress_ynb6jyjzte8ga&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: RimVzULXIkS+3b5W.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NC2FBTHCJV8&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T002849Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NBLGGH1CQ7L&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T002851Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=AmazonVideo.PrimeVideo_pwbj9vvecjh7j&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: ZE2J7eeDck25bKg4.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&bSrc=i.t&time=20211125T002857Z&asid=895c4a0955f84e58ad4a700b07c94ead&eid= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9WZDNCRFJ3Q2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T002905Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9WZDNCRFJ3P2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T002906Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=SpotifyAB.SpotifyMusic_zpdnekdrzrea0&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: PXMY0aOCLESSpGmT.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T002908Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T002911Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=Microsoft.YourPhone_8wekyb3d8bbwe&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: PMd6WADcbU+lLah4.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9WZDNCRFJ3Q2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T002912Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T002915Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T002920Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T002921Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=Microsoft.BingNews_8wekyb3d8bbwe&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: DPYP4DVpokG/Oc9X.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T002922Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T002923Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&bSrc=i.t&time=20211125T002924Z&asid=e7d7f4d7c4ad45f89add60cc371985ee&eid= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000002987389&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=WW_128000000002987389_EN-US&&PID=425389011&UIT=P-&TargetID=700370461&AN=1855766813&PG=PC000P0FR5.0000000IRT&REQASID=83038BA140ED4EC8BA086A0B705DF136&UNID=338388&ID=ABC2650A83A05690335798B29682F273&ASID=065a3ca62af94120b52fd38f23d83067&REQT=20211124T152846&TIME=20211125T002926Z&RV=&RS=&DEVOSVER=10.0.17134.1&PERSID=ABC2650A83A05690335798B29682F273&GLOBALDEVICEID=6755430129067206&LOCALID=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&DS_EVTID=0e63b6e3f70f4e7b8eccd379722ef87f&WFIDS=&ER_AC= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000002987389&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=425389011&UIT=P-&TargetID=700370461&AN=1855766813&PG=PC000P0FR5.0000000IRT&REQASID=83038BA140ED4EC8BA086A0B705DF136&UNID=338388&ID=ABC2650A83A05690335798B29682F273&ASID=065a3ca62af94120b52fd38f23d83067&REQT=20211124T152846&TIME=20211125T002928Z&RV=&RS=&DEVOSVER=10.0.17134.1&PERSID=ABC2650A83A05690335798B29682F273&GLOBALDEVICEID=6755430129067206&LOCALID=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&DS_EVTID=0e63b6e3f70f4e7b8eccd379722ef87f&WFIDS=&ER_AC= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T002952Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T002953Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T002955Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T002956Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T002957Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T002958Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T003000Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T003001Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T003002Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=30509dbef47c4abab9d50642310e87bd&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=895c4a0955f84e58ad4a700b07c94ead&time=20211125T003003Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T003004Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T003005Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T003006Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T003007Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9WZDNCRFJ3Q2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T003008Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9WZDNCRFJ3Q2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T003008Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T003009Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T003010Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T003010Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T003011Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T003012Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a5dd34e3643044ee94e2b25f137292c7&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=ABC2650A83A05690335798B29682F273&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e7d7f4d7c4ad45f89add60cc371985ee&time=20211125T003012Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /aut/minusite-6199055 HTTP/1.1Host: conades.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aut/contemporary-236025701.zip HTTP/1.1Host: conades.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Referer: http://conades.org/aut/minusite-6199055Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=2a75d0f4efd5f87e0f11bea89fda2625

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 23.35.236.56:443 -> 192.168.2.7:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.179.253.213:443 -> 192.168.2.7:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.179.253.213:443 -> 192.168.2.7:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.82.209.183:443 -> 192.168.2.7:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.82.209.183:443 -> 192.168.2.7:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.161.44.139:443 -> 192.168.2.7:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.7:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.235:443 -> 192.168.2.7:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.112.88.60:443 -> 192.168.2.7:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.7:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.7:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.7:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.7:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.7:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.7:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.7:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.112.88.60:443 -> 192.168.2.7:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.7:49874 version: TLS 1.2

System Summary:

Yara signature match

Source: C:\Users\user\AppData\Local\Temp\smlp2cvx.d4q\new-2011054530.xls, type: DROPPED

Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f

Tries to load missing DLLs

Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll			Jump to behavior

Detected potential crypto function

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 7_2_02CD02A8		7_2_02CD02A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 7_2_02CD0298		7_2_02CD0298

Reads software policies

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp			Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://Conades.org/aut/minusite-6199055
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,8824529351644360635,1512842161302076560,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1932 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1604,8824529351644360635,1512842161302076560,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=4780 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\minusite-6199055.zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\smlp2cvx.d4q" "C:\Users\user\Downloads\minusite-6199055.zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C "C:\Users\user\AppData\Local\Temp\smlp2cvx.d4q\new-2011054530.xls
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /dde
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\besta.ocx
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestb.ocx
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestc.ocx
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,8824529351644360635,1512842161302076560,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1932 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1604,8824529351644360635,1512842161302076560,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=4780 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\minusite-6199055.zip			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\smlp2cvx.d4q" "C:\Users\user\Downloads\minusite-6199055.zip			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C "C:\Users\user\AppData\Local\Temp\smlp2cvx.d4q\new-2011054530.xls			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /dde			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\besta.ocx			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestb.ocx			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestc.ocx			Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7164:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4508:120:WilError_01

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-619ED880-1104.pma

Jump to behavior

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user~1\AppData\Local\Temp\7d29ffdc-29ed-4f79-8319-1f5db3b2a8b4.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal52.expl.win@49/265@7/12

Reads ini files

Source: C:\Windows\SysWOW64\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Automated click: OK
Source: C:\Windows\SysWOW64\regsvr32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\regsvr32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\regsvr32.exe	Automated click: OK

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Checks if Microsoft Office is installed

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Uses new MSVCR Dlls

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\cmd.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6924	Thread sleep count: 172 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6924	Thread sleep time: -86000s >= -30000s			Jump to behavior

Contains functionality to query system information

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 7_2_0113B0F2 GetSystemInfo,

7_2_0113B0F2

Anti Debugging:

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Yara detected hidden Macro 4.0 in Excel

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\smlp2cvx.d4q\new-2011054530.xls, type: DROPPED

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\smlp2cvx.d4q" "C:\Users\user\Downloads\minusite-6199055.zip			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C "C:\Users\user\AppData\Local\Temp\smlp2cvx.d4q\new-2011054530.xls			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /dde			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: unarchiver.exe, 00000007.00000002.590602958.0000000001760000.00000002.00020000.sdmp, cmd.exe, 00000011.00000002.591165884.00000000035A0000.00000002.00020000.sdmp	Binary or memory string: uProgram Manager
Source: unarchiver.exe, 00000007.00000002.590602958.0000000001760000.00000002.00020000.sdmp, cmd.exe, 00000011.00000002.591165884.00000000035A0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: unarchiver.exe, 00000007.00000002.590602958.0000000001760000.00000002.00020000.sdmp, cmd.exe, 00000011.00000002.591165884.00000000035A0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: unarchiver.exe, 00000007.00000002.590602958.0000000001760000.00000002.00020000.sdmp, cmd.exe, 00000011.00000002.591165884.00000000035A0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior