Windows Analysis Report randy_woodruff Fax Message.htm

Phishing:

Yara detected HtmlPhish10

Source: Yara match

File source: 98010.0.pages.csv, type: HTML

Yara detected HtmlPhish6

Source: Yara match	File source: randy_woodruff Fax Message.htm, type: SAMPLE
Source: Yara match	File source: 98010.0.pages.csv, type: HTML

Yara detected HtmlPhish44

Source: Yara match

File source: randy_woodruff Fax Message.htm, type: SAMPLE

None HTTPS page querying sensitive user data (password, username or email)

Source: file:///C:/Users/user/Desktop/randy_woodruff%20Fax%20Message.htm#cmd=login_submit&id=512862308.338633&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b	HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/randy_woodruff%20Fax%20Message.htm#cmd=login_submit&id=512862308.338633&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b	HTTP Parser: Has password / email / username input fields

No HTML title found

Source: file:///C:/Users/user/Desktop/randy_woodruff%20Fax%20Message.htm#cmd=login_submit&id=512862308.338633&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b	HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Desktop/randy_woodruff%20Fax%20Message.htm#cmd=login_submit&id=512862308.338633&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b	HTTP Parser: HTML title missing

META author tag missing

Source: file:///C:/Users/user/Desktop/randy_woodruff%20Fax%20Message.htm#cmd=login_submit&id=512862308.338633&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/randy_woodruff%20Fax%20Message.htm#cmd=login_submit&id=512862308.338633&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: file:///C:/Users/user/Desktop/randy_woodruff%20Fax%20Message.htm#cmd=login_submit&id=512862308.338633&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/randy_woodruff%20Fax%20Message.htm#cmd=login_submit&id=512862308.338633&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b	HTTP Parser: No <meta name="copyright".. found

Compliance:

Creates license or readme file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\5116_945906207\LICENSE.txt

Jump to behavior

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 80.67.82.83:443 -> 192.168.2.6:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.41.23:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.85:443 -> 192.168.2.6:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.164:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.102.62:443 -> 192.168.2.6:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.102.62:443 -> 192.168.2.6:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.6:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.235:443 -> 192.168.2.6:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.6:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.91.112.76:443 -> 192.168.2.6:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.6:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.91.112.76:443 -> 192.168.2.6:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.112.88.60:443 -> 192.168.2.6:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.4.86:443 -> 192.168.2.6:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.6:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.6:49887 version: TLS 1.2

Networking:

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad
Source: Joe Sandbox View	JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 80.67.82.83 80.67.82.83
Source: Joe Sandbox View	IP Address: 104.18.10.207 104.18.10.207

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49680
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115

Found strings which match to known social media urls

Source: Ruleset Data.1.dr	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.1.dr, Ruleset Data.1.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.1.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

URLs found in memory or binary data

Source: angular.js.1.dr	String found in binary or memory: http://angularjs.org
Source: data_1.2.dr, data_2.2.dr	String found in binary or memory: http://baylor.edu&size=64
Source: data_2.2.dr	String found in binary or memory: http://baylor.edu&size=64Content-Type:
Source: angular.js.1.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: pnacl_public_x86_64_pnacl_sz_nexe.1.dr	String found in binary or memory: http://llvm.org/):
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: Reporting and NEL.2.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=hIalRSrNBmdEO%2BV6ua717sXU%2Bftw26iQp2ewQVXtP0PR34SYmvi4oII
Source: Reporting and NEL.2.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=xaxwmXqaLU2sEn1YA3AML1T8KSEa8A2eHnsbN993CczIY7pBk%2FintS%2B
Source: Reporting and NEL.2.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=zX0bBNgAAoJFKLL2ihnUp%2BK%2BBn%2FeLV2OaewbbQKmoYqjkAWH7H%2B
Source: manifest.json0.1.dr, 76dfdff1-6f59-48af-ace6-ad9cdfd9b476.tmp.2.dr, 748bfe23-e32d-4698-9edc-e0ed9a8a9b1d.tmp.2.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.1.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: data_1.2.dr, data_2.2.dr	String found in binary or memory: https://api-images.statvoo.com/favicon/?domain=baylor.edu
Source: data_2.2.dr	String found in binary or memory: https://api-images.statvoo.com/favicon/?domain=baylor.eduNel:
Source: data_1.2.dr	String found in binary or memory: https://api.statvoo.com/favicon/?url=baylor.edu
Source: data_1.2.dr	String found in binary or memory: https://api.statvoo.com/favicon/?url=baylor.edu#
Source: manifest.json0.1.dr, 76dfdff1-6f59-48af-ace6-ad9cdfd9b476.tmp.2.dr, 748bfe23-e32d-4698-9edc-e0ed9a8a9b1d.tmp.2.dr	String found in binary or memory: https://apis.google.com
Source: mirroring_common.js.1.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: mirroring_common.js.1.dr	String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: data_1.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/md5.js
Source: data_1.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/md5.js/
Source: data_1.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/core.min.js
Source: data_1.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/core.min.jsb
Source: pnacl_public_x86_64_libcrt_platform_a.1.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libcrt_platform_a.1.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 76dfdff1-6f59-48af-ace6-ad9cdfd9b476.tmp.2.dr, 748bfe23-e32d-4698-9edc-e0ed9a8a9b1d.tmp.2.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json0.1.dr, manifest.json.1.dr, manifest.json1.1.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 76dfdff1-6f59-48af-ace6-ad9cdfd9b476.tmp.2.dr, 748bfe23-e32d-4698-9edc-e0ed9a8a9b1d.tmp.2.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://clients6.google.com
Source: pnacl_public_x86_64_ld_nexe.1.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.1.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: data_1.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: data_1.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js&
Source: manifest.json0.1.dr	String found in binary or memory: https://content.googleapis.com
Source: common.js.1.dr, mirroring_cast_streaming.js.1.dr	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: LICENSE.txt.1.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.1.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: 76dfdff1-6f59-48af-ace6-ad9cdfd9b476.tmp.2.dr, ba66fe19-7c59-4806-a14d-cb3338cee9cb.tmp.2.dr, a1832880-c2b6-4d3d-890c-61193923a182.tmp.2.dr, 748bfe23-e32d-4698-9edc-e0ed9a8a9b1d.tmp.2.dr	String found in binary or memory: https://dns.google
Source: mirroring_common.js.1.dr	String found in binary or memory: https://docs.google.com
Source: LICENSE.txt.1.dr	String found in binary or memory: https://easylist.to/)
Source: manifest.json0.1.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: 76dfdff1-6f59-48af-ace6-ad9cdfd9b476.tmp.2.dr, 748bfe23-e32d-4698-9edc-e0ed9a8a9b1d.tmp.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: data_1.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Yellowtail&display=swap
Source: data_1.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Yellowtail&display=swapd
Source: manifest.json0.1.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: data_3.2.dr, 76dfdff1-6f59-48af-ace6-ad9cdfd9b476.tmp.2.dr, 748bfe23-e32d-4698-9edc-e0ed9a8a9b1d.tmp.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/yellowtail/v11/OZpGg_pnoDtINPfRIlLohlvHwQ.woff2)
Source: manifest.json0.1.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: angular.js.1.dr, material_css_min.css.1.dr	String found in binary or memory: https://github.com/angular/material
Source: LICENSE.txt.1.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_background.js.1.dr, craw_window.js.1.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json0.1.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: data_1.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: mirroring_common.js.1.dr	String found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: mirroring_common.js.1.dr	String found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: 76dfdff1-6f59-48af-ace6-ad9cdfd9b476.tmp.2.dr, 748bfe23-e32d-4698-9edc-e0ed9a8a9b1d.tmp.2.dr	String found in binary or memory: https://ogs.google.com
Source: manifest.json.1.dr, craw_window.js.1.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: 76dfdff1-6f59-48af-ace6-ad9cdfd9b476.tmp.2.dr	String found in binary or memory: https://r4---sn-4g5ednse.gvt1.com
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://r4---sn-4g5ednse.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic?cms_redirect=yes&mh=I2&mip=84.17
Source: 76dfdff1-6f59-48af-ace6-ad9cdfd9b476.tmp.2.dr	String found in binary or memory: https://redirector.gvt1.com
Source: data_1.2.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic
Source: manifest.json.1.dr, craw_window.js.1.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 76dfdff1-6f59-48af-ace6-ad9cdfd9b476.tmp.2.dr, 748bfe23-e32d-4698-9edc-e0ed9a8a9b1d.tmp.2.dr	String found in binary or memory: https://ssl.gstatic.com
Source: messages.json83.1.dr, feedback.html.1.dr, messages.json80.1.dr, messages.json72.1.dr, messages.json73.1.dr, messages.json37.1.dr, messages.json77.1.dr, messages.json34.1.dr, messages.json48.1.dr, messages.json74.1.dr, messages.json75.1.dr, messages.json85.1.dr, messages.json41.1.dr, messages.json24.1.dr, messages.json87.1.dr, messages.json86.1.dr, messages.json44.1.dr, messages.json76.1.dr, messages.json69.1.dr, messages.json33.1.dr, messages.json84.1.dr, messages.json30.1.dr, messages.json49.1.dr, messages.json70.1.dr, messages.json35.1.dr, messages.json23.1.dr, messages.json46.1.dr, messages.json50.1.dr, messages.json25.1.dr, messages.json68.1.dr, messages.json47.1.dr, messages.json65.1.dr, messages.json79.1.dr, messages.json32.1.dr, messages.json59.1.dr, messages.json45.1.dr, messages.json71.1.dr, messages.json82.1.dr, messages.json36.1.dr, messages.json81.1.dr, messages.json42.1.dr, messages.json78.1.dr, messages.json64.1.dr, messages.json66.1.dr, messages.json43.1.dr, messages.json67.1.dr, messages.json31.1.dr, messages.json.1.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json83.1.dr, feedback.html.1.dr, messages.json80.1.dr, messages.json72.1.dr, messages.json73.1.dr, messages.json37.1.dr, messages.json77.1.dr, messages.json34.1.dr, messages.json48.1.dr, messages.json74.1.dr, messages.json75.1.dr, messages.json85.1.dr, messages.json41.1.dr, messages.json24.1.dr, messages.json87.1.dr, messages.json86.1.dr, messages.json44.1.dr, messages.json76.1.dr, messages.json69.1.dr, messages.json33.1.dr, messages.json84.1.dr, messages.json30.1.dr, messages.json49.1.dr, messages.json70.1.dr, messages.json35.1.dr, messages.json23.1.dr, messages.json46.1.dr, messages.json50.1.dr, messages.json25.1.dr, messages.json68.1.dr, messages.json47.1.dr, messages.json65.1.dr, messages.json79.1.dr, messages.json32.1.dr, messages.json59.1.dr, messages.json45.1.dr, messages.json71.1.dr, messages.json82.1.dr, messages.json36.1.dr, messages.json81.1.dr, messages.json42.1.dr, messages.json78.1.dr, messages.json64.1.dr, messages.json66.1.dr, messages.json43.1.dr, messages.json67.1.dr, messages.json31.1.dr, messages.json.1.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: 76dfdff1-6f59-48af-ace6-ad9cdfd9b476.tmp.2.dr	String found in binary or memory: https://t3.gstatic.com
Source: data_2.2.dr	String found in binary or memory: https://t3.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE
Source: data_1.2.dr	String found in binary or memory: https://ucarecdn.com/d4842f9b-219d-4bbd-855d-aaa7a98636ca/officee.jpg
Source: data_1.2.dr	String found in binary or memory: https://ucarecdn.com/eae24034-0cc9-4528-827a-d46e30dd5a83/hover.css
Source: craw_background.js.1.dr, craw_window.js.1.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: manifest.json0.1.dr, 76dfdff1-6f59-48af-ace6-ad9cdfd9b476.tmp.2.dr, 748bfe23-e32d-4698-9edc-e0ed9a8a9b1d.tmp.2.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.1.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.1.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.1.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: data_1.2.dr, data_2.2.dr	String found in binary or memory: https://www.google.com/s2/favicons?sz=64&domain_url=baylor.edu
Source: data_2.2.dr	String found in binary or memory: https://www.google.com/s2/favicons?sz=64&domain_url=baylor.eduNel:
Source: feedback_script.js.1.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json0.1.dr	String found in binary or memory: https://www.google.com;
Source: 76dfdff1-6f59-48af-ace6-ad9cdfd9b476.tmp.2.dr, craw_background.js.1.dr, craw_window.js.1.dr, 748bfe23-e32d-4698-9edc-e0ed9a8a9b1d.tmp.2.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.1.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: mirroring_common.js.1.dr	String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: mirroring_common.js.1.dr	String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: 76dfdff1-6f59-48af-ace6-ad9cdfd9b476.tmp.2.dr, 748bfe23-e32d-4698-9edc-e0ed9a8a9b1d.tmp.2.dr	String found in binary or memory: https://www.gstatic.com
Source: common.js.1.dr	String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: manifest.json0.1.dr	String found in binary or memory: https://www.gstatic.com;

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4774Host: login.live.com

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: maxcdn.bootstrapcdn.com

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /v8.0/oemdiscovery?oemId=&scmId=&phoneManufacturerName=&smBiosManufacturerName=VMware%2C+Inc.&phoneDeviceModel=&smBiosDm=VMware7%2C1 HTTP/1.1Accept-Encoding: gzip, deflateAccept: */*TASIGNORE: YESMS-PreciseDeviceFamilyVersion: 2814750890000385User-Agent: WindowsStore/11712.1001.23.0MS-CV: 7S6P/sATQkGfWx2u.1Accept-Language: en-USHost: storeedgefd.dsx.mp.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /client/config?cc=US&setlang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -480X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-Search-TimeZone: Bias=480; StandardBias=0; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUW3WS0TDKGu2jEbBhB%2BXls4oNzBQAAdKtpNPPm3M8fn1PDaHXrRA4pCugTpiYHoaoFOQMm0HiH5Y%2BSF/pyFgUcJ2LVUv4KTdm3M5l%2B9S6Io%2B9ZsmdG4CHi2PaOt2wnD1F2zxSeks1Sz/44j%2B83oGsAdKNyr6KelG3SuM4JedJ%2BC8Kja9PXORuErtUH3Vb8WMKKz2MpsZmAdFi12p9ZHa5vDDY4iyw3cKKs3A9D3JJtO5uOLs0aRjD/g9nInNuatCepLhQ8HUJIPlE/4utWmYGv748iC1DCh9Ogybj9JYwSqXs%2B8aJXJskI3DyLNMfhsase4XCJQjyapHwfqARAy4nqA%2BWKvDHMiUF%2BDXhslbKICTMaFFITw8DZgAACGkMXc2YvLPFqAEnsoB0AEgGHcxJ8kkikkyziEasEVFDshTaZP/kK0n7Gql8uLv8V/HB7rbC4oWpxg53ui2nFT9H2qf2UR1hOiLF8IoBI0hwc1/B26z%2BOydS/363IkqP1JSmB94hNlAE5kDuhocfSAjbT3CZce99RcRdX1f81odyMaMKFkyewlgdWuL%2B8Gh62WfmGUo5ROy6%2BVWEjG1gt8DnFOioCh5OVeROLgI86lWvgzppc8alvYP/n1H1ix2vfUEaKOyhqQYQpJ6/l2I5CKVqoNtFSVvnwlJahjtRfHu1FjYn71DiDH%2BJyv/7wfVjUWSCZ33ewEFHTXsVYma4pVeLLzaRAfXc6QzZGbjYD1g63ZDz/zLSASuQzFcbSUeNIeyiyNJorwj/9oOAOwDw4Or7QFrqMG/7GveRwxg1fF05bUkaSybeEI5jBKlbiWkakcNGSKYwQoQDZuC4UIuWgwYfdDBH6HMYXYX1tUw6ajtS2D4iX64VTJ2AwoEoaGGCnmiHtwSh2D/b59mC6UmbZWcjSMKuQz82f5tAkRxyfZDMI%2BoCmuhWl/VuGVTAiz8ZY%2Brd1QE%3D%26p%3DX-Agent-DeviceId: 0100748C09001CEAX-BM-CBT: 1642201769User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-Touch: falseX-Device-ClientSession: FDC9A980930E41B18DB51EF80DDB617FX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=54AD14FB4D1E4A6C815A867991009454
Source: global traffic	HTTP traffic detected: GET /image/apps.15445.9007199266246197.1102bb94-3d65-417b-bd4a-5e4abd0fc759.383d8ea0-4240-4554-8a60-3d075579c48e?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.16574.13571498826857201.00a9d390-581f-492c-b148-b2ce81649480.6a6f592e-efa9-4bb0-b008-7c3422ab3313?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.18694.9007199266247846.b5c49955-e050-4553-b8e4-0e223ed6c5a1.4e8e78d2-c2c2-4c02-8d8c-46ac3b2419e7?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.18858.9007199266246227.c596c546-6fcb-4260-935c-19bc24b971ef.1b03c26f-1753-4221-9ab1-4581f098723d?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.20893.13571498826857201.00a9d390-581f-492c-b148-b2ce81649480.acc28f88-50de-4aaf-abfc-ad1da8b04cd0?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.2052.9007199266247846.b5c49955-e050-4553-b8e4-0e223ed6c5a1.a0c3decd-308f-4f06-bcfb-2aa4f3afe248?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.23911.9007199266246197.1102bb94-3d65-417b-bd4a-5e4abd0fc759.1357e1bf-d617-4272-ae74-1ad5e64df828?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.256.14495311847124170.e89a4dce-fd9a-4a10-b8e4-a6c3aa1c055e.ca4cbefc-0ab0-4144-90c1-07f5250c8c21?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.40093.9007199266285780.3d16d9fa-052b-42c5-ba7d-a5688e3dda24.e6964d6a-18a4-4746-9238-9f0acc233a65?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.39478.14495311847124170.e89a4dce-fd9a-4a10-b8e4-a6c3aa1c055e.8ad1b690-ff36-44fa-8afc-0dc5bed1273c?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.37827.13753891519397067.09276afb-06f9-44a1-b0d9-b027aaf639b5.96a6ae2c-a3e2-4b3c-8de1-2a17df388872?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.49856.13753891519397067.09276afb-06f9-44a1-b0d9-b027aaf639b5.44e51362-f63c-4737-878e-9c83ae307c47?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.49525.13510798887047136.8a1815b2-017c-48c8-80cc-ca4d1ae5c8cf.2f6b9bdf-a4fc-42d8-aea0-65c437755b78?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.58298.9007199266285780.3d16d9fa-052b-42c5-ba7d-a5688e3dda24.55988ee1-bd9b-4322-980a-a610abdc7713?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.616.13510798887047136.8a1815b2-017c-48c8-80cc-ca4d1ae5c8cf.d81cfd95-c9fd-48e0-8fc3-36ff7b9e590a?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.64128.9007199266246227.c596c546-6fcb-4260-935c-19bc24b971ef.d58015ff-2fcf-4113-975b-e873039b6d86?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.11554.13576748414566955.ddf411cf-737c-4c89-8b37-cb8d28921c17.e0987182-8d6c-458c-befd-5dda1218b08e?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.16957.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.aef04b90-a221-4ea5-a05d-0d51ac792471?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.18124.9007199266244427.c75d2ced-a383-40dc-babd-1ad2ceb13c86.afc6c372-c7a8-4eda-94fb-541bbb081d14?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.31377.13925855090824389.5d8469ac-bd06-459d-aeb3-ac562357124f.715204a1-f65d-4d02-859d-2a63864bf401?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.38957.9007199266246761.3059e916-5e99-4797-a868-366cc8761e37.dcc9368c-4c77-41a2-b867-8514435d8418?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.39016.9007199266243744.36dde9d0-f21a-47d2-976e-f1ea3f5b031f.bbea1229-a466-4a8c-b428-57cb58abf084?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.41671.13634052595610511.c45457c9-b4af-46b0-8e61-8d7c0aec3f56.86b1d82d-8b47-4bda-99fc-8a1db0a7ac9d?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.43423.13510798883386282.9283c867-e87c-44e6-8b74-26c2744befb9.e2e1f371-e658-4ebc-afda-254d7c8f9a8e?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.47231.13510798883386282.03d5627f-a416-4073-8989-ce5891d3a285.f7f2ba18-f7d5-4307-85b3-dba28f22a8bb?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.5075.9007199266244427.c75d2ced-a383-40dc-babd-1ad2ceb13c86.f329a73d-1ae8-4445-aa4c-bf40f3c5d62d?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.51843.9007199266243449.90709ce3-050c-4cef-8d4a-9ef213b89ef2.c13e8407-eaf8-447a-a5d6-9abd8bc2c1f3?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.52481.9007199266243744.36dde9d0-f21a-47d2-976e-f1ea3f5b031f.16c0a704-aef8-4bc4-af36-0c3b3ee0f6e2?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.54145.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.0df01b4e-7fca-47eb-b3d7-95ba7990754d?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.55990.13510798886747090.a0953092-5fc3-46f0-aefa-796cb3a9b90b.1c9f2174-7e18-48ba-af90-e569a2444a83?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.58878.9007199266246761.3059e916-5e99-4797-a868-366cc8761e37.21987aba-4948-4f44-bf2e-eba90517f1c5?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.54562.13634052595610511.c45457c9-b4af-46b0-8e61-8d7c0aec3f56.24af4abe-62f8-404b-b1a9-ee8fe4d32d94?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.59367.13510798885854323.dbec43fa-fcea-4036-9b1c-96de66922c18.da850a8e-5b3f-49fd-b3dc-6a8c0db400e4?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.5940.13925855090824389.5d8469ac-bd06-459d-aeb3-ac562357124f.4188e018-d924-474d-ad09-e02db690d34f?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.62687.13510798885854323.6a8c11ad-84e9-4247-9ba9-ab3742bdbb87.e61dfadd-3bdd-4f66-beb1-6bb763b60b02?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.7873.9007199266243449.90709ce3-050c-4cef-8d4a-9ef213b89ef2.7885dc21-4015-4284-a596-d3d24cf6c1b8?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.8341.13510798886747090.a0953092-5fc3-46f0-aefa-796cb3a9b90b.fc0c6be7-c064-44dc-a7df-81e7097e3c93?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.8607.13576748414566955.ddf411cf-737c-4c89-8b37-cb8d28921c17.c26d58e8-2d33-4e9a-bf78-e22de319ec46?format=source HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: nullUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /eae24034-0cc9-4528-827a-d46e30dd5a83/hover.css HTTP/1.1Host: ucarecdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/core.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/3.1.9-1/md5.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d4842f9b-219d-4bbd-855d-aaa7a98636ca/officee.jpg HTTP/1.1Host: ucarecdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon/?url=baylor.edu HTTP/1.1Host: api.statvoo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon/?domain=baylor.edu HTTP/1.1Host: api-images.statvoo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s2/favicons?sz=64&domain_url=baylor.edu HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d4842f9b-219d-4bbd-855d-aaa7a98636ca/officee.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: ucarecdn.com
Source: global traffic	HTTP traffic detected: GET /favicon/?url=baylor.edu HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: api.statvoo.com
Source: global traffic	HTTP traffic detected: GET /favicon/?domain=baylor.edu HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: api-images.statvoo.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /s2/favicons?sz=64&domain_url=baylor.edu HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Connection: Keep-AliveHost: www.google.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220114T231012Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=73dd258445c444a9b019e84800d7b8c6&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1342277&metered=false&nettype=ethernet&npid=sc-338389&oemName=fsbxfu%2C%20Inc.&oemid=fsbxfu%2C%20Inc.&ossku=Professional&smBiosDm=fsbxfu7%2C1&tl=2&tsu=1342277&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32345&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAeSbmOSkRWTOt2oqjnHODk5otJbuR41QmmFJGy0jBwZcbogXCXcBDkVHGlRmtSLKPI/+iERFbHZ+JFPSxWtGgE/CWektKtVqUMK431pKpG6e1qSgZqJqjVbkMhBlx3S1FDiW1gSeOD2Aq3NOdAJpiyGfrpnTZr5bd9IL7/dvvMUCqZVib5VCNTYTLjrL5oYmHJmQtJAo71Hdktyy2AkYh+kpPtiNeSMUY54oUkdumyQg2IQFmAzk0QAlYFtjdNiNzpi4hrg9rUgqBiZIr03SrGdZ4NoB9dgUlrPmtlCoS0V6781ImpTM1Tz/y4Nki7L1zbxw5Y3elON2Kr/YucmGimUDZgAACPHj+LAMWJjmqAGhL+Z+SMOmUGD7dMtzWDILw4mZbOYDcEKyDL/udfH2ZBArJMXFubC3Z86tY+/ZbEAChrNYhFsVCHsIQfc9X9qBm5v45k4YocE85O4TVHcTCK6+HmaXX4izxqzLGw4us1IOriFCag1spLCD7UkeY1dWCFbktENZwAjJA+MvqDC+ySsB/G+pqWYnb2I2yQoMUUaUDXFjDcQtDz6UmF3HikyygwW0EkA3ZBt06ZF8xLC/Les6lHdaHYfgn9ct5AbUn4qrp20YCm5HCWQbojuXDlq4f96pRZz3I0aPfH7wI734tF10Q1+RtUzaHjam21CH6A6twKAXvBp8o3kExkenN6AKSIhiAgzQH1SnsQ5pnpw1QUh3gLyBMkEDDBgp5btqUQ7ob5k7Rzsw3E3oRwPgFu6pO/GIytS36JbpleLe1u3FxsszMjRdK8YS5wX+18m2JEI9JXjKsooFm0vlf2+1uEQzjSDzBM07PxuuT6oD2JmiYoCu1xRIRAFHaRN7S4dIZYAVNIz9zgYE2qH4AzOhlt1Gc/ywczImosW47TiXU/moNbJXgwwHVwnA1QE=&p=Cache-Control: no-cacheMS-CV: 9mggcUTx8EChs8Kh.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220114T231011Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=d8c57a8b84d14b1c8326fc9dc049f98f&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1342277&metered=false&nettype=ethernet&npid=sc-310091&oemName=fsbxfu%2C%20Inc.&oemid=fsbxfu%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=fsbxfu7%2C1&tl=2&tsu=1342277&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32345&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAeSbmOSkRWTOt2oqjnHODk5otJbuR41QmmFJGy0jBwZcbogXCXcBDkVHGlRmtSLKPI/+iERFbHZ+JFPSxWtGgE/CWektKtVqUMK431pKpG6e1qSgZqJqjVbkMhBlx3S1FDiW1gSeOD2Aq3NOdAJpiyGfrpnTZr5bd9IL7/dvvMUCqZVib5VCNTYTLjrL5oYmHJmQtJAo71Hdktyy2AkYh+kpPtiNeSMUY54oUkdumyQg2IQFmAzk0QAlYFtjdNiNzpi4hrg9rUgqBiZIr03SrGdZ4NoB9dgUlrPmtlCoS0V6781ImpTM1Tz/y4Nki7L1zbxw5Y3elON2Kr/YucmGimUDZgAACPHj+LAMWJjmqAGhL+Z+SMOmUGD7dMtzWDILw4mZbOYDcEKyDL/udfH2ZBArJMXFubC3Z86tY+/ZbEAChrNYhFsVCHsIQfc9X9qBm5v45k4YocE85O4TVHcTCK6+HmaXX4izxqzLGw4us1IOriFCag1spLCD7UkeY1dWCFbktENZwAjJA+MvqDC+ySsB/G+pqWYnb2I2yQoMUUaUDXFjDcQtDz6UmF3HikyygwW0EkA3ZBt06ZF8xLC/Les6lHdaHYfgn9ct5AbUn4qrp20YCm5HCWQbojuXDlq4f96pRZz3I0aPfH7wI734tF10Q1+RtUzaHjam21CH6A6twKAXvBp8o3kExkenN6AKSIhiAgzQH1SnsQ5pnpw1QUh3gLyBMkEDDBgp5btqUQ7ob5k7Rzsw3E3oRwPgFu6pO/GIytS36JbpleLe1u3FxsszMjRdK8YS5wX+18m2JEI9JXjKsooFm0vlf2+1uEQzjSDzBM07PxuuT6oD2JmiYoCu1xRIRAFHaRN7S4dIZYAVNIz9zgYE2qH4AzOhlt1Gc/ywczImosW47TiXU/moNbJXgwwHVwnA1QE=&p=Cache-Control: no-cacheMS-CV: 9mggcUTx8EChs8Kh.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220114T231033Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=e83aab4b1d244183b8de2bd2aa5a5da9&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1342277&metered=false&nettype=ethernet&npid=sc-280815&oemName=fsbxfu%2C%20Inc.&oemid=fsbxfu%2C%20Inc.&ossku=Professional&smBiosDm=fsbxfu7%2C1&tl=2&tsu=1342277&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32345&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAeSbmOSkRWTOt2oqjnHODk5otJbuR41QmmFJGy0jBwZcbogXCXcBDkVHGlRmtSLKPI/+iERFbHZ+JFPSxWtGgE/CWektKtVqUMK431pKpG6e1qSgZqJqjVbkMhBlx3S1FDiW1gSeOD2Aq3NOdAJpiyGfrpnTZr5bd9IL7/dvvMUCqZVib5VCNTYTLjrL5oYmHJmQtJAo71Hdktyy2AkYh+kpPtiNeSMUY54oUkdumyQg2IQFmAzk0QAlYFtjdNiNzpi4hrg9rUgqBiZIr03SrGdZ4NoB9dgUlrPmtlCoS0V6781ImpTM1Tz/y4Nki7L1zbxw5Y3elON2Kr/YucmGimUDZgAACPHj+LAMWJjmqAGhL+Z+SMOmUGD7dMtzWDILw4mZbOYDcEKyDL/udfH2ZBArJMXFubC3Z86tY+/ZbEAChrNYhFsVCHsIQfc9X9qBm5v45k4YocE85O4TVHcTCK6+HmaXX4izxqzLGw4us1IOriFCag1spLCD7UkeY1dWCFbktENZwAjJA+MvqDC+ySsB/G+pqWYnb2I2yQoMUUaUDXFjDcQtDz6UmF3HikyygwW0EkA3ZBt06ZF8xLC/Les6lHdaHYfgn9ct5AbUn4qrp20YCm5HCWQbojuXDlq4f96pRZz3I0aPfH7wI734tF10Q1+RtUzaHjam21CH6A6twKAXvBp8o3kExkenN6AKSIhiAgzQH1SnsQ5pnpw1QUh3gLyBMkEDDBgp5btqUQ7ob5k7Rzsw3E3oRwPgFu6pO/GIytS36JbpleLe1u3FxsszMjRdK8YS5wX+18m2JEI9JXjKsooFm0vlf2+1uEQzjSDzBM07PxuuT6oD2JmiYoCu1xRIRAFHaRN7S4dIZYAVNIz9zgYE2qH4AzOhlt1Gc/ywczImosW47TiXU/moNbJXgwwHVwnA1QE=&p=Cache-Control: no-cacheMS-CV: 9mggcUTx8EChs8Kh.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220114T231033Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=0e6022d829244bb2aaecdc46c9498cc4&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1342277&metered=false&nettype=ethernet&npid=sc-338387&oemName=fsbxfu%2C%20Inc.&oemid=fsbxfu%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=fsbxfu7%2C1&tl=2&tsu=1342277&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32345&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAeSbmOSkRWTOt2oqjnHODk5otJbuR41QmmFJGy0jBwZcbogXCXcBDkVHGlRmtSLKPI/+iERFbHZ+JFPSxWtGgE/CWektKtVqUMK431pKpG6e1qSgZqJqjVbkMhBlx3S1FDiW1gSeOD2Aq3NOdAJpiyGfrpnTZr5bd9IL7/dvvMUCqZVib5VCNTYTLjrL5oYmHJmQtJAo71Hdktyy2AkYh+kpPtiNeSMUY54oUkdumyQg2IQFmAzk0QAlYFtjdNiNzpi4hrg9rUgqBiZIr03SrGdZ4NoB9dgUlrPmtlCoS0V6781ImpTM1Tz/y4Nki7L1zbxw5Y3elON2Kr/YucmGimUDZgAACPHj+LAMWJjmqAGhL+Z+SMOmUGD7dMtzWDILw4mZbOYDcEKyDL/udfH2ZBArJMXFubC3Z86tY+/ZbEAChrNYhFsVCHsIQfc9X9qBm5v45k4YocE85O4TVHcTCK6+HmaXX4izxqzLGw4us1IOriFCag1spLCD7UkeY1dWCFbktENZwAjJA+MvqDC+ySsB/G+pqWYnb2I2yQoMUUaUDXFjDcQtDz6UmF3HikyygwW0EkA3ZBt06ZF8xLC/Les6lHdaHYfgn9ct5AbUn4qrp20YCm5HCWQbojuXDlq4f96pRZz3I0aPfH7wI734tF10Q1+RtUzaHjam21CH6A6twKAXvBp8o3kExkenN6AKSIhiAgzQH1SnsQ5pnpw1QUh3gLyBMkEDDBgp5btqUQ7ob5k7Rzsw3E3oRwPgFu6pO/GIytS36JbpleLe1u3FxsszMjRdK8YS5wX+18m2JEI9JXjKsooFm0vlf2+1uEQzjSDzBM07PxuuT6oD2JmiYoCu1xRIRAFHaRN7S4dIZYAVNIz9zgYE2qH4AzOhlt1Gc/ywczImosW47TiXU/moNbJXgwwHVwnA1QE=&p=Cache-Control: no-cacheMS-CV: 9mggcUTx8EChs8Kh.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220114T231033Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=088314e0c52945a09d94d6bfd27eb524&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1342277&metered=false&nettype=ethernet&npid=sc-338388&oemName=fsbxfu%2C%20Inc.&oemid=fsbxfu%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=fsbxfu7%2C1&tl=2&tsu=1342277&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32345&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAeSbmOSkRWTOt2oqjnHODk5otJbuR41QmmFJGy0jBwZcbogXCXcBDkVHGlRmtSLKPI/+iERFbHZ+JFPSxWtGgE/CWektKtVqUMK431pKpG6e1qSgZqJqjVbkMhBlx3S1FDiW1gSeOD2Aq3NOdAJpiyGfrpnTZr5bd9IL7/dvvMUCqZVib5VCNTYTLjrL5oYmHJmQtJAo71Hdktyy2AkYh+kpPtiNeSMUY54oUkdumyQg2IQFmAzk0QAlYFtjdNiNzpi4hrg9rUgqBiZIr03SrGdZ4NoB9dgUlrPmtlCoS0V6781ImpTM1Tz/y4Nki7L1zbxw5Y3elON2Kr/YucmGimUDZgAACPHj+LAMWJjmqAGhL+Z+SMOmUGD7dMtzWDILw4mZbOYDcEKyDL/udfH2ZBArJMXFubC3Z86tY+/ZbEAChrNYhFsVCHsIQfc9X9qBm5v45k4YocE85O4TVHcTCK6+HmaXX4izxqzLGw4us1IOriFCag1spLCD7UkeY1dWCFbktENZwAjJA+MvqDC+ySsB/G+pqWYnb2I2yQoMUUaUDXFjDcQtDz6UmF3HikyygwW0EkA3ZBt06ZF8xLC/Les6lHdaHYfgn9ct5AbUn4qrp20YCm5HCWQbojuXDlq4f96pRZz3I0aPfH7wI734tF10Q1+RtUzaHjam21CH6A6twKAXvBp8o3kExkenN6AKSIhiAgzQH1SnsQ5pnpw1QUh3gLyBMkEDDBgp5btqUQ7ob5k7Rzsw3E3oRwPgFu6pO/GIytS36JbpleLe1u3FxsszMjRdK8YS5wX+18m2JEI9JXjKsooFm0vlf2+1uEQzjSDzBM07PxuuT6oD2JmiYoCu1xRIRAFHaRN7S4dIZYAVNIz9zgYE2qH4AzOhlt1Gc/ywczImosW47TiXU/moNbJXgwwHVwnA1QE=&p=Cache-Control: no-cacheMS-CV: 9mggcUTx8EChs8Kh.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220114T231039Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=4eca5a0e66f442b09d51176c45313bf2&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1342277&metered=false&nettype=ethernet&npid=sc-338388&oemName=fsbxfu%2C%20Inc.&oemid=fsbxfu%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=fsbxfu7%2C1&tl=2&tsu=1342277&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000000402926&chs=0&imp=0&chf=0&ds=50583&fs=32345&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAeSbmOSkRWTOt2oqjnHODk5otJbuR41QmmFJGy0jBwZcbogXCXcBDkVHGlRmtSLKPI/+iERFbHZ+JFPSxWtGgE/CWektKtVqUMK431pKpG6e1qSgZqJqjVbkMhBlx3S1FDiW1gSeOD2Aq3NOdAJpiyGfrpnTZr5bd9IL7/dvvMUCqZVib5VCNTYTLjrL5oYmHJmQtJAo71Hdktyy2AkYh+kpPtiNeSMUY54oUkdumyQg2IQFmAzk0QAlYFtjdNiNzpi4hrg9rUgqBiZIr03SrGdZ4NoB9dgUlrPmtlCoS0V6781ImpTM1Tz/y4Nki7L1zbxw5Y3elON2Kr/YucmGimUDZgAACPHj+LAMWJjmqAGhL+Z+SMOmUGD7dMtzWDILw4mZbOYDcEKyDL/udfH2ZBArJMXFubC3Z86tY+/ZbEAChrNYhFsVCHsIQfc9X9qBm5v45k4YocE85O4TVHcTCK6+HmaXX4izxqzLGw4us1IOriFCag1spLCD7UkeY1dWCFbktENZwAjJA+MvqDC+ySsB/G+pqWYnb2I2yQoMUUaUDXFjDcQtDz6UmF3HikyygwW0EkA3ZBt06ZF8xLC/Les6lHdaHYfgn9ct5AbUn4qrp20YCm5HCWQbojuXDlq4f96pRZz3I0aPfH7wI734tF10Q1+RtUzaHjam21CH6A6twKAXvBp8o3kExkenN6AKSIhiAgzQH1SnsQ5pnpw1QUh3gLyBMkEDDBgp5btqUQ7ob5k7Rzsw3E3oRwPgFu6pO/GIytS36JbpleLe1u3FxsszMjRdK8YS5wX+18m2JEI9JXjKsooFm0vlf2+1uEQzjSDzBM07PxuuT6oD2JmiYoCu1xRIRAFHaRN7S4dIZYAVNIz9zgYE2qH4AzOhlt1Gc/ywczImosW47TiXU/moNbJXgwwHVwnA1QE=&p=Cache-Control: no-cacheMS-CV: 9mggcUTx8EChs8Kh.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220114T231038Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b08f2b648b614085897e0954a6912e69&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1342277&metered=false&nettype=ethernet&npid=sc-280815&oemName=fsbxfu%2C%20Inc.&oemid=fsbxfu%2C%20Inc.&ossku=Professional&smBiosDm=fsbxfu7%2C1&tl=2&tsu=1342277&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32345&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAeSbmOSkRWTOt2oqjnHODk5otJbuR41QmmFJGy0jBwZcbogXCXcBDkVHGlRmtSLKPI/+iERFbHZ+JFPSxWtGgE/CWektKtVqUMK431pKpG6e1qSgZqJqjVbkMhBlx3S1FDiW1gSeOD2Aq3NOdAJpiyGfrpnTZr5bd9IL7/dvvMUCqZVib5VCNTYTLjrL5oYmHJmQtJAo71Hdktyy2AkYh+kpPtiNeSMUY54oUkdumyQg2IQFmAzk0QAlYFtjdNiNzpi4hrg9rUgqBiZIr03SrGdZ4NoB9dgUlrPmtlCoS0V6781ImpTM1Tz/y4Nki7L1zbxw5Y3elON2Kr/YucmGimUDZgAACPHj+LAMWJjmqAGhL+Z+SMOmUGD7dMtzWDILw4mZbOYDcEKyDL/udfH2ZBArJMXFubC3Z86tY+/ZbEAChrNYhFsVCHsIQfc9X9qBm5v45k4YocE85O4TVHcTCK6+HmaXX4izxqzLGw4us1IOriFCag1spLCD7UkeY1dWCFbktENZwAjJA+MvqDC+ySsB/G+pqWYnb2I2yQoMUUaUDXFjDcQtDz6UmF3HikyygwW0EkA3ZBt06ZF8xLC/Les6lHdaHYfgn9ct5AbUn4qrp20YCm5HCWQbojuXDlq4f96pRZz3I0aPfH7wI734tF10Q1+RtUzaHjam21CH6A6twKAXvBp8o3kExkenN6AKSIhiAgzQH1SnsQ5pnpw1QUh3gLyBMkEDDBgp5btqUQ7ob5k7Rzsw3E3oRwPgFu6pO/GIytS36JbpleLe1u3FxsszMjRdK8YS5wX+18m2JEI9JXjKsooFm0vlf2+1uEQzjSDzBM07PxuuT6oD2JmiYoCu1xRIRAFHaRN7S4dIZYAVNIz9zgYE2qH4AzOhlt1Gc/ywczImosW47TiXU/moNbJXgwwHVwnA1QE=&p=Cache-Control: no-cacheMS-CV: 9mggcUTx8EChs8Kh.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWP8jZ?ver=ee71 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWQ9h6?ver=96e5 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWQvjG?ver=7176 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWP0UD?ver=de4e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWP8kl?ver=76a1 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220114T231051Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=06e7ac5bb2d045f797e99944a6acd19e&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1342277&metered=false&nettype=ethernet&npid=sc-338387&oemName=fsbxfu%2C%20Inc.&oemid=fsbxfu%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=fsbxfu7%2C1&tl=2&tsu=1342277&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=WW_128000000003135209_EN-US,WW_128000000003097129_EN-US,WW_128000000003022789_EN-US&chs=0&imp=0&chf=0&ds=50583&fs=32345&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAeSbmOSkRWTOt2oqjnHODk5otJbuR41QmmFJGy0jBwZcbogXCXcBDkVHGlRmtSLKPI/+iERFbHZ+JFPSxWtGgE/CWektKtVqUMK431pKpG6e1qSgZqJqjVbkMhBlx3S1FDiW1gSeOD2Aq3NOdAJpiyGfrpnTZr5bd9IL7/dvvMUCqZVib5VCNTYTLjrL5oYmHJmQtJAo71Hdktyy2AkYh+kpPtiNeSMUY54oUkdumyQg2IQFmAzk0QAlYFtjdNiNzpi4hrg9rUgqBiZIr03SrGdZ4NoB9dgUlrPmtlCoS0V6781ImpTM1Tz/y4Nki7L1zbxw5Y3elON2Kr/YucmGimUDZgAACPHj+LAMWJjmqAGhL+Z+SMOmUGD7dMtzWDILw4mZbOYDcEKyDL/udfH2ZBArJMXFubC3Z86tY+/ZbEAChrNYhFsVCHsIQfc9X9qBm5v45k4YocE85O4TVHcTCK6+HmaXX4izxqzLGw4us1IOriFCag1spLCD7UkeY1dWCFbktENZwAjJA+MvqDC+ySsB/G+pqWYnb2I2yQoMUUaUDXFjDcQtDz6UmF3HikyygwW0EkA3ZBt06ZF8xLC/Les6lHdaHYfgn9ct5AbUn4qrp20YCm5HCWQbojuXDlq4f96pRZz3I0aPfH7wI734tF10Q1+RtUzaHjam21CH6A6twKAXvBp8o3kExkenN6AKSIhiAgzQH1SnsQ5pnpw1QUh3gLyBMkEDDBgp5btqUQ7ob5k7Rzsw3E3oRwPgFu6pO/GIytS36JbpleLe1u3FxsszMjRdK8YS5wX+18m2JEI9JXjKsooFm0vlf2+1uEQzjSDzBM07PxuuT6oD2JmiYoCu1xRIRAFHaRN7S4dIZYAVNIz9zgYE2qH4AzOhlt1Gc/ywczImosW47TiXU/moNbJXgwwHVwnA1QE=&p=Cache-Control: no-cacheMS-CV: 9mggcUTx8EChs8Kh.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWMYIP?ver=1057 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=Disney.37853FC22B2CE_6rarf9sa4v8jt&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: gwAfIJtOCkGRk4uL.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=BytedancePte.Ltd.TikTok_6yccndn6064se&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: dAThPT/lGkWb/oz+.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWNeua?ver=6e66 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=AdobeSystemsIncorporated.AdobePhotoshopExpress_ynb6jyjzte8ga&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: Kbf8yI2KeEGJVt8n.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=AmazonVideo.PrimeVideo_pwbj9vvecjh7j&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: aG/qHHpz1Ua0l3ko.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=SpotifyAB.SpotifyMusic_zpdnekdrzrea0&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: V6FHPhlW702Rpm4Z.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=Microsoft.YourPhone_8wekyb3d8bbwe&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: TtnryeSl0EWJYQgh.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=Microsoft.BingNews_8wekyb3d8bbwe&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: stb02yRwFky9zcmn.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=a45b4d6f14f3419ba0574287da80c9a2&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=c75e72daf4d34f458f89bcfc8461f052&time=20220114T231014Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=a45b4d6f14f3419ba0574287da80c9a2&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=c75e72daf4d34f458f89bcfc8461f052&time=20220114T231015Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=a45b4d6f14f3419ba0574287da80c9a2&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=c75e72daf4d34f458f89bcfc8461f052&time=20220114T231016Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=a45b4d6f14f3419ba0574287da80c9a2&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=c75e72daf4d34f458f89bcfc8461f052&time=20220114T231021Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=a45b4d6f14f3419ba0574287da80c9a2&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=c75e72daf4d34f458f89bcfc8461f052&time=20220114T231021Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=a45b4d6f14f3419ba0574287da80c9a2&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=c75e72daf4d34f458f89bcfc8461f052&time=20220114T231022Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=a45b4d6f14f3419ba0574287da80c9a2&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=c75e72daf4d34f458f89bcfc8461f052&time=20220114T231023Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=a45b4d6f14f3419ba0574287da80c9a2&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9N0866FS04W8&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=c75e72daf4d34f458f89bcfc8461f052&time=20220114T231023Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=a45b4d6f14f3419ba0574287da80c9a2&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ10M&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=c75e72daf4d34f458f89bcfc8461f052&time=20220114T231024Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=a45b4d6f14f3419ba0574287da80c9a2&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ140&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=c75e72daf4d34f458f89bcfc8461f052&time=20220114T231025Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=a45b4d6f14f3419ba0574287da80c9a2&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NC2FBTHCJV8&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=c75e72daf4d34f458f89bcfc8461f052&time=20220114T231026Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=a45b4d6f14f3419ba0574287da80c9a2&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH1CQ7L&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=c75e72daf4d34f458f89bcfc8461f052&time=20220114T231026Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=a45b4d6f14f3419ba0574287da80c9a2&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220114T231027Z&asid=c75e72daf4d34f458f89bcfc8461f052&eid= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=3fa19172c1b34677beee2a6014f7adb3&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ3Q2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=fd1367f5ad214c89bf7ec06c43c3eab7&time=20220114T231032Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=3fa19172c1b34677beee2a6014f7adb3&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ3P2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=fd1367f5ad214c89bf7ec06c43c3eab7&time=20220114T231034Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=3fa19172c1b34677beee2a6014f7adb3&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=fd1367f5ad214c89bf7ec06c43c3eab7&time=20220114T231035Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=3fa19172c1b34677beee2a6014f7adb3&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=fd1367f5ad214c89bf7ec06c43c3eab7&time=20220114T231039Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=3fa19172c1b34677beee2a6014f7adb3&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ3Q2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=fd1367f5ad214c89bf7ec06c43c3eab7&time=20220114T231041Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=3fa19172c1b34677beee2a6014f7adb3&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=fd1367f5ad214c89bf7ec06c43c3eab7&time=20220114T231042Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Thu, 20 Apr 2017 16:10:39 GMTUser-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=3fa19172c1b34677beee2a6014f7adb3&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=fd1367f5ad214c89bf7ec06c43c3eab7&time=20220114T231043Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=3fa19172c1b34677beee2a6014f7adb3&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=fd1367f5ad214c89bf7ec06c43c3eab7&time=20220114T231044Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWPh04?ver=a482 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWOVPV?ver=22fc HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWQuiL?ver=64b9 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWEJq7?ver=71af HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=3fa19172c1b34677beee2a6014f7adb3&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=fd1367f5ad214c89bf7ec06c43c3eab7&time=20220114T231045Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWQ9gi?ver=0c4f HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 80.67.82.83:443 -> 192.168.2.6:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.41.23:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.138.85:443 -> 192.168.2.6:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.164:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.102.62:443 -> 192.168.2.6:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.102.62:443 -> 192.168.2.6:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.6:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.235:443 -> 192.168.2.6:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.6:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.91.112.76:443 -> 192.168.2.6:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.6:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.91.112.76:443 -> 192.168.2.6:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.112.88.60:443 -> 192.168.2.6:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.4.86:443 -> 192.168.2.6:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.6:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.6:49887 version: TLS 1.2

System Summary:

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\randy_woodruff Fax Message.htm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1644,2187988796033575539,14428119858466154277,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1936 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1644,2187988796033575539,14428119858466154277,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1936 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61E202B8-13FC.pma

Jump to behavior

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\17f710a1-a635-41db-abc5-de6bbcee30f2.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal64.phis.winHTM@35/286@14/16

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Persistence and Installation Behavior:

Creates license or readme file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\5116_945906207\LICENSE.txt

Jump to behavior

Remote Access Functionality:

Contains strings related to BOT control commands

Source: History.1.dr	String found in binary or memory: file:///C:/Users/user/Desktop/randy_woodruff%20Fax%20Message.htm#cmd=login_submit&id=512862308.338633&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445bMail - USER - Outlook
Source: History.1.dr	String found in binary or memory: file:///C:/Users/user/Desktop/randy_woodruff%20Fax%20Message.htm#cmd=login_submit&id=512862308.338633&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445bMail - USER - Outlook/4).
Source: History.1.dr	String found in binary or memory: file:///C:/Users/user/Desktop/randy_woodruff%20Fax%20Message.htm#cmd=login_submit&id=512862308.338633&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b
Source: History Provider Cache.1.dr	String found in binary or memory: file:///C:/Users/user/Desktop/randy_woodruff%20Fax%20Message.htm#cmd=login_submit&id=512862308.338633&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b2
Source: Current Session.1.dr	String found in binary or memory: file:///C:/Users/user/Desktop/randy_woodruff%20Fax%20Message.htm#cmd=login_submit&id=512862308.338633&session=487f7b22f68312d2c1bbc93b1aea445b487f7b22f68312d2c1bbc93b1aea445b