Can you provide some additional detail? Where are you seeing this?

Using osqueryi on windows 10, I noticed that in the

process_open_socket

table, there was an

ESTABLISHED

socket to multiple AWS ips (cloudfront). the pid was the one of

osqueryi.exe