Play interactive tour

Edit tour

Analysis Report https://tenderdocsrfp.typeform.com/to/RVzhstxV

Overview

General Information

Sample URL:	https://tenderdocsrfp.typeform.com/to/RVzhstxV
Analysis ID:	322824
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish_10

Allocates a big amount of memory (probably used for heap spraying)

HTML body contains low number of good links

HTML title does not match URL

Invalid 'forgot password' link found

Classification

Startup

System is w10x64

iexplore.exe (PID: 4888 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 5412 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4888 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\submission[1].htm	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

Phishing:

Yara detected HtmlPhish_10

Show sources

Source: Yara match	File source: 496536.0.links.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\submission[1].htm, type: DROPPED

Source: https://getrfpsubs.com/submission/	HTTP Parser: Number of links: 0
Source: https://getrfpsubs.com/submission/	HTTP Parser: Number of links: 0

Source: https://getrfpsubs.com/submission/	HTTP Parser: Title: Sign in to Outlook does not match URL
Source: https://getrfpsubs.com/submission/	HTTP Parser: Title: Sign in to Outlook does not match URL

Source: https://getrfpsubs.com/submission/	HTTP Parser: Invalid link: Forgot my password
Source: https://getrfpsubs.com/submission/	HTTP Parser: Invalid link: Forgot my password

Source: https://getrfpsubs.com/submission/	HTTP Parser: No <meta name="author".. found
Source: https://getrfpsubs.com/submission/	HTTP Parser: No <meta name="author".. found

Source: https://getrfpsubs.com/submission/	HTTP Parser: No <meta name="copyright".. found
Source: https://getrfpsubs.com/submission/	HTTP Parser: No <meta name="copyright".. found

Source: iexplore.exe

Memory has grown: Private usage: 0MB later: 106MB

Source: unknown

DNS traffic detected: queries for: tenderdocsrfp.typeform.com

Source: font-awesome[1].css.2.dr	String found in binary or memory: http://fontawesome.io
Source: font-awesome[1].css.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: vendors~form.a91c37aea0cc98f30227[1].js.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: vendors~form.a91c37aea0cc98f30227[1].js.2.dr	String found in binary or memory: http://www.jacklmoore.com/autosize
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.s
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_635a63d500a92a0b8497cdc58d0f66b1.svg
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_96f69d0cefd8a8ba623a182c351ccc64.png
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.s
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_5bc252567ef56db648207d9c36a9d004.p
Source: imagestore.dat.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Source: imagestore.dat.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~
Source: imagestore.dat.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~(
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_aad_9de70d1c5191d1852a0d5aac28b44
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_add_56e73414003cdb676008ff7857343
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/picker_more_7568a43cf440757c55d2e7f51557ae1f.svg
Source: submission[1].htm0.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Source: submission[1].htm0.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: imagestore.dat.2.dr	String found in binary or memory: https://form.typeform.com/favicon.ico
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://form.typeform.com/oembed?url=https%3A%2F%2Fform.typeform.com%2Fto%2FRVzhstxV
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://form.typeform.com/to/RVzhstxV
Source: {EAB6AA29-2FB4-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://form.typeform.com/to/RVzhstxVRoot
Source: {EAB6AA29-2FB4-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://form.typeform.com/to/RVzhstxVl
Source: {EAB6AA29-2FB4-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://getrfpsubs.com
Source: submission[1].htm.2.dr	String found in binary or memory: https://getrfpsubs.com/submission/
Source: ~DF332E8F0BA382E52E.TMP.1.dr	String found in binary or memory: https://getrfpsubs.com/submission/V
Source: {EAB6AA29-2FB4-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://getrfpsubs.comcom/to/RVzhstxVl
Source: renderer.3874ba4ac90514aa7200[1].js.2.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: vendors~form.a91c37aea0cc98f30227[1].js.2.dr	String found in binary or memory: https://github.com/kof/animationFrame
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://images.typeform.com/images/FYUps4mFKPYK/image/default
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://images.typeform.com/images/inKuSYPfhLGZ/background/large
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://images.typeform.com/images/inKuSYPfhLGZ/background/large);background-position:top
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://renderer-assets.typeform.com/
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://renderer-assets.typeform.com/blocks-matrix.a0638b15db7116da2f6d.js
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://renderer-assets.typeform.com/form.4f0b76be4a593ee62771.js
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://renderer-assets.typeform.com/modern-renderer.b5d8910ad502e48055f9.js
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://renderer-assets.typeform.com/phonenumber.37c19ce10e1b02882b22.js
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://renderer-assets.typeform.com/renderer.3874ba4ac90514aa7200.js
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://renderer-assets.typeform.com/vendors~attachment.ce631fd384ee79179761.js
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://renderer-assets.typeform.com/vendors~blocks-ranking.51d997857d845fa77423.js
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://renderer-assets.typeform.com/vendors~form.a91c37aea0cc98f30227.js

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: classification engine

Classification label: mal48.phis.win@3/32@14/9

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFE12BD7E786555811.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4888 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4888 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Masquerading1	OS Credential Dumping	File and Directory Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Extra Window Memory Injection1	Process Injection1	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Extra Window Memory Injection1	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://tenderdocsrfp.typeform.com/to/RVzhstxV	0%	Avira URL Cloud	safe

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://aadcdn.msftauth.net/ests/2.1/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/picker_more_7568a43cf440757c55d2e7f51557ae1f.svg	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	URL Reputation	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	URL Reputation	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	URL Reputation	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.s	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_635a63d500a92a0b8497cdc58d0f66b1.svg	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_aad_9de70d1c5191d1852a0d5aac28b44	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~(	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.s	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_add_56e73414003cdb676008ff7857343	0%	Avira URL Cloud	safe
https://getrfpsubs.com	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.	0%	Avira URL Cloud	safe
https://getrfpsubs.com/submission/V	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_96f69d0cefd8a8ba623a182c351ccc64.png	0%	Avira URL Cloud	safe
https://getrfpsubs.comcom/to/RVzhstxVl	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_5bc252567ef56db648207d9c36a9d004.p	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
getrfpsubs.com	54.206.89.250	true	false	unknown
d296je7bbdd650.cloudfront.net	13.224.100.80	true	false	high
cs1100.wpc.omegacdn.net	152.199.23.37	true	false	unknown
cdnjs.cloudflare.com	104.16.18.94	true	false	high
api.segment.io	52.33.248.165	true	false	high
d2citsn5wf4j9j.cloudfront.net	13.224.93.60	true	false	high
d2nvsmtq2poimt.cloudfront.net	13.224.93.102	true	false	high
bam.nr-data.net	162.247.242.19	true	false	unknown
js-agent.newrelic.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown
images.typeform.com	unknown	unknown	false	high
tenderdocsrfp.typeform.com	unknown	unknown	false	high
cdn.segment.com	unknown	unknown	false	high
try.typeform.com	unknown	unknown	false	high
code.jquery.com	unknown	unknown	false	high
renderer-assets.typeform.com	unknown	unknown	false	high
form.typeform.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://getrfpsubs.com/submission/	true		unknown
https://form.typeform.com/to/RVzhstxV	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aadcdn.msftauth.net/ests/2.1/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png	submission[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://form.typeform.com/favicon.ico	imagestore.dat.2.dr	false		high
https://renderer-assets.typeform.com/	RVzhstxV[1].htm.2.dr	false		high
http://fontawesome.io	font-awesome[1].css.2.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	vendors~form.a91c37aea0cc98f30227[1].js.2.dr	false		high
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css	submission[1].htm0.2.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/picker_more_7568a43cf440757c55d2e7f51557ae1f.svg	submission[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	imagestore.dat.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://images.typeform.com/images/inKuSYPfhLGZ/background/large);background-position:top	RVzhstxV[1].htm.2.dr	false		high
https://code.jquery.com/jquery-3.1.1.min.js	submission[1].htm0.2.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.s	submission[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://renderer-assets.typeform.com/vendors~blocks-ranking.51d997857d845fa77423.js	RVzhstxV[1].htm.2.dr	false		high
https://form.typeform.com/oembed?url=https%3A%2F%2Fform.typeform.com%2Fto%2FRVzhstxV	RVzhstxV[1].htm.2.dr	false		high
https://form.typeform.com/to/RVzhstxVRoot	{EAB6AA29-2FB4-11EB-90E4-ECF4BB862DED}.dat.1.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_635a63d500a92a0b8497cdc58d0f66b1.svg	submission[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/kof/animationFrame	vendors~form.a91c37aea0cc98f30227[1].js.2.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_aad_9de70d1c5191d1852a0d5aac28b44	submission[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~	imagestore.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://renderer-assets.typeform.com/modern-renderer.b5d8910ad502e48055f9.js	RVzhstxV[1].htm.2.dr	false		high
https://images.typeform.com/images/FYUps4mFKPYK/image/default	RVzhstxV[1].htm.2.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg	submission[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~(	imagestore.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://images.typeform.com/images/inKuSYPfhLGZ/background/large	RVzhstxV[1].htm.2.dr	false		high
https://renderer-assets.typeform.com/blocks-matrix.a0638b15db7116da2f6d.js	RVzhstxV[1].htm.2.dr	false		high
https://renderer-assets.typeform.com/renderer.3874ba4ac90514aa7200.js	RVzhstxV[1].htm.2.dr	false		high
https://renderer-assets.typeform.com/vendors~attachment.ce631fd384ee79179761.js	RVzhstxV[1].htm.2.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.s	submission[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
http://fontawesome.io/license	font-awesome[1].css.2.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_add_56e73414003cdb676008ff7857343	submission[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://form.typeform.com/to/RVzhstxV	RVzhstxV[1].htm.2.dr	false		high
https://getrfpsubs.com	{EAB6AA29-2FB4-11EB-90E4-ECF4BB862DED}.dat.1.dr	false	Avira URL Cloud: safe	unknown
http://www.jacklmoore.com/autosize	vendors~form.a91c37aea0cc98f30227[1].js.2.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.	submission[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://form.typeform.com/to/RVzhstxVl	{EAB6AA29-2FB4-11EB-90E4-ECF4BB862DED}.dat.1.dr	false		high
https://github.com/js-cookie/js-cookie	renderer.3874ba4ac90514aa7200[1].js.2.dr	false		high
https://getrfpsubs.com/submission/V	~DF332E8F0BA382E52E.TMP.1.dr	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_96f69d0cefd8a8ba623a182c351ccc64.png	submission[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://getrfpsubs.comcom/to/RVzhstxVl	{EAB6AA29-2FB4-11EB-90E4-ECF4BB862DED}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://getrfpsubs.com/submission/	submission[1].htm.2.dr	false		unknown
https://renderer-assets.typeform.com/phonenumber.37c19ce10e1b02882b22.js	RVzhstxV[1].htm.2.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_5bc252567ef56db648207d9c36a9d004.p	submission[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://renderer-assets.typeform.com/form.4f0b76be4a593ee62771.js	RVzhstxV[1].htm.2.dr	false		high
https://renderer-assets.typeform.com/vendors~form.a91c37aea0cc98f30227.js	RVzhstxV[1].htm.2.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
13.224.100.80	unknown	United States	16509	AMAZON-02US	false
54.206.89.250	unknown	United States	16509	AMAZON-02US	false
162.247.242.19	unknown	United States	23467	NEWRELIC-AS-1US	false
13.224.93.102	unknown	United States	16509	AMAZON-02US	false
13.224.93.60	unknown	United States	16509	AMAZON-02US	false
52.33.248.165	unknown	United States	16509	AMAZON-02US	false
152.199.23.37	unknown	United States	15133	EDGECASTUS	false
104.16.18.94	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	322824
Start date:	25.11.2020
Start time:	22:58:36
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://tenderdocsrfp.typeform.com/to/RVzhstxV
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@3/32@14/9
Cookbook Comments:	Adjust boot time Enable AMSI Browsing link: https://getrfpsubs.com/submission
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, ielowutil.exe, backgroundTaskHost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 104.108.39.131, 104.18.27.71, 104.18.26.71, 151.101.2.110, 151.101.66.110, 151.101.130.110, 151.101.194.110, 104.43.139.144, 51.104.146.109, 209.197.3.24, 92.122.144.200, 152.199.19.161 Excluded domains from analysis (whitelisted): cds.s5x3j6q5.hwcdn.net, arc.msn.com.nsatc.net, fs.microsoft.com, ie9comview.vo.msecnd.net, f4.shared.global.fastly.net, aadcdnoriginneu.azureedge.net, e1723.g.akamaiedge.net, skypedataprdcolcus16.cloudapp.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, aadcdnoriginneu.ec.azureedge.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, go.microsoft.com, random.typeform.com.cdn.cloudflare.net, try.typeform.com.cdn.cloudflare.net, go.microsoft.com.edgekey.net, blobcollector.events.data.trafficmanager.net, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, cs9.wpc.v0cdn.net Report size getting too big, too many NtDeviceIoControlFile calls found. VT rate limit hit for: https://tenderdocsrfp.typeform.com/to/RVzhstxV

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\F8BGPKB1\form.typeform[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	127637
Entropy (8bit):	5.358816381265442
Encrypted:	false
SSDEEP:	1536:86H6l6S6H6H6g6H6f6g6p6w6I6I6868616lLg6b6tLR6tLa6tLa6tL3LxHV6tL/T:s
MD5:	6E609A3DF230ECB9BEB9CADF789A57FC
SHA1:	B1D8CFBE3068B00D233F3BBD8DFD41DEBD875700
SHA-256:	FAB60F303AB835789EC14E902437358E56AEF125822A62165460EB48DEBB57C6
SHA-512:	582FBEC9D8403846381C8849342D45F44C56FB6340AA4DD9E03DDF78DDD80D4C3EF5A2D14AA69FB45CF0B190E6E77604B1E788A8C62BF16364926AA0D26CEBAE
Malicious:	false
Reputation:	low
Preview:	<root></root><root><item name="RVzhstxV-visitorId" value="RVzhstxV-1606373969496-68" ltime="2944997232" htime="30852033" /></root><root><item name="RVzhstxV-visitorId" value="RVzhstxV-1606373969496-68" ltime="2944997232" htime="30852033" /><item name="5f90dd48-36cf-440f-93e6-68da759356fa" value="test_value" ltime="2948637232" htime="30852033" /></root><root><item name="RVzhstxV-visitorId" value="RVzhstxV-1606373969496-68" ltime="2944997232" htime="30852033" /><item name="debug" value="undefined" ltime="2948677232" htime="30852033" /></root><root><item name="RVzhstxV-visitorId" value="RVzhstxV-1606373969496-68" ltime="2944997232" htime="30852033" /><item name="debug" value="undefined" ltime="2948757232" htime="30852033" /></root><root><item name="RVzhstxV-visitorId" value="RVzhstxV-1606373969496-68" ltime="2944997232" htime="30852033" /><item name="debug" value="undefined" ltime="2948757232" htime="30852033" /></root><root><item name="RVzhstxV-visitorId" value="RVzhstxV-1606373969496-68

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EAB6AA27-2FB4-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	33368
Entropy (8bit):	1.877177674819414
Encrypted:	false
SSDEEP:	96:r6ZlZx2YX9WZZtZufZ2BMZMZ+ZJZ7tZOS3:r6ZlZx2YX9WHtEf4BMyUj9tQS3
MD5:	BE05126D3F66D73A013C2C9CBCC97F4D
SHA1:	CA54C2ED73B2A02EF3837D918EAD0F103F46BBCB
SHA-256:	72E2396740CC1557C00598B2682B4768C43CF5D81C12E15337475E488FA05043
SHA-512:	9294099FEECB09A8AE844A2CEF44EECF31F819E2A22919CE3D3019B20A0802CBBB36D374692B57664B811A8D2A1B27018F74894C3CE421654557A84B8A944B9C
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{EAB6AA29-2FB4-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	34154
Entropy (8bit):	1.8715463980868396
Encrypted:	false
SSDEEP:	192:r1ZeQf61k0FjJ2YkWMM7Y0CHXbbSIMy6h5b2r2:r7bS+0hYcJ714rWUqaC
MD5:	788B02BD76365BE5744A11C7B6387E73
SHA1:	D562F34E75C6583D1C3F56D33513699197D9E5C7
SHA-256:	E0C142061E8F26D3D55BB17CEEE77BC4D02609D88CA9F5EC11D390BA47FE6259
SHA-512:	74F63DE733C65C60AA4BEAD6050B223A2D0D6708E948A457E1A46EE06FFF0A1E0EFF4453B8A8E73B6C645E2D4D23750322F63B38F8C29E830437F6DEE96B0E0E
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{EAB6AA2A-2FB4-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.5657490477324967
Encrypted:	false
SSDEEP:	48:IwpGcprYGwpavG4pQL7GrapbSrUrGQpK14G7HpRFsTGIpG:rvZAQh6bBSAFAJTF4A
MD5:	E757012ACB3D2A3107B29096973E0684
SHA1:	25E8D7BCA078B77701BAA195C184E45310A868B5
SHA-256:	1F876FF54D8477A2864925FEE7885316CC4A15C17FA1704A1C57269301270143
SHA-512:	94798830DC356BC18C9FEECF3BFA835CD9BD71D960FB6926AAD93DA5F32A18F29A1CC22485450B47101D321933C1B0386B15DDA6D39029E67082B1D3F5D07FE3
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	modified
Size (bytes):	22898
Entropy (8bit):	3.2795846723235322
Encrypted:	false
SSDEEP:	48:OJw3m8bdg5t30eT82/1IrHPx1XtJ5+J57J5jJ5YgyyyyyyyyyyyyyjJ5KmJ5/QQA:Dm8bqnq51XLUXXsv9QQQQQZ
MD5:	D8C6F22598C903780778000654665956
SHA1:	E278BD96698BAF9178EEED2ADFD7A52706573A22
SHA-256:	6AE3031721002D5B1DB6A43DAF7E4C2F7AD985397D1A2C84764891AFFBCD62A8
SHA-512:	8378AD62CE2575593A6C44B20A008822E34629D8AAFF8EC1E569E3983CAA098E74BCF84059AF0CCB580637DAA929AE1EBD0C60E54B8579E3D49670D4328A8C91
Malicious:	false
Reputation:	low
Preview:	%.h.t.t.p.s.:././.f.o.r.m...t.y.p.e.f.o.r.m...c.o.m./.f.a.v.i.c.o.n...i.c.o........... .... .........(... ...@..... .................................................................................333.+++)))2)))8(((:&&&.................................................................................................'''p&&&.'''.'''.'''.'''.'''.'''.'''.'''.(((F........................................................................777.'''.&&&.&&&.'''T(((.....................,,,.&&&k&&&.&&&.(((R............................................................'''N&&&.'''.((( ............................................'''A&&&.'''.+++.................................................'''\|&&&.''';............................................................&&&.&&&.**+........................................&&&.&&&.,,,.....................................................................'''\&&&.+++.................................'''.'''.999...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\analytics.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	361942
Entropy (8bit):	5.336273193870077
Encrypted:	false
SSDEEP:	3072:RbGJ3czFyJlp0zfBQEVyKliFIjREFy1JvLCEt4OKFjF/AgrE:VGy9yeyKliFoRPbQg
MD5:	07A8487352DD7DCAF6052A94171E3A70
SHA1:	77CCABB5EDFFA72F9CA5084859A41BDDA79F450A
SHA-256:	4A989A4958CD294C1586815026B5972F5E22CA4AB7192B5AB00B0FDFC36E9435
SHA-512:	2FD744FD9054AE006CA6DB8C35E844C849D14301701947465DE97A24A01BDB5B84134C81791B2367B7159603B7BAF1C5FCCF1DDD1C4374434A00A17629362FF6
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdn.segment.com/analytics.js/v1/9at6spGDYXelHDdz4r0cP73b3wV1f0ri/analytics.min.js
Preview:	!function(define){"function"==typeof define&&define.amd&&(define=undefined);!function(){function e(t,n,o){function i(r,s){if(!n[r]){if(!t[r]){var u="function"==typeof require&&require;if(!s&&u)return u(r,!0);if(a)return a(r,!0);var l=new Error("Cannot find module '"+r+"'");throw l.code="MODULE_NOT_FOUND",l}var c=n[r]={exports:{}};t[r][0].call(c.exports,function(e){return i(t[r][1][e]\|\|e)},c,c.exports,e,t,n,o)}return n[r].exports}for(var a="function"==typeof require&&require,r=0;r<o.length;r++)i(o[r]);return i}return e}()({1:[function(e,t,n){"use strict";var o=e("@segment/analytics.js-core"),i=e("@ndhoule/each");t.exports=function(e){i(function(e){o.use(e)},e);return o}},{"@ndhoule/each":32,"@segment/analytics.js-core":64}],2:[function(e,t,n){(function(n){"use strict";var o=e("@segment/send-json");t.exports=function(){for(var e=!1,t=!1,i=/.\/analytics\.js\/v1\/([^/])(\/platform)?\/analytics.*/,a=n.document.getElementsByTagName("script"),r=0;r<a.length;r++){var s=a[r].src,u=i.exec(s);i

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	513
Entropy (8bit):	4.720499940334011
Encrypted:	false
SSDEEP:	12:t4BdU/uRqv6DLfBHKFWJCDLfBSU1pRXIFl+MJ4bADc:t4TU/uRff0EcfIU1XXU+t2c
MD5:	A9CC2824EF3517B6C4160DCF8FF7D410
SHA1:	8DB9AEBAD84CA6E4225BFDD2458FF3821CC4F064
SHA-256:	34F9DB946E89F031A80DFCA7B16B2B686469C9886441261AE70A44DA1DFA2D58
SHA-512:	AA3DDAB0A1CFF9533F9A668ABA4FB5E3D75ED9F8AFF8A1CAA4C29F9126D85FF4529E82712C0119D2E81035D1CE1CC491FF9473384D211317D4D00E0E234AD97F
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><title>assets</title><path d="M18,11.578v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944.594.594L7.617,11.578Z" fill="#404040"/><path d="M10.944,7.056l.594.594L7.617,11.578H18v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944m0-.141-.071.07L5.929,11.929,5.858,12l.071.071,4.944,4.944.071.07.071-.07.594-.595.071-.07-.071-.071L7.858,12.522H18.1V11.478H7.858l3.751-3.757.071-.071-.071-.07-.594-.595-.071-.07Z" fill="#404040"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\font-awesome[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	troff or preprocessor input, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	37414
Entropy (8bit):	4.82325822639402
Encrypted:	false
SSDEEP:	768:mmMtI+A4CSIDqvnI+YTBrFPvVrJjhiRAiiEL:mXtI+A4GDUI+Y9rpVljhiIEL
MD5:	C495654869785BC3DF60216616814AD1
SHA1:	0140952C64E3F2B74EF64E050F2FE86EAB6624C8
SHA-256:	36E0A7E08BEE65774168528938072C536437669C1B7458AC77976EC788E4439C
SHA-512:	E40F27C1D30E5AB4B3DB47C3B2373381489D50147C9623D853E5B299364FD65998F46E8E73B1E566FD79E97AA7B20354CD3C8C79F15372C147FED9C913FFB106
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Preview:	/!. Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). /./ FONT PATH. * -------------------------- /.@font-face {. font-family: 'FontAwesome';. src: url('../fonts/fontawesome-webfont.eot?v=4.7.0');. src: url('../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'), url('../fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'), url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'), url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'), url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');. font-weight: normal;. font-style: normal;.}..fa {. display: inline-block;. font: normal normal normal 14px/1 FontAwesome;. font-size: inherit;. text-rendering: auto;. -webkit-font-smoothing: antialiased;. -moz-osx-font-smoothing: grayscale;.}./ makes the font 33% larger relative to the icon container */..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\picker_account_aad_9de70d1c5191d1852a0d5aac28b44a6c[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	756
Entropy (8bit):	4.879179443781471
Encrypted:	false
SSDEEP:	12:t4pb8WsQKvkBWSfYcW3ffBfYfomQO1a7aajR2F1hgWSnuCNSganii7v/NPujARqj:t4pb8WvKMTfY3ffBfYfomQO1eXjR2oug
MD5:	9DE70D1C5191D1852A0D5AAC28B44A6C
SHA1:	F4F64F5CBDBE6D1115C10A7F9CCB8828E6B67CAE
SHA-256:	5D3357BD875B7335ACE42E8EE3A64578E4253BED1A4E279109DE403EEDAE3A69
SHA-512:	CAC13FC2FE30E10772008F2AFF70FCA031EA9918E1F8C5C8B91CB9E79463383183406EFAADF89360DE3A08573FCDF2716C14DA6411E24B7E260B96AF84F00762
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_aad_9de70d1c5191d1852a0d5aac28b44a6c.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><circle cx="24" cy="24" r="24" fill="#e6e6e6"/><path d="M34,35V14a2.938,2.938,0,0,0-3-3H27V8l2-1L27.948,5.638,24,8,20.07,5.648,19,7l2,1v3H17a2.938,2.938,0,0,0-3,3V35a2.938,2.938,0,0,0,3,3H31A2.938,2.938,0,0,0,34,35Zm-3,1H17a.979.979,0,0,1-1-1V14a.979.979,0,0,1,1-1h6V10h2v3h6a.979.979,0,0,1,1,1V35A.979.979,0,0,1,31,36Z" fill="#404040"/><path d="M26.766,25.42a4.432,4.432,0,1,0-5.533,0A6.237,6.237,0,0,0,17.765,31h1.653a4.582,4.582,0,1,1,9.165,0h1.653A6.237,6.237,0,0,0,26.766,25.42Zm-5.546-3.435A2.779,2.779,0,1,1,24,24.765,2.783,2.783,0,0,1,21.221,21.985Z" fill="#404040"/><rect x="21" y="14" width="6" height="2" rx="1" ry="1" fill="#404040"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\vendors~form.a91c37aea0cc98f30227[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	downloaded
Size (bytes):	447992
Entropy (8bit):	5.75821034505678
Encrypted:	false
SSDEEP:	3072:XZlWb7LuY4Iz2DGmvA+5UO203o4PRjdzK4+Z9NGUKa4Ywaq1JxX/Zr6uAttiQDrp:XZlWzuY4IzUGTUUUd24+7sUP4YwrGtZF
MD5:	208F224D5E5175D7B9251ACDE758C070
SHA1:	EBF63D33FD6F768039ACAE3647C06D9C9251B760
SHA-256:	ED45D24659835AD636FC074DEB0DDE5FD14CD2D281F0C7BF179A47B1451FC7ED
SHA-512:	AFF69E294A214F8FF383EDCE00EF6ABCB074212ECF2AC486E1632BBD2333CDBCC0FF0245273E12079FFD9AA0B49C6705AA2B09938122DCA23336FBC4051F463C
Malicious:	false
Reputation:	low
IE Cache URL:	https://renderer-assets.typeform.com/vendors~form.a91c37aea0cc98f30227.js
Preview:	(window.webpackJsonp_name_=window.webpackJsonp_name_\|\|[]).push([[6],Array(428).concat([function(t,e,n){"use strict";n.d(e,"a",(function(){return M})),n.d(e,"b",(function(){return b})),n.d(e,"c",(function(){return L})),n.d(e,"d",(function(){return w})),n.d(e,"e",(function(){return d})),n.d(e,"f",(function(){return F})),n.d(e,"g",(function(){return K})),n.d(e,"h",(function(){return P})),n.d(e,"i",(function(){return z})),n.d(e,"j",(function(){return X})),n.d(e,"k",(function(){return rt})),n.d(e,"l",(function(){return at})),n.d(e,"m",(function(){return nt})),n.d(e,"n",(function(){return lt})),n.d(e,"o",(function(){return R})),n.d(e,"p",(function(){return N})),n.d(e,"q",(function(){return A})),n.d(e,"r",(function(){return B})),n.d(e,"s",(function(){return j})),n.d(e,"t",(function(){return dt})),n.d(e,"u",(function(){return tt})),n.d(e,"v",(function(){return Z})),n.d(e,"w",(function(){return J})),n.d(e,"x",(function(){return D})),n.d(e,"y",(function(){return ot})),n.d(e,"z",(function(){retur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\aa6e0ec721[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\favicon[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	4286
Entropy (8bit):	2.2086476734448737
Encrypted:	false
SSDEEP:	24:suV+U0mElbdgPBtL70o5hOiT825681Iro2siPxnGA1tR:W3m8bdg5t30eT82/1IrHPx1XR
MD5:	21FA426135560F2A424680343FAE7E13
SHA1:	CB69BD05400CBA23CDA0BBC8498792D5D35966BE
SHA-256:	EBD418438064DDB9CC5AA42C356DE2D76C0F9C27AF97740F0952912272D28108
SHA-512:	B459F97F5F22464A3667B1616FE67538FA0F917BE95380A8F7302591519D09C50E3AE7F0FAE14F255D45061D6B08446ACCBF376314F448C4A6F7EB3B514580A6
Malicious:	false
Reputation:	low
IE Cache URL:	https://form.typeform.com/favicon.ico
Preview:	...... .... .........(... ...@..... .................................................................................333.+++)))2)))8(((:&&&.................................................................................................'''p&&&.'''.'''.'''.'''.'''.'''.'''.'''.(((F........................................................................777.'''.&&&.&&&.'''T(((.....................,,,.&&&k&&&.&&&.(((R............................................................'''N&&&.'''.((( ............................................'''A&&&.'''.+++.................................................'''\|&&&.''';............................................................&&&.&&&.**+........................................&&&.&&&.,,,.....................................................................'''\&&&.+++.................................'''.'''.999.............................................................................(((.&&&.............................(((`&&&.+++...............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\favicon_a_eupayfgghqiai7k9sol6lg2[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\jquery-3.1.1.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	86709
Entropy (8bit):	5.367391365596119
Encrypted:	false
SSDEEP:	1536:9NhEyjjTikEJO4edXXe9J578go6MWXqcVhrLyB4Lw13sh2bzrl1+iuH7U3gBORDT:jxcq0hrLZwpsYbmzORDU8Cu5
MD5:	E071ABDA8FE61194711CFC2AB99FE104
SHA1:	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA
SHA-256:	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
SHA-512:	53A2B560B20551672FBB0E6E72632D4FD1C7E2DD2ECF7337EBAAAB179CB8BE7C87E9D803CE7765706BC7FCBCF993C34587CD1237DE5A279AEA19911D69067B65
Malicious:	false
Reputation:	low
IE Cache URL:	https://code.jquery.com/jquery-3.1.1.min.js
Preview:	/! jQuery v3.1.1 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.1.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var b=r.merge(this.con

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\nr-1123.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	24380
Entropy (8bit):	5.3039076589847856
Encrypted:	false
SSDEEP:	384:yNeRyajOhmUdGa4PFaOy0hGF1Ux9EmiwbikgkYPMvFzoUMC0GPwi5MteM7gN+u:yNP0HgGa4P7x+XM9zoJmlGtGN+u
MD5:	7FFB242072196E9DB5F4F1BFBFA2ED7D
SHA1:	6CFD443F06C2D4E96E14765E045277B67DA0EEC5
SHA-256:	94CDF5B7F868883DE0E1248CD80B42DD84E3F38685F2B234747550C02190DC82
SHA-512:	371BCC019D60EDBC2DD331F379AC46951B6D8E50FCA25FC79062C02F4E78A6B41DC884C590FD2E8F47EDE8BC392F3A84B0CFE102386282504538BFD157848B17
Malicious:	false
Reputation:	low
IE Cache URL:	https://js-agent.newrelic.com/nr-1123.min.js
Preview:	!function(n,e,t){function r(t,i){if(!e[t]){if(!n[t]){var a="function"==typeof __nr_require&&__nr_require;if(!i&&a)return a(t,!0);if(o)return o(t,!0);throw new Error("Cannot find module '"+t+"'")}var s=e[t]={exports:{}};n[t][0].call(s.exports,function(e){var o=n[t][1][e];return r(o\|\|e)},s,s.exports)}return e[t].exports}for(var o="function"==typeof __nr_require&&__nr_require,i=0;i<t.length;i++)r(t[i]);return r}({1:[function(n,e,t){e.exports=function(n,e){return"addEventListener"in window?window.addEventListener(n,e,!1):"attachEvent"in window?window.attachEvent("on"+n,e):void 0}},{}],2:[function(n,e,t){function r(n,e,t,r,i){d[n]\|\|(d[n]={});var a=d[n][e];return a\|\|(a=d[n][e]={params:t\|\|{}},i&&(a.custom=i)),a.metrics=o(r,a.metrics),a}function o(n,e){return e\|\|(e={count:0}),e.count+=1,f(n,function(n,t){e[n]=i(t,e[n])}),e}function i(n,e){return e?(e&&!e.c&&(e={t:e.t,min:e.t,max:e.t,sos:e.te.t,c:1}),e.c+=1,e.t+=n,e.sos+=nn,n>e.max&&(e.max=n),n<e.min&&(e.min=n),e):{t:n}}function a(n,e){return

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\submission[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	116336
Entropy (8bit):	5.3816220537602755
Encrypted:	false
SSDEEP:	1536:Yhuhw+ExmazA/PWrF7qvEAFiQcpmNtuhPyJRp7xvnXE1Esns8lR:Yt4wyJjZnXE1Esns8H
MD5:	3752C84E2D4118729A264E7629A62E88
SHA1:	22C6C7C155B63E6F566BF554406A5F0780C3F800
SHA-256:	94860511EBE34294BA25E9D70248BA9855B1743CF7CB88796605494C130582D5
SHA-512:	BFCBFC34FD403CD7CBE119C697E1D71AF7F83E83C2BAD190852502C2CEC0669D117AAFB824BB0422667DAEC66D819F7FC40205AFB94C09CB4376572972CAEE03
Malicious:	true
Yara Hits:	Rule: JoeSecurity_HtmlPhish_10, Description: Yara detected HtmlPhish_10, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\submission[1].htm, Author: Joe Security
Reputation:	low
IE Cache URL:	https://getrfpsubs.com/submission/
Preview:	<html dir="ltr" lang="en">.. <meta charset="utf-8">.. <link href="https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico" rel="shortcut icon">.. <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css" integrity="sha256-NuCn4IvuZXdBaFKJOAcsU2Q3ZpwbdFisd5dux4jkQ5w=" crossorigin="anonymous">.. <style>... html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:bold}dfn{font-style:italic}h1{font-size:2em;margin:.67em 0}mark{background:#ff0;color:#000}small{font-size:80%}sub,sup{font-size:75%

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\2_bc3d32a696895f78c19df6c717586a5d[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\53_8b36337037cff88c3df203bb73d58e41[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:	96:oX2DsRVNYc82nTGTirCPqKO1gDPFjDiwK3aM5yO/bUlVV6JKo5N9jIMw7RLW1ZHb:ofRgc82nTprQsgDNDP7QgVVoH9+kMK9
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\aa6e0ec721[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.340020120659463
Encrypted:	false
SSDEEP:	3:U3KTDW3MiqVkMWVrfUh:H6NukMWVr8h
MD5:	06DD80AEB628C60DC680BC7A4BEE6651
SHA1:	8C86EB7DDFF5E1E5D527BD7A41C9D3F6767E23E0
SHA-256:	5E864C2E3F674C60970513411EAEEEAFD2D615D842E65EC01D09CCFCB4A7B38D
SHA-512:	C6EE8252743A760AD7BEE017FF7A804B6E34236764BC5630289D5E4C7C15E38CB971F161821586F0235882FD581630F1531FD6396761BF1284581CD8C2CAC4C6
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':0,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\form.4f0b76be4a593ee62771[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	220250
Entropy (8bit):	5.282233578694434
Encrypted:	false
SSDEEP:	3072:IeSEm4j/7GqTCTBy7N6pf0Unhjw5JWu9RauTyWa6/wzqPLP:zj/BCTBg6pfRh0bRiWaCVj
MD5:	1EE0F825CD7FBE03F5D127497563339B
SHA1:	9518F55710BF0EC4BCE81E6F8F70D99933EB80D0
SHA-256:	12824B612AF916B150F542682DC86577DA4F9B0F34F2E75C60BBEE47F64AADA0
SHA-512:	0D3DF4B9B4062451B8878841A27B84221F374B89CA93552342D57163A7A43974F1A260FDDDE453949B92F4713C3454D9A0FABDABD5FA988E0791C7E2F5660637
Malicious:	false
Reputation:	low
IE Cache URL:	https://renderer-assets.typeform.com/form.4f0b76be4a593ee62771.js
Preview:	(window.webpackJsonp_name_=window.webpackJsonp_name_\|\|[]).push([[1],{236:function(e,t,n){"use strict";n.d(t,"a",(function(){return o})),n.d(t,"b",(function(){return a}));var r=n(12),o=function(){return{type:r.t,payload:{}}},a=function(){return{type:r.E,payload:{}}}},237:function(e,t,n){"use strict";n.d(t,"b",(function(){return o})),n.d(t,"a",(function(){return a}));var r=n(12);function o(e){return{type:r.A,payload:e}}function a(e){return{type:r.z,payload:e}}},238:function(e,t,n){"use strict";n.d(t,"b",(function(){return ye})),n.d(t,"a",(function(){return Ce}));var r=n(86),o=n.n(r),a=(n(159),n(123)),c=n.n(a),i=n(3),u=n(30),s=n(115),l=n(6),p=n(484);n(435);var d=n(151),f=(n(32),n(485),n(486),n(523),n(9),n(19)),b=n.n(f),h=n(530),m=n.n(h),v=n(524),O=n.n(v),g=(n(11),n(13),n(14),n(17),n(18),n(15),n(2)),y=n.n(g),j=n(225),w=(n(31),n(35),n(457),n(90),n(206)),k=n.n(w),x=function(e){var t=e.split("-"),n=b()(t,3),r=n[0],o=n[1],a=n[2];if(!r\|\|!o\|\|!a)return!1;r=r.padStart(4,"0"),o=o.padStart(2,"0"),a=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\picker_account_add_56e73414003cdb676008ff7857343074[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	222
Entropy (8bit):	5.004415423297573
Encrypted:	false
SSDEEP:	3:tIsqDmJS4RKb5zMc7XpCN+bJMacvRxyJAgR/QvfqhcDQKG2TcVER+HLZqWTboZUq:tI9mc4slztdbC/yXADQKDTcVEqLwDZsc
MD5:	56E73414003CDB676008FF7857343074
SHA1:	9ED7A58CD0E81E9689AC8C6D548A47D0185E0FDC
SHA-256:	749F85621D92A5B31B2A377A8C385A36D48A83327DAD9A8A8DA93CD831B8C9A2
SHA-512:	FAD0071AC2DFA23989BFBC7D3850415F3C340A74A54D3D8D797AFCCD6A301513BBC769DF4E5148605BE1E23A8750973EB80726F3CC959A2A457B0EC09AE14F27
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_add_56e73414003cdb676008ff7857343074.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><circle cx="24" cy="24" r="24" fill="#e6e6e6"/><path d="M25,23H36v2H25V36H23V25H12V23H23V12h2Z" fill="#404040"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\RVzhstxV[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	121534
Entropy (8bit):	5.367615809186343
Encrypted:	false
SSDEEP:	1536:M4lWpZaX8ynI1Z4tG81pMH/+eA/7D5GccKppVCJ05fQN6Db7ItUhnLd71UiGw8OT:2KI6p7einQTyV8uVnPzw+b
MD5:	C909ED7A2F5EF94B06B89FC214C7405C
SHA1:	973E913CBA1B734A4A45207AC84A9DF686AD2832
SHA-256:	239528724D1F16C164368B486CBE4A0BB59B042E800309E395C05C0EFEA0CDD5
SHA-512:	7338EBB221B102216E258EA590C8C9A05C518CBD8F114B843E409675CC1268A3672206EF3B91D5894209CA419E1B37B36ED037C353B582ADEFEF24358FE22BF4
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html><html lang="en"><head><title>submit your tender/rfp</title><meta charSet="utf-8"/><meta content="#f6f6f7" name="theme-color"/><meta content="width=device-width, initial-scale=1.0, viewport-fit=cover" name="viewport"/><meta content="Turn data collection into an experience with Typeform. Create beautiful online forms, surveys, quizzes, and so much more. Try it for FREE." name="description"/><meta content="ie=edge" http-equiv="x-ua-compatible"/><meta content="yes" name="apple-mobile-web-app-capable"/><meta content="index,follow" name="robots"/><meta name="referrer" content="no-referrer-when-downgrade"/><meta content="website" property="og:type"/><meta content="https://form.typeform.com/to/RVzhstxV" property="og:url"/><meta content="submit your tender/rfp" property="og:title"/><meta content="Turn data collection into an experience with Typeform. Create beautiful online forms, surveys, quizzes, and so much more. Try it for FREE." property="og:description"/><meta content="http

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\ellipsis_635a63d500a92a0b8497cdc58d0f66b1[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	900
Entropy (8bit):	3.8081778439799248
Encrypted:	false
SSDEEP:	24:t4CvnAVRHf1QqCSzGUdiHTVtpRduf1QqCWbVHTVeUV0Uv6f1QqCWbVHTVeUV0UFl:fn+1QqC4GuiHFXS1QqCWRHQ3V1QqCWRV
MD5:	635A63D500A92A0B8497CDC58D0F66B1
SHA1:	A32EBA4B4D139E8DA52C5801A13C1EE222B2B882
SHA-256:	61D7CCC5D2C41BF86BE6CEFB0063405067849BA64E9F219F60596EF09A54A942
SHA-512:	EFFE15E105FC5FA853E76917B533AAE6C75EBA9A256049FB5EAB88BBF319D63A4CE4AE3743A09D6A5F474B01649D6EDC5C8BCCC61B8CA9EA9E5C39E7AE724C16
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_635a63d500a92a0b8497cdc58d0f66b1.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16"><title>assets</title><path d="M1.143,6.857a1.107,1.107,0,0,1,.446.089,1.164,1.164,0,0,1,.607.607,1.161,1.161,0,0,1,0,.893,1.164,1.164,0,0,1-.607.607,1.107,1.107,0,0,1-.446.089A1.107,1.107,0,0,1,.7,9.054a1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893A1.164,1.164,0,0,1,.7,6.946a1.107,1.107,0,0,1,.446-.089M8,6.857a1.107,1.107,0,0,1,.446.089,1.164,1.164,0,0,1,.607.607,1.161,1.161,0,0,1,0,.893,1.164,1.164,0,0,1-.607.607,1.161,1.161,0,0,1-.893,0,1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893,1.164,1.164,0,0,1,.607-.607A1.107,1.107,0,0,1,8,6.857m6.857,0a1.107,1.107,0,0,1,.446.089,1.164,1.164,0,0,1,.607.607,1.161,1.161,0,0,1,0,.893,1.164,1.164,0,0,1-.607.607,1.161,1.161,0,0,1-.893,0,1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893,1.164,1.164,0,0,1,.607-.607A1.107,1.107,0,0,1,14.857,6.857Z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	915
Entropy (8bit):	3.8525277758130154
Encrypted:	false
SSDEEP:	24:t4CvnAVRfFArf1QqCSzGUdiHTVtpRduf1QqCWbVHTVeUV0Uv6f1QqCWbVHTVeUVx:fn1r1QqC4GuiHFXS1QqCWRHQ3V1QqCWz
MD5:	2B5D393DB04A5E6E1F739CB266E65B4C
SHA1:	6A435DF5CAC3D58CCAD655FE022CCF3DD4B9B721
SHA-256:	16C3F6531D0FA5B4D16E82ABF066233B2A9F284C068C663699313C09F5E8D6E6
SHA-512:	3A692635EE8EBD7B15930E78D9E7E808E48C7ED3ED79003B8CA6F9290FA0E2B0FA3573409001489C00FB41D5710E75D17C3C4D65D26F9665849FB7406562A406
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16"><title>assets</title><path fill="#777777" d="M1.143,6.857a1.107,1.107,0,0,1,.446.089,1.164,1.164,0,0,1,.607.607,1.161,1.161,0,0,1,0,.893,1.164,1.164,0,0,1-.607.607,1.107,1.107,0,0,1-.446.089A1.107,1.107,0,0,1,.7,9.054a1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893A1.164,1.164,0,0,1,.7,6.946a1.107,1.107,0,0,1,.446-.089M8,6.857a1.107,1.107,0,0,1,.446.089,1.164,1.164,0,0,1,.607.607,1.161,1.161,0,0,1,0,.893,1.164,1.164,0,0,1-.607.607,1.161,1.161,0,0,1-.893,0,1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893,1.164,1.164,0,0,1,.607-.607A1.107,1.107,0,0,1,8,6.857m6.857,0a1.107,1.107,0,0,1,.446.089,1.164,1.164,0,0,1,.607.607,1.161,1.161,0,0,1,0,.893,1.164,1.164,0,0,1-.607.607,1.161,1.161,0,0,1-.893,0,1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893,1.164,1.164,0,0,1,.607-.607A1.107,1.107,0,0,1,14.857,6.857Z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\large[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 300 x 168, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	3897
Entropy (8bit):	7.808318452733727
Encrypted:	false
SSDEEP:	96:MKr3/lT2gJiJSTgLBDhpWZlp/X920YLx1aHFit6XZg:b3/Z2gJzgLXpWZ7X9zYL6HFiMXZg
MD5:	D29608F4E4F3A787108D376CE78708E4
SHA1:	58093F71DA6EBA370859936757E625F66DE00F70
SHA-256:	92F8C87A1FE370402BF6623ED40A4F5389AEB4F226F593695F7A8A2E9B11C1A8
SHA-512:	FCDA7C2AEABF707FD32ED2E7DBB74225FA6827B768B2E835672639DD933C68B74A79EAAA118980A8E669EEB50E2F7EFC828C7F95149066A3AF13B72645F26430
Malicious:	false
Reputation:	low
IE Cache URL:	https://images.typeform.com/images/inKuSYPfhLGZ/background/large
Preview:	.PNG........IHDR...,..........IDX....pHYs...........~.....IDATx..O.]W...Z.....T.r/........ n.Z.$4...R.> XhV....TB....-....Z.5F.3..i.q..3....s.}..L.>...7..s.}..=...X...............................................................................................................................................................................nE./\8...t.._Gm.....j.........Dr.\Kxee.s..{w.c[.uw..o{s.=.~.....Sg~..ow<...~t.....?.=.......p..'..t...v.{a.g.]..&n....E.......]}m....M9Lr.\K.H%........O.l..}X...o.VIx..k+.....0..../>.b.j....\$.l......:Z.FI.H8.CIx............zI.TH.!! !.B..J..$....e.)..7.O.>}......\|...z=~.........E.n.zC.V..n..W.\..,..6...:..'...;.=..@.....<..C{...w.}.v..}.......sE...N.8.O...>J....z....:...y.o...d.%.'.>.....9.E.3G.....R.a......,8..~..=G..{.I!.....F%..]G...d...m...)..'...=.(.....CB%....pb...R..u.......J.4........H.<.N.+......E.#?.........R. q..-$.7.$.^..M......HW....m>..u>KB.#...?Q].{*...U\|.....Ry...Y\..b......[.9...T@I..F..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:	96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\picker_more_7568a43cf440757c55d2e7f51557ae1f[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	899
Entropy (8bit):	3.8260330857236338
Encrypted:	false
SSDEEP:	24:t4CvnAVROLgCWbVHTVSRUyL3Fe09gCWbVHTVeUVh10UsSgCWbVHTVeUVh10Usb7:fncCWRH0JL3FECWRHQA10rCWRHQA10F
MD5:	7568A43CF440757C55D2E7F51557AE1F
SHA1:	55C22CA98B5CDCED134F6E24205C288845312A2D
SHA-256:	B7FCD37EAAFE3F08647ED072D5289EADFFF6C660A26CDEF31532B3FCFB4A0BB2
SHA-512:	F01DA2804594C3C78C0694FD6CC49B667663DA95AE7367EE3F0F5112B9957A3220389AAE4A5B750BCB3BC4F1092EA614266A4BFFD7E0FE16232E1CB57606E901
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/picker_more_7568a43cf440757c55d2e7f51557ae1f.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16"><title>assets</title><path d="M9.143,1.143a1.107,1.107,0,0,1-.089.446,1.164,1.164,0,0,1-.607.607,1.161,1.161,0,0,1-.893,0,1.164,1.164,0,0,1-.607-.607,1.107,1.107,0,0,1-.089-.446A1.107,1.107,0,0,1,6.946.7,1.164,1.164,0,0,1,7.554.089a1.161,1.161,0,0,1,.893,0A1.164,1.164,0,0,1,9.054.7a1.107,1.107,0,0,1,.089.446M9.143,8a1.107,1.107,0,0,1-.089.446,1.164,1.164,0,0,1-.607.607,1.161,1.161,0,0,1-.893,0,1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893,1.164,1.164,0,0,1,.607-.607,1.161,1.161,0,0,1,.893,0,1.164,1.164,0,0,1,.607.607A1.107,1.107,0,0,1,9.143,8m0,6.857a1.107,1.107,0,0,1-.089.446,1.164,1.164,0,0,1-.607.607,1.161,1.161,0,0,1-.893,0,1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893,1.164,1.164,0,0,1,.607-.607,1.161,1.161,0,0,1,.893,0,1.164,1.164,0,0,1,.607.607A1.107,1.107,0,0,1,9.143,14.857Z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\renderer.3874ba4ac90514aa7200[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	546254
Entropy (8bit):	5.363551196814252
Encrypted:	false
SSDEEP:	6144:BPfOihFb+vphu8AE41swRV1qWQwZCws+Czdi03qSbYTV:BNuvCjrxmo03a
MD5:	EBA01E9D00A24AF43A6F072C2429A894
SHA1:	2EE4989C5A23E5AC29AEA7E92649373C16893B58
SHA-256:	62325823E63ACDA4A0E9DA911F1C10F2662B8AD928EBCC70E5B4581506C824E0
SHA-512:	EE3DB60E5819CFCBEA24FA85D7CDE7178964ADAF81BB762AD2B5B4AE745A869BC92ED30A18F57189A11EDB250715A8F963363BB0511E897CB3E739AC1778AFEB
Malicious:	false
Reputation:	low
IE Cache URL:	https://renderer-assets.typeform.com/renderer.3874ba4ac90514aa7200.js
Preview:	window.renderer=function(e){function t(t){for(var n,o,i=t[0],a=t[1],u=0,l=[];u<i.length;u++)o=i[u],Object.prototype.hasOwnProperty.call(r,o)&&r[o]&&l.push(r[o][0]),r[o]=0;for(n in a)Object.prototype.hasOwnProperty.call(a,n)&&(e[n]=a[n]);for(c&&c(t);l.length;)l.shift()()}var n={},r={3:0};function o(t){if(n[t])return n[t].exports;var r=n[t]={i:t,l:!1,exports:{}};return e[t].call(r.exports,r,r.exports,o),r.l=!0,r.exports}o.e=function(e){var t=[],n=r[e];if(0!==n)if(n)t.push(n[2]);else{var i=new Promise((function(t,o){n=r[e]=[t,o]}));t.push(n[2]=i);var a,u=document.createElement("script");u.charset="utf-8",u.timeout=120,o.nc&&u.setAttribute("nonce",o.nc),u.src=function(e){return o.p+""+({0:"blocks-matrix",1:"form",2:"phonenumber",4:"vendors~attachment",5:"vendors~blocks-ranking",6:"vendors~form"}[e]\|\|e)+"."+{0:"a0638b15db7116da2f6d",1:"4f0b76be4a593ee62771",2:"37c19ce10e1b02882b22",4:"ce631fd384ee79179761",5:"51d997857d845fa77423",6:"a91c37aea0cc98f30227"}[e]+".js"}(e);var c=new Error;a=fun

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\submission[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	242
Entropy (8bit):	5.12656117121659
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwol6hEr6VX16hu9nP0hSIXzOR+KqD:J0+ox0RJWWPMOET
MD5:	EAF60CB3550718475C0FF50217AD0CBE
SHA1:	A52669E34CF6990EA42372BD965F63BD15FA4F62
SHA-256:	3E3D3F9F7F8218397F422E5D803AEBA6A6C512B0C6736D1BE1DDE4A4F45A0340
SHA-512:	62FCE17AFC8B235962DCD5E9FD96667D4FA1B65968E3BBF45126F3D71BADC69ADE7A85A0AB1E9F1944BAF32D6D16A8F58DF0E0516BE331E7B1EF4E98EB0A8001
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="https://getrfpsubs.com/submission/">here</a>.</p>.</body></html>.

C:\Users\user\AppData\Local\Temp\~DF332E8F0BA382E52E.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	43395
Entropy (8bit):	0.4491598713874928
Encrypted:	false
SSDEEP:	48:kBqoxKAuvScS+CaJuHLILxmNQaXW8a43Nw8aXaJaKak0SnNJLpXwzNeLpX6:kBqoxKAuvScS+CkuH0cXt3NAkRAuK
MD5:	864C9A2C87FC6E23C8D89E2F79F52F59
SHA1:	BE3D97CACC96C82AA4CE12BEC36FAC1C0FD98AAD
SHA-256:	559E1BD98F4760D3427B8FDE4E8561E948A5CAFB6FE0B270C2B00B52C681BD0A
SHA-512:	F20B17A724408993D9DDB170DD04E899215AE535DC9193139D1B86CD872CA3557BBDB81E55DC20FC83A8870CF53CFE177893D35784FD821FB3EF70EEB79330BE
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF5181903B4D6B00F5.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	25441
Entropy (8bit):	0.27918767598683664
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lRx/9lRJ9lTb9lTb9lSSU9lSSU9laAa/9laA:kBqoxxJhHWSVSEab
MD5:	AB889A32AB9ACD33E816C2422337C69A
SHA1:	1190C6B34DED2D295827C2A88310D10A8B90B59B
SHA-256:	4D6EC54B8D244E63B0F04FBE2B97402A3DF722560AD12F218665BA440F4CEFDA
SHA-512:	BD250855747BB4CEC61814D0E44F810156D390E3E9F120A12935EFDF80ACA33C4777AD66257CCA4E4003FEF0741692894980B9298F01C4CDD2D8A9C7BB522FB6
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFE12BD7E786555811.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13077
Entropy (8bit):	0.5139236851147084
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loAF9loo9lW5TSkT9ANRfNRJ:kBqoITF5TpTiNRfNRJ
MD5:	CB192CD1FD6C55717BE8E68495D70378
SHA1:	810D458DBB9E1972D7FB522419F065978AC71513
SHA-256:	3F8EC4512FF32DE7F43DACB0D4819754867333B7AAD8987C63F880053FE3069C
SHA-512:	E15BEDE6FF80711808B9A5158A97B77676A7EB15DE2C06C9F5FFB81A7C2F1EF7BD71C1CC91EDCF76BAF8F873BCEB170ACB7AA411E7BD4F1E223F5F5A9E0CC6DA
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2020 22:59:28.398176908 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.398984909 CET	49712	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.414513111 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.414616108 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.415086985 CET	443	49712	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.415224075 CET	49712	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.416297913 CET	49712	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.416909933 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.432374954 CET	443	49712	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.432832003 CET	443	49712	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.432874918 CET	443	49712	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.432917118 CET	443	49712	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.432946920 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.432945013 CET	49712	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.433008909 CET	49712	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.433016062 CET	49712	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.433315992 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.433357000 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.433372021 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.433407068 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.433420897 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.433468103 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.435182095 CET	443	49712	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.435224056 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.435269117 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.435327053 CET	49712	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.587992907 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.590490103 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.590692997 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.591145992 CET	49712	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.591514111 CET	49712	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.604038000 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.604341984 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.604368925 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.604408979 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.604435921 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.605287075 CET	49714	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.605925083 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.606364965 CET	49713	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.606471062 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.606530905 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.606570959 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.606575966 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.607101917 CET	443	49712	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.607381105 CET	443	49712	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.607407093 CET	443	49712	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.607448101 CET	443	49712	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.607505083 CET	49712	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.608037949 CET	49712	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.609783888 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.609838009 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.609977961 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.609996080 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.610017061 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.610038042 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.610060930 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.610199928 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.610218048 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.610234976 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.610241890 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.610251904 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.610277891 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.610306978 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.611124992 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.611144066 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.611161947 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.611179113 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.611181974 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.611207008 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.611238003 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.612046003 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.612065077 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.612082958 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.612099886 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.612101078 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.612126112 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.612163067 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.612950087 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.612966061 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.612986088 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.613003969 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.613013983 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.613034010 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.613065004 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.613856077 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.613873005 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.613888979 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.613904953 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.613913059 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.613945007 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.614803076 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.614820957 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.614866018 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.614901066 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.620371103 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.620392084 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.620431900 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.620452881 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.621064901 CET	443	49714	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.621140957 CET	49714	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.621696949 CET	49714	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.621823072 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.622226954 CET	443	49713	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.622291088 CET	49713	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.622515917 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.622530937 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.622551918 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.622564077 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.622579098 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.622596025 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.622598886 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.622631073 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.622872114 CET	49713	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.623904943 CET	443	49712	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.625755072 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.625775099 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.625792027 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.625814915 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.626111984 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.626130104 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.626146078 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.626162052 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.626162052 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.626183033 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.626220942 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.626878977 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.626894951 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.626912117 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.626928091 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.626931906 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.626950979 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.626982927 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.627793074 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.627810001 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.627825022 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.627840996 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.627868891 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.627882957 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.627901077 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.628700972 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.628716946 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.628751040 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.628766060 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.628793955 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.628828049 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.628837109 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.628870964 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.629616022 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.629636049 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.629656076 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.629664898 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.629672050 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.629684925 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.629703045 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.630538940 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.630557060 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.630577087 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.630593061 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.630593061 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.630621910 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.630650997 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.631448030 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.631465912 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.631481886 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.631498098 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.631514072 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.631515980 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.631548882 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.632390022 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.632407904 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.632424116 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.632441044 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.632441998 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.632457018 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.632484913 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.633308887 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.633327007 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.633342981 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.633361101 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.633361101 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.633388996 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.633410931 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.634191990 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.634212971 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.634229898 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.634248018 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.634268045 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.634269953 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.634288073 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.634305954 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.635102034 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.635119915 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.635135889 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.635152102 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.635154009 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.635174036 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.635205030 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.636370897 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.636392117 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.636411905 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.636428118 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.636435032 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.636445999 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.636467934 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.636495113 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.637475967 CET	443	49714	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.637842894 CET	443	49714	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.637859106 CET	443	49714	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.637876034 CET	443	49714	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.637904882 CET	49714	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.637928963 CET	49714	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.638442993 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.638470888 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.638488054 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.638497114 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.638529062 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.638716936 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.638730049 CET	443	49713	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.638746023 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.638756990 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.638762951 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.638781071 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.638787985 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.638797998 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.638823032 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.638849974 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.639043093 CET	443	49713	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.639062881 CET	443	49713	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.639080048 CET	443	49713	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.639087915 CET	49713	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.639106035 CET	49713	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.639127016 CET	49713	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.639724970 CET	443	49714	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.639784098 CET	49714	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.640907049 CET	443	49713	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.640979052 CET	49713	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.641710997 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.641727924 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.641745090 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.641767979 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.641788006 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.642085075 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.642129898 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.642138958 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.642158031 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.642174959 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.642175913 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.642191887 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.642194986 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.642214060 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.642234087 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.642805099 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.642822027 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.642838955 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.642853975 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.642857075 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.642877102 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.642879009 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.642916918 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.643706083 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.643724918 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.643743038 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.643759012 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.643775940 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.643775940 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.643822908 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.644515991 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.644542933 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.644566059 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.644567966 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.644593000 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.644597054 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.644613028 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.644618988 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.644630909 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.644654036 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.645339966 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.645360947 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.645396948 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.645399094 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.645415068 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.645421982 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.645433903 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.645442009 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.645458937 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.645466089 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.645473957 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.645498991 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.646286011 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.646308899 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.646342039 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.646363020 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.646593094 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.646610975 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.646629095 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.646629095 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.646648884 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:28.646648884 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.646670103 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.646692038 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:28.648391962 CET	49714	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.648935080 CET	49714	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.649223089 CET	49714	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.653584957 CET	49713	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.654141903 CET	49713	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.664218903 CET	443	49714	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.664355040 CET	443	49714	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.664417982 CET	49714	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.664427042 CET	443	49714	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.664474010 CET	49714	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.664628029 CET	443	49714	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.664705038 CET	443	49714	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.664743900 CET	49714	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.664952040 CET	443	49714	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.665396929 CET	49714	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.669482946 CET	443	49713	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.669709921 CET	443	49713	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.669749022 CET	443	49713	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.669759989 CET	49713	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.669785976 CET	49713	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.670038939 CET	443	49713	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.670054913 CET	443	49713	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.670099020 CET	49713	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.671257019 CET	49713	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.674099922 CET	443	49714	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.674118996 CET	443	49714	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.674129009 CET	443	49714	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.674175024 CET	49714	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.674196005 CET	49714	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.674370050 CET	443	49714	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.674438000 CET	49714	443	192.168.2.3	13.224.93.102
Nov 25, 2020 22:59:28.681148052 CET	443	49714	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:28.687201023 CET	443	49713	13.224.93.102	192.168.2.3
Nov 25, 2020 22:59:29.128617048 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.144594908 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.160931110 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.160963058 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.160989046 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161011934 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161032915 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161047935 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.161053896 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161077976 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161096096 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.161099911 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161122084 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.161123037 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161144972 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161153078 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.161168098 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161183119 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.161214113 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.161297083 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161317110 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161334038 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.161351919 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.161459923 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161483049 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161499023 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.161504984 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161519051 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.161525965 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161541939 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.161547899 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161564112 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.161571026 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161581993 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.161593914 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161603928 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.161614895 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161623955 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.161636114 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161647081 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.161658049 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161669970 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.161679029 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.161691904 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.161711931 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.162336111 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.162363052 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.162384987 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.162400007 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.162406921 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.162422895 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.162427902 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.162450075 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.162456989 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.162471056 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.162478924 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.162492990 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.162509918 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.162514925 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.162532091 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.162538052 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.162554979 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.162559032 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.162589073 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.162606955 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.163233042 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.163259983 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.163281918 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.163284063 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.163304090 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.163306952 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.163324118 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.163324118 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.163345098 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.163346052 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.163362026 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.163367033 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.163382053 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.163387060 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.163400888 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.163407087 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.163419962 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.163429022 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.163438082 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.163450003 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.163456917 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.163480043 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.164145947 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.164174080 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.164196968 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.164197922 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.164220095 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.164227009 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.164241076 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.164263010 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.164263964 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.164283991 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.164299965 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.164304972 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.164325953 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.164329052 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.164345980 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.164361000 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.164369106 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.164391041 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.164422035 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.165051937 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.165079117 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.165100098 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.165113926 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.165127993 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.165143967 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.165150881 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.165174007 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.165174961 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.165196896 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.165215969 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.165216923 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.165235996 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.165250063 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.165270090 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.165271044 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.165290117 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.165303946 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.165330887 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.165958881 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.165985107 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.166006088 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.166013956 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.166028023 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.166042089 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.166048050 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.166073084 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.166074991 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.166095018 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.166110039 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.166115046 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.166136026 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.166141033 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.166157007 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.166173935 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.166177988 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.166207075 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.166862011 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.166887045 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.166903973 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.166908026 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.166929007 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.166937113 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.166949034 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.166955948 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.166971922 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.166987896 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.166991949 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.167011976 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.167015076 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.167032003 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.167036057 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.167052031 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.167058945 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.167073011 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.167076111 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.167093039 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.167117119 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.167818069 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.167840958 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.167861938 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.167875051 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.167881966 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.167900085 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.167902946 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.167923927 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.167929888 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.167941093 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.167959929 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.167989016 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.169158936 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.186459064 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.186489105 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.186510086 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.186532021 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.186534882 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.186554909 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.186577082 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.186579943 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.186599016 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.186616898 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.186619043 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.186640024 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.186640024 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.186662912 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.186671019 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.186685085 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.186691046 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.186712980 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.186737061 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.186852932 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.186872005 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.186893940 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.186911106 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.186940908 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.186983109 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.186995029 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.187017918 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.187035084 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.187040091 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.187053919 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.187062025 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.187078953 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.187084913 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.187102079 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.187107086 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.187124014 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.187129974 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.187146902 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.187154055 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.187164068 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.187176943 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.187194109 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.187196970 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.187215090 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.187232971 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.187825918 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.187869072 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.187874079 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.187891006 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.187910080 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.187915087 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.187932014 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.187937975 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.187954903 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.187962055 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.187977076 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.187983036 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.187999964 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.188004971 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.188020945 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.188026905 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.188043118 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.188047886 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.188065052 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.188070059 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.188081980 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.188107967 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.188787937 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.188815117 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.188837051 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.188841105 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.188858032 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.188864946 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.188879967 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.188884020 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.188900948 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.188905001 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.188921928 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.188929081 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.188942909 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.188946962 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.188960075 CET	443	49711	13.224.93.60	192.168.2.3
Nov 25, 2020 22:59:29.188970089 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:29.188997030 CET	49711	443	192.168.2.3	13.224.93.60
Nov 25, 2020 22:59:30.073117971 CET	49718	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:30.073226929 CET	49717	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:30.105829954 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.106226921 CET	49720	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.122246027 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.122288942 CET	443	49720	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.122360945 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.122421026 CET	49720	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.122948885 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.123558044 CET	49720	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.139038086 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.139301062 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.139347076 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.139370918 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.139375925 CET	443	49720	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.139400005 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.139776945 CET	443	49720	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.139817953 CET	443	49720	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.139868975 CET	49720	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.139915943 CET	49720	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.141609907 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.141644001 CET	443	49720	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.141664982 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.141709089 CET	49720	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.173655987 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.174123049 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.174339056 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.189987898 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.190119028 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.190176964 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.190201998 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.190220118 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.190253019 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.190294981 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.190917015 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.195396900 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.195455074 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.195493937 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.195501089 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.195517063 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.195532084 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.195544004 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.195576906 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.195579052 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.195621014 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.195621014 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.195657969 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.195667982 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.195698977 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.195702076 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.195741892 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.196116924 CET	49720	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.196151018 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.196196079 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.196211100 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.196233034 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.196243048 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.196273088 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.196274042 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.196316004 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.196521997 CET	49720	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.197061062 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.197099924 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.197124958 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.197138071 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.197153091 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.197176933 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.197181940 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.197223902 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.197999001 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.198067904 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.198283911 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.198312044 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.198327065 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.198338032 CET	443	49717	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:30.198344946 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.198345900 CET	443	49718	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:30.198368073 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.198390007 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.198455095 CET	49717	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:30.198462963 CET	49718	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:30.198841095 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.198858976 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.198874950 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.198890924 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.198894024 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.198926926 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.198966026 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.199773073 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.199793100 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.199831963 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.199855089 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.205749035 CET	49717	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:30.206279039 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.206305027 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.206331015 CET	49718	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:30.206367970 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.206399918 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.206881046 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.211682081 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.211708069 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.211728096 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.211745977 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.211756945 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.211779118 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.211816072 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.211987019 CET	443	49720	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.212151051 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.212171078 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.212187052 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.212203026 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.212203979 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.212232113 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.212266922 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.212306976 CET	443	49720	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.212330103 CET	443	49720	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.212340117 CET	443	49720	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.212367058 CET	49720	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.212393045 CET	49720	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.213041067 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.213063955 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.213079929 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.213095903 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.213120937 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.213152885 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.214015007 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.214035034 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.214046955 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.214060068 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.214096069 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.214133978 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.214848995 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.214870930 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.214888096 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.214906931 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.214920044 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.214961052 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.215783119 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.215804100 CET	443	49719	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.215877056 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.215905905 CET	49719	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.218655109 CET	49720	443	192.168.2.3	13.224.100.80
Nov 25, 2020 22:59:30.234572887 CET	443	49720	13.224.100.80	192.168.2.3
Nov 25, 2020 22:59:30.330585003 CET	443	49717	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:30.331334114 CET	443	49717	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:30.331366062 CET	443	49717	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:30.331393957 CET	443	49717	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:30.331415892 CET	443	49718	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:30.331439972 CET	49717	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:30.331480026 CET	49717	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:30.332281113 CET	443	49718	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:30.332309961 CET	443	49718	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:30.332326889 CET	443	49718	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:30.332371950 CET	49718	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:30.332411051 CET	49718	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:30.340338945 CET	49717	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:30.340887070 CET	49717	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:30.362663984 CET	49718	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:30.465919018 CET	443	49717	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:30.466300011 CET	443	49717	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:30.466337919 CET	443	49717	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:30.466365099 CET	443	49717	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:30.466389894 CET	443	49717	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:30.466404915 CET	49717	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:30.466433048 CET	49717	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:30.466439962 CET	49717	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:30.488028049 CET	443	49718	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:30.488679886 CET	443	49718	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:30.488739014 CET	443	49718	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:30.488749027 CET	49718	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:30.488785028 CET	49718	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:30.529870033 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:30.721487999 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:30.721643925 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:30.722878933 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:30.850416899 CET	49722	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:30.914159060 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:30.915805101 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:30.915887117 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:30.915946007 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:30.915958881 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:30.915997028 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:30.916019917 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:30.921331882 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.041791916 CET	443	49722	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.041955948 CET	49722	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.042681932 CET	49722	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.112895966 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.112947941 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.113125086 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.116105080 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.116195917 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.116458893 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.168862104 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.175518990 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.233819008 CET	443	49722	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.235069036 CET	443	49722	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.235093117 CET	443	49722	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.235110044 CET	443	49722	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.235204935 CET	49722	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.245603085 CET	49722	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.307549000 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.307566881 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.307853937 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.353853941 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.360142946 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.360205889 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.360280037 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.360728025 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.360743999 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.360793114 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.360831022 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.360869884 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.360924006 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.409863949 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.437043905 CET	443	49722	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.437086105 CET	443	49722	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.437127113 CET	49722	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.437151909 CET	49722	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.438788891 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.438808918 CET	49722	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.439133883 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.439263105 CET	49722	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.439400911 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.630279064 CET	443	49722	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.630333900 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.630420923 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.630451918 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.630537987 CET	49722	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.630655050 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.631686926 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.631715059 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:31.631819010 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:31.677948952 CET	443	49722	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.210442066 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.212549925 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.212584019 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.404026985 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.404896021 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.404932976 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.404994965 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.405035973 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.563424110 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.563621044 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.563812971 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.563966990 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.564204931 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.569683075 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.600130081 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.600217104 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.600316048 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.754976988 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.755196095 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.755223989 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.755398989 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.755428076 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.755469084 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.755549908 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.756428003 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.756443977 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.756532907 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.756608963 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.756633997 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.756648064 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.756707907 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.756740093 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.756783962 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.756819963 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.760977030 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.760992050 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.761077881 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.761161089 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.761511087 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.761590004 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:33.791445971 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.833941936 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.946654081 CET	443	49721	52.33.248.165	192.168.2.3
Nov 25, 2020 22:59:33.946940899 CET	49721	443	192.168.2.3	52.33.248.165
Nov 25, 2020 22:59:47.913161039 CET	49734	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:47.913655043 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:48.213243008 CET	443	49734	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:48.213360071 CET	49734	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:48.213675976 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:48.213782072 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:48.214260101 CET	49734	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:48.214384079 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:48.514342070 CET	443	49734	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:48.514365911 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:48.514947891 CET	443	49734	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:48.514980078 CET	443	49734	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:48.514995098 CET	443	49734	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:48.515007973 CET	443	49734	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:48.515069962 CET	49734	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:48.515088081 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:48.515105009 CET	49734	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:48.515115023 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:48.515131950 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:48.515142918 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:48.515160084 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:48.515185118 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:48.516392946 CET	443	49734	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:48.516473055 CET	49734	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:48.516756058 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:48.516820908 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:48.562289953 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:48.562714100 CET	49734	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:48.563251972 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:48.862901926 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:48.862934113 CET	443	49734	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:48.862996101 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:48.863023043 CET	49734	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:48.867139101 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:48.867244959 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:48.984313011 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.294715881 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.294744968 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.294756889 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.294768095 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.294780016 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.294796944 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.294811964 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.294826984 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.294842005 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.294859886 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.294867992 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.294897079 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.294938087 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.595158100 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.595187902 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.595351934 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.598407984 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.598464012 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.598498106 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.598522902 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.598546028 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.598562956 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.598578930 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.598592043 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.598601103 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.598617077 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.598625898 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.598632097 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.598648071 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.598655939 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.598661900 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.598680019 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.598690987 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.598691940 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.598710060 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.598720074 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.598726988 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.598743916 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.598752022 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.598762035 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.598773003 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.598838091 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.598865032 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.612798929 CET	49718	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:49.612864017 CET	49718	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:49.613660097 CET	49717	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:49.641117096 CET	49737	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.642312050 CET	49738	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.657334089 CET	443	49737	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.657421112 CET	49737	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.658479929 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.658554077 CET	49738	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.682481050 CET	49737	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.683330059 CET	49738	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.698713064 CET	443	49737	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.699495077 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.699943066 CET	443	49737	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.699961901 CET	443	49737	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.700020075 CET	49737	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.700051069 CET	49737	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.701433897 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.701452017 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.701529026 CET	49738	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.737970114 CET	443	49718	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:49.737998009 CET	443	49718	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:49.738090992 CET	49718	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:49.738135099 CET	49718	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:49.738368988 CET	443	49717	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:49.739780903 CET	443	49717	162.247.242.19	192.168.2.3
Nov 25, 2020 22:59:49.739877939 CET	49717	443	192.168.2.3	162.247.242.19
Nov 25, 2020 22:59:49.785403013 CET	49738	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.786228895 CET	49737	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.787528038 CET	49738	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.787945032 CET	49738	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.788243055 CET	49737	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.801753044 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.802429914 CET	443	49737	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.802547932 CET	443	49737	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.802578926 CET	443	49737	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.802627087 CET	49737	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.802673101 CET	49737	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.803664923 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.804086924 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.804357052 CET	443	49737	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.805012941 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.805102110 CET	49738	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.805561066 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.805625916 CET	49738	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.807707071 CET	443	49737	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.807775021 CET	49737	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.816106081 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.816127062 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.816140890 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.816152096 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.816169024 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.816184044 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.816199064 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.816216946 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.816227913 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.816325903 CET	49738	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.816355944 CET	49738	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.825994968 CET	49737	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.869400978 CET	49738	443	192.168.2.3	104.16.18.94
Nov 25, 2020 22:59:49.882966995 CET	443	49737	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.885621071 CET	443	49738	104.16.18.94	192.168.2.3
Nov 25, 2020 22:59:49.895540953 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.895562887 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.895574093 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.895586014 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.895711899 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.898858070 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.898880005 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.898890972 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.898906946 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.898951054 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.898993969 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899004936 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899033070 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899033070 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899070024 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899074078 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899105072 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899116039 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899144888 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899146080 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899179935 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899179935 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899204969 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899220943 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899229050 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899245024 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899254084 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899261951 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899275064 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899279118 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899293900 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899302006 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899313927 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899322033 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899332047 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899347067 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899353981 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899363041 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899378061 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899385929 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899394035 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899410009 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899418116 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899425983 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899449110 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899460077 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899468899 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899482965 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899503946 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899504900 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899522066 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899533987 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899540901 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899564028 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899584055 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899724960 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899755955 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899774075 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899775982 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899791956 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899808884 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.899816036 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.899849892 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:49.900032043 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:49.900087118 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:50.195924997 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:50.195961952 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:50.195977926 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:50.195996046 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:50.196012974 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:50.196027994 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:50.196031094 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:50.196047068 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:50.196062088 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:50.196069002 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:50.196121931 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:50.199700117 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:50.199728966 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:50.199739933 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:50.199759007 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:50.199775934 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:50.199790955 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:50.199805975 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:50.199820995 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:50.199837923 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:50.199845076 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:50.199846983 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:50.199908972 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:50.390111923 CET	49739	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.391006947 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.391846895 CET	49741	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.392680883 CET	49742	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.393486023 CET	49743	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.394298077 CET	49744	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.406275988 CET	443	49739	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.406403065 CET	49739	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.407026052 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.407084942 CET	49739	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.407119989 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.407769918 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.407866955 CET	443	49741	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.407939911 CET	49741	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.408668041 CET	443	49742	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.408746004 CET	49742	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.409305096 CET	49742	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.409507036 CET	443	49743	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.409584045 CET	49743	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.410120010 CET	49743	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.410301924 CET	443	49744	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.410379887 CET	49744	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.423090935 CET	443	49739	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.423748970 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.424036980 CET	443	49739	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.424053907 CET	443	49739	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.424068928 CET	443	49739	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.424081087 CET	443	49739	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.424129009 CET	49739	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.424160004 CET	49739	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.424760103 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.424787045 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.424803972 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.424813986 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.424815893 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.424823999 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.424865961 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.424915075 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.425302982 CET	443	49742	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.426064014 CET	443	49743	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.426274061 CET	443	49742	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.426295996 CET	443	49742	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.426311970 CET	443	49742	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.426323891 CET	443	49742	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.426326990 CET	49742	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.426331043 CET	443	49742	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.426352024 CET	49742	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.426388979 CET	49742	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.427177906 CET	443	49743	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.427195072 CET	443	49743	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.427210093 CET	443	49743	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.427220106 CET	443	49743	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.427232027 CET	443	49743	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.427246094 CET	49743	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.427282095 CET	49743	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.499954939 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.500442982 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.500646114 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.500746012 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.500838041 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.500925064 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.501023054 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.501113892 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.501202106 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.501292944 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.501745939 CET	49742	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.502118111 CET	49742	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.516396046 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.516428947 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.516444921 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.516464949 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.516504049 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.516864061 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.517179012 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.517306089 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.517996073 CET	443	49742	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.518026114 CET	443	49742	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.518080950 CET	49742	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.518109083 CET	49742	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.518136978 CET	443	49742	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.518177986 CET	49742	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.518755913 CET	49742	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.522057056 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.522078037 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.522089958 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.522102118 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.522119045 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.522188902 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.522228956 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.522247076 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.522284985 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.522384882 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.522424936 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.522543907 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.522582054 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.523004055 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.523067951 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.525698900 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.525778055 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.525993109 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.526046991 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.526181936 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.526195049 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.526226997 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.526263952 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.539853096 CET	49743	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.556265116 CET	443	49743	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.556288958 CET	443	49743	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.556421041 CET	49743	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.557806015 CET	49743	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.562911987 CET	49741	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.564867020 CET	49743	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.565090895 CET	49744	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.574111938 CET	443	49743	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.574274063 CET	49743	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.575372934 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.578023911 CET	443	49742	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.578923941 CET	443	49741	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.580030918 CET	443	49741	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.580051899 CET	443	49741	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.580065012 CET	443	49741	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.580071926 CET	443	49741	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.580137968 CET	49741	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.580202103 CET	49741	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.581059933 CET	443	49744	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.582073927 CET	443	49744	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.582093000 CET	443	49744	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.582104921 CET	443	49744	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.582112074 CET	443	49744	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.582123995 CET	443	49744	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.582166910 CET	49744	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.582194090 CET	49744	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.623754025 CET	443	49743	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.698369026 CET	49741	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.699295998 CET	49744	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.701423883 CET	49741	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.701788902 CET	49744	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.714723110 CET	443	49741	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.714742899 CET	443	49741	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.714858055 CET	49741	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.715564013 CET	443	49744	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.715588093 CET	443	49744	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.715624094 CET	49744	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.715658903 CET	49744	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.717494011 CET	443	49741	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.717539072 CET	49741	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.717813969 CET	443	49744	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.717855930 CET	49744	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.803314924 CET	49741	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.803359032 CET	49744	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:50.859987020 CET	443	49744	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:50.861273050 CET	443	49741	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.459587097 CET	49739	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:51.459992886 CET	49739	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:51.476115942 CET	443	49739	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.476157904 CET	443	49739	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.476254940 CET	49739	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:51.476284027 CET	49739	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:51.484009027 CET	49739	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:51.547790051 CET	443	49739	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.641232967 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:51.657740116 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.660182953 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:51.661056995 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.661134005 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:51.677642107 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.677707911 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.677751064 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.677788973 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.677826881 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.677864075 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.677865028 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:51.677892923 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:51.677900076 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.677922964 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:51.677937984 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.677949905 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:51.677974939 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.678006887 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:51.678023100 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.678025961 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:51.678066015 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.678102016 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.678103924 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:51.678122997 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:51.678139925 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.678143978 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:51.678168058 CET	443	49740	152.199.23.37	192.168.2.3
Nov 25, 2020 22:59:51.678220034 CET	49740	443	192.168.2.3	152.199.23.37
Nov 25, 2020 22:59:52.901808023 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:52.901829004 CET	443	49733	54.206.89.250	192.168.2.3
Nov 25, 2020 22:59:52.901902914 CET	49733	443	192.168.2.3	54.206.89.250
Nov 25, 2020 22:59:52.901941061 CET	49733	443	192.168.2.3	54.206.89.250

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2020 22:59:26.014925957 CET	55984	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:26.052067041 CET	53	55984	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:27.100387096 CET	64185	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:27.149633884 CET	53	64185	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:27.688915014 CET	65110	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:27.739742041 CET	53	65110	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:28.358079910 CET	58361	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:28.396683931 CET	53	58361	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:28.564795971 CET	63492	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:28.602845907 CET	53	63492	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:29.107600927 CET	60831	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:29.144404888 CET	53	60831	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:30.041925907 CET	60100	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:30.066435099 CET	53195	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:30.069195032 CET	53	60100	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:30.103801966 CET	53	53195	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:30.494595051 CET	50141	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:30.521728039 CET	53	50141	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:42.675776958 CET	53023	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:42.702848911 CET	53	53023	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:43.938949108 CET	49563	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:43.974452972 CET	53	49563	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:44.502845049 CET	51352	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:44.548142910 CET	53	51352	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:44.557048082 CET	59349	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:44.584060907 CET	53	59349	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:45.572069883 CET	57084	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:45.607676983 CET	53	57084	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:46.403858900 CET	58823	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:46.439290047 CET	53	58823	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:47.301111937 CET	57568	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:47.328110933 CET	53	57568	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:47.427870989 CET	50540	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:47.463267088 CET	53	50540	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:47.606112003 CET	54366	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:47.910852909 CET	53	54366	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:48.238707066 CET	53034	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:48.265875101 CET	53	53034	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:49.060725927 CET	57762	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:49.096277952 CET	53	57762	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:49.611470938 CET	55435	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:49.638529062 CET	53	55435	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:50.217159986 CET	50713	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:50.255131006 CET	53	50713	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:50.709280014 CET	56132	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:50.736268044 CET	53	56132	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:51.924830914 CET	58987	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:51.951921940 CET	53	58987	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:52.773816109 CET	56579	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:52.800863028 CET	53	56579	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:54.874524117 CET	60633	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:54.912585020 CET	53	60633	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:56.003994942 CET	61292	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:56.031342030 CET	53	61292	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:56.690658092 CET	63619	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:56.726073027 CET	53	63619	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:56.932539940 CET	64938	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:56.967885017 CET	53	64938	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:57.008564949 CET	61292	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:57.035568953 CET	53	61292	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:57.695239067 CET	63619	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:57.722259998 CET	53	63619	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:58.035890102 CET	61292	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:58.062854052 CET	53	61292	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:58.711026907 CET	63619	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:58.738065004 CET	53	63619	8.8.8.8	192.168.2.3
Nov 25, 2020 22:59:58.985153913 CET	61946	53	192.168.2.3	8.8.8.8
Nov 25, 2020 22:59:59.012170076 CET	53	61946	8.8.8.8	192.168.2.3
Nov 25, 2020 23:00:00.023766041 CET	61292	53	192.168.2.3	8.8.8.8
Nov 25, 2020 23:00:00.061296940 CET	53	61292	8.8.8.8	192.168.2.3
Nov 25, 2020 23:00:00.115883112 CET	64910	53	192.168.2.3	8.8.8.8
Nov 25, 2020 23:00:00.143073082 CET	53	64910	8.8.8.8	192.168.2.3
Nov 25, 2020 23:00:00.726546049 CET	63619	53	192.168.2.3	8.8.8.8
Nov 25, 2020 23:00:00.753678083 CET	53	63619	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 25, 2020 22:59:27.100387096 CET	192.168.2.3	8.8.8.8	0x8d17	Standard query (0)	tenderdocsrfp.typeform.com	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:27.688915014 CET	192.168.2.3	8.8.8.8	0x656a	Standard query (0)	form.typeform.com	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:28.358079910 CET	192.168.2.3	8.8.8.8	0xdda5	Standard query (0)	renderer-assets.typeform.com	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:28.564795971 CET	192.168.2.3	8.8.8.8	0xa36c	Standard query (0)	images.typeform.com	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:29.107600927 CET	192.168.2.3	8.8.8.8	0x7724	Standard query (0)	js-agent.newrelic.com	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:30.041925907 CET	192.168.2.3	8.8.8.8	0x8613	Standard query (0)	bam.nr-data.net	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:30.066435099 CET	192.168.2.3	8.8.8.8	0x6312	Standard query (0)	cdn.segment.com	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:30.494595051 CET	192.168.2.3	8.8.8.8	0xde2d	Standard query (0)	api.segment.io	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:43.938949108 CET	192.168.2.3	8.8.8.8	0x277a	Standard query (0)	form.typeform.com	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:44.502845049 CET	192.168.2.3	8.8.8.8	0xdefc	Standard query (0)	try.typeform.com	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:47.606112003 CET	192.168.2.3	8.8.8.8	0x6baa	Standard query (0)	getrfpsubs.com	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:49.611470938 CET	192.168.2.3	8.8.8.8	0x4ad0	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:50.217159986 CET	192.168.2.3	8.8.8.8	0x121	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:50.709280014 CET	192.168.2.3	8.8.8.8	0x398	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Nov 25, 2020 22:59:27.149633884 CET	8.8.8.8	192.168.2.3	0x8d17	No error (0)	tenderdocsrfp.typeform.com	random.typeform.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 22:59:27.739742041 CET	8.8.8.8	192.168.2.3	0x656a	No error (0)	form.typeform.com	random.typeform.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 22:59:28.396683931 CET	8.8.8.8	192.168.2.3	0xdda5	No error (0)	renderer-assets.typeform.com	d2citsn5wf4j9j.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 22:59:28.396683931 CET	8.8.8.8	192.168.2.3	0xdda5	No error (0)	d2citsn5wf4j9j.cloudfront.net		13.224.93.60	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:28.396683931 CET	8.8.8.8	192.168.2.3	0xdda5	No error (0)	d2citsn5wf4j9j.cloudfront.net		13.224.93.43	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:28.396683931 CET	8.8.8.8	192.168.2.3	0xdda5	No error (0)	d2citsn5wf4j9j.cloudfront.net		13.224.93.45	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:28.396683931 CET	8.8.8.8	192.168.2.3	0xdda5	No error (0)	d2citsn5wf4j9j.cloudfront.net		13.224.93.116	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:28.602845907 CET	8.8.8.8	192.168.2.3	0xa36c	No error (0)	images.typeform.com	d2nvsmtq2poimt.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 22:59:28.602845907 CET	8.8.8.8	192.168.2.3	0xa36c	No error (0)	d2nvsmtq2poimt.cloudfront.net		13.224.93.102	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:28.602845907 CET	8.8.8.8	192.168.2.3	0xa36c	No error (0)	d2nvsmtq2poimt.cloudfront.net		13.224.93.115	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:28.602845907 CET	8.8.8.8	192.168.2.3	0xa36c	No error (0)	d2nvsmtq2poimt.cloudfront.net		13.224.93.75	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:28.602845907 CET	8.8.8.8	192.168.2.3	0xa36c	No error (0)	d2nvsmtq2poimt.cloudfront.net		13.224.93.46	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:29.144404888 CET	8.8.8.8	192.168.2.3	0x7724	No error (0)	js-agent.newrelic.com	f4.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 22:59:30.069195032 CET	8.8.8.8	192.168.2.3	0x8613	No error (0)	bam.nr-data.net		162.247.242.19	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:30.069195032 CET	8.8.8.8	192.168.2.3	0x8613	No error (0)	bam.nr-data.net		162.247.242.18	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:30.069195032 CET	8.8.8.8	192.168.2.3	0x8613	No error (0)	bam.nr-data.net		162.247.242.20	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:30.069195032 CET	8.8.8.8	192.168.2.3	0x8613	No error (0)	bam.nr-data.net		162.247.242.21	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:30.103801966 CET	8.8.8.8	192.168.2.3	0x6312	No error (0)	cdn.segment.com	d296je7bbdd650.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 22:59:30.103801966 CET	8.8.8.8	192.168.2.3	0x6312	No error (0)	d296je7bbdd650.cloudfront.net		13.224.100.80	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:30.521728039 CET	8.8.8.8	192.168.2.3	0xde2d	No error (0)	api.segment.io		52.33.248.165	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:30.521728039 CET	8.8.8.8	192.168.2.3	0xde2d	No error (0)	api.segment.io		52.89.58.223	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:30.521728039 CET	8.8.8.8	192.168.2.3	0xde2d	No error (0)	api.segment.io		54.70.105.250	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:30.521728039 CET	8.8.8.8	192.168.2.3	0xde2d	No error (0)	api.segment.io		52.25.204.187	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:30.521728039 CET	8.8.8.8	192.168.2.3	0xde2d	No error (0)	api.segment.io		54.68.229.68	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:30.521728039 CET	8.8.8.8	192.168.2.3	0xde2d	No error (0)	api.segment.io		54.187.246.64	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:30.521728039 CET	8.8.8.8	192.168.2.3	0xde2d	No error (0)	api.segment.io		54.200.110.219	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:30.521728039 CET	8.8.8.8	192.168.2.3	0xde2d	No error (0)	api.segment.io		52.35.37.211	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:43.974452972 CET	8.8.8.8	192.168.2.3	0x277a	No error (0)	form.typeform.com	random.typeform.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 22:59:44.548142910 CET	8.8.8.8	192.168.2.3	0xdefc	No error (0)	try.typeform.com	try.typeform.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 22:59:47.910852909 CET	8.8.8.8	192.168.2.3	0x6baa	No error (0)	getrfpsubs.com		54.206.89.250	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:49.638529062 CET	8.8.8.8	192.168.2.3	0x4ad0	No error (0)	cdnjs.cloudflare.com		104.16.18.94	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:49.638529062 CET	8.8.8.8	192.168.2.3	0x4ad0	No error (0)	cdnjs.cloudflare.com		104.16.19.94	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:50.255131006 CET	8.8.8.8	192.168.2.3	0x121	No error (0)	aadcdn.msftauth.net	aadcdnoriginneu.azureedge.net		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 22:59:50.255131006 CET	8.8.8.8	192.168.2.3	0x121	No error (0)	cs1100.wpc.omegacdn.net		152.199.23.37	A (IP address)	IN (0x0001)
Nov 25, 2020 22:59:50.736268044 CET	8.8.8.8	192.168.2.3	0x398	No error (0)	code.jquery.com	cds.s5x3j6q5.hwcdn.net		CNAME (Canonical name)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Nov 25, 2020 22:59:28.435182095 CET	13.224.93.60	443	192.168.2.3	49712	CN=*.typeform.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Tue Dec 24 01:00:00 CET 2019 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sun Jan 24 13:00:00 CET 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Nov 25, 2020 22:59:28.435224056 CET	13.224.93.60	443	192.168.2.3	49711	CN=*.typeform.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Tue Dec 24 01:00:00 CET 2019 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sun Jan 24 13:00:00 CET 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Nov 25, 2020 22:59:28.639724970 CET	13.224.93.102	443	192.168.2.3	49714	CN=*.typeform.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Tue Dec 24 01:00:00 CET 2019 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sun Jan 24 13:00:00 CET 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Nov 25, 2020 22:59:28.640907049 CET	13.224.93.102	443	192.168.2.3	49713	CN=*.typeform.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Tue Dec 24 01:00:00 CET 2019 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sun Jan 24 13:00:00 CET 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Nov 25, 2020 22:59:30.141609907 CET	13.224.100.80	443	192.168.2.3	49719	CN=*.segment.com, O="Segment.io, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Jun 12 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Tue Jul 27 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 22:59:30.141609907 CET	13.224.100.80	443	192.168.2.3	49719	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 22:59:30.141644001 CET	13.224.100.80	443	192.168.2.3	49720	CN=*.segment.com, O="Segment.io, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Jun 12 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Tue Jul 27 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 22:59:30.141644001 CET	13.224.100.80	443	192.168.2.3	49720	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 22:59:30.331393957 CET	162.247.242.19	443	192.168.2.3	49717	CN=*.nr-data.net, O="New Relic, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 05 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013	Tue Feb 08 13:00:00 CET 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 22:59:30.331393957 CET	162.247.242.19	443	192.168.2.3	49717	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 22:59:30.332326889 CET	162.247.242.19	443	192.168.2.3	49718	CN=*.nr-data.net, O="New Relic, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 05 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013	Tue Feb 08 13:00:00 CET 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 22:59:30.332326889 CET	162.247.242.19	443	192.168.2.3	49718	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 22:59:30.915958881 CET	52.33.248.165	443	192.168.2.3	49721	CN=*.segment.com, O="Segment.io, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Jun 12 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Tue Jul 27 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 22:59:30.915958881 CET	52.33.248.165	443	192.168.2.3	49721	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 22:59:31.235110044 CET	52.33.248.165	443	192.168.2.3	49722	CN=*.segment.com, O="Segment.io, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Jun 12 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Tue Jul 27 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 22:59:31.235110044 CET	52.33.248.165	443	192.168.2.3	49722	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 22:59:48.516392946 CET	54.206.89.250	443	192.168.2.3	49734	CN=getrfpsubs.com CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Nov 25 01:00:00 CET 2020 Mon May 18 02:00:00 CEST 2015 Thu Jan 01 01:00:00 CET 2004	Wed Feb 24 00:59:59 CET 2021 Sun May 18 01:59:59 CEST 2025 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Mon May 18 02:00:00 CEST 2015	Sun May 18 01:59:59 CEST 2025
					CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Jan 01 01:00:00 CET 2004	Mon Jan 01 00:59:59 CET 2029
Nov 25, 2020 22:59:48.516756058 CET	54.206.89.250	443	192.168.2.3	49733	CN=getrfpsubs.com CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Nov 25 01:00:00 CET 2020 Mon May 18 02:00:00 CEST 2015 Thu Jan 01 01:00:00 CET 2004	Wed Feb 24 00:59:59 CET 2021 Sun May 18 01:59:59 CEST 2025 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Mon May 18 02:00:00 CEST 2015	Sun May 18 01:59:59 CEST 2025
					CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Jan 01 01:00:00 CET 2004	Mon Jan 01 00:59:59 CET 2029
Nov 25, 2020 22:59:49.699961901 CET	104.16.18.94	443	192.168.2.3	49737	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Oct 21 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Thu Oct 21 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 22:59:49.699961901 CET	104.16.18.94	443	192.168.2.3	49737	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 22:59:49.701452017 CET	104.16.18.94	443	192.168.2.3	49738	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Oct 21 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Thu Oct 21 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 22:59:49.701452017 CET	104.16.18.94	443	192.168.2.3	49738	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 22:59:50.424068928 CET	152.199.23.37	443	192.168.2.3	49739	CN=aadcdn.msftauth.net, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jul 09 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Fri Jul 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Nov 25, 2020 22:59:50.424803972 CET	152.199.23.37	443	192.168.2.3	49740	CN=aadcdn.msftauth.net, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jul 09 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Fri Jul 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Nov 25, 2020 22:59:50.426311970 CET	152.199.23.37	443	192.168.2.3	49742	CN=aadcdn.msftauth.net, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jul 09 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Fri Jul 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Nov 25, 2020 22:59:50.427210093 CET	152.199.23.37	443	192.168.2.3	49743	CN=aadcdn.msftauth.net, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jul 09 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Fri Jul 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Nov 25, 2020 22:59:50.580065012 CET	152.199.23.37	443	192.168.2.3	49741	CN=aadcdn.msftauth.net, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jul 09 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Fri Jul 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Nov 25, 2020 22:59:50.582104921 CET	152.199.23.37	443	192.168.2.3	49744	CN=aadcdn.msftauth.net, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jul 09 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Fri Jul 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 4888 Parent PID: 792

General

Start time:	22:59:25
Start date:	25/11/2020
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff68d880000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: iexplore.exe PID: 5412 Parent PID: 4888

General

Start time:	22:59:25
Start date:	25/11/2020
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4888 CREDAT:17410 /prefetch:2
Imagebase:	0x10f0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Reset < >

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report https://tenderdocsrfp.typeform.com/to/RVzhstxV

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Dropped Files

Sigma Overview

Signature Overview

Phishing:

Software Vulnerabilities:

Networking:

System Summary:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: iexplore.exe PID: 4888 Parent PID: 792

General

Chronological Activities

Analysis Process: iexplore.exe PID: 5412 Parent PID: 4888

General

Chronological Activities

Disassembly